import * as API from "@distilled.cloud/core/api";
import * as S from "@distilled.cloud/core/schema-lite";
import type * as Redacted from "effect/Redacted";
import { type WorkosOpError, type WorkosOpContext } from "../protocol.ts";
export type { WorkosOpError, WorkosOpContext };
declare const BadRequest_base: S.TaggedErrorClass<"BadRequest", {
    readonly code: any;
    readonly message: any;
}> & (new (...args: any[]) => {
    "@distilled.cloud/error/categories": {
        BadRequestError: true;
    };
});
export declare class BadRequest extends /*@__PURE__*/ BadRequest_base {
}
declare const Conflict_base: S.TaggedErrorClass<"Conflict", {
    readonly code: any;
    readonly message: any;
}> & (new (...args: any[]) => {
    "@distilled.cloud/error/categories": {
        ConflictError: true;
    };
});
export declare class Conflict extends /*@__PURE__*/ Conflict_base {
}
declare const Forbidden_base: S.TaggedErrorClass<"Forbidden", {
    readonly code: any;
    readonly message: any;
}> & (new (...args: any[]) => {
    "@distilled.cloud/error/categories": {
        AuthError: true;
    };
});
export declare class Forbidden extends /*@__PURE__*/ Forbidden_base {
}
declare const NotFound_base: S.TaggedErrorClass<"NotFound", {
    readonly code: any;
    readonly message: any;
}> & (new (...args: any[]) => {
    "@distilled.cloud/error/categories": {
        BadRequestError: true;
    };
});
export declare class NotFound extends /*@__PURE__*/ NotFound_base {
}
declare const UnprocessableEntity_base: S.TaggedErrorClass<"UnprocessableEntity", {
    readonly code: any;
    readonly message: any;
}> & (new (...args: any[]) => {
    "@distilled.cloud/error/categories": {
        BadRequestError: true;
    };
});
export declare class UnprocessableEntity extends /*@__PURE__*/ UnprocessableEntity_base {
}
export interface AcceptUserlandUserInvitesControllerRequest {
    /** The unique ID of the invitation. */
    id: string;
}
/** The state of the invitation. */
export type AcceptUserlandUserInvitesControllerResponseState = "pending" | "accepted" | "expired" | "revoked";
export interface AcceptUserlandUserInvitesControllerResponse {
    /** Distinguishes the invitation object. */
    object: string;
    /** The unique ID of the invitation. */
    id: string;
    /** The email address of the recipient. */
    email: string;
    /** The state of the invitation. */
    state: AcceptUserlandUserInvitesControllerResponseState;
    /** The timestamp when the invitation was accepted, or null if not yet accepted. */
    accepted_at: string | null;
    /** The timestamp when the invitation was revoked, or null if not revoked. */
    revoked_at: string | null;
    /** The timestamp when the invitation expires. */
    expires_at: string;
    /** The ID of the [organization](/reference/organization) that the recipient will join. */
    organization_id: string | null;
    /** The ID of the user who invited the recipient, if provided. */
    inviter_user_id: string | null;
    /** The ID of the user who accepted the invitation, once accepted. */
    accepted_user_id: string | null;
    /** Slug of the role the invitee will be assigned on acceptance. Reflects the current role on the invitee's organization membership. null when the invitation has no associated organization. */
    role_slug: string | null;
    /** An ISO 8601 timestamp. */
    created_at: string;
    /** An ISO 8601 timestamp. */
    updated_at: string;
    /** The token used to accept the invitation. */
    token: string;
    /** The URL where the recipient can accept the invitation. */
    accept_invitation_url: string;
}
export interface AddAuthorizationOrganizationRolePermissionsControllerPermissionRequest {
    /** The ID of the organization. */
    organizationId: string;
    /** The slug of the role. */
    slug: string;
}
/** Whether the role is scoped to the environment or an organization (custom role). */
export type AddAuthorizationOrganizationRolePermissionsControllerPermissionResponseType = "EnvironmentRole" | "OrganizationRole";
/** The permission slugs assigned to the role. */
export type AddAuthorizationOrganizationRolePermissionsControllerPermissionResponsePermissionsList = Array<string>;
export interface AddAuthorizationOrganizationRolePermissionsControllerPermissionResponse {
    /** A unique slug for the role. */
    slug: string;
    /** Distinguishes the role object. */
    object: string;
    /** Unique identifier of the role. */
    id: string;
    /** A descriptive name for the role. */
    name: string;
    /** An optional description of the role. */
    description: string | null;
    /** Whether the role is scoped to the environment or an organization (custom role). */
    type: AddAuthorizationOrganizationRolePermissionsControllerPermissionResponseType;
    /** The slug of the resource type the role is scoped to. */
    resource_type_slug: string;
    /** The permission slugs assigned to the role. */
    permissions: AddAuthorizationOrganizationRolePermissionsControllerPermissionResponsePermissionsList;
    /** An ISO 8601 timestamp. */
    created_at: string;
    /** An ISO 8601 timestamp. */
    updated_at: string;
}
export interface AddAuthorizationRolePermissionsControllerPermissionRequest {
    /** The slug of the environment role. */
    slug: string;
}
/** Whether the role is scoped to the environment or an organization (custom role). */
export type AddAuthorizationRolePermissionsControllerPermissionResponseType = "EnvironmentRole" | "OrganizationRole";
/** The permission slugs assigned to the role. */
export type AddAuthorizationRolePermissionsControllerPermissionResponsePermissionsList = Array<string>;
export interface AddAuthorizationRolePermissionsControllerPermissionResponse {
    /** A unique slug for the role. */
    slug: string;
    /** Distinguishes the role object. */
    object: string;
    /** Unique identifier of the role. */
    id: string;
    /** A descriptive name for the role. */
    name: string;
    /** An optional description of the role. */
    description: string | null;
    /** Whether the role is scoped to the environment or an organization (custom role). */
    type: AddAuthorizationRolePermissionsControllerPermissionResponseType;
    /** The slug of the resource type the role is scoped to. */
    resource_type_slug: string;
    /** The permission slugs assigned to the role. */
    permissions: AddAuthorizationRolePermissionsControllerPermissionResponsePermissionsList;
    /** An ISO 8601 timestamp. */
    created_at: string;
    /** An ISO 8601 timestamp. */
    updated_at: string;
}
export interface AddGroupMembershipsControllerMemberRequest {
    /** Unique identifier of the Organization. */
    organizationId: string;
    /** Unique identifier of the Group. */
    groupId: string;
    /** The ID of the Organization Membership to add to the group. */
    organization_membership_id?: string;
}
export interface Group {
    /** The Group object. */
    object?: string;
    /** The unique ID of the Group. */
    id?: string;
    /** The ID of the Organization the Group belongs to. */
    organization_id?: string;
    /** The name of the Group. */
    name?: string;
    /** An optional description of the Group. */
    description?: string | null;
    /** An ISO 8601 timestamp. */
    created_at?: string;
    /** An ISO 8601 timestamp. */
    updated_at?: string;
}
/** The user to attach to the claim attempt, identified by email and external ID. */
export interface AgentAdminControllerLinkClaimAttemptToExternalUserRequestUser {
    /** The email address of the user. */
    email: string;
    /** The external ID of the user. */
    external_id: string;
}
export interface AgentAdminControllerLinkClaimAttemptToExternalUserRequest {
    /** The operation to perform on the claim attempt. Currently only `link_external_user` is supported. */
    type: string;
    /** The token identifying the claim attempt. */
    claim_attempt_token: string;
    /** The user to attach to the claim attempt, identified by email and external ID. */
    user: AgentAdminControllerLinkClaimAttemptToExternalUserRequestUser;
    /** The organization to place the agent in. Required when the user belongs to more than one organization. */
    organization_id?: string;
}
/** Current status of the agent registration. */
export type ClaimViewResponseStatus = "unverified" | "verified" | "expired" | "revoked";
export interface ClaimViewResponseOrganizationsItem {
    /** The organization ID. */
    id: string;
    /** The organization name. */
    name: string;
}
/** Organizations the user belongs to, offered as placement choices. */
export type ClaimViewResponseOrganizationsList = Array<ClaimViewResponseOrganizationsItem>;
export interface ClaimViewResponse {
    /** The agent registration ID. */
    id: string;
    /** Current status of the agent registration. */
    status: ClaimViewResponseStatus;
    /** The user code the agent needs to complete the claim. */
    user_code: string;
    /** Organizations the user belongs to, offered as placement choices. */
    organizations: ClaimViewResponseOrganizationsList;
}
export interface AgentBlueprintsTokenControllerMintTokenRequestBodyCase0 {
    /** How the session is minted: `user_delegated`, `autonomous`, `agent_delegated`, or `refresh`. */
    type: string;
    /** The access token of the user delegating to the agent. The token identifies the user and organization; effective permissions are resolved server-side. */
    user_access_token: string;
    /** Optional caller-supplied context, echoed as an object with a `text` field in the `intent` claim of the minted access token. */
    intent?: string;
}
export interface AgentBlueprintsTokenControllerMintTokenRequestBodyCase1 {
    /** How the session is minted: `user_delegated`, `autonomous`, `agent_delegated`, or `refresh`. */
    type: string;
    /** The organization the agent acts within when operating as itself. */
    organization_id: string;
    /** Optional caller-supplied context, echoed as an object with a `text` field in the `intent` claim of the minted access token. */
    intent?: string;
}
export interface AgentBlueprintsTokenControllerMintTokenRequestBodyCase2 {
    /** How the session is minted: `user_delegated`, `autonomous`, `agent_delegated`, or `refresh`. */
    type: string;
    /** The agent's own access token to exchange for a new session on the same instance. The token must have been minted from this blueprint; permissions are re-derived from current authority. */
    agent_access_token: string;
    /** Optional caller-supplied context, echoed as an object with a `text` field in the `intent` claim of the minted access token. */
    intent?: string;
}
export interface AgentBlueprintsTokenControllerMintTokenRequestBodyCase3 {
    /** How the session is minted: `user_delegated`, `autonomous`, `agent_delegated`, or `refresh`. */
    type: string;
    /** The refresh token issued with a previous agent access token. Refresh tokens are single-use: each refresh rotates it. */
    refresh_token: string | Redacted.Redacted<string>;
    /** Optional caller-supplied context, echoed as an object with a `text` field in the `intent` claim of the minted access token. */
    intent?: string;
}
/** How to mint the agent session, discriminated by `type`. `intent` is optional on every variant. */
export type AgentBlueprintsTokenControllerMintTokenRequestBody = AgentBlueprintsTokenControllerMintTokenRequestBodyCase0 | AgentBlueprintsTokenControllerMintTokenRequestBodyCase1 | AgentBlueprintsTokenControllerMintTokenRequestBodyCase2 | AgentBlueprintsTokenControllerMintTokenRequestBodyCase3;
export interface AgentBlueprintsTokenControllerMintTokenRequest {
    /** The unique ID of the agent blueprint. */
    agent_blueprint_id: string;
    body: AgentBlueprintsTokenControllerMintTokenRequestBody;
}
/** The effective permission slugs carried by the token. */
export type AgentTokenPermissionsList = Array<string>;
export interface AgentToken {
    /** The agent access token (a JWT) carrying the effective permissions. */
    access_token: string | Redacted.Redacted<string>;
    /** Always `Bearer`. */
    token_type: string;
    /** Number of seconds until the access token expires. */
    expires_in: number;
    /** Single-use refresh token for rotating the access token within the session lifetime. */
    refresh_token: string | Redacted.Redacted<string>;
    /** The agent instance the session belongs to. */
    agent_instance_id: string;
    /** Whether this mint created the agent instance: `true` only for the mint that inserted the row, `false` when an existing instance was reused (including when a concurrent mint inserted it first). */
    new_instance: boolean;
    /** The backing agent instance session. */
    agent_instance_session_id: string;
    /** The effective permission slugs carried by the token. */
    permissions: AgentTokenPermissionsList;
}
export interface ApiKeysControllerExpireRequest {
    /** The unique ID of the API key. */
    id: string;
    /** When the API key should expire. If omitted or in the past, the key expires immediately. Use null to clear a scheduled future expiration. */
    expires_at?: string | null;
}
export interface ApiKeyOwnerCase0 {
    /** The type of the API Key owner. */
    type: string;
    /** Unique identifier of the API Key owner. */
    id: string;
}
export interface ApiKeyOwnerCase1 {
    /** The type of the API Key owner. */
    type: string;
    /** Unique identifier of the API Key owner. */
    id: string;
    /** Unique identifier of the organization the API Key can access. */
    organization_id: string;
}
/** The entity that owns the API Key. */
export type ApiKeyOwner = ApiKeyOwnerCase0 | ApiKeyOwnerCase1;
/** The permission slugs assigned to the API Key. */
export type ApiKeyPermissionsList = Array<string>;
export interface ApiKey {
    /** Distinguishes the API Key object. */
    object?: string;
    /** Unique identifier of the API Key. */
    id?: string;
    /** The entity that owns the API Key. */
    owner?: ApiKeyOwner;
    /** A descriptive name for the API Key. */
    name?: string;
    /** An obfuscated representation of the API Key value. */
    obfuscated_value?: string;
    /** Timestamp of when the API Key was last used. */
    last_used_at?: string | null;
    /** Timestamp when the API Key expires. Null means the key does not expire. */
    expires_at?: string | null;
    /** The permission slugs assigned to the API Key. */
    permissions?: ApiKeyPermissionsList;
    /** An ISO 8601 timestamp. */
    created_at?: string;
    /** An ISO 8601 timestamp. */
    updated_at?: string;
}
export interface ApplicationsControllerFindRequest {
    /** The application ID or client ID of the Connect Application. */
    id: string;
}
/** The scopes available for this application. */
export type ApplicationsControllerFindResponseScopesList = Array<string>;
export interface ApplicationsControllerFindResponseRedirectUrisItem {
    /** The redirect URI for the application. */
    uri: string;
    /** Whether this is the default redirect URI. */
    default: boolean;
}
/** The redirect URIs configured for this application. */
export type ApplicationsControllerFindResponseRedirectUrisList = Array<ApplicationsControllerFindResponseRedirectUrisItem>;
export interface ApplicationsControllerFindResponse {
    /** Distinguishes the connect application object. */
    object: string;
    /** The unique ID of the connect application. */
    id: string;
    /** The client ID of the connect application. */
    client_id: string;
    /** A description of the connect application. */
    description: string | null;
    /** The name of the connect application. */
    name: string;
    /** The scopes available for this application. */
    scopes: ApplicationsControllerFindResponseScopesList;
    /** An ISO 8601 timestamp. */
    created_at: string;
    /** An ISO 8601 timestamp. */
    updated_at: string;
    /** The type of the application. */
    application_type?: string;
    /** The redirect URIs configured for this application. */
    redirect_uris?: ApplicationsControllerFindResponseRedirectUrisList;
    /** Whether the application uses PKCE for authorization. */
    uses_pkce?: boolean;
    /** Whether the application is a first-party application. */
    is_first_party?: boolean;
    /** Whether the application was dynamically registered. */
    was_dynamically_registered?: boolean;
    /** The ID of the organization the application belongs to. */
    organization_id?: string;
}
export interface ApproveWaitlistEntriesControllerRequest {
    /** The unique ID of the waitlist entry. */
    id: string;
}
/** The state of the waitlist entry. */
export type ApproveWaitlistEntriesControllerResponseState = "pending" | "approved" | "denied";
/** Additional fields submitted when the user joined the waitlist. Values are user-provided -- treat them as untrusted input when rendering or exporting. */
export type ApproveWaitlistEntriesControllerResponseAdditionalFieldsMap = {
    [key: string]: string | undefined;
};
export interface ApproveWaitlistEntriesControllerResponse {
    /** The unique ID of the waitlist entry. */
    id: string;
    /** The email address of the user on the waitlist. */
    email: string;
    /** The state of the waitlist entry. */
    state: ApproveWaitlistEntriesControllerResponseState;
    /** The timestamp when the entry was approved, or null if not yet approved. */
    approved_at: string | null;
    /** Additional fields submitted when the user joined the waitlist. Values are user-provided -- treat them as untrusted input when rendering or exporting. */
    additional_fields?: ApproveWaitlistEntriesControllerResponseAdditionalFieldsMap;
    /** The unique ID of the waitlist the entry belongs to. */
    waitlist_id?: string | null;
    /** An ISO 8601 timestamp. */
    created_at: string;
    /** An ISO 8601 timestamp. */
    updated_at: string;
    /** Distinguishes the Waitlist Entry object. */
    object: string;
}
export interface AssignAuthorizationRoleAssignmentsControllerRoleRequest {
    /** The ID of the organization membership. */
    organization_membership_id: string;
    /** The slug of the role to assign. */
    role_slug: string;
    /** The ID of the resource. Mutually exclusive with `resource_external_id` and `resource_type_slug`. */
    resource_id?: string;
    /** The external ID of the resource. Required with `resource_type_slug`. Mutually exclusive with `resource_id`. */
    resource_external_id?: string;
    /** The resource type slug. Required with `resource_external_id`. Mutually exclusive with `resource_id`. */
    resource_type_slug?: string;
}
/** The primary role assigned to the user. */
export interface SlimRole {
    /** The slug of the assigned role. */
    slug?: string;
}
/** The resource the role is assigned on. */
export interface UserRoleAssignmentResource {
    /** The unique ID of the Resource. */
    id: string;
    /** An identifier you provide to reference the resource in your system. */
    external_id: string;
    /** The slug of the resource type this resource belongs to. */
    resource_type_slug: string;
}
/** Whether the role was assigned directly or derived from a group. */
export type UserRoleAssignmentSourceType = "direct" | "group";
export interface UserRoleAssignmentSourceGroup {
    /** The unique ID of the Group the role was derived from. */
    id: string;
    /** The name of the Group the role was derived from. */
    name: string;
}
/** The origin of the role assignment. */
export interface UserRoleAssignmentSource {
    /** Whether the role was assigned directly or derived from a group. */
    type: UserRoleAssignmentSourceType;
    /** The ID of the group role assignment the role was derived from, or null if direct. */
    group_role_assignment_id: string | null;
    /** The group the role was derived from, or null if direct. */
    group: UserRoleAssignmentSourceGroup | null;
}
export interface UserRoleAssignment {
    /** Distinguishes the role assignment object. */
    object: string;
    /** Unique identifier of the role assignment. */
    id: string;
    /** The ID of the organization membership the role is assigned to. */
    organization_membership_id: string;
    /** The role included in the assignment. */
    role: SlimRole;
    /** The resource the role is assigned on. */
    resource: UserRoleAssignmentResource;
    /** The origin of the role assignment. */
    source: UserRoleAssignmentSource;
    /** An ISO 8601 timestamp. */
    created_at: string;
    /** An ISO 8601 timestamp. */
    updated_at: string;
}
/** List of actions to filter against. */
export type AuditLogExportsControllerExportsRequestActionsList = Array<string>;
/** Deprecated. Use `actor_names` instead. */
export type AuditLogExportsControllerExportsRequestActorsList = Array<string>;
/** List of actor names to filter against. */
export type AuditLogExportsControllerExportsRequestActorNamesList = Array<string>;
/** List of actor IDs to filter against. */
export type AuditLogExportsControllerExportsRequestActorIdsList = Array<string>;
/** List of target types to filter against. */
export type AuditLogExportsControllerExportsRequestTargetsList = Array<string>;
export interface AuditLogExportsControllerExportsRequest {
    /** The unique ID of the Organization. */
    organization_id?: string;
    /** ISO-8601 value for start of the export range. */
    range_start?: string;
    /** ISO-8601 value for end of the export range. */
    range_end?: string;
    /** List of actions to filter against. */
    actions?: AuditLogExportsControllerExportsRequestActionsList;
    /** Deprecated. Use `actor_names` instead. */
    actors?: AuditLogExportsControllerExportsRequestActorsList;
    /** List of actor names to filter against. */
    actor_names?: AuditLogExportsControllerExportsRequestActorNamesList;
    /** List of actor IDs to filter against. */
    actor_ids?: AuditLogExportsControllerExportsRequestActorIdsList;
    /** List of target types to filter against. */
    targets?: AuditLogExportsControllerExportsRequestTargetsList;
}
/** The state of the export. Possible values: pending, ready, error, expired. */
export type AuditLogExportJsonState = "pending" | "ready" | "error" | "expired";
export interface AuditLogExportJson {
    /** Distinguishes the Audit Log Export object. */
    object?: string;
    /** The unique ID of the Audit Log Export. */
    id?: string;
    /** The state of the export. Possible values: pending, ready, error, expired. */
    state?: AuditLogExportJsonState;
    /** A URL to the CSV file. Only defined when the Audit Log Export is ready. */
    url?: string | null;
    /** An ISO 8601 timestamp. */
    created_at?: string;
    /** An ISO 8601 timestamp. */
    updated_at?: string;
}
export interface AuditLogsRetentionControllerAuditLogsRetentionRequest {
    /** Unique identifier of the Organization. */
    id: string;
}
export interface AuditLogsRetentionJson {
    /** The number of days Audit Log events will be retained before being permanently deleted. Valid values are 30 through 330 in 30-day increments and 365 through 3650 in 365-day increments. */
    retention_period_in_days?: number | null;
}
export type PaginationOrder = "normal" | "desc" | "asc";
export interface AuditLogValidatorVersionsControllerSchemasRequest {
    /** The name of the Audit Log action. */
    actionName: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. */
    before?: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. */
    after?: string;
    /** Upper limit on the number of objects to return, between `1` and `100`. */
    limit?: number;
    /** Order the results by the creation time. Defaults to `normal`. */
    order?: PaginationOrder | (string & {});
}
/** Pagination cursors for navigating between pages of results. */
export interface AuditLogValidatorVersionsControllerSchemasResponseListMetadata {
    /** An object ID that defines your place in the list. When the ID is not present, you are at the start of the list. */
    before: string | null;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. */
    after: string | null;
}
/** The JSON Schema definition for actor metadata. */
export type AuditLogSchemaJsonActorMetadataMap = {
    [key: string]: unknown | undefined;
};
/** The metadata schema for the actor. */
export interface AuditLogSchemaJsonActor {
    /** The JSON Schema definition for actor metadata. */
    metadata: AuditLogSchemaJsonActorMetadataMap;
}
/** Additional data associated with the event or entity. */
export type AuditLogSchemaJsonTargetsItemMetadataMap = {
    [key: string]: unknown | undefined;
};
export interface AuditLogSchemaJsonTargetsItem {
    /** The type of the target resource. */
    type: string;
    /** Additional data associated with the event or entity. */
    metadata?: AuditLogSchemaJsonTargetsItemMetadataMap;
}
/** The list of targets for the schema. */
export type AuditLogSchemaJsonTargetsList = Array<AuditLogSchemaJsonTargetsItem>;
/** Additional data associated with the event or entity. */
export type AuditLogSchemaJsonMetadataMap = {
    [key: string]: unknown | undefined;
};
export interface AuditLogSchemaJson {
    /** Distinguishes the Audit Log Schema object. */
    object?: string;
    /** The version of the schema. */
    version?: number;
    /** The metadata schema for the actor. */
    actor?: AuditLogSchemaJsonActor;
    /** The list of targets for the schema. */
    targets?: AuditLogSchemaJsonTargetsList;
    /** Additional data associated with the event or entity. */
    metadata?: AuditLogSchemaJsonMetadataMap;
    /** The timestamp when the Audit Log Schema was created. */
    created_at?: string;
}
/** The list of records for the current page. */
export type AuditLogValidatorVersionsControllerSchemasResponseDataList = Array<AuditLogSchemaJson>;
export interface AuditLogValidatorVersionsControllerSchemasResponse {
    /** Indicates this is a list response. */
    object?: string;
    /** Pagination cursors for navigating between pages of results. */
    list_metadata?: AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
    /** The list of records for the current page. */
    data?: AuditLogValidatorVersionsControllerSchemasResponseDataList;
}
export interface AuthenticationFactorsControllerChallengeRequest {
    /** The unique ID of the Authentication Factor to be challenged. */
    id: string;
    /** A custom template for the SMS message. Use the {{code}} placeholder to include the verification code. Must not contain URLs or domain names. */
    sms_template?: string;
}
export interface AuthenticationChallenge {
    /** Distinguishes the authentication challenge object. */
    object?: string;
    /** The unique ID of the authentication challenge. */
    id?: string;
    /** The timestamp when the challenge will expire. Does not apply to TOTP factors. */
    expires_at?: string;
    /** The one-time code for the challenge. */
    code?: string;
    /** The unique ID of the authentication factor the challenge belongs to. */
    authentication_factor_id?: string;
    /** An ISO 8601 timestamp. */
    created_at?: string;
    /** An ISO 8601 timestamp. */
    updated_at?: string;
}
export interface AuthorizationPermissionsControllerFindRequest {
    /** A unique key to reference the permission. Must be lowercase and contain only letters, numbers, hyphens, underscores, colons, periods, and asterisks. */
    slug: string;
}
export interface AuthorizationPermission {
    /** Distinguishes the Permission object. */
    object?: string;
    /** Unique identifier of the Permission. */
    id?: string;
    /** A unique key to reference the permission. Must be lowercase and contain only letters, numbers, hyphens, underscores, colons, periods, and asterisks. */
    slug?: string;
    /** A descriptive name for the Permission. */
    name?: string;
    /** An optional description of the Permission. */
    description?: string | null;
    /** Whether the permission is a system permission. System permissions are managed by WorkOS and cannot be deleted. */
    system?: boolean;
    /** The slug of the resource type associated with the permission. */
    resource_type_slug?: string;
    /** An ISO 8601 timestamp. */
    created_at?: string;
    /** An ISO 8601 timestamp. */
    updated_at?: string;
}
export interface AuthorizationResourcesControllerFindByIdRequest {
    /** The ID of the authorization resource. */
    resource_id: string;
}
export interface AuthorizationResource {
    /** Distinguishes the Resource object. */
    object?: string;
    /** A human-readable name for the Resource. */
    name?: string;
    /** An optional description of the Resource. */
    description?: string | null;
    /** The ID of the organization that owns the resource. */
    organization_id?: string;
    /** The ID of the parent resource, if this resource is nested. */
    parent_resource_id?: string | null;
    /** The unique ID of the Resource. */
    id?: string;
    /** An identifier you provide to reference the resource in your system. */
    external_id?: string;
    /** The slug of the resource type this resource belongs to. */
    resource_type_slug?: string;
    /** An ISO 8601 timestamp. */
    created_at?: string;
    /** An ISO 8601 timestamp. */
    updated_at?: string;
}
export type AuthorizeSsoControllerRequestProviderScopesList = Array<string>;
export type AuthorizeSsoControllerRequestProviderQueryParamsMap = {
    [key: string]: string | undefined;
};
export type AuthorizeSsoControllerRequestProvider = "AppleOAuth" | "BitbucketOAuth" | "GitHubOAuth" | "GitLabOAuth" | "GoogleOAuth" | "IntuitOAuth" | "LinkedInOAuth" | "MicrosoftOAuth" | "SalesforceOAuth" | "SlackOAuth" | "VercelMarketplaceOAuth" | "VercelOAuth" | "XeroOAuth";
export interface AuthorizeSsoControllerRequest {
    /** Additional scopes to request from the identity provider. Applicable when using OAuth or OpenID Connect connections. */
    provider_scopes?: AuthorizeSsoControllerRequestProviderScopesList;
    /** Key/value pairs of query parameters to pass to the OAuth provider. Only applicable when using OAuth connections. */
    provider_query_params?: AuthorizeSsoControllerRequestProviderQueryParamsMap;
    /** The unique identifier of the WorkOS environment client. */
    client_id: string;
    /** Deprecated. Use `connection` or `organization` instead. Used to initiate SSO for a connection by domain. The domain must be associated with a connection in your WorkOS environment. */
    domain?: string;
    /** Used to initiate OAuth authentication with various providers. */
    provider?: AuthorizeSsoControllerRequestProvider | (string & {});
    /** Where to redirect the user after they complete the authentication process. You must use one of the redirect URIs configured via the [Redirects](https://dashboard.workos.com/redirects) page on the dashboard. */
    redirect_uri: string;
    /** The only valid option for the response type parameter is `"code"`. The `"code"` parameter value initiates an [authorization code grant type](https://tools.ietf.org/html/rfc6749#section-4.1). This grant type allows you to exchange an authorization code for an access token during the redirect that takes place after a user has authenticated with an identity provider. */
    response_type: string;
    /** An optional parameter that can be used to encode arbitrary information to help restore application state between redirects. If included, the redirect URI received from WorkOS will contain the exact `state` that was passed. */
    state?: string;
    /** Used to initiate SSO for a connection. The value should be a WorkOS connection ID. You can persist the WorkOS connection ID with application user or team identifiers. WorkOS will use the connection indicated by the connection parameter to direct the user to the corresponding IdP for authentication. */
    connection?: string;
    /** Used to initiate SSO for an organization. The value should be a WorkOS organization ID. You can persist the WorkOS organization ID with application user or team identifiers. WorkOS will use the organization ID to determine the appropriate connection and the IdP to direct the user to for authentication. */
    organization?: string;
    /** Can be used to pre-fill the domain field when initiating authentication with Microsoft OAuth or with a Google SAML connection type. */
    domain_hint?: string;
    /** Can be used to pre-fill the username/email address field of the IdP sign-in page for the user, if you know their username ahead of time. Currently supported for OAuth, OpenID Connect, Okta, Entra ID, and custom SAML connections. */
    login_hint?: string;
    /** A random string generated by the client that is used to mitigate replay attacks. */
    nonce?: string;
    /** If set to `login`, forces re-authentication at the identity provider. For supported SAML providers this sets `ForceAuthn="true"` in the SAML request; providers that don't support it are unaffected. */
    prompt?: string;
}
export interface SsoAuthorizeUrlResponse {
    /** An OAuth 2.0 authorization URL. */
    url?: string;
}
export type AuthorizeUserlandSsoControllerRequestProviderQueryParamsMap = {
    [key: string]: string | undefined;
};
export type AuthorizeUserlandSsoControllerRequestProviderScopesList = Array<string>;
export type AuthorizeUserlandSsoControllerRequestScreenHint = "sign-up" | "sign-in";
export type AuthorizeUserlandSsoControllerRequestProvider = "authkit" | "AppleOAuth" | "BitbucketOAuth" | "GitHubOAuth" | "GitLabOAuth" | "GoogleOAuth" | "IntuitOAuth" | "LinkedInOAuth" | "MicrosoftOAuth" | "SalesforceOAuth" | "SlackOAuth" | "VercelMarketplaceOAuth" | "VercelOAuth" | "XeroOAuth";
export interface AuthorizeUserlandSsoControllerRequest {
    /** The only valid PKCE code challenge method is `"S256"`. Required when specifying a `code_challenge`. */
    code_challenge_method?: string;
    /** Code challenge derived from the code verifier used for the PKCE flow. */
    code_challenge?: string;
    /** A domain hint for SSO connection lookup. */
    domain_hint?: string;
    /** The ID of an SSO connection to use for authentication. */
    connection_id?: string;
    /** Key/value pairs of query parameters to pass to the OAuth provider. */
    provider_query_params?: AuthorizeUserlandSsoControllerRequestProviderQueryParamsMap;
    /** Additional OAuth scopes to request from the identity provider. */
    provider_scopes?: AuthorizeUserlandSsoControllerRequestProviderScopesList;
    /** A token representing a user invitation to redeem during authentication. */
    invitation_token?: string;
    /** Maximum allowable elapsed time, in seconds, since the user last actively authenticated. If the last authentication is older than this value, the user is prompted to re-authenticate; a value of `0` forces re-authentication. Only supported when the provider is `authkit`. */
    max_age?: number;
    /** Used to specify which screen to display when the provider is `authkit`. */
    screen_hint?: AuthorizeUserlandSsoControllerRequestScreenHint | (string & {});
    /** A hint to the authorization server about the login identifier the user might use. */
    login_hint?: string;
    /** The OAuth provider to authenticate with (e.g., GoogleOAuth, MicrosoftOAuth, GitHubOAuth). */
    provider?: AuthorizeUserlandSsoControllerRequestProvider | (string & {});
    /** Controls the authentication flow behavior for the user. */
    prompt?: string;
    /** An opaque value used to maintain state between the request and the callback. */
    state?: string;
    /** The ID of the organization to authenticate the user against. */
    organization_id?: string;
    /** The response type of the application. */
    response_type: string;
    /** The callback URI where the authorization code will be sent after authentication. */
    redirect_uri: string;
    /** The unique identifier of the WorkOS environment client. */
    client_id: string;
}
export interface AuthorizeUserlandSsoControllerResponse {
}
export interface CheckAuthorizationControllerRequest {
    /** The ID of the organization membership to check. */
    organization_membership_id: string;
    /** The slug of the permission to check. */
    permission_slug: string;
    /** The ID of the resource. Mutually exclusive with `resource_external_id` and `resource_type_slug`. */
    resource_id?: string;
    /** The external ID of the resource. Required with `resource_type_slug`. Mutually exclusive with `resource_id`. */
    resource_external_id?: string;
    /** The slug of the resource type. Required with `resource_external_id`. Mutually exclusive with `resource_id`. */
    resource_type_slug?: string;
}
export interface AuthorizationCheck {
    /** Whether the organization membership has the specified permission on the resource. */
    authorized?: boolean;
}
export interface ClientApiTokenControllerIssueClientApiTokenRequest {
    /** The ID of the organization to scope the Client API token to. */
    organization_id: string;
    /** The ID of the user to issue the Client API token for. */
    user_id: string;
}
export interface ClientApiTokenResponse {
    /** The Client API token. */
    token: string;
}
/** A set of key-value pairs to attach to the user. */
export type UserObjectMetadataMap = {
    [key: string]: string | undefined;
};
export interface UserObject {
    /** Your application's user identifier, which will be stored as an [`external_id`](/authkit/metadata/external-identifiers). Used for upserting and deduplication. */
    id?: string;
    /** The user's email address. */
    email?: string;
    /** The user's first name. */
    first_name?: string;
    /** The user's last name. */
    last_name?: string;
    /** The user's full name. */
    name?: string;
    /** A set of key-value pairs to attach to the user. */
    metadata?: UserObjectMetadataMap;
}
export interface UserConsentOptionChoicesItem {
    /** The value of this choice. */
    value?: string;
    /** A human-readable label for this choice. */
    label?: string;
}
/** The available choices for this consent option. */
export type UserConsentOptionChoicesList = Array<UserConsentOptionChoicesItem>;
export interface UserConsentOption {
    /** The claim name for this consent option. */
    claim?: string;
    /** The type of consent option. */
    type?: string;
    /** A human-readable label for this consent option. */
    label?: string;
    /** The available choices for this consent option. */
    choices?: UserConsentOptionChoicesList;
}
/** Array of [User Consent Options](/reference/workos-connect/standalone/user-consent-options) to store with the session. */
export type CompleteExternalAuthControllerLoginRequestUserConsentOptionsList = Array<UserConsentOption>;
export interface CompleteExternalAuthControllerLoginRequest {
    /** Identifier provided when AuthKit redirected to your login page. */
    external_auth_id?: string;
    /** The user to create or update in AuthKit. */
    user?: UserObject;
    /** Array of [User Consent Options](/reference/workos-connect/standalone/user-consent-options) to store with the session. */
    user_consent_options?: CompleteExternalAuthControllerLoginRequestUserConsentOptionsList;
}
export interface ExternalAuthCompleteResponse {
    /** URI to redirect the user back to AuthKit to complete the OAuth flow. */
    redirect_uri?: string;
}
export interface ConfirmUserlandUsersControllerEmailChangeRequest {
    /** The unique ID of the user. */
    id: string;
    /** The one-time code used to confirm the email change. */
    code?: string;
}
/** Object containing metadata key/value pairs associated with the user. */
export type ConfirmUserlandUsersControllerEmailChangeResponseUserMetadataMap = {
    [key: string]: string | undefined;
};
/** The user object. */
export interface ConfirmUserlandUsersControllerEmailChangeResponseUser {
    /** Distinguishes the user object. */
    object: string;
    /** The unique ID of the user. */
    id: string;
    /** The first name of the user. */
    first_name: string | null;
    /** The last name of the user. */
    last_name: string | null;
    /** The user's full name. */
    name?: string | null;
    /** A URL reference to an image representing the user. */
    profile_picture_url: string | null;
    /** The email address of the user. */
    email: string;
    /** Whether the user's email has been verified. */
    email_verified: boolean;
    /** The external ID of the user. */
    external_id: string | null;
    /** Object containing metadata key/value pairs associated with the user. */
    metadata?: ConfirmUserlandUsersControllerEmailChangeResponseUserMetadataMap;
    /** The timestamp when the user last signed in. */
    last_sign_in_at: string | null;
    /** The user's preferred locale. */
    locale?: string | null;
    /** An ISO 8601 timestamp. */
    created_at: string;
    /** An ISO 8601 timestamp. */
    updated_at: string;
}
export interface ConfirmUserlandUsersControllerEmailChangeResponse {
    /** Distinguishes the email change confirmation object. */
    object: string;
    /** The user object. */
    user: ConfirmUserlandUsersControllerEmailChangeResponseUser;
}
export interface ConnectionsControllerFindRequest {
    /** Unique identifier for the Connection. */
    id: string;
}
/** The type of the SSO Connection used to authenticate the user. The Connection type may be used to dynamically generate authorization URLs. */
export type ConnectionConnectionType = "Pending" | "ADFSSAML" | "AdpOidc" | "AppleOAuth" | "Auth0Migration" | "Auth0SAML" | "AzureSAML" | "BitbucketOAuth" | "CasSAML" | "ClassLinkSAML" | "CleverOIDC" | "CloudflareSAML" | "CyberArkSAML" | "DuoSAML" | "EntraIdOIDC" | "GenericOIDC" | "GenericSAML" | "GitHubOAuth" | "GitLabOAuth" | "GoogleOAuth" | "GoogleOIDC" | "GoogleSAML" | "IntuitOAuth" | "JumpCloudSAML" | "KeycloakSAML" | "LastPassSAML" | "LinkedInOAuth" | "LoginGovOidc" | "MagicLink" | "MicrosoftOAuth" | "MiniOrangeSAML" | "NetIqSAML" | "OktaOIDC" | "OktaSAML" | "OneLoginSAML" | "OracleSAML" | "PingFederateSAML" | "PingOneSAML" | "RipplingSAML" | "SalesforceSAML" | "ShibbolethGenericSAML" | "ShibbolethSAML" | "SimpleSamlPhpSAML" | "SalesforceOAuth" | "SlackOAuth" | "TestIdp" | "VercelMarketplaceOAuth" | "VercelOAuth" | "VMwareSAML" | "XeroOAuth";
/** Indicates whether a Connection is able to authenticate users. */
export type ConnectionState = "requires_type" | "draft" | "active" | "validating" | "inactive" | "deleting";
/** Deprecated. Use `state` instead. */
export type ConnectionStatus = "linked" | "unlinked";
export interface ConnectionDomainsItem {
    /** Unique identifier for the Connection Domain. */
    id: string;
    /** Distinguishes the Connection Domain object. */
    object: string;
    /** The domain value. */
    domain: string;
}
/** List of Organization Domains. */
export type ConnectionDomainsList = Array<ConnectionDomainsItem>;
export interface Connection {
    /** Distinguishes the Connection object. */
    object?: string;
    /** Unique identifier for the Connection. */
    id?: string;
    /** Unique identifier for the Organization in which the Connection resides. */
    organization_id?: string;
    /** The type of the SSO Connection used to authenticate the user. The Connection type may be used to dynamically generate authorization URLs. */
    connection_type?: ConnectionConnectionType;
    /** A human-readable name for the Connection. This will most commonly be the organization's name. */
    name?: string;
    /** Indicates whether a Connection is able to authenticate users. */
    state?: ConnectionState;
    /** Deprecated. Use `state` instead. */
    status?: ConnectionStatus;
    /** List of Organization Domains. */
    domains?: ConnectionDomainsList;
    /** An ISO 8601 timestamp. */
    created_at?: string;
    /** An ISO 8601 timestamp. */
    updated_at?: string;
}
/** Permission slugs forming the ceiling on what sessions minted from this blueprint may do. Each slug must exist in the environment. */
export type CreateAgentBlueprintsControllerRequestPermissionsList = Array<string>;
/** Role slugs whose members may mint user-delegated sessions from this blueprint. An empty list allows any member. */
export type CreateAgentBlueprintsControllerRequestInvocableByRoleSlugsList = Array<string>;
/** Organizations in which sessions may be minted from this blueprint, enforced on user-delegated, autonomous, and agent-delegated mints. An empty list allows any organization in the environment. */
export type CreateAgentBlueprintsControllerRequestInvocableByOrganizationIdsList = Array<string>;
/** Who may mint sessions from this blueprint. */
export interface CreateAgentBlueprintsControllerRequestInvocableBy {
    /** Role slugs whose members may mint user-delegated sessions from this blueprint. An empty list allows any member. */
    role_slugs?: CreateAgentBlueprintsControllerRequestInvocableByRoleSlugsList;
    /** Organizations in which sessions may be minted from this blueprint, enforced on user-delegated, autonomous, and agent-delegated mints. An empty list allows any organization in the environment. */
    organization_ids?: CreateAgentBlueprintsControllerRequestInvocableByOrganizationIdsList;
}
export type CreateAgentBlueprintsControllerRequestInvocableAsInstanceTypesItem = "delegated" | "autonomous";
/** Instance types that may be minted from this blueprint: `delegated` (a user-delegated session, minted with a user access token) and/or `autonomous` (a session acting as the agent itself, minted with an agent registration credential). Agent-delegated chaining and refreshes are checked against the type of the presenting instance. Defaults to both. */
export type CreateAgentBlueprintsControllerRequestInvocableAsInstanceTypesList = Array<CreateAgentBlueprintsControllerRequestInvocableAsInstanceTypesItem | (string & {})>;
/** How sessions may be minted from this blueprint. */
export interface CreateAgentBlueprintsControllerRequestInvocableAs {
    /** Instance types that may be minted from this blueprint: `delegated` (a user-delegated session, minted with a user access token) and/or `autonomous` (a session acting as the agent itself, minted with an agent registration credential). Agent-delegated chaining and refreshes are checked against the type of the presenting instance. Defaults to both. */
    instance_types?: CreateAgentBlueprintsControllerRequestInvocableAsInstanceTypesList;
}
/** Token and session lifetimes for sessions minted from this blueprint. */
export interface CreateAgentBlueprintsControllerRequestSessionSettings {
    /** Maximum lifetime of a session in seconds; refreshes never extend a session past this. At most 31,536,000 (365 days). */
    max_age_seconds: number;
    /** Lifetime of each minted access token in seconds. At most 3,600 (1 hour). */
    access_token_ttl_seconds: number;
    /** Lifetime of each rotated refresh token in seconds. At most 5,184,000 (60 days). */
    refresh_token_ttl_seconds: number;
}
export interface CreateAgentBlueprintsControllerRequest {
    /** Human-readable name of the agent blueprint. */
    name: string;
    /** Human-readable description of the agent blueprint. */
    description?: string;
    /** Permission slugs forming the ceiling on what sessions minted from this blueprint may do. Each slug must exist in the environment. */
    permissions?: CreateAgentBlueprintsControllerRequestPermissionsList;
    /** Who may mint sessions from this blueprint. */
    invocable_by?: CreateAgentBlueprintsControllerRequestInvocableBy;
    /** How sessions may be minted from this blueprint. */
    invocable_as?: CreateAgentBlueprintsControllerRequestInvocableAs;
    /** Token and session lifetimes for sessions minted from this blueprint. */
    session_settings?: CreateAgentBlueprintsControllerRequestSessionSettings;
}
/** Permission slugs forming the ceiling on what sessions minted from this blueprint may do. */
export type AgentBlueprintPermissionsList = Array<string>;
/** Role slugs whose members may mint user-delegated sessions from this blueprint. */
export type AgentBlueprintInvocableByRoleSlugsList = Array<string>;
/** Organizations in which sessions may be minted from this blueprint, enforced on user-delegated, autonomous, and agent-delegated mints. */
export type AgentBlueprintInvocableByOrganizationIdsList = Array<string>;
/** Who may mint sessions from this blueprint. */
export interface AgentBlueprintInvocableBy {
    /** Role slugs whose members may mint user-delegated sessions from this blueprint. */
    role_slugs: AgentBlueprintInvocableByRoleSlugsList;
    /** Organizations in which sessions may be minted from this blueprint, enforced on user-delegated, autonomous, and agent-delegated mints. */
    organization_ids: AgentBlueprintInvocableByOrganizationIdsList;
}
export type AgentBlueprintInvocableAsInstanceTypesItem = "delegated" | "autonomous";
/** Instance types that may be minted from this blueprint: `delegated` and/or `autonomous`. */
export type AgentBlueprintInvocableAsInstanceTypesList = Array<AgentBlueprintInvocableAsInstanceTypesItem>;
/** How sessions may be minted from this blueprint. */
export interface AgentBlueprintInvocableAs {
    /** Instance types that may be minted from this blueprint: `delegated` and/or `autonomous`. */
    instance_types: AgentBlueprintInvocableAsInstanceTypesList;
}
/** Token and session lifetimes for sessions minted from this blueprint. */
export interface AgentBlueprintSessionSettings {
    /** Maximum lifetime of a session in seconds; refreshes never extend a session past this. */
    max_age_seconds: number;
    /** Lifetime of each minted access token in seconds. */
    access_token_ttl_seconds: number;
    /** Lifetime of each rotated refresh token in seconds. */
    refresh_token_ttl_seconds: number;
}
export interface AgentBlueprint {
    /** Distinguishes the agent blueprint object. */
    object: string;
    /** Unique identifier of the agent blueprint. */
    id: string;
    /** Human-readable name of the agent blueprint. */
    name: string;
    /** Human-readable description of the agent blueprint. */
    description: string | null;
    /** Permission slugs forming the ceiling on what sessions minted from this blueprint may do. */
    permissions: AgentBlueprintPermissionsList;
    /** Who may mint sessions from this blueprint. */
    invocable_by: AgentBlueprintInvocableBy;
    /** How sessions may be minted from this blueprint. */
    invocable_as: AgentBlueprintInvocableAs;
    /** Token and session lifetimes for sessions minted from this blueprint. */
    session_settings: AgentBlueprintSessionSettings;
    /** Timestamp when the agent blueprint was created. */
    created_at: string;
    /** Timestamp when the agent blueprint was last updated. */
    updated_at: string;
}
export interface CreateApplicationCredentialsControllerRequest {
    /** The application ID or client ID of the Connect Application. */
    id: string;
}
export interface NewConnectApplicationSecret {
    /** Distinguishes the connect application secret object. */
    object?: string;
    /** The unique ID of the client secret. */
    id?: string;
    /** A hint showing the last few characters of the secret value. */
    secret_hint?: string;
    /** The timestamp when the client secret was last used, or null if never used. */
    last_used_at?: string | null;
    /** An ISO 8601 timestamp. */
    created_at?: string;
    /** An ISO 8601 timestamp. */
    updated_at?: string;
    /** The plaintext secret value. Only returned at creation time and cannot be retrieved later. */
    secret?: string | Redacted.Redacted<string>;
}
/** The OAuth scopes granted to the application. */
export type CreateOAuthApplicationDtoScopesList = Array<string>;
export interface RedirectUriDto {
    /** The redirect URI. */
    uri?: string;
    /** Whether this is the default redirect URI. */
    default?: boolean | null;
}
/** Redirect URIs for the application. */
export type CreateOAuthApplicationDtoRedirectUrisList = Array<RedirectUriDto>;
export interface CreateOAuthApplicationDto {
    /** The name of the application. */
    name?: string;
    /** The type of application to create. */
    application_type?: string;
    /** A description for the application. */
    description?: string | null;
    /** The OAuth scopes granted to the application. */
    scopes?: CreateOAuthApplicationDtoScopesList | null;
    /** Redirect URIs for the application. */
    redirect_uris?: CreateOAuthApplicationDtoRedirectUrisList | null;
    /** Whether the application uses PKCE (Proof Key for Code Exchange). */
    uses_pkce?: boolean | null;
    /** Whether this is a first-party application. Third-party applications require an organization_id. */
    is_first_party?: boolean;
    /** The organization ID this application belongs to. Required when is_first_party is false. */
    organization_id?: string | null;
}
/** The OAuth scopes granted to the application. */
export type CreateM2MApplicationDtoScopesList = Array<string>;
export interface CreateM2MApplicationDto {
    /** The name of the application. */
    name?: string;
    /** The type of application to create. */
    application_type?: string;
    /** A description for the application. */
    description?: string | null;
    /** The OAuth scopes granted to the application. */
    scopes?: CreateM2MApplicationDtoScopesList | null;
    /** The organization ID this application belongs to. */
    organization_id?: string;
}
export type CreateApplicationsControllerRequestBody = CreateOAuthApplicationDto | CreateM2MApplicationDto;
export interface CreateApplicationsControllerRequest {
    body: CreateApplicationsControllerRequestBody;
}
/** The scopes available for this application. */
export type CreateApplicationsControllerResponseScopesList = Array<string>;
export type CreateApplicationsControllerResponseRedirectUrisItem = ApplicationsControllerFindResponseRedirectUrisItem;
/** The redirect URIs configured for this application. */
export type CreateApplicationsControllerResponseRedirectUrisList = Array<ApplicationsControllerFindResponseRedirectUrisItem>;
export interface CreateApplicationsControllerResponse {
    /** Distinguishes the connect application object. */
    object: string;
    /** The unique ID of the connect application. */
    id: string;
    /** The client ID of the connect application. */
    client_id: string;
    /** A description of the connect application. */
    description: string | null;
    /** The name of the connect application. */
    name: string;
    /** The scopes available for this application. */
    scopes: CreateApplicationsControllerResponseScopesList;
    /** An ISO 8601 timestamp. */
    created_at: string;
    /** An ISO 8601 timestamp. */
    updated_at: string;
    /** The type of the application. */
    application_type?: string;
    /** The redirect URIs configured for this application. */
    redirect_uris?: CreateApplicationsControllerResponseRedirectUrisList;
    /** Whether the application uses PKCE for authorization. */
    uses_pkce?: boolean;
    /** Whether the application is a first-party application. */
    is_first_party?: boolean;
    /** Whether the application was dynamically registered. */
    was_dynamically_registered?: boolean;
    /** The ID of the organization the application belongs to. */
    organization_id?: string;
}
export interface AuditLogEventActorDto {
    /** Actor identifier. */
    id?: string;
    /** Actor type. */
    type?: string;
    /** Optional actor name. */
    name?: string;
    /** Additional data associated with the event or entity. */
    metadata?: unknown;
}
export interface AuditLogEventTargetDto {
    /** Target identifier. */
    id?: string;
    /** Target type. */
    type?: string;
    /** Optional target name. */
    name?: string;
    /** Additional data associated with the event or entity. */
    metadata?: unknown;
}
/** The resources affected by the action. */
export type AuditLogEventDtoTargetsList = Array<AuditLogEventTargetDto>;
export interface AuditLogEventContextDto {
    /** IP Address or some other geolocation identifier. */
    location?: string;
    /** User agent string. */
    user_agent?: string;
}
export interface AuditLogEventDto {
    /** Identifier of what happened. */
    action?: string;
    /** ISO-8601 value of when the action occurred. */
    occurred_at?: string;
    /** The entity that performed the action. */
    actor?: AuditLogEventActorDto;
    /** The resources affected by the action. */
    targets?: AuditLogEventDtoTargetsList;
    /** Additional context about where and how the action occurred. */
    context?: AuditLogEventContextDto;
    /** Additional data associated with the event or entity. */
    metadata?: unknown;
    /** What schema version the event is associated with. */
    version?: number;
}
export interface CreateAuditLogEventsControllerRequest {
    /** The unique ID of the Organization. */
    organization_id?: string;
    /** The audit log event to create. */
    event?: AuditLogEventDto;
}
export interface AuditLogEventCreateResponse {
    /** Whether the Audit Log event was created successfully. */
    success?: boolean;
}
export interface AuditLogSchemaActorDto {
    /** JSON schema for actor metadata. */
    metadata?: unknown;
}
export interface AuditLogSchemaTargetDto {
    /** The type of the target resource. */
    type?: string;
    /** Optional JSON schema for target metadata. */
    metadata?: unknown;
}
/** The list of targets for the schema. */
export type CreateAuditLogValidatorVersionsControllerRequestTargetsList = Array<AuditLogSchemaTargetDto>;
export interface CreateAuditLogValidatorVersionsControllerRequest {
    /** The name of the Audit Log action. */
    actionName: string;
    /** The metadata schema for the actor. */
    actor?: AuditLogSchemaActorDto;
    /** The list of targets for the schema. */
    targets?: CreateAuditLogValidatorVersionsControllerRequestTargetsList;
    /** Optional JSON schema for event metadata. */
    metadata?: unknown;
}
/** The type of factor to enroll. */
export type CreateAuthenticationFactorsControllerRequestType = "generic_otp" | "sms" | "totp";
export interface CreateAuthenticationFactorsControllerRequest {
    /** The type of factor to enroll. */
    type: CreateAuthenticationFactorsControllerRequestType | (string & {});
    /** Required when type is 'sms'. */
    phone_number?: string;
    /** Required when type is 'totp'. */
    totp_issuer?: string;
    /** Required when type is 'totp'. */
    totp_user?: string;
    /** The ID of the user to associate the factor with. */
    user_id?: string;
}
/** The type of the factor to enroll. */
export type AuthenticationFactorEnrolledType = "generic_otp" | "sms" | "totp" | "webauthn";
/** SMS-based authentication factor details. */
export interface AuthenticationFactorEnrolledSms {
    /** The user's phone number for SMS-based authentication. */
    phone_number: string;
}
/** TOTP-based authentication factor details. Includes enrollment secrets only available at creation time. */
export interface AuthenticationFactorEnrolledTotp {
    /** Your application or company name displayed in the user's authenticator app. Defaults to your WorkOS team name. */
    issuer: string;
    /** The user's account name displayed in their authenticator app. Defaults to the user's email. */
    user: string;
    /** TOTP secret that can be manually entered into some authenticator apps in place of scanning a QR code. */
    secret: string | Redacted.Redacted<string>;
    /** Base64 encoded image containing scannable QR code. */
    qr_code: string;
    /** The `otpauth` URI that is encoded by the provided `qr_code`. */
    uri: string;
}
export interface AuthenticationFactorEnrolled {
    /** Distinguishes the authentication factor object. */
    object?: string;
    /** The unique ID of the factor. */
    id?: string;
    /** The type of the factor to enroll. */
    type?: AuthenticationFactorEnrolledType;
    /** The ID of the [user](/reference/authkit/user). */
    user_id?: string;
    /** SMS-based authentication factor details. */
    sms?: AuthenticationFactorEnrolledSms;
    /** TOTP-based authentication factor details. Includes enrollment secrets only available at creation time. */
    totp?: AuthenticationFactorEnrolledTotp;
    /** An ISO 8601 timestamp. */
    created_at?: string;
    /** An ISO 8601 timestamp. */
    updated_at?: string;
}
export interface CreateAuthkitOauthResourcesControllerRequest {
    /** The resource URI. May be a wildcard pattern with a single `*`, either in the leftmost hostname label or as the final path segment, where enabled for the environment. */
    uri: string;
    /** Whether the resource being created becomes the environment default, clearing any previous default. Applies at creation only -- this API has no update endpoint yet, so changing the default on an existing resource is done from the dashboard. A wildcard pattern cannot be the default. */
    default?: boolean;
}
export interface AuthkitOauthResource {
    /** The object type. */
    object: string;
    /** The ID of the MCP resource indicator. */
    id: string;
    /** The resource URI. */
    uri: string;
    /** Whether this is the default MCP resource indicator for the environment. */
    default: boolean;
    /** The timestamp when the MCP resource indicator was created. */
    created_at: string;
    /** The timestamp when the MCP resource indicator was last updated. */
    updated_at: string;
}
export interface CreateAuthorizationGroupRoleAssignmentsControllerRequest {
    /** The ID of the group. */
    group_id: string;
    /** The slug of the role to assign to the group. */
    role_slug: string;
    /** The ID of the resource. Omit along with the external-id fields to target the organization itself. */
    resource_id?: string;
    /** The external ID of the resource. */
    resource_external_id?: string;
    /** The resource type slug. */
    resource_type_slug?: string;
}
/** The resource the role is assigned on. */
export type GroupRoleAssignmentResource = UserRoleAssignmentResource;
export interface GroupRoleAssignment {
    /** Distinguishes the group role assignment object. */
    object: string;
    /** Unique identifier of the group role assignment. */
    id: string;
    /** The ID of the group the role is assigned to. */
    group_id: string;
    /** The role included in the assignment. */
    role: SlimRole;
    /** The resource the role is assigned on. */
    resource: UserRoleAssignmentResource;
    /** An ISO 8601 timestamp. */
    created_at: string;
    /** An ISO 8601 timestamp. */
    updated_at: string;
}
export interface CreateAuthorizationOrganizationRolesControllerRequest {
    /** The ID of the organization. */
    organizationId: string;
    /** A unique identifier for the role within the organization. When provided, must begin with 'org-' and contain only lowercase letters, numbers, hyphens, and underscores. When omitted, a slug is auto-generated from the role name and a random suffix. */
    slug?: string;
    /** A descriptive name for the role. */
    name?: string;
    /** An optional description of the role's purpose. */
    description?: string | null;
    /** The slug of the resource type the role is scoped to. */
    resource_type_slug?: string;
}
/** Whether the role is scoped to the environment or an organization (custom role). */
export type CreateAuthorizationOrganizationRolesControllerResponseType = "EnvironmentRole" | "OrganizationRole";
/** The permission slugs assigned to the role. */
export type CreateAuthorizationOrganizationRolesControllerResponsePermissionsList = Array<string>;
export interface CreateAuthorizationOrganizationRolesControllerResponse {
    /** A unique slug for the role. */
    slug: string;
    /** Distinguishes the role object. */
    object: string;
    /** Unique identifier of the role. */
    id: string;
    /** A descriptive name for the role. */
    name: string;
    /** An optional description of the role. */
    description: string | null;
    /** Whether the role is scoped to the environment or an organization (custom role). */
    type: CreateAuthorizationOrganizationRolesControllerResponseType;
    /** The slug of the resource type the role is scoped to. */
    resource_type_slug: string;
    /** The permission slugs assigned to the role. */
    permissions: CreateAuthorizationOrganizationRolesControllerResponsePermissionsList;
    /** An ISO 8601 timestamp. */
    created_at: string;
    /** An ISO 8601 timestamp. */
    updated_at: string;
}
export interface CreateAuthorizationPermissionsControllerRequest {
    /** A unique key to reference the permission. Must be lowercase and contain only letters, numbers, hyphens, underscores, colons, periods, and asterisks. */
    slug?: string;
    /** A descriptive name for the Permission. */
    name?: string;
    /** An optional description of the Permission. */
    description?: string | null;
    /** The slug of the resource type this permission is scoped to. */
    resource_type_slug?: string;
}
export interface CreateAuthorizationPermissionsControllerResponse {
    /** Distinguishes the Permission object. */
    object: string;
    /** Unique identifier of the Permission. */
    id: string;
    /** A unique key to reference the permission. Must be lowercase and contain only letters, numbers, hyphens, underscores, colons, periods, and asterisks. */
    slug: string;
    /** A descriptive name for the Permission. */
    name: string;
    /** An optional description of the Permission. */
    description: string | null;
    /** Whether the permission is a system permission. System permissions are managed by WorkOS and cannot be deleted. */
    system: boolean;
    /** The slug of the resource type associated with the permission. */
    resource_type_slug: string;
    /** An ISO 8601 timestamp. */
    created_at: string;
    /** An ISO 8601 timestamp. */
    updated_at: string;
}
export interface CreateAuthorizationResourcesControllerRequest {
    /** An external identifier for the resource. */
    external_id: string;
    /** A display name for the resource. */
    name: string;
    /** An optional description of the resource. */
    description?: string | null;
    /** The slug of the resource type. */
    resource_type_slug: string;
    /** The ID of the organization this resource belongs to. */
    organization_id: string;
    /** The ID of the parent resource. Mutually exclusive with `parent_resource_external_id` and `parent_resource_type_slug`. */
    parent_resource_id?: string | null;
    /** The external ID of the parent resource. Required with `parent_resource_type_slug`. Mutually exclusive with `parent_resource_id`. */
    parent_resource_external_id?: string;
    /** The resource type slug of the parent resource. Required with `parent_resource_external_id`. Mutually exclusive with `parent_resource_id`. */
    parent_resource_type_slug?: string;
}
export interface CreateAuthorizationResourcesControllerResponse {
    /** Distinguishes the Resource object. */
    object: string;
    /** A human-readable name for the Resource. */
    name: string;
    /** An optional description of the Resource. */
    description: string | null;
    /** The ID of the organization that owns the resource. */
    organization_id: string;
    /** The ID of the parent resource, if this resource is nested. */
    parent_resource_id: string | null;
    /** The unique ID of the Resource. */
    id: string;
    /** An identifier you provide to reference the resource in your system. */
    external_id: string;
    /** The slug of the resource type this resource belongs to. */
    resource_type_slug: string;
    /** An ISO 8601 timestamp. */
    created_at: string;
    /** An ISO 8601 timestamp. */
    updated_at: string;
}
export interface CreateAuthorizationRolesControllerRequest {
    /** A unique slug for the role. */
    slug?: string;
    /** A descriptive name for the role. */
    name?: string;
    /** An optional description of the role. */
    description?: string | null;
    /** The slug of the resource type the role is scoped to. */
    resource_type_slug?: string;
}
/** Whether the role is scoped to the environment or an organization (custom role). */
export type CreateAuthorizationRolesControllerResponseType = "EnvironmentRole" | "OrganizationRole";
/** The permission slugs assigned to the role. */
export type CreateAuthorizationRolesControllerResponsePermissionsList = Array<string>;
export interface CreateAuthorizationRolesControllerResponse {
    /** A unique slug for the role. */
    slug: string;
    /** Distinguishes the role object. */
    object: string;
    /** Unique identifier of the role. */
    id: string;
    /** A descriptive name for the role. */
    name: string;
    /** An optional description of the role. */
    description: string | null;
    /** Whether the role is scoped to the environment or an organization (custom role). */
    type: CreateAuthorizationRolesControllerResponseType;
    /** The slug of the resource type the role is scoped to. */
    resource_type_slug: string;
    /** The permission slugs assigned to the role. */
    permissions: CreateAuthorizationRolesControllerResponsePermissionsList;
    /** An ISO 8601 timestamp. */
    created_at: string;
    /** An ISO 8601 timestamp. */
    updated_at: string;
}
export interface CreateConnectionStandardAttributesDto {
    /** The IdP attribute or claim the profile's `idp_id` is mapped from. When omitted, the default for the connection type is used. */
    idp_id?: string;
    /** The IdP attribute or claim the profile's `email` is mapped from. When omitted, the default for the connection type is used. */
    email?: string;
    /** The IdP attribute or claim the profile's `first_name` is mapped from. When omitted, the default for the connection type is used. */
    first_name?: string;
    /** The IdP attribute or claim the profile's `last_name` is mapped from. When omitted, the default for the connection type is used. */
    last_name?: string;
    /** The IdP attribute or claim the profile's `groups` are mapped from. `null` leaves the mapping unset. */
    groups?: string | null;
    /** The IdP attribute or claim the profile's `name` is mapped from. `null` leaves the mapping unset. */
    name?: string | null;
}
/** How IdP attributes or claims map onto custom attributes, keyed by custom attribute name. Custom attributes must already be defined in the WorkOS dashboard. */
export type CreateConnectionAttributeMapsDtoCustomAttributesMap = {
    [key: string]: string | undefined;
};
export interface CreateConnectionAttributeMapsDto {
    /** How IdP attributes or claims map onto the standard WorkOS profile fields. Provided fields override the defaults for the connection type. */
    standard_attributes?: CreateConnectionStandardAttributesDto;
    /** How IdP attributes or claims map onto custom attributes, keyed by custom attribute name. Custom attributes must already be defined in the WorkOS dashboard. */
    custom_attributes?: CreateConnectionAttributeMapsDtoCustomAttributesMap;
}
/** The X.509 certificates used to verify signed SAML responses from the Identity Provider. Required when configuring the connection with manual IdP fields. */
export type CreateConnectionSamlOptionsDtoIdpSigningCertsList = Array<string>;
export interface CreateConnectionKeyPairDto {
    /** The PEM-encoded private key. */
    key: string;
    /** The PEM-encoded X.509 certificate for the key. */
    cert: string;
}
/** The customer-owned key pairs used to decrypt encrypted SAML responses from the Identity Provider. When omitted, WorkOS generates and manages the encryption key pair. */
export type CreateConnectionSamlOptionsDtoSpEncryptionKeyPairsList = Array<CreateConnectionKeyPairDto>;
export interface CreateConnectionSamlOptionsDto {
    /** The Identity Provider metadata URL. When provided, the IdP fields and signing certificates are imported from the metadata document. Mutually exclusive with the manual IdP fields. */
    idp_metadata_url?: string;
    /** A custom Assertion Consumer Service (ACS) URL override. When omitted, the standard WorkOS-generated ACS URL is used. */
    acs_url?: string;
    /** A custom Service Provider Entity ID (audience) override. When omitted, the connection external key is used. */
    sp_entity_id?: string;
    /** The Identity Provider Entity ID. */
    idp_entity_id?: string;
    /** The Identity Provider SSO URL. Required when configuring the connection with manual IdP fields. */
    idp_sso_url?: string;
    /** The X.509 certificates used to verify signed SAML responses from the Identity Provider. Required when configuring the connection with manual IdP fields. */
    idp_signing_certs?: CreateConnectionSamlOptionsDtoIdpSigningCertsList;
    /** The customer-owned key pair used to sign SAML requests sent to the Identity Provider. When omitted, WorkOS generates and manages the signing key pair. */
    sp_signing_key_pair?: CreateConnectionKeyPairDto;
    /** The customer-owned key pairs used to decrypt encrypted SAML responses from the Identity Provider. When omitted, WorkOS generates and manages the encryption key pair. */
    sp_encryption_key_pairs?: CreateConnectionSamlOptionsDtoSpEncryptionKeyPairsList;
}
/** The token-endpoint client authentication method. */
export type CreateConnectionOidcOptionsDtoTokenAuthenticationMethod = "client_secret_post" | "client_secret_basic" | "private_key_jwt";
/** The ID-token signing algorithm. */
export type CreateConnectionOidcOptionsDtoIdTokenSignatureAlgorithm = "ES256" | "ES384" | "ES512" | "EdDSA" | "HS256" | "HS384" | "HS512" | "PS256" | "PS384" | "PS512" | "RS256" | "RS384" | "RS512";
export interface CreateConnectionOidcOptionsDto {
    /** The OIDC discovery endpoint. */
    discovery_endpoint: string;
    /** The OIDC client ID. */
    client_id: string;
    /** The OIDC client secret. Required for `client_secret_basic` and `client_secret_post`, and rejected for `private_key_jwt`, which authenticates with a key pair instead. This value is write-only and is never returned. */
    client_secret?: string | Redacted.Redacted<string>;
    /** A custom OAuth callback URL override. When omitted, the standard WorkOS-generated redirect URI is used. */
    redirect_uri?: string;
    /** Whether PKCE is enabled for the connection. */
    pkce?: boolean;
    /** The token-endpoint client authentication method. */
    token_authentication_method?: CreateConnectionOidcOptionsDtoTokenAuthenticationMethod | (string & {});
    /** A key pair for WorkOS to sign `private_key_jwt` client assertions with. Only accepted when `token_authentication_method` is `private_key_jwt`; when omitted, WorkOS generates one and returns its certificate in `oidc_options.jwt_signing_certs`. */
    jwt_signing_key_pair?: CreateConnectionKeyPairDto;
    /** The ID-token signing algorithm. */
    id_token_signature_algorithm?: CreateConnectionOidcOptionsDtoIdTokenSignatureAlgorithm | (string & {});
    /** Whether to fetch additional profile attributes from the userinfo endpoint. */
    fetch_user_info?: boolean;
}
export interface CreateConnectionsControllerRequest {
    /** Unique identifier for the Organization in which the Connection resides. */
    organization_id: string;
    /** A human-readable name for the Connection. This will most commonly be the organization's name. */
    name?: string;
    /** The customer-owned identifier for the Connection. */
    external_id?: string;
    /** The type of the Connection. Only SAML and OIDC connection types may be created. When omitted, the type is inferred from the provided options. */
    connection_type?: string;
    /** How IdP attributes or claims map onto WorkOS profile fields. Provided fields override the defaults for the connection type. */
    attribute_maps?: CreateConnectionAttributeMapsDto;
    /** Protocol configuration for SAML connections. Mutually exclusive with `oidc_options`. */
    saml_options?: CreateConnectionSamlOptionsDto;
    /** Protocol configuration for OIDC connections. Mutually exclusive with `saml_options`. */
    oidc_options?: CreateConnectionOidcOptionsDto;
}
export interface CreateCorsOriginsControllerCorsOriginRequest {
    /** The origin URL to allow for CORS requests. */
    origin?: string;
}
export interface CorsOriginResponse {
    /** Distinguishes the CORS origin object. */
    object?: string;
    /** Unique identifier of the CORS origin. */
    id?: string;
    /** The origin URL. */
    origin?: string;
    /** Timestamp when the CORS origin was created. */
    created_at?: string;
    /** Timestamp when the CORS origin was last updated. */
    updated_at?: string;
}
/** Whose connection to create or rotate. `user` (the default) addresses the connection owned by `user_id`. `organization` addresses the connection shared by every member of `organization_id`; `user_id` then identifies the member performing the request and must be an active member of the organization. */
export type CreateDataIntegrationsControllerApiKeyConnectionRequestConnectionOwner = "user" | "organization";
export interface CreateDataIntegrationsControllerApiKeyConnectionRequest {
    /** The identifier of the integration. */
    slug: string;
    /** A mutable, non-unique label. Omit to preserve an existing label; null clears it. Labels are never account identifiers. */
    account_display_name?: string | null;
    /** A developer-attested provider account identifier, never inferred from a label or credential. Omit to preserve an existing identifier; null clears it. */
    account_identifier?: string | null;
    /** A [User](/reference/authkit/user) identifier. */
    user_id: string;
    /** An [Organization](/reference/organization) identifier. Optional parameter to scope the connection to a specific organization. Required when `connection_owner` is `organization`. */
    organization_id?: string;
    /** Whose connection to create or rotate. `user` (the default) addresses the connection owned by `user_id`. `organization` addresses the connection shared by every member of `organization_id`; `user_id` then identifies the member performing the request and must be an active member of the organization. */
    connection_owner?: CreateDataIntegrationsControllerApiKeyConnectionRequestConnectionOwner | (string & {});
    /** The API key secret to store for this integration. */
    secret: string | Redacted.Redacted<string>;
    /** Must be `add`: this endpoint only creates another connection. The first connection for an owner shape fills the compatibility slot; later connections are standard. Creating an additional connection is not yet available: until it is, `add` succeeds only when the owner has no connection for this integration and otherwise returns 404 `multiple_connections_unavailable`. */
    connection_intent: string;
}
/** Whether this row is the compatibility connection visible to undeclared clients or a standard peer for plural-aware clients. The role does not indicate preference or creation order. */
export type ConnectedAccountWriteResponseConnectionRole = "compatibility" | "standard";
/** The OAuth scopes granted for this connection. */
export type ConnectedAccountWriteResponseScopesList = Array<string>;
/** The authentication method used for this connection (`oauth`, `api_key`, or `client_credentials`). Defaults to `oauth` if absent. */
export type ConnectedAccountWriteResponseAuthMethod = "oauth" | "api_key" | "client_credentials";
/** The connection-level configuration values stored for this connection -- the fields the provider declares at `installation` scope, excluding secret and undeclared fields. Returned for every authentication method; empty when no stored values can be disclosed. */
export type ConnectedAccountWriteResponseConfigMap = {
    [key: string]: string | undefined;
};
/** The state of the connected account: - `connected`: The connection is active and tokens are valid. - `needs_reauthorization`: The user needs to reauthorize the connection, typically because required scopes have changed. - `disconnected`: The connection has been disconnected. */
export type ConnectedAccountWriteResponseState = "connected" | "needs_reauthorization" | "disconnected";
export interface ConnectedAccountWriteResponseWarningsItem {
    code: string;
    /** A human-readable explanation of the non-blocking warning. */
    message: string;
}
/** Non-blocking warnings about an explicitly supplied label, omitted when no duplicate exists. Reads do not include this field. */
export type ConnectedAccountWriteResponseWarningsList = Array<ConnectedAccountWriteResponseWarningsItem>;
export interface ConnectedAccountWriteResponse {
    /** Distinguishes the connected account object. */
    object: string;
    /** The unique identifier of the connected account. */
    id: string;
    /** Whether this row is the compatibility connection visible to undeclared clients or a standard peer for plural-aware clients. The role does not indicate preference or creation order. */
    connection_role: ConnectedAccountWriteResponseConnectionRole;
    /** A best-effort identifier for the provider account this connection points at. It is correlation metadata, not the connection identifier or a selector. */
    account_identifier: string | null;
    /** A mutable, non-unique display name for the provider account connection. */
    account_display_name: string | null;
    /** The [User](/reference/authkit/user) identifier associated with this connection. */
    user_id: string | null;
    /** The [Organization](/reference/organization) identifier associated with this connection, or `null` if not scoped to an organization. */
    organization_id: string | null;
    /** The OAuth scopes granted for this connection. */
    scopes: ConnectedAccountWriteResponseScopesList;
    /** The authentication method used for this connection (`oauth`, `api_key`, or `client_credentials`). Defaults to `oauth` if absent. */
    auth_method?: ConnectedAccountWriteResponseAuthMethod;
    /** The last four characters of the API key, or `null` for OAuth connections. */
    api_key_last_4?: string | null;
    /** The client ID supplied for this connection. Only present when `auth_method` is `client_credentials`. */
    client_id?: string | null;
    /** The last four characters of the client secret supplied for this connection, or `null` when it can't be read. Only present when `auth_method` is `client_credentials`. */
    client_secret_last_4?: string | null;
    /** The connection-level configuration values stored for this connection -- the fields the provider declares at `installation` scope, excluding secret and undeclared fields. Returned for every authentication method; empty when no stored values can be disclosed. */
    config?: ConnectedAccountWriteResponseConfigMap;
    /** The state of the connected account: - `connected`: The connection is active and tokens are valid. - `needs_reauthorization`: The user needs to reauthorize the connection, typically because required scopes have changed. - `disconnected`: The connection has been disconnected. */
    state: ConnectedAccountWriteResponseState;
    /** The timestamp when the connection was created. */
    created_at: string;
    /** The timestamp when the connection was last updated. */
    updated_at: string;
    /** Non-blocking warnings about an explicitly supplied label, omitted when no duplicate exists. Reads do not include this field. */
    warnings?: ConnectedAccountWriteResponseWarningsList;
}
/** Whose connection to create or rotate. `user` (the default) addresses the connection owned by `user_id`. `organization` addresses the connection shared by every member of `organization_id`; `user_id` then identifies the member performing the request and must be an active member of the organization. */
export type CreateDataIntegrationsControllerClientCredentialsConnectionRequestConnectionOwner = "user" | "organization";
/** Provider-specific configuration values collected for this installation, keyed by the provider's config field descriptors. */
export type CreateDataIntegrationsControllerClientCredentialsConnectionRequestConfigMap = {
    [key: string]: string | undefined;
};
export interface CreateDataIntegrationsControllerClientCredentialsConnectionRequest {
    /** The identifier of the integration. */
    slug: string;
    /** A mutable, non-unique label. Omit to preserve an existing label; null clears it. Labels are never account identifiers. */
    account_display_name?: string | null;
    /** A developer-attested provider account identifier, never inferred from a label or credential. Omit to preserve an existing identifier; null clears it. */
    account_identifier?: string | null;
    /** A [User](/reference/authkit/user) identifier. */
    user_id: string;
    /** An [Organization](/reference/organization) identifier. Optional parameter to scope the connection to a specific organization. Required when `connection_owner` is `organization`. */
    organization_id?: string;
    /** Whose connection to create or rotate. `user` (the default) addresses the connection owned by `user_id`. `organization` addresses the connection shared by every member of `organization_id`; `user_id` then identifies the member performing the request and must be an active member of the organization. */
    connection_owner?: CreateDataIntegrationsControllerClientCredentialsConnectionRequestConnectionOwner | (string & {});
    /** The OAuth client ID to store for this integration. */
    client_id: string;
    /** The OAuth client secret to store for this integration. */
    client_secret: string | Redacted.Redacted<string>;
    /** Provider-specific configuration values collected for this installation, keyed by the provider's config field descriptors. */
    config?: CreateDataIntegrationsControllerClientCredentialsConnectionRequestConfigMap;
    /** Must be `add`: this endpoint only creates another connection. The first connection for an owner shape fills the compatibility slot; later connections are standard. Creating an additional connection is not yet available: until it is, `add` succeeds only when the owner has no connection for this integration and otherwise returns 404 `multiple_connections_unavailable`. */
    connection_intent: string;
}
/** Who owns the Data Integration. `user` (the default) creates the integration users connect their own accounts to; `organization` creates the root organizations connect to. Ownership is fixed at creation, and one integration of each ownership may exist per provider. Independent of `credentials.type`. */
export type CreateDataIntegrationsManagementControllerDataIntegrationRequestOwnership = "user" | "organization";
/** The OAuth scopes to request for the Data Integration. Defaults to the provider's configured scopes when omitted. */
export type CreateDataIntegrationsManagementControllerDataIntegrationRequestScopesList = Array<string>;
export type CreateDataIntegrationsManagementControllerDataIntegrationRequestAuthMethodsItem = "oauth" | "api_key" | "client_credentials";
/** How accounts authenticate with the provider. Defaults to `["oauth"]`. Use `["api_key"]` to declare an API key integration; `credentials` is then not required and keys are supplied per-tenant (optionally via `api_key` on this request). Use `["client_credentials"]` to declare a client-credentials integration; `credentials` is likewise not required and client credentials are supplied per-tenant. */
export type CreateDataIntegrationsManagementControllerDataIntegrationRequestAuthMethodsList = Array<CreateDataIntegrationsManagementControllerDataIntegrationRequestAuthMethodsItem | (string & {})>;
/** Provider-specific config values (e.g. a Snowflake `account`), keyed by the config field. Only fields the built-in provider declares are accepted. */
export type CreateDataIntegrationsManagementControllerDataIntegrationRequestConfigMap = {
    [key: string]: string | undefined;
};
/** The credentials type. `custom` uses your own OAuth app credentials; `organization` has each organization supply its own credentials (configured per-organization). */
export type DataIntegrationCredentialsDtoType = "custom" | "organization";
export interface DataIntegrationCredentialsDto {
    /** The credentials type. `custom` uses your own OAuth app credentials; `organization` has each organization supply its own credentials (configured per-organization). */
    type: DataIntegrationCredentialsDtoType | (string & {});
    /** OAuth client ID for the provider app. Required when `type` is `custom`; omit for `organization`. */
    client_id?: string;
    /** OAuth client secret for the provider app. Required when `type` is `custom`; omit for `organization`. */
    client_secret?: string | Redacted.Redacted<string>;
}
export interface ApiKeyInstallationDto {
    /** The API key secret to store for the tenant. */
    secret: string | Redacted.Redacted<string>;
    /** The User identifier the API key is installed for. */
    user_id: string;
    /** An Organization identifier to scope the installation to a specific organization. */
    organization_id?: string;
}
/** Additional static query parameters appended to the authorization request. */
export type CustomProviderDefinitionDtoAdditionalAuthorizationParametersMap = {
    [key: string]: string | undefined;
};
/** How client credentials are sent when exchanging authorization codes and refreshing tokens. */
export type CustomProviderDefinitionDtoAuthenticateVia = "request_body" | "basic_auth_header";
export interface CustomProviderDefinitionDto {
    /** A descriptive name for the custom provider. */
    name: string;
    /** The provider's OAuth authorization endpoint. Required for OAuth providers; omit for `api_key` providers. Must be a static URL: `${config....}` placeholders are resolved against a provider's declared config fields, which custom providers cannot declare. */
    authorization_url?: string;
    /** The provider's OAuth token endpoint. Required for OAuth and `client_credentials` providers; omit for `api_key` providers. Must be a static URL: `${config....}` placeholders are resolved against a provider's declared config fields, which custom providers cannot declare. */
    token_url?: string;
    /** The endpoint used to refresh tokens, if different from the token endpoint. Must be a static URL, like the other endpoints. */
    refresh_token_url?: string | null;
    /** Whether PKCE is used during the authorization code flow. Defaults to `true`. */
    pkce_enabled?: boolean;
    /** The separator used to join requested scopes. Defaults to a space. */
    request_scope_separator?: string;
    /** Whether at least one scope must be selected when connecting an account. Defaults to `false`. */
    scopes_required?: boolean;
    /** Whether a client secret is required for this provider. Defaults to `true`. */
    client_secret_required?: boolean;
    /** Additional static query parameters appended to the authorization request. */
    additional_authorization_parameters?: CustomProviderDefinitionDtoAdditionalAuthorizationParametersMap;
    /** The Content-Type used when exchanging the token request. */
    token_body_content_type?: string;
    /** How client credentials are sent when exchanging authorization codes and refreshing tokens. */
    authenticate_via?: CustomProviderDefinitionDtoAuthenticateVia | (string & {});
}
export interface CreateDataIntegrationsManagementControllerDataIntegrationRequest {
    /** The provider to create a Data Integration for. For a built-in provider use its slug (e.g. `github`, `slack`). For a custom provider, this is the new provider slug and `custom_provider` must be supplied. A custom provider slug cannot shadow an existing global provider slug. */
    provider: string;
    /** Who owns the Data Integration. `user` (the default) creates the integration users connect their own accounts to; `organization` creates the root organizations connect to. Ownership is fixed at creation, and one integration of each ownership may exist per provider. Independent of `credentials.type`. */
    ownership?: CreateDataIntegrationsManagementControllerDataIntegrationRequestOwnership | (string & {});
    /** An optional description of the Data Integration. */
    description?: string | null;
    /** Whether the Data Integration is enabled. Defaults to `false`. */
    enabled?: boolean;
    /** The OAuth scopes to request for the Data Integration. Defaults to the provider's configured scopes when omitted. */
    scopes?: CreateDataIntegrationsManagementControllerDataIntegrationRequestScopesList | null;
    /** How accounts authenticate with the provider. Defaults to `["oauth"]`. Use `["api_key"]` to declare an API key integration; `credentials` is then not required and keys are supplied per-tenant (optionally via `api_key` on this request). Use `["client_credentials"]` to declare a client-credentials integration; `credentials` is likewise not required and client credentials are supplied per-tenant. */
    auth_methods?: CreateDataIntegrationsManagementControllerDataIntegrationRequestAuthMethodsList;
    /** Provider-specific config values (e.g. a Snowflake `account`), keyed by the config field. Only fields the built-in provider declares are accepted. */
    config?: CreateDataIntegrationsManagementControllerDataIntegrationRequestConfigMap;
    /** The OAuth credentials to configure for the Data Integration. Required for OAuth integrations; omit when `auth_methods` is `["api_key"]`. */
    credentials?: DataIntegrationCredentialsDto;
    /** An optional API key to install for the first tenant on an `api_key` integration. Omit to declare a keyless integration; tenants can be added later via the per-installation API key path. */
    api_key?: ApiKeyInstallationDto;
    /** The OAuth definition for a custom provider. Supply this to define a custom provider; omit it to create an integration for a built-in provider. */
    custom_provider?: CustomProviderDefinitionDto;
}
/** Who owns the Data Integration: `user` when users connect their own accounts, `organization` when organizations connect. Fixed at creation. */
export type DataIntegrationOwnership = "user" | "organization";
/** The state of the Data Integration. */
export type DataIntegrationState = "valid" | "invalid" | "requested";
export type DataIntegrationScopesList = Array<string>;
export type DataIntegrationAuthMethodsItem = "oauth" | "api_key" | "client_credentials";
/** How accounts authenticate with the provider for this Data Integration. */
export type DataIntegrationAuthMethodsList = Array<DataIntegrationAuthMethodsItem>;
/** The credentials type. `custom` uses your own OAuth app credentials; `organization` has each organization supply its own credentials (so `client_id`/`redacted_client_secret` are null on the integration itself). */
export type DataIntegrationCredentialsType = "custom" | "organization";
export interface DataIntegrationCredentials {
    /** The credentials type. `custom` uses your own OAuth app credentials; `organization` has each organization supply its own credentials (so `client_id`/`redacted_client_secret` are null on the integration itself). */
    type: DataIntegrationCredentialsType;
    /** The OAuth client ID configured for the provider app. Null for `organization` credentials. */
    client_id: string | null;
    /** The last four characters of the OAuth client secret. The full secret is never returned. Null for `organization` credentials. */
    redacted_client_secret: string | Redacted.Redacted<string> | null;
}
/** Whether this is the compatibility connection visible to undeclared clients or a standard connection for plural-aware clients. */
export type DataIntegrationInstallationConnectionRole = "compatibility" | "standard";
export interface DataIntegrationInstallation {
    /** Unique identifier of the installation. */
    id: string;
    /** Whether this is the compatibility connection visible to undeclared clients or a standard connection for plural-aware clients. */
    connection_role: DataIntegrationInstallationConnectionRole;
    /** A best-effort provider account identifier used for correlation, not connection selection. */
    account_identifier: string | null;
    /** A mutable, non-unique display name for this connection. */
    account_display_name: string | null;
    /** The User the API key was installed for. Null on an `organization`-owned integration, whose installations belong to the organization. */
    user_id: string | null;
    /** The Organization the installation is scoped to (or owned by, on an `organization`-owned integration), or null when unscoped. */
    organization_id: string | null;
    /** The last four characters of the stored API key. The full key is never returned. */
    api_key_last_4: string | null;
}
/** Provider-specific config values set on the Data Integration (e.g. a Snowflake `account`), keyed by config field. Only fields the provider declares are accepted. */
export type DataIntegrationConfigMap = {
    [key: string]: string | undefined;
};
/** Additional static query parameters appended to the authorization request. */
export type DataIntegrationCustomProviderAdditionalAuthorizationParametersMap = {
    [key: string]: string | undefined;
};
/** How client credentials are sent when exchanging authorization codes and refreshing tokens. */
export type DataIntegrationCustomProviderAuthenticateVia = "request_body" | "basic_auth_header";
export interface DataIntegrationCustomProvider {
    /** A descriptive name for the custom provider. */
    name: string;
    /** The provider's OAuth authorization endpoint. */
    authorization_url: string | null;
    /** The provider's OAuth token endpoint. */
    token_url: string | null;
    /** The endpoint used to refresh tokens, if different from the token endpoint. */
    refresh_token_url: string | null;
    /** Whether PKCE is used during the authorization code flow. */
    pkce_enabled: boolean;
    /** The separator used to join requested scopes. */
    request_scope_separator: string;
    /** Whether at least one scope must be selected when connecting an account. */
    scopes_required: boolean;
    /** Whether a client secret is required for this provider. */
    client_secret_required: boolean;
    /** Additional static query parameters appended to the authorization request. */
    additional_authorization_parameters: DataIntegrationCustomProviderAdditionalAuthorizationParametersMap;
    /** The Content-Type used when exchanging the token request. */
    token_body_content_type: string;
    /** How client credentials are sent when exchanging authorization codes and refreshing tokens. */
    authenticate_via: DataIntegrationCustomProviderAuthenticateVia;
}
export interface DataIntegration {
    /** Distinguishes the Data Integration object. */
    object: string;
    /** Unique identifier of the Data Integration. */
    id: string;
    /** The provider slug for this Data Integration. */
    slug: string;
    /** The integration type derived from the provider. */
    integration_type: string;
    /** Who owns the Data Integration: `user` when users connect their own accounts, `organization` when organizations connect. Fixed at creation. */
    ownership: DataIntegrationOwnership;
    /** An optional description of the Data Integration. */
    description: string | null;
    /** Whether the Data Integration is enabled. */
    enabled: boolean;
    /** The state of the Data Integration. */
    state: DataIntegrationState;
    /** The OAuth scopes configured for the Data Integration. `null` when the provider's configured scopes are used. */
    scopes: DataIntegrationScopesList | null;
    /** The OAuth redirect URI to register with the provider when configuring the custom application. Empty for `api_key` and `client_credentials` integrations, which run no authorization redirect. */
    redirect_uri: string;
    /** How accounts authenticate with the provider for this Data Integration. */
    auth_methods: DataIntegrationAuthMethodsList;
    /** The integration-level OAuth app credentials. `null` for `api_key` and `client_credentials` integrations, which hold no integration-level credentials (secrets are installed per-tenant). */
    credentials: DataIntegrationCredentials | null;
    /** The tenant installation created when an API key was supplied at creation time; `null` otherwise. Not populated on list/get responses. */
    installation: DataIntegrationInstallation | null;
    /** Provider-specific config values set on the Data Integration (e.g. a Snowflake `account`), keyed by config field. Only fields the provider declares are accepted. */
    config: DataIntegrationConfigMap;
    /** The OAuth definition when this is a custom provider; `null` for built-in providers. */
    custom_provider: DataIntegrationCustomProvider | null;
    /** An ISO 8601 timestamp. */
    created_at: string;
    /** An ISO 8601 timestamp. */
    updated_at: string;
}
/** The OAuth scopes granted for this connection. */
export type CreateDataIntegrationsOrganizationControllerOrganizationDataInstallationRequestScopesList = Array<string>;
/** Explicitly set the state of the connected account. When omitted, the state is derived from the token combination provided. */
export type CreateDataIntegrationsOrganizationControllerOrganizationDataInstallationRequestState = "connected" | "needs_reauthorization";
export interface CreateDataIntegrationsOrganizationControllerOrganizationDataInstallationRequest {
    /** An [Organization](/reference/organization) identifier. */
    organization_id: string;
    /** The slug identifier of the provider (e.g., `github`, `slack`, `notion`). */
    slug: string;
    /** A mutable, non-unique connection label; null clears it. Not an account identifier. */
    account_display_name?: string | null;
    /** A developer-attested account identifier; null clears it. */
    account_identifier?: string | null;
    /** The OAuth access token for the connected account. */
    access_token?: string | Redacted.Redacted<string>;
    /** The OAuth refresh token for the connected account. */
    refresh_token?: string | Redacted.Redacted<string>;
    /** The ISO-8601 timestamp when the access token expires. Required when `access_token` is provided for tokens that expire. */
    expires_at?: string;
    /** The OAuth scopes granted for this connection. */
    scopes?: CreateDataIntegrationsOrganizationControllerOrganizationDataInstallationRequestScopesList;
    /** Explicitly set the state of the connected account. When omitted, the state is derived from the token combination provided. */
    state?: CreateDataIntegrationsOrganizationControllerOrganizationDataInstallationRequestState | (string & {});
    /** The [User](/reference/authkit/user) identifier of the organization member on whose behalf the connected account is being imported or updated. The user must be an active member of the organization. */
    user_id: string;
    /** Set to `add` to create another connected account. Omit this field for permanent compatibility behavior. Creating an additional connection is not yet available: until it is, `add` succeeds only when the owner has no connection for this integration, which creates the compatibility connection, and otherwise returns 404 `multiple_connections_unavailable`. */
    connection_intent?: string;
}
/** The OAuth scopes granted for this connection. */
export type CreateDataIntegrationsUserManagementControllerUserDataInstallationRequestScopesList = Array<string>;
/** Explicitly set the state of the connected account. When omitted, the state is derived from the token combination provided. */
export type CreateDataIntegrationsUserManagementControllerUserDataInstallationRequestState = "connected" | "needs_reauthorization";
export interface CreateDataIntegrationsUserManagementControllerUserDataInstallationRequest {
    /** A [User](/reference/authkit/user) identifier. */
    user_id: string;
    /** The slug identifier of the provider (e.g., `github`, `slack`, `notion`). */
    slug: string;
    /** An [Organization](/reference/organization) identifier. Optional parameter if the connection is scoped to an organization. */
    organization_id?: string;
    /** A mutable, non-unique connection label; null clears it. Not an account identifier. */
    account_display_name?: string | null;
    /** A developer-attested account identifier; null clears it. */
    account_identifier?: string | null;
    /** The OAuth access token for the connected account. */
    access_token?: string | Redacted.Redacted<string>;
    /** The OAuth refresh token for the connected account. */
    refresh_token?: string | Redacted.Redacted<string>;
    /** The ISO-8601 timestamp when the access token expires. Required when `access_token` is provided for tokens that expire. */
    expires_at?: string;
    /** The OAuth scopes granted for this connection. */
    scopes?: CreateDataIntegrationsUserManagementControllerUserDataInstallationRequestScopesList;
    /** Explicitly set the state of the connected account. When omitted, the state is derived from the token combination provided. */
    state?: CreateDataIntegrationsUserManagementControllerUserDataInstallationRequestState | (string & {});
    /** Set to `add` to create another connected account. Omit this field for permanent compatibility behavior. Creating an additional connection is not yet available: until it is, `add` succeeds only when the owner has no connection for this integration, which creates the compatibility connection, and otherwise returns 404 `multiple_connections_unavailable`. */
    connection_intent?: string;
}
export interface CreateFlagTargetsControllerTargetRequest {
    /** The unique slug identifier of the feature flag. */
    slug: string;
    /** The resource ID in format "user_<id>" or "org_<id>". */
    resourceId: string;
}
export interface CreateFlagTargetsControllerTargetResponse {
}
export interface CreateGroupsControllerRequest {
    /** The ID of the organization. */
    organizationId: string;
    /** The name of the Group. */
    name?: string;
    /** An optional description of the Group. */
    description?: string | null;
}
export interface CreateItContactsControllerRequest {
    /** The ID of the organization. */
    organization_id: string;
    /** The email address of the IT contact. */
    email: string;
}
export interface ItContact {
    /** The IT Contact object. */
    object: string;
    /** The unique ID of the IT Contact. */
    id: string;
    /** The email address of the IT Contact. */
    email: string;
    /** An ISO 8601 timestamp. */
    created_at: string;
    /** An ISO 8601 timestamp. */
    updated_at: string;
}
/** Map of values used to determine the encryption key. */
export type CreateJumpWireWebDataVaultControllerRequestKeyContextMap = {
    [key: string]: string | undefined;
};
export interface CreateJumpWireWebDataVaultControllerRequest {
    /** Map of values used to determine the encryption key. */
    key_context: CreateJumpWireWebDataVaultControllerRequestKeyContextMap;
    /** Unique name for the object. */
    name: string;
    /** Plaintext data to encrypt and store. */
    value: string;
}
/** Map of values used to determine the encryption key. */
export type ObjectMetadataContextMap = {
    [key: string]: string | undefined;
};
/** The user or API key that performed an action. */
export interface Actor {
    /** Unique identifier of the actor. */
    id: string;
    /** Display name of the actor. */
    name: string;
}
/** Metadata for a stored encrypted object. */
export interface ObjectMetadata {
    /** Map of values used to determine the encryption key. */
    context: ObjectMetadataContextMap;
    /** Environment the object belongs to. */
    environment_id: string;
    /** Unique identifier of the object. */
    id: string;
    /** Encryption key identifier. */
    key_id: string;
    /** Timestamp of the last update. */
    updated_at: string;
    updated_by: Actor;
    /** Current version identifier of the object. */
    version_id?: string | null;
}
/** The permission slugs to assign to the API key. */
export type CreateOrganizationApiKeysControllerRequestPermissionsList = Array<string>;
export interface CreateOrganizationApiKeysControllerRequest {
    /** Unique identifier of the Organization. */
    organizationId: string;
    /** The name for the API key. */
    name?: string;
    /** The permission slugs to assign to the API key. */
    permissions?: CreateOrganizationApiKeysControllerRequestPermissionsList;
    /** The timestamp when the API key should expire. Must be a future timestamp. If omitted, the key does not expire. */
    expires_at?: string;
}
/** The entity that owns the API Key. */
export type OrganizationApiKeyWithValueOwner = ApiKeyOwnerCase0;
/** The permission slugs assigned to the API Key. */
export type OrganizationApiKeyWithValuePermissionsList = Array<string>;
export interface OrganizationApiKeyWithValue {
    /** Distinguishes the API Key object. */
    object: string;
    /** Unique identifier of the API Key. */
    id: string;
    /** The entity that owns the API Key. */
    owner: ApiKeyOwnerCase0;
    /** A descriptive name for the API Key. */
    name: string;
    /** An obfuscated representation of the API Key value. */
    obfuscated_value: string;
    /** Timestamp of when the API Key was last used. */
    last_used_at: string | null;
    /** Timestamp when the API Key expires. Null means the key does not expire. */
    expires_at: string | null;
    /** The permission slugs assigned to the API Key. */
    permissions: OrganizationApiKeyWithValuePermissionsList;
    /** An ISO 8601 timestamp. */
    created_at: string;
    /** An ISO 8601 timestamp. */
    updated_at: string;
    /** The full API Key value. Only returned once at creation time. */
    value: string;
}
export interface CreateOrganizationDomainsControllerRequest {
    /** The domain to add to the organization. */
    domain?: string;
    /** The ID of the organization to add the domain to. */
    organization_id?: string;
}
/** Verification state of the domain. */
export type CreateOrganizationDomainsControllerResponseState = "failed" | "legacy_verified" | "pending" | "unverified" | "verified";
/** Strategy used to verify the domain. */
export type CreateOrganizationDomainsControllerResponseVerificationStrategy = "dns" | "manual";
export interface CreateOrganizationDomainsControllerResponse {
    /** Distinguishes the organization domain object. */
    object: string;
    /** Unique identifier of the organization domain. */
    id: string;
    /** ID of the parent Organization. */
    organization_id: string;
    /** Domain for the organization domain. */
    domain: string;
    /** Verification state of the domain. */
    state?: CreateOrganizationDomainsControllerResponseState;
    /** The prefix used in DNS verification. */
    verification_prefix?: string;
    /** Validation token to be used in DNS TXT record. */
    verification_token?: string;
    /** Strategy used to verify the domain. */
    verification_strategy?: CreateOrganizationDomainsControllerResponseVerificationStrategy;
    /** An ISO 8601 timestamp. */
    created_at: string;
    /** An ISO 8601 timestamp. */
    updated_at: string;
}
/** The domains associated with the organization. Deprecated in favor of `domain_data`. */
export type CreateOrganizationsControllerRequestDomainsList = Array<string>;
/** The verification state of the domain. */
export type OrganizationDomainDataDtoState = "pending" | "verified";
export interface OrganizationDomainDataDto {
    /** The domain value. */
    domain?: string;
    /** The verification state of the domain. */
    state?: OrganizationDomainDataDtoState | (string & {});
}
/** The domains associated with the organization, including verification state. */
export type CreateOrganizationsControllerRequestDomainDataList = Array<OrganizationDomainDataDto>;
/** Object containing [metadata](/authkit/metadata) key/value pairs associated with the Organization. */
export type CreateOrganizationsControllerRequestMetadataMap = {
    [key: string]: string | undefined;
};
export interface CreateOrganizationsControllerRequest {
    /** The name of the organization. */
    name?: string;
    /** Whether the organization allows profiles from outside the organization to sign in. */
    allow_profiles_outside_organization?: boolean;
    /** The domains associated with the organization. Deprecated in favor of `domain_data`. */
    domains?: CreateOrganizationsControllerRequestDomainsList;
    /** The domains associated with the organization, including verification state. */
    domain_data?: CreateOrganizationsControllerRequestDomainDataList;
    /** Object containing [metadata](/authkit/metadata) key/value pairs associated with the Organization. */
    metadata?: CreateOrganizationsControllerRequestMetadataMap | null;
    /** An external identifier for the Organization. */
    external_id?: string | null;
}
/** Verification state of the domain. */
export type OrganizationDomainsItemState = "failed" | "legacy_verified" | "pending" | "unverified" | "verified";
/** Strategy used to verify the domain. */
export type OrganizationDomainsItemVerificationStrategy = "dns" | "manual";
export interface OrganizationDomainsItem {
    /** Distinguishes the organization domain object. */
    object: string;
    /** Unique identifier of the organization domain. */
    id: string;
    /** ID of the parent Organization. */
    organization_id: string;
    /** Domain for the organization domain. */
    domain: string;
    /** Verification state of the domain. */
    state?: OrganizationDomainsItemState;
    /** The prefix used in DNS verification. */
    verification_prefix?: string;
    /** Validation token to be used in DNS TXT record. */
    verification_token?: string;
    /** Strategy used to verify the domain. */
    verification_strategy?: OrganizationDomainsItemVerificationStrategy;
    /** An ISO 8601 timestamp. */
    created_at: string;
    /** An ISO 8601 timestamp. */
    updated_at: string;
}
/** List of Organization Domains. */
export type OrganizationDomainsList = Array<OrganizationDomainsItem>;
/** Object containing [metadata](/authkit/metadata) key/value pairs associated with the Organization. */
export type OrganizationMetadataMap = {
    [key: string]: string | undefined;
};
export interface Organization {
    /** Distinguishes the Organization object. */
    object?: string;
    /** Unique identifier of the Organization. */
    id?: string;
    /** A descriptive name for the Organization. This field does not need to be unique. */
    name?: string;
    /** List of Organization Domains. */
    domains?: OrganizationDomainsList;
    /** Object containing [metadata](/authkit/metadata) key/value pairs associated with the Organization. */
    metadata?: OrganizationMetadataMap;
    /** The external ID of the Organization. */
    external_id?: string | null;
    /** The Stripe customer ID of the Organization. */
    stripe_customer_id?: string;
    /** An ISO 8601 timestamp. */
    created_at?: string;
    /** An ISO 8601 timestamp. */
    updated_at?: string;
    /** Whether the Organization allows profiles outside of its managed domains. */
    allow_profiles_outside_organization?: boolean;
}
/** The intent of the Admin Portal. - `sso` - Launch Admin Portal for creating SSO connections - `dsync` - Launch Admin Portal for creating Directory Sync connections - `audit_logs` - Launch Admin Portal for viewing Audit Logs - `log_streams` - Launch Admin Portal for creating Log Streams - `domain_verification` - Launch Admin Portal for Domain Verification - `certificate_renewal` - Launch Admin Portal for renewing SAML Certificates - `bring_your_own_key` - Launch Admin Portal for configuring Bring Your Own Key */
export type CreatePortalSessionsControllerRequestIntent = "sso" | "dsync" | "audit_logs" | "log_streams" | "domain_verification" | "certificate_renewal" | "bring_your_own_key";
/** The email addresses of the IT contacts to grant access to the Admin Portal for the given organization. Accepts up to 20 emails. */
export type CreatePortalSessionsControllerRequestItContactEmailsList = Array<string>;
export interface CreatePortalSessionsControllerRequest {
    /** The URL to go to when an admin clicks on your logo in the Admin Portal. If not specified, the return URL configured on the [Admin Portal](https://dashboard.workos.com/admin-portal) page will be used. */
    return_url?: string;
    /** The URL to redirect the admin to when they finish setup. If not specified, the success URL configured on the [Admin Portal](https://dashboard.workos.com/admin-portal) page will be used. */
    success_url?: string;
    /** An [Organization](/reference/organization) identifier. */
    organization?: string;
    /** The intent of the Admin Portal. - `sso` - Launch Admin Portal for creating SSO connections - `dsync` - Launch Admin Portal for creating Directory Sync connections - `audit_logs` - Launch Admin Portal for viewing Audit Logs - `log_streams` - Launch Admin Portal for creating Log Streams - `domain_verification` - Launch Admin Portal for Domain Verification - `certificate_renewal` - Launch Admin Portal for renewing SAML Certificates - `bring_your_own_key` - Launch Admin Portal for configuring Bring Your Own Key */
    intent?: CreatePortalSessionsControllerRequestIntent | (string & {});
    /** The email addresses of the IT contacts to grant access to the Admin Portal for the given organization. Accepts up to 20 emails. */
    it_contact_emails?: CreatePortalSessionsControllerRequestItContactEmailsList;
}
export interface PortalLinkResponse {
    /** An ephemeral link to initiate the Admin Portal. */
    link?: string;
}
export interface CreateRedirectUrisControllerRequest {
    /** The redirect URI to create. */
    uri?: string;
}
export interface RedirectUri {
    /** The object type. */
    object?: string;
    /** The ID of the redirect URI. */
    id?: string;
    /** The redirect URI. */
    uri?: string;
    /** Whether this is the default redirect URI. */
    default?: boolean;
    /** The timestamp when the redirect URI was created. */
    created_at?: string;
    /** The timestamp when the redirect URI was last updated. */
    updated_at?: string;
}
export interface CreateSamlIdpSigningCertificatesControllerRequest {
    /** Unique identifier for the Connection. */
    connectionId: string;
    /** The PEM-encoded X.509 certificate. */
    value: string;
}
export interface SamlIdpSigningCertificate {
    /** Distinguishes the SAML Identity Provider signing certificate object. */
    object: string;
    /** Unique identifier for the Identity Provider signing certificate. */
    id: string;
    /** The PEM-encoded public X.509 certificate. */
    value: string;
    /** When the certificate becomes valid. */
    not_before: string | null;
    /** When the certificate expires. */
    not_after: string | null;
    /** An ISO 8601 timestamp. */
    created_at: string;
}
export interface CreateSamlSpEncryptionCertificatesControllerRequest {
    /** Unique identifier for the Connection. */
    connectionId: string;
}
export interface SamlSpEncryptionCertificate {
    /** Distinguishes the SAML Service Provider encryption certificate object. */
    object: string;
    /** Unique identifier for the Service Provider encryption key pair. WorkOS holds the corresponding private key, which is never exposed. */
    id: string;
    /** The PEM-encoded public X.509 certificate. */
    value: string;
    /** When the certificate becomes valid. */
    not_before: string | null;
    /** When the certificate expires. */
    not_after: string | null;
    /** An ISO 8601 timestamp. */
    created_at: string;
}
export interface CreateSamlSpSigningCertificatesControllerRequest {
    /** Unique identifier for the Connection. */
    connectionId: string;
}
export interface SamlSpSigningCertificate {
    /** Distinguishes the SAML Service Provider signing certificate object. */
    object: string;
    /** Unique identifier for the Service Provider signing key pair. WorkOS holds the corresponding private key, which is never exposed. */
    id: string;
    /** The PEM-encoded public X.509 certificate. */
    value: string;
    /** When the certificate becomes valid. */
    not_before: string | null;
    /** When the certificate expires. */
    not_after: string | null;
    /** An ISO 8601 timestamp. */
    created_at: string;
}
export interface CreateTeamsControllerTeamRequest {
    /** The email address of the person who will administer the team. An invitation is sent to this address. */
    admin_email: string;
    /** Name of the team. */
    name: string;
}
/** Whether the team can host production environments. `Active` means billing is set up. `Inactive` means a team admin must add a payment method in the WorkOS Dashboard. `Suspended` and `Deleting` mean the team can't be provisioned into. */
export type TeamProductionState = "Active" | "Inactive" | "Suspended" | "Deleting";
export interface Team {
    /** Distinguishes the team object. */
    object: string;
    /** Unique identifier of the team. */
    id: string;
    /** The name of the team. */
    name: string;
    /** Whether the team can host production environments. `Active` means billing is set up. `Inactive` means a team admin must add a payment method in the WorkOS Dashboard. `Suspended` and `Deleting` mean the team can't be provisioned into. */
    production_state: TeamProductionState;
    /** The timestamp when production was enabled for the team, or `null` if it never has been. */
    production_enabled_at: string | null;
    /** The timestamp when the team was created. */
    created_at: string;
    /** The timestamp when the team was last updated. */
    updated_at: string;
}
/** The permission slugs to assign to the API key. Each permission must be enabled for user API keys. */
export type CreateUserApiKeysControllerRequestPermissionsList = Array<string>;
export interface CreateUserApiKeysControllerRequest {
    /** Unique identifier of the user. */
    userId: string;
    /** A descriptive name for the API key. */
    name: string;
    /** The ID of the organization the user API key is associated with. The user must have an active membership in this organization. */
    organization_id: string;
    /** The permission slugs to assign to the API key. Each permission must be enabled for user API keys. */
    permissions?: CreateUserApiKeysControllerRequestPermissionsList;
    /** The timestamp when the API key should expire. Must be a future timestamp. If omitted, the key does not expire. */
    expires_at?: string;
}
/** The entity that owns the API Key. */
export type UserApiKeyWithValueOwner = ApiKeyOwnerCase1;
/** The permission slugs assigned to the API Key. */
export type UserApiKeyWithValuePermissionsList = Array<string>;
export interface UserApiKeyWithValue {
    /** Distinguishes the API Key object. */
    object: string;
    /** Unique identifier of the API Key. */
    id: string;
    /** The entity that owns the API Key. */
    owner: ApiKeyOwnerCase1;
    /** A descriptive name for the API Key. */
    name: string;
    /** An obfuscated representation of the API Key value. */
    obfuscated_value: string;
    /** Timestamp of when the API Key was last used. */
    last_used_at: string | null;
    /** Timestamp when the API Key expires. Null means the key does not expire. */
    expires_at: string | null;
    /** The permission slugs assigned to the API Key. */
    permissions: UserApiKeyWithValuePermissionsList;
    /** An ISO 8601 timestamp. */
    created_at: string;
    /** An ISO 8601 timestamp. */
    updated_at: string;
    /** The full API Key value. Only returned once at creation time. */
    value: string;
}
/** The locale to use when rendering the invitation email. See [supported locales](/authkit/hosted-ui/localization). */
export type CreateUserlandUserInvitesControllerRequestLocale = "af" | "am" | "ar" | "bg" | "bn" | "bs" | "ca" | "cs" | "da" | "de" | "de-DE" | "el" | "en" | "en-AU" | "en-CA" | "en-GB" | "en-US" | "es" | "es-419" | "es-ES" | "es-US" | "et" | "fa" | "fi" | "fil" | "fr" | "fr-BE" | "fr-CA" | "fr-FR" | "fy" | "gl" | "gu" | "ha" | "he" | "hi" | "hr" | "hu" | "hy" | "id" | "is" | "it" | "it-IT" | "ja" | "jv" | "ka" | "kk" | "km" | "kn" | "ko" | "lt" | "lv" | "mk" | "ml" | "mn" | "mr" | "ms" | "my" | "nb" | "ne" | "nl" | "nl-BE" | "nl-NL" | "nn" | "no" | "pa" | "pl" | "pt" | "pt-BR" | "pt-PT" | "ro" | "ru" | "sk" | "sl" | "sq" | "sr" | "sv" | "sw" | "ta" | "te" | "th" | "tr" | "uk" | "ur" | "uz" | "vi" | "zh" | "zh-CN" | "zh-HK" | "zh-TW" | "zu";
export interface CreateUserlandUserInvitesControllerRequest {
    /** The email address of the recipient. */
    email?: string;
    /** The ID of the [organization](/reference/organization) that the recipient will join. */
    organization_id?: string;
    /** The [role](/authkit/roles) that the recipient will receive when they join the organization in the invitation. */
    role_slug?: string;
    /** How many days the invitations will be valid for. Must be between 1 and 30 days. Defaults to 7 days if not specified. */
    expires_in_days?: number;
    /** The ID of the [user](/reference/authkit/user) who invites the recipient. The invitation email will mention the name of this user. */
    inviter_user_id?: string;
    /** The locale to use when rendering the invitation email. See [supported locales](/authkit/hosted-ui/localization). */
    locale?: CreateUserlandUserInvitesControllerRequestLocale | (string & {});
}
/** The state of the invitation. */
export type UserlandUserInviteState = "pending" | "accepted" | "expired" | "revoked";
export interface UserlandUserInvite {
    /** Distinguishes the invitation object. */
    object?: string;
    /** The unique ID of the invitation. */
    id?: string;
    /** The email address of the recipient. */
    email?: string;
    /** The state of the invitation. */
    state?: UserlandUserInviteState;
    /** The timestamp when the invitation was accepted, or null if not yet accepted. */
    accepted_at?: string | null;
    /** The timestamp when the invitation was revoked, or null if not revoked. */
    revoked_at?: string | null;
    /** The timestamp when the invitation expires. */
    expires_at?: string;
    /** The ID of the [organization](/reference/organization) that the recipient will join. */
    organization_id?: string | null;
    /** The ID of the user who invited the recipient, if provided. */
    inviter_user_id?: string | null;
    /** The ID of the user who accepted the invitation, once accepted. */
    accepted_user_id?: string | null;
    /** Slug of the role the invitee will be assigned on acceptance. Reflects the current role on the invitee's organization membership. null when the invitation has no associated organization. */
    role_slug?: string | null;
    /** An ISO 8601 timestamp. */
    created_at?: string;
    /** An ISO 8601 timestamp. */
    updated_at?: string;
    /** The token used to accept the invitation. */
    token?: string;
    /** The URL where the recipient can accept the invitation. */
    accept_invitation_url?: string;
}
/** An array of role identifiers. Limited to one role when Multiple Roles is disabled. Mutually exclusive with `role_slug`. */
export type CreateUserlandUserOrganizationMembershipsControllerRequestRoleSlugsList = Array<string>;
export interface CreateUserlandUserOrganizationMembershipsControllerRequest {
    /** The ID of the [user](/reference/authkit/user). */
    user_id: string;
    /** The ID of the [organization](/reference/organization) which the user belongs to. */
    organization_id: string;
    /** A single role identifier. Defaults to `member` or the explicit default role. Mutually exclusive with `role_slugs`. */
    role_slug?: string;
    /** An array of role identifiers. Limited to one role when Multiple Roles is disabled. Mutually exclusive with `role_slug`. */
    role_slugs?: CreateUserlandUserOrganizationMembershipsControllerRequestRoleSlugsList;
}
/** The status of the organization membership. One of `active`, `inactive`, or `pending`. */
export type CreateUserlandUserOrganizationMembershipsControllerResponseStatus = "active" | "inactive" | "pending";
/** An object containing IdP-sourced attributes from the linked [Directory User](/reference/directory-sync/directory-user) or [SSO Profile](/reference/sso/profile). Directory User attributes take precedence when both are linked. */
export type CreateUserlandUserOrganizationMembershipsControllerResponseCustomAttributesMap = {
    [key: string]: unknown | undefined;
};
/** The list of roles assigned to the user within the organization. */
export type CreateUserlandUserOrganizationMembershipsControllerResponseRolesList = Array<SlimRole>;
/** Object containing metadata key/value pairs associated with the user. */
export type UserlandUserMetadataMap = {
    [key: string]: string | undefined;
};
/** The user object. */
export interface UserlandUser {
    /** Distinguishes the user object. */
    object?: string;
    /** The unique ID of the user. */
    id?: string;
    /** The first name of the user. */
    first_name?: string | null;
    /** The last name of the user. */
    last_name?: string | null;
    /** The user's full name. */
    name?: string | null;
    /** A URL reference to an image representing the user. */
    profile_picture_url?: string | null;
    /** The email address of the user. */
    email?: string;
    /** Whether the user's email has been verified. */
    email_verified?: boolean;
    /** The external ID of the user. */
    external_id?: string | null;
    /** Object containing metadata key/value pairs associated with the user. */
    metadata?: UserlandUserMetadataMap;
    /** The timestamp when the user last signed in. */
    last_sign_in_at?: string | null;
    /** The user's preferred locale. */
    locale?: string | null;
    /** An ISO 8601 timestamp. */
    created_at?: string;
    /** An ISO 8601 timestamp. */
    updated_at?: string;
}
export interface CreateUserlandUserOrganizationMembershipsControllerResponse {
    /** Distinguishes the organization membership object. */
    object: string;
    /** The unique ID of the organization membership. */
    id: string;
    /** The ID of the user. */
    user_id: string;
    /** The ID of the organization which the user belongs to. */
    organization_id: string;
    /** The status of the organization membership. One of `active`, `inactive`, or `pending`. */
    status: CreateUserlandUserOrganizationMembershipsControllerResponseStatus;
    /** Whether this organization membership is managed by a directory sync connection. */
    directory_managed: boolean;
    /** The name of the organization which the user belongs to. */
    organization_name?: string;
    /** An object containing IdP-sourced attributes from the linked [Directory User](/reference/directory-sync/directory-user) or [SSO Profile](/reference/sso/profile). Directory User attributes take precedence when both are linked. */
    custom_attributes?: CreateUserlandUserOrganizationMembershipsControllerResponseCustomAttributesMap;
    /** An ISO 8601 timestamp. */
    created_at: string;
    /** An ISO 8601 timestamp. */
    updated_at: string;
    /** The primary role assigned to the user within the organization. */
    role: SlimRole;
    /** The list of roles assigned to the user within the organization. */
    roles: CreateUserlandUserOrganizationMembershipsControllerResponseRolesList;
    /** The user that belongs to the organization through this membership. */
    user: UserlandUser;
}
/** Object containing additional key/value pairs collected with the waitlist entry. Supports up to 50 string pairs, with keys up to 40 characters and values up to 600 characters. Values are user-provided -- treat them as untrusted input when rendering or exporting. */
export type CreateWaitlistsControllerEntryRequestAdditionalFieldsMap = {
    [key: string]: string | undefined;
};
export interface CreateWaitlistsControllerEntryRequest {
    /** The unique ID of the waitlist, or the literal `default` for the environment's default waitlist. Use `default` when adding the first entry -- the default waitlist is created automatically. */
    id: string;
    /** The email address of the user joining the waitlist. */
    email: string;
    /** Object containing additional key/value pairs collected with the waitlist entry. Supports up to 50 string pairs, with keys up to 40 characters and values up to 600 characters. Values are user-provided -- treat them as untrusted input when rendering or exporting. */
    additional_fields?: CreateWaitlistsControllerEntryRequestAdditionalFieldsMap;
    /** Whether to send the waitlist confirmation email to the user. Defaults to `false`. No email is sent when the waitlist confirmation email is disabled in the environment, even if `send_confirmation_email` is `true`. */
    send_confirmation_email?: boolean;
}
/** The state of the waitlist entry. */
export type WaitlistEntryState = "pending" | "approved" | "denied";
/** Additional fields submitted when the user joined the waitlist. Values are user-provided -- treat them as untrusted input when rendering or exporting. */
export type WaitlistEntryAdditionalFieldsMap = {
    [key: string]: string | undefined;
};
export interface WaitlistEntry {
    /** The unique ID of the waitlist entry. */
    id: string;
    /** The email address of the user on the waitlist. */
    email: string;
    /** The state of the waitlist entry. */
    state: WaitlistEntryState;
    /** The timestamp when the entry was approved, or null if not yet approved. */
    approved_at: string | null;
    /** Additional fields submitted when the user joined the waitlist. Values are user-provided -- treat them as untrusted input when rendering or exporting. */
    additional_fields?: WaitlistEntryAdditionalFieldsMap;
    /** The unique ID of the waitlist the entry belongs to. */
    waitlist_id?: string | null;
    /** An ISO 8601 timestamp. */
    created_at: string;
    /** An ISO 8601 timestamp. */
    updated_at: string;
    /** Distinguishes the Waitlist Entry object. */
    object: string;
}
export type CreateWebhookEndpointsControllerRequestEventsItem = "agent.blueprint.created" | "agent.blueprint.deleted" | "agent.blueprint.updated" | "agent.instance.created" | "agent.instance.deleted" | "agent.instance.session.created" | "agent.instance.session.revoked" | "agent.registration.created" | "agent.registration.claim.attempt.created" | "agent.registration.claim.completed" | "agent.registration.credential.issued" | "agent.registration.deleted" | "agent.registration.refreshed" | "agent.registration.expired" | "agent.registration.organization.switched" | "agent.registration.revoked" | "authentication.email_verification_succeeded" | "authentication.magic_auth_failed" | "authentication.magic_auth_succeeded" | "authentication.mfa_succeeded" | "authentication.oauth_failed" | "authentication.oauth_succeeded" | "authentication.password_failed" | "authentication.password_succeeded" | "authentication.passkey_failed" | "authentication.passkey_succeeded" | "authentication.sso_failed" | "authentication.sso_started" | "authentication.sso_succeeded" | "authentication.sso_timed_out" | "radar.challenge_created" | "authentication.radar_risk_detected" | "authentication.reauthentication_succeeded" | "api_key.created" | "api_key.revoked" | "api_key.updated" | "connection.activated" | "connection.deactivated" | "connection.saml_certificate_renewal_required" | "connection.saml_certificate_renewed" | "connection.deleted" | "dsync.activated" | "dsync.deleted" | "dsync.group.created" | "dsync.group.deleted" | "dsync.group.updated" | "dsync.group.user_added" | "dsync.group.user_removed" | "dsync.user.created" | "dsync.user.deleted" | "dsync.user.updated" | "email_verification.created" | "group.created" | "group.deleted" | "group.member_added" | "group.member_removed" | "group.updated" | "flag.created" | "flag.deleted" | "flag.updated" | "flag.rule_updated" | "invitation.accepted" | "invitation.created" | "invitation.resent" | "invitation.revoked" | "magic_auth.created" | "organization.created" | "organization.deleted" | "organization.updated" | "organization_domain.created" | "organization_domain.deleted" | "organization_domain.updated" | "organization_domain.verified" | "organization_domain.verification_failed" | "password_reset.created" | "password_reset.succeeded" | "user.created" | "user.updated" | "user.deleted" | "organization_membership.created" | "organization_membership.deleted" | "organization_membership.updated" | "role.created" | "role.deleted" | "role.updated" | "organization_role.created" | "organization_role.deleted" | "organization_role.updated" | "permission.created" | "permission.deleted" | "permission.updated" | "pipes.account_connection.add_failed" | "pipes.account_connection.connected" | "pipes.account_connection.connection_failed" | "pipes.account_connection.disconnected" | "pipes.account_connection.reauthorization_needed" | "pipes.connected_account.connected" | "pipes.connected_account.connection_failed" | "pipes.connected_account.disconnected" | "pipes.connected_account.reauthorization_needed" | "session.created" | "session.revoked" | "waitlist_user.approved" | "waitlist_user.created" | "waitlist_user.denied";
/** The events that the Webhook Endpoint is subscribed to. */
export type CreateWebhookEndpointsControllerRequestEventsList = Array<CreateWebhookEndpointsControllerRequestEventsItem | (string & {})>;
export interface CreateWebhookEndpointsControllerRequest {
    /** The HTTPS URL where webhooks will be sent. */
    endpoint_url?: string;
    /** The events that the Webhook Endpoint is subscribed to. */
    events?: CreateWebhookEndpointsControllerRequestEventsList;
}
/** Whether the Webhook Endpoint is enabled or disabled. */
export type WebhookEndpointJsonStatus = "enabled" | "disabled";
/** The events that the Webhook Endpoint is subscribed to. */
export type WebhookEndpointJsonEventsList = Array<string>;
export interface WebhookEndpointJson {
    /** Distinguishes the Webhook Endpoint object. */
    object?: string;
    /** Unique identifier of the Webhook Endpoint. */
    id?: string;
    /** The URL to which webhooks are sent. */
    endpoint_url?: string;
    /** The secret used to sign webhook payloads. */
    secret?: string | Redacted.Redacted<string>;
    /** Whether the Webhook Endpoint is enabled or disabled. */
    status?: WebhookEndpointJsonStatus;
    /** The events that the Webhook Endpoint is subscribed to. */
    events?: WebhookEndpointJsonEventsList;
    /** An ISO 8601 timestamp. */
    created_at?: string;
    /** An ISO 8601 timestamp. */
    updated_at?: string;
}
/** Who will own the connected account. `user` (the default) connects the user's own account. `organization` connects the organization's shared account and requires `organization_id`. */
export type DataIntegrationsControllerGetDataIntegrationAuthorizeUrlRequestBodyCase0ConnectionOwner = "user" | "organization";
/** Connect-time config values for the provider-declared `installation`-scope fields (e.g. a Zendesk `subdomain`), keyed by the config field. Only fields the provider declares may be supplied, and required fields must be provided unless already pinned on the integration. */
export type DataIntegrationsControllerGetDataIntegrationAuthorizeUrlRequestBodyCase0ConfigMap = {
    [key: string]: string | undefined;
};
export interface DataIntegrationsControllerGetDataIntegrationAuthorizeUrlRequestBodyCase0 {
    /** A mutable, non-unique label. Omit to preserve an existing label; null clears it. Labels are never account identifiers. */
    account_display_name?: string | null;
    /** The ID of the user to authorize. When `connection_owner` is `organization`, this is the user authorizing on behalf of the organization; they must be an active member of the organization and do not become the owner of the resulting connected account. */
    user_id: string;
    /** An organization ID to scope the authorization to a specific organization. Required when `connection_owner` is `organization`. */
    organization_id?: string;
    /** Who will own the connected account. `user` (the default) connects the user's own account. `organization` connects the organization's shared account and requires `organization_id`. */
    connection_owner?: DataIntegrationsControllerGetDataIntegrationAuthorizeUrlRequestBodyCase0ConnectionOwner | (string & {});
    /** The URL to redirect the user to after authorization. */
    return_to?: string;
    /** Connect-time config values for the provider-declared `installation`-scope fields (e.g. a Zendesk `subdomain`), keyed by the config field. Only fields the provider declares may be supplied, and required fields must be provided unless already pinned on the integration. */
    config?: DataIntegrationsControllerGetDataIntegrationAuthorizeUrlRequestBodyCase0ConfigMap;
}
/** Who will own the connected account. `user` (the default) connects the user's own account. `organization` connects the organization's shared account and requires `organization_id`. */
export type DataIntegrationsControllerGetDataIntegrationAuthorizeUrlRequestBodyCase1ConnectionOwner = "user" | "organization";
/** Connect-time config values for the provider-declared `installation`-scope fields (e.g. a Zendesk `subdomain`), keyed by the config field. Only fields the provider declares may be supplied, and required fields must be provided unless already pinned on the integration. */
export type DataIntegrationsControllerGetDataIntegrationAuthorizeUrlRequestBodyCase1ConfigMap = {
    [key: string]: string | undefined;
};
export interface DataIntegrationsControllerGetDataIntegrationAuthorizeUrlRequestBodyCase1 {
    /** A mutable, non-unique label. Omit to preserve an existing label; null clears it. Labels are never account identifiers. */
    account_display_name?: string | null;
    /** The ID of the user to authorize. When `connection_owner` is `organization`, this is the user authorizing on behalf of the organization; they must be an active member of the organization and do not become the owner of the resulting connected account. */
    user_id: string;
    /** An organization ID to scope the authorization to a specific organization. Required when `connection_owner` is `organization`. */
    organization_id?: string;
    /** Who will own the connected account. `user` (the default) connects the user's own account. `organization` connects the organization's shared account and requires `organization_id`. */
    connection_owner?: DataIntegrationsControllerGetDataIntegrationAuthorizeUrlRequestBodyCase1ConnectionOwner | (string & {});
    /** The URL to redirect the user to after authorization. */
    return_to?: string;
    /** Connect-time config values for the provider-declared `installation`-scope fields (e.g. a Zendesk `subdomain`), keyed by the config field. Only fields the provider declares may be supplied, and required fields must be provided unless already pinned on the integration. */
    config?: DataIntegrationsControllerGetDataIntegrationAuthorizeUrlRequestBodyCase1ConfigMap;
    /** Create another connection. The first connection for an owner shape fills the compatibility slot; later connections are standard. Creating an additional connection is not yet available: until it is, `add` succeeds only when the owner has no connection for this integration and otherwise returns 404 `multiple_connections_unavailable`. Omit `connection_intent` to use the compatibility connection, or send `reauthorize` with `connected_account_id` to reauthorize one exact connection. */
    connection_intent: string;
}
/** Who will own the connected account. `user` (the default) connects the user's own account. `organization` connects the organization's shared account and requires `organization_id`. */
export type DataIntegrationsControllerGetDataIntegrationAuthorizeUrlRequestBodyCase2ConnectionOwner = "user" | "organization";
/** Connect-time config values for the provider-declared `installation`-scope fields (e.g. a Zendesk `subdomain`), keyed by the config field. Only fields the provider declares may be supplied, and required fields must be provided unless already pinned on the integration. */
export type DataIntegrationsControllerGetDataIntegrationAuthorizeUrlRequestBodyCase2ConfigMap = {
    [key: string]: string | undefined;
};
export interface DataIntegrationsControllerGetDataIntegrationAuthorizeUrlRequestBodyCase2 {
    /** A mutable, non-unique label. Omit to preserve an existing label; null clears it. Labels are never account identifiers. */
    account_display_name?: string | null;
    /** The ID of the user to authorize. When `connection_owner` is `organization`, this is the user authorizing on behalf of the organization; they must be an active member of the organization and do not become the owner of the resulting connected account. */
    user_id: string;
    /** An organization ID to scope the authorization to a specific organization. Required when `connection_owner` is `organization`. */
    organization_id?: string;
    /** Who will own the connected account. `user` (the default) connects the user's own account. `organization` connects the organization's shared account and requires `organization_id`. */
    connection_owner?: DataIntegrationsControllerGetDataIntegrationAuthorizeUrlRequestBodyCase2ConnectionOwner | (string & {});
    /** The URL to redirect the user to after authorization. */
    return_to?: string;
    /** Connect-time config values for the provider-declared `installation`-scope fields (e.g. a Zendesk `subdomain`), keyed by the config field. Only fields the provider declares may be supplied, and required fields must be provided unless already pinned on the integration. */
    config?: DataIntegrationsControllerGetDataIntegrationAuthorizeUrlRequestBodyCase2ConfigMap;
    /** Reauthorize exactly the connection named by `connected_account_id`. */
    connection_intent: string;
    /** The exact connected account to reauthorize. Required with `connection_intent: reauthorize`. */
    connected_account_id: string;
}
export type DataIntegrationsControllerGetDataIntegrationAuthorizeUrlRequestBody = DataIntegrationsControllerGetDataIntegrationAuthorizeUrlRequestBodyCase0 | DataIntegrationsControllerGetDataIntegrationAuthorizeUrlRequestBodyCase1 | DataIntegrationsControllerGetDataIntegrationAuthorizeUrlRequestBodyCase2;
export interface DataIntegrationsControllerGetDataIntegrationAuthorizeUrlRequest {
    /** The slug identifier of the provider (e.g., `github`, `slack`, `notion`). */
    slug: string;
    body: DataIntegrationsControllerGetDataIntegrationAuthorizeUrlRequestBody;
}
export interface DataIntegrationAuthorizeUrlResponse {
    /** The OAuth authorization URL to redirect the user to. */
    url?: string;
}
/** Which connection to vend from. `user` (the default) vends the user's own connection and requires `user_id`. `organization` vends the organization's shared connection and requires `organization_id`. */
export type DataIntegrationsControllerVendCredentialsRequestConnectionOwner = "user" | "organization";
export interface DataIntegrationsControllerVendCredentialsRequest {
    /** The identifier of the integration. */
    slug: string;
    /** A [User](/reference/authkit/user) identifier. When `connection_owner` is `organization`, this is the user the credentials are vended on behalf of; they must be an active member of the organization. */
    user_id: string;
    /** An [Organization](/reference/organization) identifier. Optional parameter to scope the connection to a specific organization. Required when `connection_owner` is `organization`. */
    organization_id?: string;
    /** A [connected account](/reference/pipes/connected-account) identifier. Use this to select a specific connection when the user has several for this provider. */
    connected_account_id?: string;
    /** Which connection to vend from. `user` (the default) vends the user's own connection and requires `user_id`. `organization` vends the organization's shared connection and requires `organization_id`. */
    connection_owner?: DataIntegrationsControllerVendCredentialsRequestConnectionOwner | (string & {});
    /** Set to `true` to use the plural connection contract. If no `connected_account_id` is supplied and several connections match, the request returns `account_selection_required`. When omitted or `false`, only the compatibility connection is considered. */
    supports_multiple_connections?: boolean;
}
/** The scopes granted to the access token. Present for `oauth` and `client_credentials` credentials; absent for `api_key`. */
export type DataIntegrationVendedCredentialCase0ScopesList = Array<string>;
/** If the integration has requested scopes that aren't present on the access token, they're listed here. Present for `oauth` and `client_credentials` credentials; absent for `api_key`. */
export type DataIntegrationVendedCredentialCase0MissingScopesList = Array<string>;
/** Provider-declared, non-secret config from the installation snapshot, with current defaults for unset fields. Includes both integration- and installation-scope fields; omits undeclared fields and fields marked secret. Use these values to address a per-tenant host, such as Snowflake's `account` or Zendesk's `subdomain`. Empty when no values are disclosable. Changes to integration or organization pins require reconnecting or explicitly rebinding the connection. Defaults are live and can differ from a cached token's audience until refresh or re-mint. */
export type DataIntegrationVendedCredentialCase0ConfigMap = {
    [key: string]: string | undefined;
};
export interface DataIntegrationVendedCredentialCase0 {
    /** Distinguishes the credential object. */
    object: string;
    /** The authentication method for this credential. Additional values may be added in the future; handle unknown values gracefully. */
    auth_method: string;
    /** The vended secret. An OAuth access token when `auth_method` is `oauth`, the API key when `api_key`, or the client-credentials access token when `client_credentials`. */
    value: string;
    /** The ISO-8601 formatted timestamp indicating when the credential expires, or `null` if it does not expire. Present for `oauth` and `client_credentials` credentials; absent for `api_key`. */
    expires_at: string | null;
    /** The scopes granted to the access token. Present for `oauth` and `client_credentials` credentials; absent for `api_key`. */
    scopes: DataIntegrationVendedCredentialCase0ScopesList;
    /** If the integration has requested scopes that aren't present on the access token, they're listed here. Present for `oauth` and `client_credentials` credentials; absent for `api_key`. */
    missing_scopes: DataIntegrationVendedCredentialCase0MissingScopesList;
    /** Provider-declared, non-secret config from the installation snapshot, with current defaults for unset fields. Includes both integration- and installation-scope fields; omits undeclared fields and fields marked secret. Use these values to address a per-tenant host, such as Snowflake's `account` or Zendesk's `subdomain`. Empty when no values are disclosable. Changes to integration or organization pins require reconnecting or explicitly rebinding the connection. Defaults are live and can differ from a cached token's audience until refresh or re-mint. */
    config: DataIntegrationVendedCredentialCase0ConfigMap;
}
/** Provider-declared, non-secret config from the installation snapshot, with current defaults for unset fields. Includes both integration- and installation-scope fields; omits undeclared fields and fields marked secret. Use these values to address a per-tenant host, such as Snowflake's `account` or Zendesk's `subdomain`. Empty when no values are disclosable. Changes to integration or organization pins require reconnecting or explicitly rebinding the connection. Defaults are live and can differ from a cached token's audience until refresh or re-mint. */
export type DataIntegrationVendedCredentialCase1ConfigMap = {
    [key: string]: string | undefined;
};
export interface DataIntegrationVendedCredentialCase1 {
    /** Distinguishes the credential object. */
    object: string;
    /** The authentication method for this credential. Additional values may be added in the future; handle unknown values gracefully. */
    auth_method: string;
    /** The API key secret. */
    value: string;
    /** Provider-declared, non-secret config from the installation snapshot, with current defaults for unset fields. Includes both integration- and installation-scope fields; omits undeclared fields and fields marked secret. Use these values to address a per-tenant host, such as Snowflake's `account` or Zendesk's `subdomain`. Empty when no values are disclosable. Changes to integration or organization pins require reconnecting or explicitly rebinding the connection. Defaults are live and can differ from a cached token's audience until refresh or re-mint. */
    config: DataIntegrationVendedCredentialCase1ConfigMap;
}
/** The scopes granted to the access token. */
export type DataIntegrationVendedCredentialCase2ScopesList = Array<string>;
/** If the integration has requested scopes that aren't present on the access token, they're listed here. The scopes granted to a client-credentials token are governed by the connected organization's client application, so the integration's configured scopes are requests or defaults rather than guarantees. */
export type DataIntegrationVendedCredentialCase2MissingScopesList = Array<string>;
/** Non-sensitive fields captured from the provider token response (e.g. Salesforce `instance_url`), as configured for the provider. Only present for `client_credentials` credentials. */
export type DataIntegrationVendedCredentialCase2MetadataMap = {
    [key: string]: unknown | undefined;
};
/** Provider-declared, non-secret config from the installation snapshot, with current defaults for unset fields. Includes both integration- and installation-scope fields; omits undeclared fields and fields marked secret. Use these values to address a per-tenant host, such as Snowflake's `account` or Zendesk's `subdomain`. Empty when no values are disclosable. Changes to integration or organization pins require reconnecting or explicitly rebinding the connection. Defaults are live and can differ from a cached token's audience until refresh or re-mint. */
export type DataIntegrationVendedCredentialCase2ConfigMap = {
    [key: string]: string | undefined;
};
export interface DataIntegrationVendedCredentialCase2 {
    /** Distinguishes the credential object. */
    object: string;
    /** The authentication method for this credential. Additional values may be added in the future; handle unknown values gracefully. */
    auth_method: string;
    /** The client-credentials access token. */
    value: string;
    /** The ISO-8601 formatted timestamp indicating when the credential expires. */
    expires_at: string | null;
    /** The scopes granted to the access token. */
    scopes: DataIntegrationVendedCredentialCase2ScopesList;
    /** If the integration has requested scopes that aren't present on the access token, they're listed here. The scopes granted to a client-credentials token are governed by the connected organization's client application, so the integration's configured scopes are requests or defaults rather than guarantees. */
    missing_scopes: DataIntegrationVendedCredentialCase2MissingScopesList;
    /** Non-sensitive fields captured from the provider token response (e.g. Salesforce `instance_url`), as configured for the provider. Only present for `client_credentials` credentials. */
    metadata: DataIntegrationVendedCredentialCase2MetadataMap;
    /** Provider-declared, non-secret config from the installation snapshot, with current defaults for unset fields. Includes both integration- and installation-scope fields; omits undeclared fields and fields marked secret. Use these values to address a per-tenant host, such as Snowflake's `account` or Zendesk's `subdomain`. Empty when no values are disclosable. Changes to integration or organization pins require reconnecting or explicitly rebinding the connection. Defaults are live and can differ from a cached token's audience until refresh or re-mint. */
    config: DataIntegrationVendedCredentialCase2ConfigMap;
}
export type DataIntegrationVendedCredential = DataIntegrationVendedCredentialCase0 | DataIntegrationVendedCredentialCase1 | DataIntegrationVendedCredentialCase2;
export interface DataIntegrationCredentialsResponseCase0 {
    /** Indicates credentials are available. */
    active: boolean;
    /** The credential object containing the vended secret. */
    credential: DataIntegrationVendedCredential;
}
/** The reason credentials are unavailable. Additional values may be added in the future; handle unknown values gracefully. - `"not_installed"`: The user does not have the integration installed. - `"needs_reauthorization"`: The user needs to reauthorize the integration. */
export type DataIntegrationCredentialsResponseCase1Error = "not_installed" | "needs_reauthorization";
export interface DataIntegrationCredentialsResponseCase1 {
    /** Indicates credentials are not available. */
    active: boolean;
    /** The reason credentials are unavailable. Additional values may be added in the future; handle unknown values gracefully. - `"not_installed"`: The user does not have the integration installed. - `"needs_reauthorization"`: The user needs to reauthorize the integration. */
    error: DataIntegrationCredentialsResponseCase1Error;
}
export type DataIntegrationCredentialsResponse = DataIntegrationCredentialsResponseCase0 | DataIntegrationCredentialsResponseCase1;
export type DataIntegrationsControllerVendCredentialsResponse = DataIntegrationCredentialsResponse;
export interface DeactivateUserlandUserOrganizationMembershipsControllerRequest {
    /** The unique ID of the organization membership. */
    id: string;
}
/** The status of the organization membership. One of `active`, `inactive`, or `pending`. */
export type DeactivateUserlandUserOrganizationMembershipsControllerResponseStatus = "active" | "inactive" | "pending";
/** An object containing IdP-sourced attributes from the linked [Directory User](/reference/directory-sync/directory-user) or [SSO Profile](/reference/sso/profile). Directory User attributes take precedence when both are linked. */
export type DeactivateUserlandUserOrganizationMembershipsControllerResponseCustomAttributesMap = {
    [key: string]: unknown | undefined;
};
/** The list of roles assigned to the user within the organization. */
export type DeactivateUserlandUserOrganizationMembershipsControllerResponseRolesList = Array<SlimRole>;
export interface DeactivateUserlandUserOrganizationMembershipsControllerResponse {
    /** Distinguishes the organization membership object. */
    object: string;
    /** The unique ID of the organization membership. */
    id: string;
    /** The ID of the user. */
    user_id: string;
    /** The ID of the organization which the user belongs to. */
    organization_id: string;
    /** The status of the organization membership. One of `active`, `inactive`, or `pending`. */
    status: DeactivateUserlandUserOrganizationMembershipsControllerResponseStatus;
    /** Whether this organization membership is managed by a directory sync connection. */
    directory_managed: boolean;
    /** The name of the organization which the user belongs to. */
    organization_name?: string;
    /** An object containing IdP-sourced attributes from the linked [Directory User](/reference/directory-sync/directory-user) or [SSO Profile](/reference/sso/profile). Directory User attributes take precedence when both are linked. */
    custom_attributes?: DeactivateUserlandUserOrganizationMembershipsControllerResponseCustomAttributesMap;
    /** An ISO 8601 timestamp. */
    created_at: string;
    /** An ISO 8601 timestamp. */
    updated_at: string;
    /** The primary role assigned to the user within the organization. */
    role: SlimRole;
    /** The list of roles assigned to the user within the organization. */
    roles: DeactivateUserlandUserOrganizationMembershipsControllerResponseRolesList;
    /** The user that belongs to the organization through this membership. */
    user: UserlandUser;
}
export interface DecryptJumpWireWebKeyControllerRequest {
    /** Base64-encoded encrypted data key to decrypt. */
    keys: string;
}
export interface DecryptResponse {
    /** Base64-encoded decrypted data key. */
    data_key: string;
    /** Unique identifier of the decrypted data key. */
    id: string;
}
export interface DeleteAgentBlueprintsControllerRequest {
    /** The unique ID of the agent blueprint. */
    agent_blueprint_id: string;
}
export interface DeleteAgentBlueprintsControllerResponse {
}
export interface DeleteAgentInstancesControllerRequest {
    /** The unique ID of the agent instance. */
    agent_instance_id: string;
}
export interface DeleteAgentInstancesControllerResponse {
}
export interface DeleteApiKeysControllerRequest {
    /** The unique ID of the API key. */
    id: string;
}
export interface DeleteApiKeysControllerResponse {
}
export interface DeleteApplicationCredentialsControllerRequest {
    /** The unique ID of the client secret. */
    id: string;
}
export interface DeleteApplicationCredentialsControllerResponse {
}
export interface DeleteApplicationsControllerRequest {
    /** The application ID or client ID of the Connect Application. */
    id: string;
}
export interface DeleteApplicationsControllerResponse {
}
export interface DeleteAuthenticationFactorsControllerRequest {
    /** The unique ID of the Factor. */
    id: string;
}
export interface DeleteAuthenticationFactorsControllerResponse {
}
export interface DeleteAuthkitOauthResourcesControllerRequest {
    /** The ID of the MCP resource indicator to delete. */
    id: string;
}
export interface DeleteAuthkitOauthResourcesControllerResponse {
}
export interface DeleteAuthorizationOrganizationRolesControllerRequest {
    /** The ID of the organization. */
    organizationId: string;
    /** The slug of the role. */
    slug: string;
}
export interface DeleteAuthorizationOrganizationRolesControllerResponse {
}
export interface DeleteAuthorizationPermissionsControllerRequest {
    /** A unique key to reference the permission. Must be lowercase and contain only letters, numbers, hyphens, underscores, colons, periods, and asterisks. */
    slug: string;
}
export interface DeleteAuthorizationPermissionsControllerResponse {
}
export interface DeleteAuthorizationResourcesByExternalIdControllerByExternalIdRequest {
    /** The ID of the organization that owns the resource. */
    organization_id: string;
    /** The slug of the resource type. */
    resource_type_slug: string;
    /** An identifier you provide to reference the resource in your system. */
    external_id: string;
    /** If true, deletes all descendant resources and role assignments. If not set and the resource has children or assignments, the request will fail. */
    cascade_delete?: boolean;
}
export interface DeleteAuthorizationResourcesByExternalIdControllerByExternalIdResponse {
}
export interface DeleteAuthorizationResourcesControllerRequest {
    /** The ID of the authorization resource. */
    resource_id: string;
    /** If true, deletes all descendant resources and role assignments. If not set and the resource has children or assignments, the request will fail. */
    cascade_delete?: boolean;
}
export interface DeleteAuthorizationResourcesControllerResponse {
}
export interface DeleteAuthorizedApplicationsControllerRequest {
    /** The ID of the user. */
    user_id: string;
    /** The ID or client ID of the application. */
    application_id: string;
}
export interface DeleteAuthorizedApplicationsControllerResponse {
}
export interface DeleteConnectionsControllerRequest {
    /** Unique identifier for the Connection. */
    id: string;
}
export interface DeleteConnectionsControllerResponse {
}
export interface DeleteDataIntegrationsManagementControllerDataIntegrationRequest {
    /** The slug identifier of the data integration. */
    slug: string;
}
export interface DeleteDataIntegrationsManagementControllerDataIntegrationResponse {
}
export interface DeleteDataIntegrationsManagementControllerOrganizationDataIntegrationRequest {
    /** The slug identifier of the data integration. */
    slug: string;
}
export interface DeleteDataIntegrationsManagementControllerOrganizationDataIntegrationResponse {
}
export interface DeleteDataIntegrationsOrganizationControllerOrganizationDataInstallationRequest {
    /** An [Organization](/reference/organization) identifier. */
    organization_id: string;
    /** The slug identifier of the provider (e.g., `github`, `slack`, `notion`). */
    slug: string;
    /** Set to `true` to use the plural connection contract. When omitted or `false`, only the compatibility connection is considered. */
    supports_multiple_connections?: boolean;
    /** A [connected account](/reference/pipes/connected-account) identifier. Use this to select the connection to delete. */
    connected_account_id?: string;
}
export interface DeleteDataIntegrationsOrganizationControllerOrganizationDataInstallationResponse {
}
export interface DeleteDataIntegrationsUserManagementControllerUserDataInstallationRequest {
    /** A [User](/reference/authkit/user) identifier. */
    user_id: string;
    /** The slug identifier of the provider (e.g., `github`, `slack`, `notion`). */
    slug: string;
    /** An [Organization](/reference/organization) identifier. Optional parameter if the connection is scoped to an organization. */
    organization_id?: string;
    /** Set to `true` to use the plural connection contract. When omitted or `false`, only the compatibility connection is considered. */
    supports_multiple_connections?: boolean;
    /** A [connected account](/reference/pipes/connected-account) identifier. Use this to select the connection to delete. */
    connected_account_id?: string;
}
export interface DeleteDataIntegrationsUserManagementControllerUserDataInstallationResponse {
}
export interface DeleteDirectoriesControllerDirectoryRequest {
    /** Unique identifier for the Directory. */
    id: string;
}
export interface DeleteDirectoriesControllerDirectoryResponse {
}
export interface DeleteFlagTargetsControllerTargetRequest {
    /** The unique slug identifier of the feature flag. */
    slug: string;
    /** The resource ID in format "user_<id>" or "org_<id>". */
    resourceId: string;
}
export interface DeleteFlagTargetsControllerTargetResponse {
}
export interface DeleteGroupsControllerRequest {
    /** The ID of the organization. */
    organizationId: string;
    /** The ID of the group. */
    groupId: string;
}
export interface DeleteGroupsControllerResponse {
}
export interface DeleteItContactsControllerRequest {
    /** The ID of the organization. */
    organization_id: string;
    /** The ID of the IT contact. */
    contact_id: string;
}
export interface DeleteItContactsControllerResponse {
}
export interface DeleteJumpWireWebDataVaultControllerRequest {
    /** Unique identifier of the object. */
    id: string;
    /** Expected current version for optimistic locking. */
    version_check?: string;
}
export interface DeleteObjectResponse {
    /** Name of the deleted object. */
    name: string;
    /** Whether the deletion succeeded. */
    success: boolean;
}
export interface DeleteOrganizationDomainsControllerRequest {
    /** Unique identifier of the organization domain. */
    id: string;
}
export interface DeleteOrganizationDomainsControllerResponse {
}
export interface DeleteOrganizationsControllerOrganizationRequest {
    /** Unique identifier of the Organization. */
    id: string;
}
export interface DeleteOrganizationsControllerOrganizationResponse {
}
export interface DeleteRedirectUrisControllerRequest {
    /** The ID of the redirect URI to delete. */
    id: string;
}
export interface DeleteRedirectUrisControllerResponse {
}
export interface DeleteSamlIdpSigningCertificatesControllerRequest {
    /** Unique identifier for the Connection. */
    connectionId: string;
    /** Unique identifier for the Identity Provider signing certificate. */
    certificateId: string;
}
export interface DeleteSamlIdpSigningCertificatesControllerResponse {
}
export interface DeleteSamlSpEncryptionCertificatesControllerRequest {
    /** Unique identifier for the Connection. */
    connectionId: string;
    /** Unique identifier for the Service Provider encryption key pair. WorkOS holds the corresponding private key, which is never exposed. */
    certificateId: string;
}
export interface DeleteSamlSpEncryptionCertificatesControllerResponse {
}
export interface DeleteSamlSpSigningCertificatesControllerRequest {
    /** Unique identifier for the Connection. */
    connectionId: string;
    /** Unique identifier for the Service Provider signing key pair. WorkOS holds the corresponding private key, which is never exposed. */
    certificateId: string;
}
export interface DeleteSamlSpSigningCertificatesControllerResponse {
}
export interface DeleteUserlandUserOrganizationMembershipsControllerRequest {
    /** The unique ID of the organization membership. */
    id: string;
}
export interface DeleteUserlandUserOrganizationMembershipsControllerResponse {
}
export interface DeleteWaitlistEntriesControllerRequest {
    /** The unique ID of the waitlist entry. */
    id: string;
}
export interface DeleteWaitlistEntriesControllerResponse {
}
export interface DeleteWebhookEndpointsControllerRequest {
    /** Unique identifier of the Webhook Endpoint. */
    id: string;
}
export interface DeleteWebhookEndpointsControllerResponse {
}
export interface DescribeJumpWireWebDataVaultControllerRequest {
    /** Unique identifier of the object. */
    id: string;
}
/** An encrypted object's metadata (value excluded). */
export interface ObjectWithoutValue {
    /** Unique identifier of the object. */
    id: string;
    metadata: ObjectMetadata;
    /** Unique name of the object. */
    name: string;
}
export interface DirectoriesControllerFindRequest {
    /** Unique identifier for the Directory. */
    id: string;
}
/** The type of external Directory Provider integrated with. */
export type DirectoryType = "azure scim v2.0" | "bamboohr" | "breathe hr" | "cezanne hr" | "cyberark scim v2.0" | "fourth hr" | "generic scim v2.0" | "gsuite directory" | "hibob" | "sailpoint scim v2.0" | "jump cloud scim v2.0" | "okta scim v2.0" | "onelogin scim v2.0" | "people hr" | "personio" | "pingfederate scim v2.0" | "rippling scim v2.0" | "s3" | "sftp" | "sftp workday" | "workday";
/** Describes whether the Directory has been successfully connected to an external provider. */
export type DirectoryState = "linked" | "validating" | "invalid_credentials" | "unlinked" | "deleting";
/** Counts of active and inactive directory users. */
export interface DirectoryMetadataUsers {
    /** Count of active directory users. */
    active: number;
    /** Count of inactive directory users. */
    inactive: number;
}
/** Aggregate counts of directory users and groups synced from the provider. */
export interface DirectoryMetadata {
    /** Counts of active and inactive directory users. */
    users: DirectoryMetadataUsers;
    /** Count of directory groups. */
    groups: number;
}
export interface Directory {
    /** Distinguishes the Directory object. */
    object?: string;
    /** Unique identifier for the Directory. */
    id?: string;
    /** The unique identifier for the Organization in which the directory resides. */
    organization_id?: string;
    /** External Key for the Directory. */
    external_key?: string;
    /** The type of external Directory Provider integrated with. */
    type?: DirectoryType;
    /** Describes whether the Directory has been successfully connected to an external provider. */
    state?: DirectoryState;
    /** The name of the directory. */
    name?: string;
    /** The URL associated with an Enterprise Client. */
    domain?: string;
    /** Aggregate counts of directory users and groups synced from the provider. */
    metadata?: DirectoryMetadata;
    /** An ISO 8601 timestamp. */
    created_at?: string;
    /** An ISO 8601 timestamp. */
    updated_at?: string;
}
export interface DirectoryGroupsControllerFindRequest {
    /** Unique identifier for the Directory Group. */
    id: string;
}
/** The raw attributes received from the directory provider. */
export type DirectoryGroupRawAttributesMap = {
    [key: string]: unknown | undefined;
};
export interface DirectoryGroup {
    /** Distinguishes the Directory Group object. */
    object?: string;
    /** Unique identifier for the Directory Group. */
    id?: string;
    /** Unique identifier for the group, assigned by the Directory Provider. Different Directory Providers use different ID formats. */
    idp_id?: string;
    /** The identifier of the Directory the Directory Group belongs to. */
    directory_id?: string;
    /** The identifier for the Organization in which the Directory resides. */
    organization_id?: string;
    /** The name of the Directory Group. */
    name?: string;
    /** The raw attributes received from the directory provider. */
    raw_attributes?: DirectoryGroupRawAttributesMap;
    /** An ISO 8601 timestamp. */
    created_at?: string;
    /** An ISO 8601 timestamp. */
    updated_at?: string;
}
export interface DirectoryUsersControllerFindRequest {
    /** Unique identifier for the Directory User. */
    id: string;
}
export interface DirectoryUserWithGroupsEmailsItem {
    /** Whether this is the primary email address. */
    primary?: boolean;
    /** The type of email address. */
    type?: string;
    /** The email address value. */
    value?: string | null;
}
/** A list of email addresses for the user. */
export type DirectoryUserWithGroupsEmailsList = Array<DirectoryUserWithGroupsEmailsItem>;
/** The state of the user. */
export type DirectoryUserWithGroupsState = "active" | "suspended" | "inactive";
/** The raw attributes received from the directory provider. */
export type DirectoryUserWithGroupsRawAttributesMap = {
    [key: string]: unknown | undefined;
};
/** An object containing the custom attribute mapping for the Directory Provider. */
export type DirectoryUserWithGroupsCustomAttributesMap = {
    [key: string]: unknown | undefined;
};
/** All roles assigned to the user. */
export type DirectoryUserWithGroupsRolesList = Array<SlimRole>;
/** The directory groups the user belongs to. Deprecated: starting May 1, 2026, this field returns an empty array by default for newly created teams. Existing teams currently depending on this field should migrate to the new access pattern for better throughput performance -- the field is unbounded by user, so users with many group memberships produce large, slow response payloads. Use the List Directory Groups endpoint with a `user` filter to fetch a user's group memberships. */
export type DirectoryUserWithGroupsGroupsList = Array<DirectoryGroup>;
export interface DirectoryUserWithGroups {
    /** Distinguishes the Directory User object. */
    object?: string;
    /** Unique identifier for the Directory User. */
    id?: string;
    /** The identifier of the Directory the Directory User belongs to. */
    directory_id?: string;
    /** The identifier for the Organization in which the Directory resides. */
    organization_id?: string;
    /** Unique identifier for the user, assigned by the Directory Provider. Different Directory Providers use different ID formats. */
    idp_id?: string;
    /** The email address of the user. */
    email?: string | null;
    /** The first name of the user. */
    first_name?: string | null;
    /** The last name of the user. */
    last_name?: string | null;
    /** The full name of the user. */
    name?: string | null;
    /** A list of email addresses for the user. */
    emails?: DirectoryUserWithGroupsEmailsList;
    /** The job title of the user. */
    job_title?: string | null;
    /** The username of the user. */
    username?: string | null;
    /** The state of the user. */
    state?: DirectoryUserWithGroupsState;
    /** The raw attributes received from the directory provider. */
    raw_attributes?: DirectoryUserWithGroupsRawAttributesMap;
    /** An object containing the custom attribute mapping for the Directory Provider. */
    custom_attributes?: DirectoryUserWithGroupsCustomAttributesMap;
    role?: SlimRole;
    /** All roles assigned to the user. */
    roles?: DirectoryUserWithGroupsRolesList;
    /** An ISO 8601 timestamp. */
    created_at?: string;
    /** An ISO 8601 timestamp. */
    updated_at?: string;
    /** The directory groups the user belongs to. Deprecated: starting May 1, 2026, this field returns an empty array by default for newly created teams. Existing teams currently depending on this field should migrate to the new access pattern for better throughput performance -- the field is unbounded by user, so users with many group memberships produce large, slow response payloads. Use the List Directory Groups endpoint with a `user` filter to fetch a user's group memberships. */
    groups?: DirectoryUserWithGroupsGroupsList;
}
export interface DisableFeatureFlagsControllerFlagRequest {
    /** A unique key to reference the Feature Flag. */
    slug: string;
}
export interface DisableFeatureFlagsControllerFlagResponseOwner {
    /** The email address of the flag owner. */
    email: string;
    /** The first name of the flag owner. */
    first_name: string | null;
    /** The last name of the flag owner. */
    last_name: string | null;
}
/** Labels assigned to the Feature Flag for categorizing and filtering. */
export type DisableFeatureFlagsControllerFlagResponseTagsList = Array<string>;
export interface DisableFeatureFlagsControllerFlagResponse {
    /** Distinguishes the Feature Flag object. */
    object: string;
    /** Unique identifier of the Feature Flag. */
    id: string;
    /** A unique key to reference the Feature Flag. */
    slug: string;
    /** A descriptive name for the Feature Flag. This field does not need to be unique. */
    name: string;
    /** A description for the Feature Flag. */
    description: string | null;
    /** The owner of the Feature Flag. */
    owner: DisableFeatureFlagsControllerFlagResponseOwner | null;
    /** Labels assigned to the Feature Flag for categorizing and filtering. */
    tags: DisableFeatureFlagsControllerFlagResponseTagsList;
    /** Specifies whether the Feature Flag is active for the current environment. */
    enabled: boolean;
    /** The value returned for users and organizations who don't match any configured targeting rules. */
    default_value: boolean;
    /** An ISO 8601 timestamp. */
    created_at: string;
    /** An ISO 8601 timestamp. */
    updated_at: string;
}
export interface EnableFeatureFlagsControllerFlagRequest {
    /** A unique key to reference the Feature Flag. */
    slug: string;
}
export type EnableFeatureFlagsControllerFlagResponseOwner = DisableFeatureFlagsControllerFlagResponseOwner;
/** Labels assigned to the Feature Flag for categorizing and filtering. */
export type EnableFeatureFlagsControllerFlagResponseTagsList = Array<string>;
export interface EnableFeatureFlagsControllerFlagResponse {
    /** Distinguishes the Feature Flag object. */
    object: string;
    /** Unique identifier of the Feature Flag. */
    id: string;
    /** A unique key to reference the Feature Flag. */
    slug: string;
    /** A descriptive name for the Feature Flag. This field does not need to be unique. */
    name: string;
    /** A description for the Feature Flag. */
    description: string | null;
    /** The owner of the Feature Flag. */
    owner: DisableFeatureFlagsControllerFlagResponseOwner | null;
    /** Labels assigned to the Feature Flag for categorizing and filtering. */
    tags: EnableFeatureFlagsControllerFlagResponseTagsList;
    /** Specifies whether the Feature Flag is active for the current environment. */
    enabled: boolean;
    /** The value returned for users and organizations who don't match any configured targeting rules. */
    default_value: boolean;
    /** An ISO 8601 timestamp. */
    created_at: string;
    /** An ISO 8601 timestamp. */
    updated_at: string;
}
export interface ExportAuditLogExportsControllerRequest {
    /** The unique ID of the Audit Log Export. */
    auditLogExportId: string;
}
export interface FeatureFlagsControllerFindBySlugRequest {
    /** A unique key to reference the Feature Flag. */
    slug: string;
}
export type FlagOwner = DisableFeatureFlagsControllerFlagResponseOwner;
/** Labels assigned to the Feature Flag for categorizing and filtering. */
export type FlagTagsList = Array<string>;
export interface Flag {
    /** Distinguishes the Feature Flag object. */
    object?: string;
    /** Unique identifier of the Feature Flag. */
    id?: string;
    /** A unique key to reference the Feature Flag. */
    slug?: string;
    /** A descriptive name for the Feature Flag. This field does not need to be unique. */
    name?: string;
    /** A description for the Feature Flag. */
    description?: string | null;
    /** The owner of the Feature Flag. */
    owner?: DisableFeatureFlagsControllerFlagResponseOwner | null;
    /** Labels assigned to the Feature Flag for categorizing and filtering. */
    tags?: FlagTagsList;
    /** Specifies whether the Feature Flag is active for the current environment. */
    enabled?: boolean;
    /** The value returned for users and organizations who don't match any configured targeting rules. */
    default_value?: boolean;
    /** An ISO 8601 timestamp. */
    created_at?: string;
    /** An ISO 8601 timestamp. */
    updated_at?: string;
}
export interface GetAgentAdminControllerRegistrationRequest {
    /** The unique ID of the agent registration. */
    id: string;
}
/** The agent identity associated with this registration. */
export interface AgentRegistrationAgentIdentity {
    /** Unique identifier of the agent identity. */
    id: string;
    /** Identifier of the AuthKit user the agent identity is bound to, or `null` when the agent is not associated with a user. */
    userland_user_id: string | null;
    /** The timestamp when the agent identity was created. */
    created_at: string;
    /** The timestamp when the agent identity was last updated. */
    updated_at: string;
}
/** The current verification status of the registration. */
export type AgentRegistrationStatus = "unverified" | "verified" | "expired" | "revoked";
/** The kind of agent registration. */
export type AgentRegistrationKind = "anonymous" | "service_auth" | "identity_assertion";
export interface AgentRegistrationClaimClaimCompletion {
    /** Unique identifier of the claim completion. */
    id: string;
    /** The timestamp when the claim completion was created. */
    created_at: string;
    /** The timestamp when the claim completion was last updated. */
    updated_at: string;
    /** The timestamp when the claim completion expires. */
    expires_at: string;
    /** The timestamp when the claim was completed. */
    claimed_at: string;
}
export interface AgentRegistrationClaim {
    /** Unique identifier of the claim. */
    id: string;
    /** The completion record for the claim, or `null` if the claim has not been completed. */
    claim_completion: AgentRegistrationClaimClaimCompletion | null;
    /** The timestamp when the claim was created. */
    created_at: string;
    /** The timestamp when the claim was last updated. */
    updated_at: string;
    /** The timestamp when the claim expires. */
    expires_at: string;
}
export interface AgentRegistration {
    /** Unique identifier of the agent registration. */
    id: string;
    /** The agent identity associated with this registration. */
    agent_identity: AgentRegistrationAgentIdentity;
    /** Identifier of the organization the agent is registered to. */
    organization_id: string;
    /** The current verification status of the registration. */
    status: AgentRegistrationStatus;
    /** The kind of agent registration. */
    kind: AgentRegistrationKind;
    /** The claim associated with this registration, or `null` if the registration has no claim. */
    claim: AgentRegistrationClaim | null;
    /** The timestamp when the registration was created. */
    created_at: string;
    /** The timestamp when the registration was last updated. */
    updated_at: string;
}
export interface GetAgentBlueprintsControllerRequest {
    /** The unique ID of the agent blueprint. */
    agent_blueprint_id: string;
}
export interface GetAgentInstancesControllerRequest {
    /** The unique ID of the agent instance. */
    agent_instance_id: string;
}
/** Whether the instance acts on behalf of a specific user (`delegated`) or as itself (`autonomous`). */
export type AgentInstanceType = "delegated" | "autonomous";
export interface AgentInstance {
    /** Distinguishes the agent instance object. */
    object: string;
    /** Unique identifier of the agent instance. */
    id: string;
    /** The blueprint this instance was minted from. */
    agent_blueprint_id: string;
    /** The organization the instance acts within. */
    organization_id: string;
    /** The organization membership of the delegating user; `null` for autonomous instances. */
    organization_membership_id: string | null;
    /** Whether the instance acts on behalf of a specific user (`delegated`) or as itself (`autonomous`). */
    type: AgentInstanceType;
    /** Timestamp when the agent instance was created. */
    created_at: string;
    /** Timestamp when the agent instance was last updated. */
    updated_at: string;
}
export interface GetAgentInstanceSessionsControllerRequest {
    /** The unique ID of the agent instance session. */
    agent_instance_session_id: string;
}
/** Derived from `revoked_at` and `expires_at` at read time; a revoked session stays `revoked` even after it expires. */
export type AgentInstanceSessionStatus = "active" | "revoked" | "expired";
export interface AgentInstanceSession {
    /** Distinguishes the agent instance session object. */
    object: string;
    /** Unique identifier of the agent instance session. */
    id: string;
    /** The agent instance the session belongs to. */
    agent_instance_id: string;
    /** Derived from `revoked_at` and `expires_at` at read time; a revoked session stays `revoked` even after it expires. */
    status: AgentInstanceSessionStatus;
    /** Timestamp when the session expires. */
    expires_at: string;
    /** Timestamp when the session was revoked; `null` if it has not been revoked. */
    revoked_at: string | null;
    /** Timestamp when the session was created. */
    created_at: string;
    /** Timestamp when the session was last updated. */
    updated_at: string;
}
export interface GetAuthenticationFactorsControllerRequest {
    /** The unique ID of the Factor. */
    id: string;
}
/** The type of the factor to enroll. */
export type AuthenticationFactorType = "generic_otp" | "sms" | "totp" | "webauthn";
/** SMS-based authentication factor details. */
export type AuthenticationFactorSms = AuthenticationFactorEnrolledSms;
/** TOTP-based authentication factor details. */
export interface AuthenticationFactorTotp {
    /** Your application or company name displayed in the user's authenticator app. Defaults to your WorkOS team name. */
    issuer: string;
    /** The user's account name displayed in their authenticator app. Defaults to the user's email. */
    user: string;
}
export interface AuthenticationFactor {
    /** Distinguishes the authentication factor object. */
    object?: string;
    /** The unique ID of the factor. */
    id?: string;
    /** The type of the factor to enroll. */
    type?: AuthenticationFactorType;
    /** The ID of the [user](/reference/authkit/user). */
    user_id?: string;
    /** SMS-based authentication factor details. */
    sms?: AuthenticationFactorEnrolledSms;
    /** TOTP-based authentication factor details. */
    totp?: AuthenticationFactorTotp;
    /** An ISO 8601 timestamp. */
    created_at?: string;
    /** An ISO 8601 timestamp. */
    updated_at?: string;
}
export interface GetAuthorizationGroupRoleAssignmentsControllerRequest {
    /** The ID of the group. */
    group_id: string;
    /** The ID of the group role assignment. */
    role_assignment_id: string;
}
export interface GetAuthorizationOrganizationRolesControllerRequest {
    /** The ID of the organization. */
    organizationId: string;
    /** The slug of the role. */
    slug: string;
}
/** Whether the role is scoped to the environment or an organization (custom role). */
export type GetAuthorizationOrganizationRolesControllerResponseType = "EnvironmentRole" | "OrganizationRole";
/** The permission slugs assigned to the role. */
export type GetAuthorizationOrganizationRolesControllerResponsePermissionsList = Array<string>;
export interface GetAuthorizationOrganizationRolesControllerResponse {
    /** A unique slug for the role. */
    slug: string;
    /** Distinguishes the role object. */
    object: string;
    /** Unique identifier of the role. */
    id: string;
    /** A descriptive name for the role. */
    name: string;
    /** An optional description of the role. */
    description: string | null;
    /** Whether the role is scoped to the environment or an organization (custom role). */
    type: GetAuthorizationOrganizationRolesControllerResponseType;
    /** The slug of the resource type the role is scoped to. */
    resource_type_slug: string;
    /** The permission slugs assigned to the role. */
    permissions: GetAuthorizationOrganizationRolesControllerResponsePermissionsList;
    /** An ISO 8601 timestamp. */
    created_at: string;
    /** An ISO 8601 timestamp. */
    updated_at: string;
}
export interface GetAuthorizationResourcesByExternalIdControllerByExternalIdRequest {
    /** The ID of the organization that owns the resource. */
    organization_id: string;
    /** The slug of the resource type. */
    resource_type_slug: string;
    /** An identifier you provide to reference the resource in your system. */
    external_id: string;
}
export interface GetAuthorizationRolesControllerRequest {
    /** The slug of the environment role. */
    slug: string;
}
/** Whether the role is scoped to the environment or an organization (custom role). */
export type RoleType = "EnvironmentRole" | "OrganizationRole";
/** The permission slugs assigned to the role. */
export type RolePermissionsList = Array<string>;
export interface Role {
    /** A unique slug for the role. */
    slug?: string;
    /** Distinguishes the role object. */
    object?: string;
    /** Unique identifier of the role. */
    id?: string;
    /** A descriptive name for the role. */
    name?: string;
    /** An optional description of the role. */
    description?: string | null;
    /** Whether the role is scoped to the environment or an organization (custom role). */
    type?: RoleType;
    /** The slug of the resource type the role is scoped to. */
    resource_type_slug?: string;
    /** The permission slugs assigned to the role. */
    permissions?: RolePermissionsList;
    /** An ISO 8601 timestamp. */
    created_at?: string;
    /** An ISO 8601 timestamp. */
    updated_at?: string;
}
/** Which connection to vend from. `user` (the default) vends the user's own connection and requires `user_id`. `organization` vends the organization's shared connection and requires `organization_id`. */
export type GetDataIntegrationsControllerUserlandUserTokenRequestConnectionOwner = "user" | "organization";
export interface GetDataIntegrationsControllerUserlandUserTokenRequest {
    /** The identifier of the integration. */
    slug: string;
    /** A [User](/reference/authkit/user) identifier. When `connection_owner` is `organization`, this is the user the credentials are vended on behalf of; they must be an active member of the organization. */
    user_id: string;
    /** An [Organization](/reference/organization) identifier. Optional parameter to scope the connection to a specific organization. Required when `connection_owner` is `organization`. */
    organization_id?: string;
    /** A [connected account](/reference/pipes/connected-account) identifier. Use this to select a specific connection when the user has several for this provider. */
    connected_account_id?: string;
    /** Which connection to vend from. `user` (the default) vends the user's own connection and requires `user_id`. `organization` vends the organization's shared connection and requires `organization_id`. */
    connection_owner?: GetDataIntegrationsControllerUserlandUserTokenRequestConnectionOwner | (string & {});
    /** Set to `true` to use the plural connection contract. If no `connected_account_id` is supplied and several connections match, the request returns `account_selection_required`. When omitted or `false`, only the compatibility connection is considered. */
    supports_multiple_connections?: boolean;
}
/** The scopes granted to the access token. */
export type DataIntegrationAccessTokenResponseCase0AccessTokenScopesList = Array<string>;
/** If the integration has requested scopes that aren't present on the access token, they're listed here. */
export type DataIntegrationAccessTokenResponseCase0AccessTokenMissingScopesList = Array<string>;
/** The [access token](/reference/pipes/access-token) object, present when `active` is `true`. */
export interface DataIntegrationAccessTokenResponseCase0AccessToken {
    /** Distinguishes the access token object. */
    object: string;
    /** The OAuth access token for the connected integration. */
    access_token: string | Redacted.Redacted<string>;
    /** The ISO-8601 formatted timestamp indicating when the access token expires. */
    expires_at: string | null;
    /** The scopes granted to the access token. */
    scopes: DataIntegrationAccessTokenResponseCase0AccessTokenScopesList;
    /** If the integration has requested scopes that aren't present on the access token, they're listed here. */
    missing_scopes: DataIntegrationAccessTokenResponseCase0AccessTokenMissingScopesList;
}
export interface DataIntegrationAccessTokenResponseCase0 {
    /** Indicates whether the access token is valid and ready for use, or if reauthorization is required. */
    active: boolean;
    /** The [access token](/reference/pipes/access-token) object, present when `active` is `true`. */
    access_token: DataIntegrationAccessTokenResponseCase0AccessToken;
}
/** - `"not_installed"`: The user does not have the integration installed. - `"needs_reauthorization"`: The user needs to reauthorize the integration. */
export type DataIntegrationAccessTokenResponseCase1Error = "needs_reauthorization" | "not_installed";
export interface DataIntegrationAccessTokenResponseCase1 {
    /** Indicates whether the access token is valid and ready for use, or if reauthorization is required. */
    active: boolean;
    /** - `"not_installed"`: The user does not have the integration installed. - `"needs_reauthorization"`: The user needs to reauthorize the integration. */
    error: DataIntegrationAccessTokenResponseCase1Error;
}
export type DataIntegrationAccessTokenResponse = DataIntegrationAccessTokenResponseCase0 | DataIntegrationAccessTokenResponseCase1;
export type GetDataIntegrationsControllerUserlandUserTokenResponse = DataIntegrationAccessTokenResponse;
export interface GetDataIntegrationsManagementControllerDataIntegrationRequest {
    /** The slug identifier of the data integration. */
    slug: string;
}
export interface GetDataIntegrationsManagementControllerOrganizationDataIntegrationRequest {
    /** The slug identifier of the data integration. */
    slug: string;
}
export interface GetDataIntegrationsOrganizationControllerOrganizationDataInstallationRequest {
    /** An [Organization](/reference/organization) identifier. */
    organization_id: string;
    /** The slug identifier of the provider (e.g., `github`, `slack`, `notion`). */
    slug: string;
    /** Set to `true` to use the plural connection contract. When omitted or `false`, only the compatibility connection is considered. */
    supports_multiple_connections?: boolean;
    /** A [connected account](/reference/pipes/connected-account) identifier. Use this to select a specific connection when the organization has several for this provider. */
    connected_account_id?: string;
}
/** Whether this row is the compatibility connection visible to undeclared clients or a standard peer for plural-aware clients. The role does not indicate preference or creation order. */
export type ConnectedAccountConnectionRole = "compatibility" | "standard";
/** The OAuth scopes granted for this connection. */
export type ConnectedAccountScopesList = Array<string>;
/** The authentication method used for this connection (`oauth`, `api_key`, or `client_credentials`). Defaults to `oauth` if absent. */
export type ConnectedAccountAuthMethod = "oauth" | "api_key" | "client_credentials";
/** The connection-level configuration values stored for this connection -- the fields the provider declares at `installation` scope, excluding secret and undeclared fields. Returned for every authentication method; empty when no stored values can be disclosed. */
export type ConnectedAccountConfigMap = {
    [key: string]: string | undefined;
};
/** The state of the connected account: - `connected`: The connection is active and tokens are valid. - `needs_reauthorization`: The user needs to reauthorize the connection, typically because required scopes have changed. - `disconnected`: The connection has been disconnected. */
export type ConnectedAccountState = "connected" | "needs_reauthorization" | "disconnected";
export interface ConnectedAccount {
    /** Distinguishes the connected account object. */
    object?: string;
    /** The unique identifier of the connected account. */
    id?: string;
    /** Whether this row is the compatibility connection visible to undeclared clients or a standard peer for plural-aware clients. The role does not indicate preference or creation order. */
    connection_role?: ConnectedAccountConnectionRole;
    /** A best-effort identifier for the provider account this connection points at. It is correlation metadata, not the connection identifier or a selector. */
    account_identifier?: string | null;
    /** A mutable, non-unique display name for the provider account connection. */
    account_display_name?: string | null;
    /** The [User](/reference/authkit/user) identifier associated with this connection. */
    user_id?: string | null;
    /** The [Organization](/reference/organization) identifier associated with this connection, or `null` if not scoped to an organization. */
    organization_id?: string | null;
    /** The OAuth scopes granted for this connection. */
    scopes?: ConnectedAccountScopesList;
    /** The authentication method used for this connection (`oauth`, `api_key`, or `client_credentials`). Defaults to `oauth` if absent. */
    auth_method?: ConnectedAccountAuthMethod;
    /** The last four characters of the API key, or `null` for OAuth connections. */
    api_key_last_4?: string | null;
    /** The client ID supplied for this connection. Only present when `auth_method` is `client_credentials`. */
    client_id?: string | null;
    /** The last four characters of the client secret supplied for this connection, or `null` when it can't be read. Only present when `auth_method` is `client_credentials`. */
    client_secret_last_4?: string | null;
    /** The connection-level configuration values stored for this connection -- the fields the provider declares at `installation` scope, excluding secret and undeclared fields. Returned for every authentication method; empty when no stored values can be disclosed. */
    config?: ConnectedAccountConfigMap;
    /** The state of the connected account: - `connected`: The connection is active and tokens are valid. - `needs_reauthorization`: The user needs to reauthorize the connection, typically because required scopes have changed. - `disconnected`: The connection has been disconnected. */
    state?: ConnectedAccountState;
    /** The timestamp when the connection was created. */
    created_at?: string;
    /** The timestamp when the connection was last updated. */
    updated_at?: string;
}
export interface GetDataIntegrationsOrganizationControllerOrganizationDataIntegrationsRequest {
    /** An [Organization](/reference/organization) identifier to list providers and connected accounts for. */
    organization_id: string;
    /** Set to `true` to use the plural connection contract. When omitted or `false`, only the compatibility connection is considered. */
    supports_multiple_connections?: boolean;
}
export type DataIntegrationsListResponseDataItemScopesList = Array<string>;
export type DataIntegrationsListResponseDataItemAuthMethodsItem = "oauth" | "api_key" | "client_credentials";
/** The authentication methods supported by this provider (`oauth`, `api_key`, `client_credentials`, or a combination). Defaults to `["oauth"]` if absent. */
export type DataIntegrationsListResponseDataItemAuthMethodsList = Array<DataIntegrationsListResponseDataItemAuthMethodsItem>;
/** Who owns connections made through this provider: `user` for connections owned by individual users, or `organization` for a connection shared by every member of the organization. A provider row can exist before any connected account does. */
export type DataIntegrationsListResponseDataItemConnectionOwner = "user" | "organization";
/** Use `connection_owner` instead. Legacy spelling of the same value: `userland_user` corresponds to `connection_owner: "user"` and `organization` to `connection_owner: "organization"`. */
export type DataIntegrationsListResponseDataItemOwnership = "userland_user" | "organization";
/** Whether this row is the compatibility connection visible to undeclared clients or a standard peer for plural-aware clients. The role does not indicate preference or creation order. */
export type DataIntegrationsListResponseDataItemConnectedAccountConnectionRole = "compatibility" | "standard";
/** The OAuth scopes granted for this connection. */
export type DataIntegrationsListResponseDataItemConnectedAccountScopesList = Array<string>;
/** The authentication method used for this connection (`oauth`, `api_key`, or `client_credentials`). Defaults to `oauth` if absent. */
export type DataIntegrationsListResponseDataItemConnectedAccountAuthMethod = "oauth" | "api_key" | "client_credentials";
/** The connection-level configuration values stored for this connection -- the fields the provider declares at `installation` scope, excluding secret and undeclared fields. Returned for every authentication method; empty when no stored values can be disclosed. */
export type DataIntegrationsListResponseDataItemConnectedAccountConfigMap = {
    [key: string]: string | undefined;
};
/** The state of the connected account: - `connected`: The connection is active and tokens are valid. - `needs_reauthorization`: The user needs to reauthorize the connection, typically because required scopes have changed. - `disconnected`: The connection has been disconnected. */
export type DataIntegrationsListResponseDataItemConnectedAccountState = "connected" | "needs_reauthorization" | "disconnected";
export interface DataIntegrationsListResponseDataItemConnectedAccount {
    /** Distinguishes the connected account object. */
    object: string;
    /** The unique identifier of the connected account. */
    id: string;
    /** Whether this row is the compatibility connection visible to undeclared clients or a standard peer for plural-aware clients. The role does not indicate preference or creation order. */
    connection_role: DataIntegrationsListResponseDataItemConnectedAccountConnectionRole;
    /** A best-effort identifier for the provider account this connection points at. It is correlation metadata, not the connection identifier or a selector. */
    account_identifier: string | null;
    /** A mutable, non-unique display name for the provider account connection. */
    account_display_name: string | null;
    /** The [User](/reference/authkit/user) identifier associated with this connection. */
    user_id: string | null;
    /** The [Organization](/reference/organization) identifier associated with this connection, or `null` if not scoped to an organization. */
    organization_id: string | null;
    /** The OAuth scopes granted for this connection. */
    scopes: DataIntegrationsListResponseDataItemConnectedAccountScopesList;
    /** The authentication method used for this connection (`oauth`, `api_key`, or `client_credentials`). Defaults to `oauth` if absent. */
    auth_method?: DataIntegrationsListResponseDataItemConnectedAccountAuthMethod;
    /** The last four characters of the API key, or `null` for OAuth connections. */
    api_key_last_4?: string | null;
    /** The client ID supplied for this connection. Only present when `auth_method` is `client_credentials`. */
    client_id?: string | null;
    /** The last four characters of the client secret supplied for this connection, or `null` when it can't be read. Only present when `auth_method` is `client_credentials`. */
    client_secret_last_4?: string | null;
    /** The connection-level configuration values stored for this connection -- the fields the provider declares at `installation` scope, excluding secret and undeclared fields. Returned for every authentication method; empty when no stored values can be disclosed. */
    config?: DataIntegrationsListResponseDataItemConnectedAccountConfigMap;
    /** The state of the connected account: - `connected`: The connection is active and tokens are valid. - `needs_reauthorization`: The user needs to reauthorize the connection, typically because required scopes have changed. - `disconnected`: The connection has been disconnected. */
    state: DataIntegrationsListResponseDataItemConnectedAccountState;
    /** The timestamp when the connection was created. */
    created_at: string;
    /** The timestamp when the connection was last updated. */
    updated_at: string;
    /** Use `user_id` instead. */
    userlandUserId: string | null;
    /** Use `organization_id` instead. */
    organizationId: string | null;
    /** Use `created_at` instead. */
    createdAt: string;
    /** Use `updated_at` instead. */
    updatedAt: string;
}
/** Whether this row is the compatibility connection visible to undeclared clients or a standard peer for plural-aware clients. The role does not indicate preference or creation order. */
export type DataIntegrationsListResponseDataItemConnectedAccountsItemConnectionRole = "compatibility" | "standard";
/** The OAuth scopes granted for this connection. */
export type DataIntegrationsListResponseDataItemConnectedAccountsItemScopesList = Array<string>;
/** The authentication method used for this connection (`oauth`, `api_key`, or `client_credentials`). Defaults to `oauth` if absent. */
export type DataIntegrationsListResponseDataItemConnectedAccountsItemAuthMethod = "oauth" | "api_key" | "client_credentials";
/** The connection-level configuration values stored for this connection -- the fields the provider declares at `installation` scope, excluding secret and undeclared fields. Returned for every authentication method; empty when no stored values can be disclosed. */
export type DataIntegrationsListResponseDataItemConnectedAccountsItemConfigMap = {
    [key: string]: string | undefined;
};
/** The state of the connected account: - `connected`: The connection is active and tokens are valid. - `needs_reauthorization`: The user needs to reauthorize the connection, typically because required scopes have changed. - `disconnected`: The connection has been disconnected. */
export type DataIntegrationsListResponseDataItemConnectedAccountsItemState = "connected" | "needs_reauthorization" | "disconnected";
export interface DataIntegrationsListResponseDataItemConnectedAccountsItem {
    /** Distinguishes the connected account object. */
    object: string;
    /** The unique identifier of the connected account. */
    id: string;
    /** Whether this row is the compatibility connection visible to undeclared clients or a standard peer for plural-aware clients. The role does not indicate preference or creation order. */
    connection_role: DataIntegrationsListResponseDataItemConnectedAccountsItemConnectionRole;
    /** A best-effort identifier for the provider account this connection points at. It is correlation metadata, not the connection identifier or a selector. */
    account_identifier: string | null;
    /** A mutable, non-unique display name for the provider account connection. */
    account_display_name: string | null;
    /** The [User](/reference/authkit/user) identifier associated with this connection. */
    user_id: string | null;
    /** The [Organization](/reference/organization) identifier associated with this connection, or `null` if not scoped to an organization. */
    organization_id: string | null;
    /** The OAuth scopes granted for this connection. */
    scopes: DataIntegrationsListResponseDataItemConnectedAccountsItemScopesList;
    /** The authentication method used for this connection (`oauth`, `api_key`, or `client_credentials`). Defaults to `oauth` if absent. */
    auth_method?: DataIntegrationsListResponseDataItemConnectedAccountsItemAuthMethod;
    /** The last four characters of the API key, or `null` for OAuth connections. */
    api_key_last_4?: string | null;
    /** The client ID supplied for this connection. Only present when `auth_method` is `client_credentials`. */
    client_id?: string | null;
    /** The last four characters of the client secret supplied for this connection, or `null` when it can't be read. Only present when `auth_method` is `client_credentials`. */
    client_secret_last_4?: string | null;
    /** The connection-level configuration values stored for this connection -- the fields the provider declares at `installation` scope, excluding secret and undeclared fields. Returned for every authentication method; empty when no stored values can be disclosed. */
    config?: DataIntegrationsListResponseDataItemConnectedAccountsItemConfigMap;
    /** The state of the connected account: - `connected`: The connection is active and tokens are valid. - `needs_reauthorization`: The user needs to reauthorize the connection, typically because required scopes have changed. - `disconnected`: The connection has been disconnected. */
    state: DataIntegrationsListResponseDataItemConnectedAccountsItemState;
    /** The timestamp when the connection was created. */
    created_at: string;
    /** The timestamp when the connection was last updated. */
    updated_at: string;
    /** Use `user_id` instead. */
    userlandUserId: string | null;
    /** Use `organization_id` instead. */
    organizationId: string | null;
    /** Use `created_at` instead. */
    createdAt: string;
    /** Use `updated_at` instead. */
    updatedAt: string;
}
/** The user's connected accounts for this provider in the requested ownership context. This contains only the compatibility connection unless `supports_multiple_connections` is `true`. */
export type DataIntegrationsListResponseDataItemConnectedAccountsList = Array<DataIntegrationsListResponseDataItemConnectedAccountsItem>;
export interface DataIntegrationsListResponseDataItem {
    /** Distinguishes the data provider object. */
    object: string;
    /** The unique identifier of the provider. */
    id: string;
    /** The display name of the provider (e.g., "GitHub", "Slack"). */
    name: string;
    /** A description of the provider explaining how it will be used, if configured. */
    description: string | null;
    /** The slug identifier used in API calls (e.g., `github`, `slack`, `notion`). */
    slug: string;
    /** The type of integration (e.g., `github`, `slack`). */
    integration_type: string;
    /** The type of credentials used by the provider (e.g., `oauth2`). */
    credentials_type: string;
    /** The OAuth scopes configured for this provider, or `null` if none are configured. */
    scopes: DataIntegrationsListResponseDataItemScopesList | null;
    /** The authentication methods supported by this provider (`oauth`, `api_key`, `client_credentials`, or a combination). Defaults to `["oauth"]` if absent. */
    auth_methods?: DataIntegrationsListResponseDataItemAuthMethodsList;
    /** Who owns connections made through this provider: `user` for connections owned by individual users, or `organization` for a connection shared by every member of the organization. A provider row can exist before any connected account does. */
    connection_owner: DataIntegrationsListResponseDataItemConnectionOwner;
    /** Use `connection_owner` instead. Legacy spelling of the same value: `userland_user` corresponds to `connection_owner: "user"` and `organization` to `connection_owner: "organization"`. */
    ownership: DataIntegrationsListResponseDataItemOwnership;
    /** The timestamp when the provider was created. */
    created_at: string;
    /** The timestamp when the provider was last updated. */
    updated_at: string;
    /** Use integration_type instead. */
    integrationType: string;
    /** Use credentials_type instead. */
    credentialsType: string;
    /** Use created_at instead. */
    createdAt: string;
    /** Use updated_at instead. */
    updatedAt: string;
    /** The user's compatibility [connected account](/reference/pipes/connected-account) for this provider, or `null` when the compatibility slot is empty. This legacy field never selects a standard connection. */
    connected_account: DataIntegrationsListResponseDataItemConnectedAccount | null;
    /** The user's connected accounts for this provider in the requested ownership context. This contains only the compatibility connection unless `supports_multiple_connections` is `true`. */
    connected_accounts: DataIntegrationsListResponseDataItemConnectedAccountsList;
}
/** A list of [providers](/reference/pipes/provider), each including the legacy `connected_account` field and the additive `connected_accounts` collection. */
export type DataIntegrationsListResponseDataList = Array<DataIntegrationsListResponseDataItem>;
export interface DataIntegrationsListResponse {
    /** Indicates this is a list response. */
    object?: string;
    /** A list of [providers](/reference/pipes/provider), each including the legacy `connected_account` field and the additive `connected_accounts` collection. */
    data?: DataIntegrationsListResponseDataList;
}
export interface GetDataIntegrationsUserManagementControllerUserDataInstallationRequest {
    /** A [User](/reference/authkit/user) identifier. */
    user_id: string;
    /** The slug identifier of the provider (e.g., `github`, `slack`, `notion`). */
    slug: string;
    /** An [Organization](/reference/organization) identifier. Optional parameter if the connection is scoped to an organization. */
    organization_id?: string;
    /** Set to `true` to use the plural connection contract. When omitted or `false`, only the compatibility connection is considered. */
    supports_multiple_connections?: boolean;
    /** A [connected account](/reference/pipes/connected-account) identifier. Use this to select a specific connection when the user has several for this provider. */
    connected_account_id?: string;
}
export interface GetDataIntegrationsUserManagementControllerUserDataIntegrationsRequest {
    /** A [User](/reference/authkit/user) identifier to list providers and connected accounts for. */
    user_id: string;
    /** An [Organization](/reference/organization) identifier. Optional parameter to filter connections for a specific organization. */
    organization_id?: string;
    /** Set to `true` to use the plural connection contract. When omitted or `false`, only the compatibility connection is considered. */
    supports_multiple_connections?: boolean;
}
export interface GetGroupsControllerRequest {
    /** The ID of the organization. */
    organizationId: string;
    /** The ID of the group. */
    groupId: string;
}
export interface GetJwtTemplatesControllerJwtTemplateRequest {
}
export interface JwtTemplate {
    /** The object type. */
    object: string;
    /** The JWT template content as a Liquid template string. */
    content: string;
    /** The timestamp when the JWT template was created. */
    created_at: string;
    /** The timestamp when the JWT template was last updated. */
    updated_at: string;
}
export interface GetOrganizationDomainsControllerRequest {
    /** Unique identifier of the organization domain. */
    id: string;
}
/** Verification state of the domain. */
export type OrganizationDomainStandAloneState = "failed" | "legacy_verified" | "pending" | "unverified" | "verified";
/** Strategy used to verify the domain. */
export type OrganizationDomainStandAloneVerificationStrategy = "dns" | "manual";
export interface OrganizationDomainStandAlone {
    /** Distinguishes the organization domain object. */
    object?: string;
    /** Unique identifier of the organization domain. */
    id?: string;
    /** ID of the parent Organization. */
    organization_id?: string;
    /** Domain for the organization domain. */
    domain?: string;
    /** Verification state of the domain. */
    state?: OrganizationDomainStandAloneState;
    /** The prefix used in DNS verification. */
    verification_prefix?: string;
    /** Validation token to be used in DNS TXT record. */
    verification_token?: string;
    /** Strategy used to verify the domain. */
    verification_strategy?: OrganizationDomainStandAloneVerificationStrategy;
    /** An ISO 8601 timestamp. */
    created_at?: string;
    /** An ISO 8601 timestamp. */
    updated_at?: string;
}
export interface GetOrganizationsControllerAuditLogConfigurationRequest {
    /** Unique identifier of the Organization. */
    id: string;
}
/** The current state of the audit log configuration for the organization. */
export type AuditLogConfigurationState = "active" | "inactive" | "disabled";
/** The type of the Audit Log Stream destination. */
export type AuditLogConfigurationLogStreamType = "AzureSentinel" | "Datadog" | "GenericHttps" | "GoogleCloudStorage" | "S3" | "Snowflake" | "Splunk";
/** The current state of the Audit Log Stream. */
export type AuditLogConfigurationLogStreamState = "active" | "inactive" | "error" | "invalid";
/** The Audit Log Stream currently configured for the organization, if any. */
export interface AuditLogConfigurationLogStream {
    /** Unique identifier of the Audit Log Stream. */
    id: string;
    /** The type of the Audit Log Stream destination. */
    type: AuditLogConfigurationLogStreamType;
    /** The current state of the Audit Log Stream. */
    state: AuditLogConfigurationLogStreamState;
    /** ISO-8601 timestamp of when the last event was successfully synced, or null if no events have been synced. */
    last_synced_at: string | null;
    /** An ISO 8601 timestamp. */
    created_at: string;
}
export interface AuditLogConfiguration {
    /** Unique identifier of the Organization. */
    organization_id?: string;
    /** The number of days Audit Log events will be retained before being permanently deleted. */
    retention_period_in_days?: number;
    /** The current state of the audit log configuration for the organization. */
    state?: AuditLogConfigurationState;
    /** The Audit Log Stream currently configured for the organization, if any. */
    log_stream?: AuditLogConfigurationLogStream;
}
export interface GetOrganizationsControllerByExternalIdRequest {
    /** The external ID of the Organization. */
    external_id: string;
}
export interface GetPublicRadarChallengesControllerRequest {
    /** The unique ID of the Radar Challenge. */
    id: string;
}
export interface RadarChallenge {
    /** Distinguishes the Radar Challenge object. */
    object: string;
    /** The unique ID of the Radar Challenge. */
    id: string;
    /** The type of the Radar challenge. */
    type: string;
    /** The unique ID of the user. */
    user_id: string;
    /** The email address of the user. */
    email: string;
    /** The timestamp when the Radar Challenge code expires. */
    expires_at: string;
    /** An ISO 8601 timestamp. */
    created_at: string;
    /** An ISO 8601 timestamp. */
    updated_at: string;
    /** The code used to verify the Radar Challenge. */
    code: string;
}
export interface GetSamlSpSigningCertificatesControllerRequest {
    /** Unique identifier for the Connection. */
    connectionId: string;
}
export interface GetSsoControllerProfileRequest {
}
/** The type of SSO connection. */
export type ProfileConnectionType = "Pending" | "ADFSSAML" | "AdpOidc" | "AppleOAuth" | "Auth0Migration" | "Auth0SAML" | "AzureSAML" | "BitbucketOAuth" | "CasSAML" | "ClassLinkSAML" | "CleverOIDC" | "CloudflareSAML" | "CyberArkSAML" | "DuoSAML" | "EntraIdOIDC" | "GenericOIDC" | "GenericSAML" | "GitHubOAuth" | "GitLabOAuth" | "GoogleOAuth" | "GoogleOIDC" | "GoogleSAML" | "IntuitOAuth" | "JumpCloudSAML" | "KeycloakSAML" | "LastPassSAML" | "LinkedInOAuth" | "LoginGovOidc" | "MagicLink" | "MicrosoftOAuth" | "MiniOrangeSAML" | "NetIqSAML" | "OktaOIDC" | "OktaSAML" | "OneLoginSAML" | "OracleSAML" | "PingFederateSAML" | "PingOneSAML" | "RipplingSAML" | "SalesforceSAML" | "ShibbolethGenericSAML" | "ShibbolethSAML" | "SimpleSamlPhpSAML" | "SalesforceOAuth" | "SlackOAuth" | "TestIdp" | "VercelMarketplaceOAuth" | "VercelOAuth" | "VMwareSAML" | "XeroOAuth";
export type ProfileRolesList = Array<SlimRole>;
/** The groups the user belongs to, as returned by the identity provider. */
export type ProfileGroupsList = Array<string>;
/** Custom attribute mappings defined for the connection, returned as key-value pairs. */
export type ProfileCustomAttributesMap = {
    [key: string]: unknown | undefined;
};
/** The complete set of raw attributes returned by the identity provider. */
export type ProfileRawAttributesMap = {
    [key: string]: unknown | undefined;
};
export interface Profile {
    /** Distinguishes the profile object. */
    object?: string;
    /** Unique identifier of the profile. */
    id?: string;
    /** The ID of the organization the user belongs to. */
    organization_id?: string | null;
    /** The ID of the SSO connection used for authentication. */
    connection_id?: string;
    /** The type of SSO connection. */
    connection_type?: ProfileConnectionType;
    /** The user's unique identifier from the identity provider. */
    idp_id?: string;
    /** The user's email address. */
    email?: string;
    /** The user's first name. */
    first_name?: string | null;
    /** The user's last name. */
    last_name?: string | null;
    /** The user's full name. */
    name?: string | null;
    /** The role assigned to the user within the organization, if applicable. */
    role?: SlimRole | null;
    /** The roles assigned to the user within the organization, if applicable. */
    roles?: ProfileRolesList | null;
    /** The groups the user belongs to, as returned by the identity provider. */
    groups?: ProfileGroupsList;
    /** Custom attribute mappings defined for the connection, returned as key-value pairs. */
    custom_attributes?: ProfileCustomAttributesMap;
    /** The complete set of raw attributes returned by the identity provider. */
    raw_attributes?: ProfileRawAttributesMap;
}
export interface GetTeamsControllerTeamRequest {
    /** The ID of the team. */
    team_id: string;
}
export interface GetUserlandMagicAuthControllerRequest {
    /** The unique ID of the Magic Auth code. */
    id: string;
}
export interface MagicAuth {
    /** Distinguishes the Magic Auth object. */
    object?: string;
    /** The unique ID of the Magic Auth code. */
    id?: string;
    /** The unique ID of the user. */
    user_id?: string;
    /** The email address of the user. */
    email?: string;
    /** The timestamp when the Magic Auth code expires. */
    expires_at?: string;
    /** An ISO 8601 timestamp. */
    created_at?: string;
    /** An ISO 8601 timestamp. */
    updated_at?: string;
    /** The code used to verify the Magic Auth code. */
    code?: string;
}
export interface GetUserlandUserIdentitiesControllerRequest {
    /** The unique ID of the user. */
    id: string;
}
/** The type of OAuth provider for the identity. */
export type GetUserlandUserIdentitiesControllerResponseBodyItemProvider = "AppleOAuth" | "BitbucketOAuth" | "GithubOAuth" | "GitLabOAuth" | "GoogleOAuth" | "IntuitOAuth" | "LinkedInOAuth" | "MicrosoftOAuth" | "SalesforceOAuth" | "SlackOAuth" | "VercelMarketplaceOAuth" | "VercelOAuth" | "XeroOAuth";
export interface GetUserlandUserIdentitiesControllerResponseBodyItem {
    /** The unique ID of the user in the external identity provider. */
    idp_id: string;
    /** The type of the identity. */
    type: string;
    /** The type of OAuth provider for the identity. */
    provider: GetUserlandUserIdentitiesControllerResponseBodyItemProvider;
}
export type GetUserlandUserIdentitiesControllerResponseBodyList = Array<GetUserlandUserIdentitiesControllerResponseBodyItem>;
export type GetUserlandUserIdentitiesControllerResponse = GetUserlandUserIdentitiesControllerResponseBodyList;
export interface GetUserlandUserInvitesControllerRequest {
    /** The unique ID of the invitation. */
    id: string;
}
export interface GetUserlandUserInvitesControllerByTokenRequest {
    /** The token used to accept the invitation. */
    token: string;
}
export interface GetUserlandUserOrganizationMembershipsControllerRequest {
    /** The unique ID of the organization membership. */
    id: string;
}
/** The status of the organization membership. One of `active`, `inactive`, or `pending`. */
export type UserlandUserOrganizationMembershipStatus = "active" | "inactive" | "pending";
/** An object containing IdP-sourced attributes from the linked [Directory User](/reference/directory-sync/directory-user) or [SSO Profile](/reference/sso/profile). Directory User attributes take precedence when both are linked. */
export type UserlandUserOrganizationMembershipCustomAttributesMap = {
    [key: string]: unknown | undefined;
};
/** The list of roles assigned to the user within the organization. */
export type UserlandUserOrganizationMembershipRolesList = Array<SlimRole>;
export interface UserlandUserOrganizationMembership {
    /** Distinguishes the organization membership object. */
    object?: string;
    /** The unique ID of the organization membership. */
    id?: string;
    /** The ID of the user. */
    user_id?: string;
    /** The ID of the organization which the user belongs to. */
    organization_id?: string;
    /** The status of the organization membership. One of `active`, `inactive`, or `pending`. */
    status?: UserlandUserOrganizationMembershipStatus;
    /** Whether this organization membership is managed by a directory sync connection. */
    directory_managed?: boolean;
    /** The name of the organization which the user belongs to. */
    organization_name?: string;
    /** An object containing IdP-sourced attributes from the linked [Directory User](/reference/directory-sync/directory-user) or [SSO Profile](/reference/sso/profile). Directory User attributes take precedence when both are linked. */
    custom_attributes?: UserlandUserOrganizationMembershipCustomAttributesMap;
    /** An ISO 8601 timestamp. */
    created_at?: string;
    /** An ISO 8601 timestamp. */
    updated_at?: string;
    /** The primary role assigned to the user within the organization. */
    role?: SlimRole;
    /** The list of roles assigned to the user within the organization. */
    roles?: UserlandUserOrganizationMembershipRolesList;
    /** The user that belongs to the organization through this membership. */
    user?: UserlandUser;
}
export interface GetUserlandUsersControllerByExternalIdRequest {
    /** The external ID of the user. */
    external_id: string;
}
export interface GetUserlandUsersControllerEmailVerificationRequest {
    /** The ID of the email verification code. */
    id: string;
}
export interface EmailVerification {
    /** Distinguishes the email verification object. */
    object?: string;
    /** The unique ID of the email verification code. */
    id?: string;
    /** The unique ID of the user. */
    user_id?: string;
    /** The email address of the user. */
    email?: string;
    /** The timestamp when the email verification code expires. */
    expires_at?: string;
    /** An ISO 8601 timestamp. */
    created_at?: string;
    /** An ISO 8601 timestamp. */
    updated_at?: string;
    /** The code used to verify the email. */
    code?: string;
}
export type InviteItContactsControllerRequestIntentsItem = "sso" | "directory_sync" | "log_streams" | "domain_verification" | "bring_your_own_key";
/** The Admin Portal features that the IT contact can configure. */
export type InviteItContactsControllerRequestIntentsList = Array<InviteItContactsControllerRequestIntentsItem | (string & {})>;
export interface InviteItContactsControllerRequest {
    /** The ID of the organization. */
    organization_id: string;
    /** The ID of the IT contact. */
    contact_id: string;
    /** The Admin Portal features that the IT contact can configure. */
    intents: InviteItContactsControllerRequestIntentsList;
}
export interface InviteItContactsControllerResponse {
}
export type JumpWireWebDataVaultControllerIndexRequestOrder = "asc" | "desc";
export interface JumpWireWebDataVaultControllerIndexRequest {
    /** Upper limit on the number of objects to return. */
    limit?: number;
    /** Cursor for the previous page of results. */
    before?: string;
    /** Cursor for the next page of results. */
    after?: string;
    /** Sort direction for results. */
    order?: JumpWireWebDataVaultControllerIndexRequestOrder | (string & {});
    /** Filter results by name or structured search JSON. */
    search?: string;
    /** ISO 8601 timestamp to filter by last modified time. */
    updatedAfter?: string;
}
/** Summary of an encrypted object returned in list responses. */
export interface ObjectSummary {
    /** Unique identifier of the object. */
    id: string;
    /** Unique name of the object. */
    name: string;
    /** Timestamp of the last update. */
    updated_at?: string | null;
}
/** List of object summaries. */
export type ObjectListResponseDataList = Array<ObjectSummary>;
/** Cursor-based pagination metadata. */
export interface ListMetadata {
    /** Cursor for the next page of results. */
    after?: string | null;
    /** Cursor for the previous page of results. */
    before?: string | null;
}
export interface ObjectListResponse {
    /** List of object summaries. */
    data: ObjectListResponseDataList;
    list_metadata: ListMetadata;
}
export interface JumpWireWebDataVaultControllerShowByIdRequest {
    /** Unique identifier of the object. */
    id: string;
}
/** An encrypted object with its decrypted value and metadata. */
export interface Object {
    /** Unique identifier of the object. */
    id: string;
    metadata: ObjectMetadata;
    /** Unique name of the object. */
    name: string;
    /** Decrypted plaintext value. */
    value: string;
}
export interface JumpWireWebDataVaultControllerShowByNameRequest {
    /** Unique name of the object. */
    name: string;
}
export interface JumpWireWebDataVaultControllerVersionsRequest {
    /** Unique identifier of the object. */
    id: string;
}
/** A static snapshot of an encrypted object. */
export interface ObjectVersion {
    /** Timestamp when the version was created. */
    created_at: string;
    /** Whether this is the active version. */
    current_version: boolean;
    /** Hash of the object value. */
    etag: string;
    /** Unique identifier of the version. */
    id: string;
    /** Number of bytes of stored data. */
    size: number;
}
/** List of object versions. */
export type VersionListResponseDataList = Array<ObjectVersion>;
export interface VersionListResponse {
    /** List of object versions. */
    data: VersionListResponseDataList;
    list_metadata: ListMetadata;
}
/** Map of values used to determine the encryption key. */
export type JumpWireWebKeyControllerCreateDataKeyRequestContextMap = {
    [key: string]: string | undefined;
};
export interface JumpWireWebKeyControllerCreateDataKeyRequest {
    /** Map of values used to determine the encryption key. */
    context: JumpWireWebKeyControllerCreateDataKeyRequestContextMap;
}
/** Map of values used to determine the encryption key. */
export type CreateDataKeyResponseContextMap = {
    [key: string]: string | undefined;
};
export interface CreateDataKeyResponse {
    /** Map of values used to determine the encryption key. */
    context: CreateDataKeyResponseContextMap;
    /** Base64-encoded data encryption key. */
    data_key: string;
    /** Base64-encoded encrypted data key blob. */
    encrypted_keys: string;
    /** Unique identifier for the generated data key. */
    id: string;
}
/** Map of values used to determine the new encryption key. */
export type JumpWireWebKeyControllerRekeyRequestContextMap = {
    [key: string]: string | undefined;
};
export interface JumpWireWebKeyControllerRekeyRequest {
    /** Map of values used to determine the new encryption key. */
    context: JumpWireWebKeyControllerRekeyRequestContextMap;
    /** Base64-encoded encrypted data key blob to re-encrypt. */
    encrypted_keys: string;
}
export interface ListAgentBlueprintsControllerRequest {
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`. */
    before?: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`. */
    after?: string;
    /** Upper limit on the number of objects to return, between `1` and `100`. */
    limit?: number;
    /** Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. */
    order?: PaginationOrder | (string & {});
}
/** Pagination cursors for navigating between pages of results. */
export type ListAgentBlueprintsControllerResponseListMetadata = AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
/** The list of records for the current page. */
export type ListAgentBlueprintsControllerResponseDataList = Array<AgentBlueprint>;
export interface ListAgentBlueprintsControllerResponse {
    /** Indicates this is a list response. */
    object?: string;
    /** Pagination cursors for navigating between pages of results. */
    list_metadata?: AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
    /** The list of records for the current page. */
    data?: ListAgentBlueprintsControllerResponseDataList;
}
export interface ListAgentInstancesControllerRequest {
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`. */
    before?: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`. */
    after?: string;
    /** Upper limit on the number of objects to return, between `1` and `100`. */
    limit?: number;
    /** Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. */
    order?: PaginationOrder | (string & {});
    /** Only return instances acting within this organization. */
    organization_id?: string;
    /** Only return instances minted from this blueprint. */
    agent_blueprint_id?: string;
}
/** Pagination cursors for navigating between pages of results. */
export type ListAgentInstancesControllerResponseListMetadata = AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
/** The list of records for the current page. */
export type ListAgentInstancesControllerResponseDataList = Array<AgentInstance>;
export interface ListAgentInstancesControllerResponse {
    /** Indicates this is a list response. */
    object?: string;
    /** Pagination cursors for navigating between pages of results. */
    list_metadata?: AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
    /** The list of records for the current page. */
    data?: ListAgentInstancesControllerResponseDataList;
}
export interface ListAgentInstanceSessionsControllerRequest {
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`. */
    before?: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`. */
    after?: string;
    /** Upper limit on the number of objects to return, between `1` and `100`. */
    limit?: number;
    /** Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. */
    order?: PaginationOrder | (string & {});
    /** Only return sessions of instances acting within this organization. */
    organization_id?: string;
    /** Only return sessions of instances minted from this blueprint. */
    agent_blueprint_id?: string;
    /** Only return sessions belonging to this agent instance. */
    agent_instance_id?: string;
}
/** Pagination cursors for navigating between pages of results. */
export type ListAgentInstanceSessionsControllerResponseListMetadata = AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
/** The list of records for the current page. */
export type ListAgentInstanceSessionsControllerResponseDataList = Array<AgentInstanceSession>;
export interface ListAgentInstanceSessionsControllerResponse {
    /** Indicates this is a list response. */
    object?: string;
    /** Pagination cursors for navigating between pages of results. */
    list_metadata?: AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
    /** The list of records for the current page. */
    data?: ListAgentInstanceSessionsControllerResponseDataList;
}
export interface ListApplicationCredentialsControllerRequest {
    /** The application ID or client ID of the Connect Application. */
    id: string;
}
export interface ListApplicationCredentialsControllerResponseBodyItem {
    /** Distinguishes the connect application secret object. */
    object: string;
    /** The unique ID of the client secret. */
    id: string;
    /** A hint showing the last few characters of the secret value. */
    secret_hint: string;
    /** The timestamp when the client secret was last used, or null if never used. */
    last_used_at: string | null;
    /** An ISO 8601 timestamp. */
    created_at: string;
    /** An ISO 8601 timestamp. */
    updated_at: string;
}
export type ListApplicationCredentialsControllerResponseBodyList = Array<ListApplicationCredentialsControllerResponseBodyItem>;
export type ListApplicationCredentialsControllerResponse = ListApplicationCredentialsControllerResponseBodyList;
export type ListApplicationsControllerRequestRegistrationTypesItem = "dynamic" | "authenticated";
export type ListApplicationsControllerRequestRegistrationTypesList = Array<ListApplicationsControllerRequestRegistrationTypesItem | (string & {})>;
export interface ListApplicationsControllerRequest {
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`. */
    before?: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`. */
    after?: string;
    /** Upper limit on the number of objects to return, between `1` and `100`. */
    limit?: number;
    /** Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. */
    order?: PaginationOrder | (string & {});
    /** Filter Connect Applications by registration type. Specify multiple as a comma-separated list (e.g. `registration_types=dynamic,authenticated`). Defaults to `authenticated` only when not specified. */
    registration_types?: ListApplicationsControllerRequestRegistrationTypesList;
    /** Filter Connect Applications by organization ID. */
    organization_id?: string;
}
/** The scopes available for this application. */
export type ConnectApplicationScopesList = Array<string>;
export type ConnectApplicationRedirectUrisItem = ApplicationsControllerFindResponseRedirectUrisItem;
/** The redirect URIs configured for this application. */
export type ConnectApplicationRedirectUrisList = Array<ApplicationsControllerFindResponseRedirectUrisItem>;
export interface ConnectApplication {
    /** Distinguishes the connect application object. */
    object: string;
    /** The unique ID of the connect application. */
    id: string;
    /** The client ID of the connect application. */
    client_id: string;
    /** A description of the connect application. */
    description: string | null;
    /** The name of the connect application. */
    name: string;
    /** The scopes available for this application. */
    scopes: ConnectApplicationScopesList;
    /** An ISO 8601 timestamp. */
    created_at: string;
    /** An ISO 8601 timestamp. */
    updated_at: string;
    /** The type of the application. */
    application_type?: string;
    /** The redirect URIs configured for this application. */
    redirect_uris?: ConnectApplicationRedirectUrisList;
    /** Whether the application uses PKCE for authorization. */
    uses_pkce?: boolean;
    /** Whether the application is a first-party application. */
    is_first_party?: boolean;
    /** Whether the application was dynamically registered. */
    was_dynamically_registered?: boolean;
    /** The ID of the organization the application belongs to. */
    organization_id?: string;
}
/** The list of records for the current page. */
export type ConnectApplicationListDataList = Array<ConnectApplication>;
/** Pagination cursors for navigating between pages of results. */
export type ConnectApplicationListListMetadata = AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
export interface ConnectApplicationList {
    /** Indicates this is a list response. */
    object?: string;
    /** The list of records for the current page. */
    data?: ConnectApplicationListDataList;
    /** Pagination cursors for navigating between pages of results. */
    list_metadata?: AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
}
export interface ListAuditLogValidatorsControllerRequest {
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. */
    before?: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. */
    after?: string;
    /** Upper limit on the number of objects to return, between `1` and `100`. */
    limit?: number;
    /** Order the results by the creation time. Defaults to `normal`. */
    order?: PaginationOrder | (string & {});
}
/** Pagination cursors for navigating between pages of results. */
export type ListAuditLogValidatorsControllerResponseListMetadata = AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
export interface AuditLogActionJson {
    /** Distinguishes the Audit Log Action object. */
    object?: string;
    /** Identifier of what action was taken. */
    name?: string;
    /** The schema associated with the action. */
    schema?: AuditLogSchemaJson;
    /** An ISO 8601 timestamp. */
    created_at?: string;
    /** An ISO 8601 timestamp. */
    updated_at?: string;
}
/** The list of records for the current page. */
export type ListAuditLogValidatorsControllerResponseDataList = Array<AuditLogActionJson>;
export interface ListAuditLogValidatorsControllerResponse {
    /** Indicates this is a list response. */
    object?: string;
    /** Pagination cursors for navigating between pages of results. */
    list_metadata?: AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
    /** The list of records for the current page. */
    data?: ListAuditLogValidatorsControllerResponseDataList;
}
export interface ListAuthkitOauthResourcesControllerRequest {
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`. */
    before?: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`. */
    after?: string;
    /** Upper limit on the number of objects to return, between `1` and `100`. */
    limit?: number;
    /** Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. */
    order?: PaginationOrder | (string & {});
}
/** Pagination cursors for navigating between pages of results. */
export type ListAuthkitOauthResourcesControllerResponseListMetadata = AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
/** The list of records for the current page. */
export type ListAuthkitOauthResourcesControllerResponseDataList = Array<AuthkitOauthResource>;
export interface ListAuthkitOauthResourcesControllerResponse {
    /** Indicates this is a list response. */
    object?: string;
    /** Pagination cursors for navigating between pages of results. */
    list_metadata?: AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
    /** The list of records for the current page. */
    data?: ListAuthkitOauthResourcesControllerResponseDataList;
}
export interface ListAuthorizationControllerEffectivePermissionsRequest {
    /** The ID of the organization membership. */
    organization_membership_id: string;
    /** The ID of the authorization resource. */
    resource_id: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`. */
    before?: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`. */
    after?: string;
    /** Upper limit on the number of objects to return, between `1` and `100`. */
    limit?: number;
    /** Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. */
    order?: PaginationOrder | (string & {});
}
/** The list of records for the current page. */
export type AuthorizationPermissionListDataList = Array<AuthorizationPermission>;
/** Pagination cursors for navigating between pages of results. */
export type AuthorizationPermissionListListMetadata = AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
export interface AuthorizationPermissionList {
    /** Indicates this is a list response. */
    object?: string;
    /** The list of records for the current page. */
    data?: AuthorizationPermissionListDataList;
    /** Pagination cursors for navigating between pages of results. */
    list_metadata?: AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
}
export interface ListAuthorizationControllerEffectivePermissionsByExternalIdRequest {
    /** The ID of the organization membership. */
    organization_membership_id: string;
    /** The slug of the resource type. */
    resource_type_slug: string;
    /** An identifier you provide to reference the resource in your system. */
    external_id: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`. */
    before?: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`. */
    after?: string;
    /** Upper limit on the number of objects to return, between `1` and `100`. */
    limit?: number;
    /** Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. */
    order?: PaginationOrder | (string & {});
}
export interface ListAuthorizationControllerResourcesForMembershipRequest {
    /** The ID of the organization membership. */
    organization_membership_id: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`. */
    before?: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`. */
    after?: string;
    /** Upper limit on the number of objects to return, between `1` and `100`. */
    limit?: number;
    /** Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. */
    order?: PaginationOrder | (string & {});
    /** The permission slug to filter by. Only child resources where the organization membership has this permission are returned. */
    permission_slug: string;
    /** The WorkOS ID of the parent resource. Provide this or both `parent_resource_external_id` and `parent_resource_type_slug`, but not both. Mutually exclusive with `parent_resource_type_slug` and `parent_resource_external_id`. */
    parent_resource_id?: string;
    /** The slug of the parent resource type. Must be provided together with `parent_resource_external_id`. Required with `parent_resource_external_id`. Mutually exclusive with `parent_resource_id`. */
    parent_resource_type_slug?: string;
    /** The application-specific external identifier of the parent resource. Must be provided together with `parent_resource_type_slug`. Required with `parent_resource_type_slug`. Mutually exclusive with `parent_resource_id`. */
    parent_resource_external_id?: string;
}
/** The list of records for the current page. */
export type AuthorizationResourceListDataList = Array<AuthorizationResource>;
/** Pagination cursors for navigating between pages of results. */
export type AuthorizationResourceListListMetadata = AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
export interface AuthorizationResourceList {
    /** Indicates this is a list response. */
    object?: string;
    /** The list of records for the current page. */
    data?: AuthorizationResourceListDataList;
    /** Pagination cursors for navigating between pages of results. */
    list_metadata?: AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
}
export interface ListAuthorizationGroupRoleAssignmentsControllerRequest {
    /** The ID of the group. */
    group_id: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`. */
    before?: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`. */
    after?: string;
    /** Upper limit on the number of objects to return, between `1` and `100`. */
    limit?: number;
    /** Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. */
    order?: PaginationOrder | (string & {});
}
/** The list of records for the current page. */
export type GroupRoleAssignmentListDataList = Array<GroupRoleAssignment>;
/** Pagination cursors for navigating between pages of results. */
export type GroupRoleAssignmentListListMetadata = AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
export interface GroupRoleAssignmentList {
    /** Indicates this is a list response. */
    object: string;
    /** The list of records for the current page. */
    data: GroupRoleAssignmentListDataList;
    /** Pagination cursors for navigating between pages of results. */
    list_metadata: AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
}
export interface ListAuthorizationOrganizationRolesControllerRequest {
    /** The ID of the organization. */
    organizationId: string;
}
/** The list of records for the current page. */
export type RoleListDataList = Array<Role>;
export interface RoleList {
    object?: string;
    /** The list of records for the current page. */
    data?: RoleListDataList;
}
export interface ListAuthorizationPermissionsControllerRequest {
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`. */
    before?: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`. */
    after?: string;
    /** Upper limit on the number of objects to return, between `1` and `100`. */
    limit?: number;
    /** Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. */
    order?: PaginationOrder | (string & {});
}
export type ListAuthorizationResourcesByExternalIdControllerOrganizationMembershipsForResourceByExternalIdRequestAssignment = "direct" | "indirect";
export interface ListAuthorizationResourcesByExternalIdControllerOrganizationMembershipsForResourceByExternalIdRequest {
    /** The ID of the organization that owns the resource. */
    organization_id: string;
    /** The slug of the resource type this resource belongs to. */
    resource_type_slug: string;
    /** An identifier you provide to reference the resource in your system. */
    external_id: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`. */
    before?: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`. */
    after?: string;
    /** Upper limit on the number of objects to return, between `1` and `100`. */
    limit?: number;
    /** Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. */
    order?: PaginationOrder | (string & {});
    /** The permission slug to filter by. Only users with this permission on the resource are returned. */
    permission_slug: string;
    /** Filter by assignment type. Use "direct" for direct assignments only, or "indirect" to include inherited assignments. */
    assignment?: ListAuthorizationResourcesByExternalIdControllerOrganizationMembershipsForResourceByExternalIdRequestAssignment | (string & {});
}
/** The status of the organization membership. One of `active`, `inactive`, or `pending`. */
export type UserlandUserOrganizationMembershipBaseWithUserStatus = "active" | "inactive" | "pending";
/** An object containing IdP-sourced attributes from the linked [Directory User](/reference/directory-sync/directory-user) or [SSO Profile](/reference/sso/profile). Directory User attributes take precedence when both are linked. */
export type UserlandUserOrganizationMembershipBaseWithUserCustomAttributesMap = {
    [key: string]: unknown | undefined;
};
export interface UserlandUserOrganizationMembershipBaseWithUser {
    /** Distinguishes the organization membership object. */
    object: string;
    /** The unique ID of the organization membership. */
    id: string;
    /** The ID of the user. */
    user_id: string;
    /** The ID of the organization which the user belongs to. */
    organization_id: string;
    /** The status of the organization membership. One of `active`, `inactive`, or `pending`. */
    status: UserlandUserOrganizationMembershipBaseWithUserStatus;
    /** Whether this organization membership is managed by a directory sync connection. */
    directory_managed: boolean;
    /** The name of the organization which the user belongs to. */
    organization_name?: string;
    /** An object containing IdP-sourced attributes from the linked [Directory User](/reference/directory-sync/directory-user) or [SSO Profile](/reference/sso/profile). Directory User attributes take precedence when both are linked. */
    custom_attributes?: UserlandUserOrganizationMembershipBaseWithUserCustomAttributesMap;
    /** An ISO 8601 timestamp. */
    created_at: string;
    /** An ISO 8601 timestamp. */
    updated_at: string;
    /** The user that belongs to the organization through this membership. */
    user: UserlandUser;
}
/** The list of records for the current page. */
export type UserlandUserOrganizationMembershipBaseWithUserListDataList = Array<UserlandUserOrganizationMembershipBaseWithUser>;
/** Pagination cursors for navigating between pages of results. */
export type UserlandUserOrganizationMembershipBaseWithUserListListMetadata = AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
export interface UserlandUserOrganizationMembershipBaseWithUserList {
    /** Indicates this is a list response. */
    object: string;
    /** The list of records for the current page. */
    data: UserlandUserOrganizationMembershipBaseWithUserListDataList;
    /** Pagination cursors for navigating between pages of results. */
    list_metadata: AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
}
export interface ListAuthorizationResourcesControllerRequest {
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`. */
    before?: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`. */
    after?: string;
    /** Upper limit on the number of objects to return, between `1` and `100`. */
    limit?: number;
    /** Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. */
    order?: PaginationOrder | (string & {});
    /** Filter resources by organization ID. */
    organization_id?: string;
    /** Filter resources by resource type slug. */
    resource_type_slug?: string;
    /** Filter resources by external ID. */
    resource_external_id?: string;
    /** Filter resources by parent resource ID. Mutually exclusive with `parent_resource_type_slug` and `parent_external_id`. */
    parent_resource_id?: string;
    /** Filter resources by parent resource type slug. Required with `parent_external_id`. Mutually exclusive with `parent_resource_id`. */
    parent_resource_type_slug?: string;
    /** Filter resources by parent external ID. Required with `parent_resource_type_slug`. Mutually exclusive with `parent_resource_id`. */
    parent_external_id?: string;
}
export type ListAuthorizationResourcesControllerOrganizationMembershipsForResourceRequestAssignment = "direct" | "indirect";
export interface ListAuthorizationResourcesControllerOrganizationMembershipsForResourceRequest {
    /** The ID of the authorization resource. */
    resource_id: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`. */
    before?: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`. */
    after?: string;
    /** Upper limit on the number of objects to return, between `1` and `100`. */
    limit?: number;
    /** Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. */
    order?: PaginationOrder | (string & {});
    /** The permission slug to filter by. Only users with this permission on the resource are returned. */
    permission_slug: string;
    /** Filter by assignment type. Use `direct` for direct assignments only, or `indirect` to include inherited assignments. */
    assignment?: ListAuthorizationResourcesControllerOrganizationMembershipsForResourceRequestAssignment | (string & {});
}
export interface ListAuthorizationRoleAssignmentsControllerRoleAssignmentsRequest {
    /** The ID of the organization membership. */
    organization_membership_id: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`. */
    before?: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`. */
    after?: string;
    /** Upper limit on the number of objects to return, between `1` and `100`. */
    limit?: number;
    /** Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. */
    order?: PaginationOrder | (string & {});
    /** Filter assignments by the ID of the resource. */
    resource_id?: string;
    /** Filter assignments by the external ID of the resource. */
    resource_external_id?: string;
    /** Filter assignments by the slug of the resource type. */
    resource_type_slug?: string;
}
/** The list of records for the current page. */
export type UserRoleAssignmentListDataList = Array<UserRoleAssignment>;
/** Pagination cursors for navigating between pages of results. */
export type UserRoleAssignmentListListMetadata = AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
export interface UserRoleAssignmentList {
    /** Indicates this is a list response. */
    object: string;
    /** The list of records for the current page. */
    data: UserRoleAssignmentListDataList;
    /** Pagination cursors for navigating between pages of results. */
    list_metadata: AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
}
export interface ListAuthorizationRoleAssignmentsControllerRoleAssignmentsForResourceRequest {
    /** The ID of the authorization resource. */
    resource_id: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`. */
    before?: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`. */
    after?: string;
    /** Upper limit on the number of objects to return, between `1` and `100`. */
    limit?: number;
    /** Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. */
    order?: PaginationOrder | (string & {});
    /** Filter assignments by the slug of the role. */
    role_slug?: string;
}
export interface ListAuthorizationRoleAssignmentsControllerRoleAssignmentsForResourceByExternalIdRequest {
    /** The ID of the organization that owns the resource. */
    organization_id: string;
    /** The slug of the resource type. */
    resource_type_slug: string;
    /** An identifier you provide to reference the resource in your system. */
    external_id: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`. */
    before?: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`. */
    after?: string;
    /** Upper limit on the number of objects to return, between `1` and `100`. */
    limit?: number;
    /** Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. */
    order?: PaginationOrder | (string & {});
    /** Filter assignments by the slug of the role. */
    role_slug?: string;
}
export interface ListAuthorizationRolesControllerRequest {
}
export interface ListAuthorizedApplicationsControllerRequest {
    /** The ID of the user. */
    user_id: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`. */
    before?: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`. */
    after?: string;
    /** Upper limit on the number of objects to return, between `1` and `100`. */
    limit?: number;
    /** Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. */
    order?: PaginationOrder | (string & {});
}
/** The scopes granted by the user to the application. */
export type AuthorizedConnectApplicationListDataItemGrantedScopesList = Array<string>;
export interface AuthorizedConnectApplicationListDataItem {
    /** Distinguishes the authorized connect application object. */
    object: string;
    /** The unique ID of the authorized connect application. */
    id: string;
    /** The scopes granted by the user to the application. */
    granted_scopes: AuthorizedConnectApplicationListDataItemGrantedScopesList;
    /** The OAuth resource associated with the authorized connect application, if one was requested. */
    oauth_resource?: string;
    application: ConnectApplication;
}
/** The list of records for the current page. */
export type AuthorizedConnectApplicationListDataList = Array<AuthorizedConnectApplicationListDataItem>;
/** Pagination cursors for navigating between pages of results. */
export type AuthorizedConnectApplicationListListMetadata = AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
export interface AuthorizedConnectApplicationList {
    /** Indicates this is a list response. */
    object?: string;
    /** The list of records for the current page. */
    data?: AuthorizedConnectApplicationListDataList;
    /** Pagination cursors for navigating between pages of results. */
    list_metadata?: AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
}
export type ListConnectionsControllerRequestConnectionType = "ADFSSAML" | "AdpOidc" | "AppleOAuth" | "Auth0SAML" | "AzureSAML" | "BitbucketOAuth" | "CasSAML" | "CloudflareSAML" | "ClassLinkSAML" | "CleverOIDC" | "CyberArkSAML" | "DuoSAML" | "EntraIdOIDC" | "GenericOIDC" | "GenericSAML" | "GithubOAuth" | "GitLabOAuth" | "GoogleOAuth" | "GoogleOIDC" | "GoogleSAML" | "IntuitOAuth" | "JumpCloudSAML" | "KeycloakSAML" | "LastPassSAML" | "LinkedInOAuth" | "LoginGovOidc" | "MagicLink" | "MicrosoftOAuth" | "MiniOrangeSAML" | "NetIqSAML" | "OktaOIDC" | "OktaSAML" | "OneLoginSAML" | "OracleSAML" | "PingFederateSAML" | "PingOneSAML" | "RipplingSAML" | "SalesforceSAML" | "ShibbolethGenericSAML" | "ShibbolethSAML" | "SimpleSamlPhpSAML" | "SalesforceOAuth" | "SlackOAuth" | "VercelMarketplaceOAuth" | "VercelOAuth" | "VMwareSAML" | "XeroOAuth";
export interface ListConnectionsControllerRequest {
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. */
    before?: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. */
    after?: string;
    /** Upper limit on the number of objects to return, between `1` and `100`. */
    limit?: number;
    /** Order the results by the creation time. Defaults to `normal`. */
    order?: PaginationOrder | (string & {});
    /** Filter Connections by their type. */
    connection_type?: ListConnectionsControllerRequestConnectionType | (string & {});
    /** Filter Connections by their associated domain. */
    domain?: string;
    /** Filter Connections by their associated organization. */
    organization_id?: string;
    /** Searchable text to match against Connection names. */
    search?: string;
}
/** The list of records for the current page. */
export type ConnectionListDataList = Array<Connection>;
/** Pagination cursors for navigating between pages of results. */
export type ConnectionListListMetadata = AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
export interface ConnectionList {
    /** Indicates this is a list response. */
    object?: string;
    /** The list of records for the current page. */
    data?: ConnectionListDataList;
    /** Pagination cursors for navigating between pages of results. */
    list_metadata?: AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
}
export interface ListCorsOriginsControllerRequest {
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`. */
    before?: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`. */
    after?: string;
    /** Upper limit on the number of objects to return, between `1` and `100`. */
    limit?: number;
    /** Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. */
    order?: PaginationOrder | (string & {});
}
/** Pagination cursors for navigating between pages of results. */
export type ListCorsOriginsControllerResponseListMetadata = AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
/** The list of records for the current page. */
export type ListCorsOriginsControllerResponseDataList = Array<CorsOriginResponse>;
export interface ListCorsOriginsControllerResponse {
    /** Indicates this is a list response. */
    object?: string;
    /** Pagination cursors for navigating between pages of results. */
    list_metadata?: AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
    /** The list of records for the current page. */
    data?: ListCorsOriginsControllerResponseDataList;
}
export type ListDataIntegrationsManagementControllerDataIntegrationsRequestOwnership = "user" | "organization";
export interface ListDataIntegrationsManagementControllerDataIntegrationsRequest {
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`. */
    before?: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`. */
    after?: string;
    /** Upper limit on the number of objects to return, between `1` and `100`. */
    limit?: number;
    /** Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. */
    order?: PaginationOrder | (string & {});
    /** Only return Data Integrations with this ownership: `user` for the integrations users connect their own accounts to, or `organization` for the roots organizations connect to. Omit to return both. */
    ownership?: ListDataIntegrationsManagementControllerDataIntegrationsRequestOwnership | (string & {});
}
/** The list of records for the current page. */
export type DataIntegrationListDataList = Array<DataIntegration>;
/** Pagination cursors for navigating between pages of results. */
export type DataIntegrationListListMetadata = AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
export interface DataIntegrationList {
    /** Indicates this is a list response. */
    object: string;
    /** The list of records for the current page. */
    data: DataIntegrationListDataList;
    /** Pagination cursors for navigating between pages of results. */
    list_metadata: AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
}
export interface ListDirectoriesControllerRequest {
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. */
    before?: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. */
    after?: string;
    /** Upper limit on the number of objects to return, between `1` and `100`. */
    limit?: number;
    /** Order the results by the creation time. Defaults to `normal`. */
    order?: PaginationOrder | (string & {});
    /** Filter Directories by their associated organization. */
    organization_id?: string;
    /** Searchable text to match against Directory names. */
    search?: string;
    /** Filter Directories by their associated domain. */
    domain?: string;
}
/** The list of records for the current page. */
export type DirectoryListDataList = Array<Directory>;
/** Pagination cursors for navigating between pages of results. */
export type DirectoryListListMetadata = AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
export interface DirectoryList {
    /** Indicates this is a list response. */
    object?: string;
    /** The list of records for the current page. */
    data?: DirectoryListDataList;
    /** Pagination cursors for navigating between pages of results. */
    list_metadata?: AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
}
export interface ListDirectoryGroupsControllerRequest {
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`. */
    before?: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`. */
    after?: string;
    /** Upper limit on the number of objects to return, between `1` and `100`. */
    limit?: number;
    /** Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. */
    order?: PaginationOrder | (string & {});
    /** Unique identifier of the WorkOS Directory. This value can be obtained from the WorkOS dashboard or from the WorkOS API. */
    directory?: string;
    /** Unique identifier of the WorkOS Directory User. This value can be obtained from the WorkOS API. */
    user?: string;
}
/** The list of records for the current page. */
export type DirectoryGroupListDataList = Array<DirectoryGroup>;
/** Pagination cursors for navigating between pages of results. */
export type DirectoryGroupListListMetadata = AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
export interface DirectoryGroupList {
    /** Indicates this is a list response. */
    object?: string;
    /** The list of records for the current page. */
    data?: DirectoryGroupListDataList;
    /** Pagination cursors for navigating between pages of results. */
    list_metadata?: AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
}
export interface ListDirectoryUsersControllerRequest {
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`. */
    before?: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`. */
    after?: string;
    /** Upper limit on the number of objects to return, between `1` and `100`. */
    limit?: number;
    /** Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. */
    order?: PaginationOrder | (string & {});
    /** Unique identifier of the WorkOS Directory. This value can be obtained from the WorkOS dashboard or from the WorkOS API. */
    directory?: string;
    /** Unique identifier of the WorkOS Directory Group. This value can be obtained from the WorkOS API. */
    group?: string;
    /** Filter Directory Users by the identity provider's unique identifier (`idp_id`). Requires the `directory` parameter to also be provided. */
    idp_id?: string;
    /** Filter Directory Users by their primary email address. Requires the `directory` parameter to also be provided. */
    email?: string;
}
/** The list of records for the current page. */
export type DirectoryUserListDataList = Array<DirectoryUserWithGroups>;
/** Pagination cursors for navigating between pages of results. */
export type DirectoryUserListListMetadata = AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
export interface DirectoryUserList {
    /** Indicates this is a list response. */
    object?: string;
    /** The list of records for the current page. */
    data?: DirectoryUserListDataList;
    /** Pagination cursors for navigating between pages of results. */
    list_metadata?: AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
}
export type ListEventsControllerRequestEventsList = Array<string>;
export interface ListEventsControllerRequest {
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`. */
    before?: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`. */
    after?: string;
    /** Upper limit on the number of objects to return, between `1` and `100`. */
    limit?: number;
    /** Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. */
    order?: PaginationOrder | (string & {});
    /** Filter events by one or more event types (e.g. `dsync.user.created`). */
    events: ListEventsControllerRequestEventsList;
    /** ISO-8601 date string to filter events created after this date. */
    range_start?: string;
    /** ISO-8601 date string to filter events created before this date. */
    range_end?: string;
    /** Filter events by the [Organization](/reference/organization) that the event is associated with. */
    organization_id?: string;
}
/** The event payload. */
export type EventSchemaDataMap = {
    [key: string]: unknown | undefined;
};
/** Additional context about the event. */
export type EventSchemaContextMap = {
    [key: string]: unknown | undefined;
};
/** An event emitted by WorkOS. */
export interface EventSchema {
    /** Distinguishes the Event object. */
    object: string;
    /** Unique identifier for the Event. */
    id: string;
    /** The type of event that occurred. */
    event: string;
    /** The event payload. */
    data: EventSchemaDataMap;
    /** An ISO 8601 timestamp. */
    created_at: string;
    /** Additional context about the event. */
    context?: EventSchemaContextMap;
}
/** The list of records for the current page. */
export type EventListDataList = Array<EventSchema>;
/** Pagination cursor for navigating to the next page of results. */
export interface EventListListMetadata {
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. */
    after: string | null;
}
export interface EventList {
    /** Indicates this is a list response. */
    object?: string;
    /** The list of records for the current page. */
    data?: EventListDataList;
    /** Pagination cursor for navigating to the next page of results. */
    list_metadata?: EventListListMetadata;
}
export interface ListFeatureFlagsControllerRequest {
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. */
    before?: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. */
    after?: string;
    /** Upper limit on the number of objects to return, between `1` and `100`. */
    limit?: number;
    /** Order the results by the creation time. Defaults to `normal`. */
    order?: PaginationOrder | (string & {});
}
/** The list of records for the current page. */
export type FlagListDataList = Array<Flag>;
/** Pagination cursors for navigating between pages of results. */
export type FlagListListMetadata = AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
export interface FlagList {
    /** Indicates this is a list response. */
    object?: string;
    /** The list of records for the current page. */
    data?: FlagListDataList;
    /** Pagination cursors for navigating between pages of results. */
    list_metadata?: AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
}
export interface ListGroupMembershipsControllerMembersRequest {
    /** Unique identifier of the Organization. */
    organizationId: string;
    /** Unique identifier of the Group. */
    groupId: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`. */
    before?: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`. */
    after?: string;
    /** Upper limit on the number of objects to return, between `1` and `100`. */
    limit?: number;
    /** Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. */
    order?: PaginationOrder | (string & {});
}
/** The status of the organization membership. One of `active`, `inactive`, or `pending`. */
export type UserlandUserOrganizationMembershipBaseListDataItemStatus = "active" | "inactive" | "pending";
/** An object containing IdP-sourced attributes from the linked [Directory User](/reference/directory-sync/directory-user) or [SSO Profile](/reference/sso/profile). Directory User attributes take precedence when both are linked. */
export type UserlandUserOrganizationMembershipBaseListDataItemCustomAttributesMap = {
    [key: string]: unknown | undefined;
};
export interface UserlandUserOrganizationMembershipBaseListDataItem {
    /** Distinguishes the organization membership object. */
    object: string;
    /** The unique ID of the organization membership. */
    id: string;
    /** The ID of the user. */
    user_id: string;
    /** The ID of the organization which the user belongs to. */
    organization_id: string;
    /** The status of the organization membership. One of `active`, `inactive`, or `pending`. */
    status: UserlandUserOrganizationMembershipBaseListDataItemStatus;
    /** Whether this organization membership is managed by a directory sync connection. */
    directory_managed: boolean;
    /** The name of the organization which the user belongs to. */
    organization_name?: string;
    /** An object containing IdP-sourced attributes from the linked [Directory User](/reference/directory-sync/directory-user) or [SSO Profile](/reference/sso/profile). Directory User attributes take precedence when both are linked. */
    custom_attributes?: UserlandUserOrganizationMembershipBaseListDataItemCustomAttributesMap;
    /** An ISO 8601 timestamp. */
    created_at: string;
    /** An ISO 8601 timestamp. */
    updated_at: string;
}
/** The list of records for the current page. */
export type UserlandUserOrganizationMembershipBaseListDataList = Array<UserlandUserOrganizationMembershipBaseListDataItem>;
/** Pagination cursors for navigating between pages of results. */
export type UserlandUserOrganizationMembershipBaseListListMetadata = AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
export interface UserlandUserOrganizationMembershipBaseList {
    /** Indicates this is a list response. */
    object?: string;
    /** The list of records for the current page. */
    data?: UserlandUserOrganizationMembershipBaseListDataList;
    /** Pagination cursors for navigating between pages of results. */
    list_metadata?: AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
}
export interface ListGroupsControllerRequest {
    /** The ID of the organization. */
    organizationId: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`. */
    before?: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`. */
    after?: string;
    /** Upper limit on the number of objects to return, between `1` and `100`. */
    limit?: number;
    /** Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. */
    order?: PaginationOrder | (string & {});
    /** Search groups by name or by group ID. */
    search?: string;
}
/** The list of records for the current page. */
export type GroupListDataList = Array<Group>;
/** Pagination cursors for navigating between pages of results. */
export type GroupListListMetadata = AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
export interface GroupList {
    /** Indicates this is a list response. */
    object?: string;
    /** The list of records for the current page. */
    data?: GroupListDataList;
    /** Pagination cursors for navigating between pages of results. */
    list_metadata?: AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
}
export interface ListItContactsControllerRequest {
    /** The ID of the organization. */
    organization_id: string;
}
/** The list of records for the current page. */
export type ItContactListDataList = Array<ItContact>;
/** Pagination cursors for navigating between pages of results. */
export type ItContactListListMetadata = AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
export interface ItContactList {
    /** Indicates this is a list response. */
    object: string;
    /** The list of records for the current page. */
    data: ItContactListDataList;
    /** Pagination cursors for navigating between pages of results. */
    list_metadata: AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
}
export interface ListOrganizationApiKeysControllerRequest {
    /** Unique identifier of the Organization. */
    organizationId: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. */
    before?: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. */
    after?: string;
    /** Upper limit on the number of objects to return, between `1` and `100`. */
    limit?: number;
    /** Order the results by the creation time. Defaults to `normal`. */
    order?: PaginationOrder | (string & {});
}
/** The entity that owns the API Key. */
export type OrganizationApiKeyOwner = ApiKeyOwnerCase0;
/** The permission slugs assigned to the API Key. */
export type OrganizationApiKeyPermissionsList = Array<string>;
export interface OrganizationApiKey {
    /** Distinguishes the API Key object. */
    object: string;
    /** Unique identifier of the API Key. */
    id: string;
    /** The entity that owns the API Key. */
    owner: ApiKeyOwnerCase0;
    /** A descriptive name for the API Key. */
    name: string;
    /** An obfuscated representation of the API Key value. */
    obfuscated_value: string;
    /** Timestamp of when the API Key was last used. */
    last_used_at: string | null;
    /** Timestamp when the API Key expires. Null means the key does not expire. */
    expires_at: string | null;
    /** The permission slugs assigned to the API Key. */
    permissions: OrganizationApiKeyPermissionsList;
    /** An ISO 8601 timestamp. */
    created_at: string;
    /** An ISO 8601 timestamp. */
    updated_at: string;
}
/** The list of records for the current page. */
export type OrganizationApiKeyListDataList = Array<OrganizationApiKey>;
/** Pagination cursors for navigating between pages of results. */
export type OrganizationApiKeyListListMetadata = AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
export interface OrganizationApiKeyList {
    /** Indicates this is a list response. */
    object: string;
    /** The list of records for the current page. */
    data: OrganizationApiKeyListDataList;
    /** Pagination cursors for navigating between pages of results. */
    list_metadata: AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
}
export interface ListOrganizationAuthorizedApplicationsControllerRequest {
    /** The ID of the organization. */
    organization_id: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`. */
    before?: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`. */
    after?: string;
    /** Upper limit on the number of objects to return, between `1` and `100`. */
    limit?: number;
    /** Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. */
    order?: PaginationOrder | (string & {});
}
/** The scopes granted by the user to the application. */
export type OrganizationAuthorizedConnectApplicationListDataItemGrantedScopesList = Array<string>;
export interface OrganizationAuthorizedConnectApplicationListDataItem {
    /** Distinguishes the authorized connect application object. */
    object: string;
    /** The unique ID of the authorized connect application. */
    id: string;
    /** The scopes granted by the user to the application. */
    granted_scopes: OrganizationAuthorizedConnectApplicationListDataItemGrantedScopesList;
    /** The OAuth resource associated with the authorized connect application, if one was requested. */
    oauth_resource?: string;
    application: ConnectApplication;
    /** The ID of the user who authorized the application. */
    user_id: string;
}
/** The list of records for the current page. */
export type OrganizationAuthorizedConnectApplicationListDataList = Array<OrganizationAuthorizedConnectApplicationListDataItem>;
/** Pagination cursors for navigating between pages of results. */
export type OrganizationAuthorizedConnectApplicationListListMetadata = AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
export interface OrganizationAuthorizedConnectApplicationList {
    /** Indicates this is a list response. */
    object: string;
    /** The list of records for the current page. */
    data: OrganizationAuthorizedConnectApplicationListDataList;
    /** Pagination cursors for navigating between pages of results. */
    list_metadata: AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
}
export interface ListOrganizationFeatureFlagsControllerRequest {
    /** Unique identifier of the Organization. */
    organizationId: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. */
    before?: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. */
    after?: string;
    /** Upper limit on the number of objects to return, between `1` and `100`. */
    limit?: number;
    /** Order the results by the creation time. Defaults to `desc`. */
    order?: PaginationOrder | (string & {});
}
export interface ListOrganizationMembershipGroupsControllerGroupsRequest {
    /** Unique identifier of the Organization Membership. */
    omId: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`. */
    before?: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`. */
    after?: string;
    /** Upper limit on the number of objects to return, between `1` and `100`. */
    limit?: number;
    /** Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. */
    order?: PaginationOrder | (string & {});
}
export type ListOrganizationsControllerRequestDomainsList = Array<string>;
export interface ListOrganizationsControllerRequest {
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`. */
    before?: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`. */
    after?: string;
    /** Upper limit on the number of objects to return, between `1` and `100`. */
    limit?: number;
    /** Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. */
    order?: PaginationOrder | (string & {});
    /** The domains of an Organization. Any Organization with a matching domain will be returned. */
    domains?: ListOrganizationsControllerRequestDomainsList;
    /** Searchable text for an Organization. Matches against the organization name. */
    search?: string;
}
/** The list of records for the current page. */
export type OrganizationListDataList = Array<Organization>;
/** Pagination cursors for navigating between pages of results. */
export type OrganizationListListMetadata = AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
export interface OrganizationList {
    /** Indicates this is a list response. */
    object?: string;
    /** The list of records for the current page. */
    data?: OrganizationListDataList;
    /** Pagination cursors for navigating between pages of results. */
    list_metadata?: AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
}
export interface ListProviderControllerForOrganizationRequest {
    /** An [Organization](/reference/organization) identifier to list provider configurations for. */
    organizationId: string;
}
export type DataIntegrationConfigurationResponseScopesList = Array<string>;
/** The provider-specific config values in effect for this organization, keyed by config field. Reflects the organization override for organization-credential providers, otherwise the provider root. Empty when none are configured. */
export type DataIntegrationConfigurationResponseConfigMap = {
    [key: string]: string | undefined;
};
/** The credentials type for this integration (e.g., `shared`, `custom`, or `organization`). */
export type DataIntegrationCredentialsCredentialsType = "shared" | "custom" | "organization";
/** Organization-managed OAuth credential configuration. Present only for integrations whose credentials are supplied by the organization; absent otherwise. */
export interface DataIntegrationCredentials2 {
    /** The credentials type for this integration (e.g., `shared`, `custom`, or `organization`). */
    credentials_type: DataIntegrationCredentialsCredentialsType;
    /** Whether the organization has supplied OAuth credentials for this integration. */
    has_credentials: boolean;
    /** The OAuth client ID supplied by the organization, or `null` when none is configured. */
    client_id: string | null;
    /** The last four characters of the organization-supplied OAuth client secret, or `null` when none is configured. */
    client_secret_last_four: string | null;
    /** The redirect URI to register with the provider when configuring the organization-managed OAuth application. */
    redirect_uri: string;
}
export interface DataIntegrationConfigurationResponse {
    /** Distinguishes the data integration configuration object. */
    object: string;
    /** The unique identifier of the data integration. */
    id: string;
    /** The [Organization](/reference/organization) this configuration applies to. */
    organization_id: string;
    /** The slug identifier of the provider (e.g., `github`, `slack`, `notion`). */
    slug: string;
    /** The display name of the data integration. */
    name: string;
    /** Whether the integration is enabled for this organization. Reflects the organization override when one exists, otherwise the provider default. */
    enabled: boolean;
    /** The OAuth scopes in effect for this organization. Reflects the organization override when one is set, otherwise the provider scopes, or `null` when none are configured. */
    scopes: DataIntegrationConfigurationResponseScopesList | null;
    /** The provider-specific config values in effect for this organization, keyed by config field. Reflects the organization override for organization-credential providers, otherwise the provider root. Empty when none are configured. */
    config: DataIntegrationConfigurationResponseConfigMap;
    /** The timestamp when the configuration was created. */
    created_at: string;
    /** The timestamp when the configuration was last updated. */
    updated_at: string;
    credentials?: DataIntegrationCredentials2;
}
/** A list of data integration configurations for the organization. */
export type DataIntegrationConfigurationListResponseDataList = Array<DataIntegrationConfigurationResponse>;
export interface DataIntegrationConfigurationListResponse {
    /** Indicates this is a list response. */
    object: string;
    /** A list of data integration configurations for the organization. */
    data: DataIntegrationConfigurationListResponseDataList;
}
export interface ListRedirectUrisControllerRequest {
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`. */
    before?: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`. */
    after?: string;
    /** Upper limit on the number of objects to return, between `1` and `100`. */
    limit?: number;
    /** Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. */
    order?: PaginationOrder | (string & {});
}
/** Pagination cursors for navigating between pages of results. */
export type ListRedirectUrisControllerResponseListMetadata = AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
/** The list of records for the current page. */
export type ListRedirectUrisControllerResponseDataList = Array<RedirectUri>;
export interface ListRedirectUrisControllerResponse {
    /** Indicates this is a list response. */
    object?: string;
    /** Pagination cursors for navigating between pages of results. */
    list_metadata?: AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
    /** The list of records for the current page. */
    data?: ListRedirectUrisControllerResponseDataList;
}
export interface ListSamlIdpSigningCertificatesControllerRequest {
    /** Unique identifier for the Connection. */
    connectionId: string;
}
/** Every Identity Provider signing certificate on the Connection, including expired ones, oldest first. */
export type SamlIdpSigningCertificateListDataList = Array<SamlIdpSigningCertificate>;
export interface SamlIdpSigningCertificateList {
    object: string;
    /** Every Identity Provider signing certificate on the Connection, including expired ones, oldest first. */
    data: SamlIdpSigningCertificateListDataList;
}
export interface ListSamlSpEncryptionCertificatesControllerRequest {
    /** Unique identifier for the Connection. */
    connectionId: string;
}
/** Every Service Provider encryption certificate on the Connection, including expired ones. */
export type SamlSpEncryptionCertificateListDataList = Array<SamlSpEncryptionCertificate>;
export interface SamlSpEncryptionCertificateList {
    object: string;
    /** Every Service Provider encryption certificate on the Connection, including expired ones. */
    data: SamlSpEncryptionCertificateListDataList;
}
export interface ListUserApiKeysControllerRequest {
    /** Unique identifier of the user. */
    userId: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. */
    before?: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. */
    after?: string;
    /** Upper limit on the number of objects to return, between `1` and `100`. */
    limit?: number;
    /** Order the results by the creation time. Defaults to `normal`. */
    order?: PaginationOrder | (string & {});
    /** The ID of the organization to filter user API keys by. When provided, only API keys created against that organization membership are returned. */
    organization_id?: string;
}
/** The entity that owns the API Key. */
export type UserApiKeyOwner = ApiKeyOwnerCase1;
/** The permission slugs assigned to the API Key. */
export type UserApiKeyPermissionsList = Array<string>;
export interface UserApiKey {
    /** Distinguishes the API Key object. */
    object: string;
    /** Unique identifier of the API Key. */
    id: string;
    /** The entity that owns the API Key. */
    owner: ApiKeyOwnerCase1;
    /** A descriptive name for the API Key. */
    name: string;
    /** An obfuscated representation of the API Key value. */
    obfuscated_value: string;
    /** Timestamp of when the API Key was last used. */
    last_used_at: string | null;
    /** Timestamp when the API Key expires. Null means the key does not expire. */
    expires_at: string | null;
    /** The permission slugs assigned to the API Key. */
    permissions: UserApiKeyPermissionsList;
    /** An ISO 8601 timestamp. */
    created_at: string;
    /** An ISO 8601 timestamp. */
    updated_at: string;
}
/** The list of records for the current page. */
export type UserApiKeyListDataList = Array<UserApiKey>;
/** Pagination cursors for navigating between pages of results. */
export type UserApiKeyListListMetadata = AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
export interface UserApiKeyList {
    /** Indicates this is a list response. */
    object: string;
    /** The list of records for the current page. */
    data: UserApiKeyListDataList;
    /** Pagination cursors for navigating between pages of results. */
    list_metadata: AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
}
export interface ListUserlandUserFeatureFlagsControllerRequest {
    /** The ID of the user. */
    userId: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. */
    before?: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. */
    after?: string;
    /** Upper limit on the number of objects to return, between `1` and `100`. */
    limit?: number;
    /** Order the results by the creation time. Defaults to `desc`. */
    order?: PaginationOrder | (string & {});
}
export interface ListUserlandUserInvitesControllerRequest {
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`. */
    before?: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`. */
    after?: string;
    /** Upper limit on the number of objects to return, between `1` and `100`. */
    limit?: number;
    /** Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `desc`. */
    order?: PaginationOrder | (string & {});
    /** The ID of the [organization](/reference/organization) that the recipient will join. */
    organization_id?: string;
    /** The email address of the recipient. */
    email?: string;
}
/** The list of records for the current page. */
export type UserlandUserInviteListDataList = Array<UserlandUserInvite>;
/** Pagination cursors for navigating between pages of results. */
export type UserlandUserInviteListListMetadata = AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
export interface UserlandUserInviteList {
    /** Indicates this is a list response. */
    object: string;
    /** The list of records for the current page. */
    data: UserlandUserInviteListDataList;
    /** Pagination cursors for navigating between pages of results. */
    list_metadata: AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
}
export type ListUserlandUserOrganizationMembershipsControllerRequestStatusesItem = "active" | "inactive" | "pending";
export type ListUserlandUserOrganizationMembershipsControllerRequestStatusesList = Array<ListUserlandUserOrganizationMembershipsControllerRequestStatusesItem | (string & {})>;
export interface ListUserlandUserOrganizationMembershipsControllerRequest {
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`. */
    before?: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`. */
    after?: string;
    /** Upper limit on the number of objects to return, between `1` and `100`. */
    limit?: number;
    /** Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `desc`. */
    order?: PaginationOrder | (string & {});
    /** The ID of the [organization](/reference/organization) which the user belongs to. */
    organization_id?: string;
    /** Filter by the status of the organization membership. Array including any of `active`, `inactive`, or `pending`. */
    statuses?: ListUserlandUserOrganizationMembershipsControllerRequestStatusesList;
    /** The ID of the [user](/reference/authkit/user). */
    user_id?: string;
}
/** The list of records for the current page. */
export type UserlandUserOrganizationMembershipListDataList = Array<UserlandUserOrganizationMembership>;
/** Pagination cursors for navigating between pages of results. */
export type UserlandUserOrganizationMembershipListListMetadata = AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
export interface UserlandUserOrganizationMembershipList {
    /** Indicates this is a list response. */
    object: string;
    /** The list of records for the current page. */
    data: UserlandUserOrganizationMembershipListDataList;
    /** Pagination cursors for navigating between pages of results. */
    list_metadata: AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
}
export interface ListUserlandUserSessionsControllerRequest {
    /** The ID of the user. */
    id: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`. */
    before?: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`. */
    after?: string;
    /** Upper limit on the number of objects to return, between `1` and `100`. */
    limit?: number;
    /** Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `desc`. */
    order?: PaginationOrder | (string & {});
}
/** Pagination cursors for navigating between pages of results. */
export type ListUserlandUserSessionsControllerResponseListMetadata = AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
/** Information about the impersonator if this session was created via impersonation. */
export interface ListUserlandUserSessionsControllerResponseDataItemImpersonator {
    /** The email address of the WorkOS Dashboard user who is impersonating the user. */
    email: string;
    /** The justification the impersonator gave for impersonating the user. */
    reason: string | null;
}
/** The authentication method used to create this session. */
export type ListUserlandUserSessionsControllerResponseDataItemAuthMethod = "cross_app_auth" | "external_auth" | "impersonation" | "magic_code" | "migrated_session" | "oauth" | "passkey" | "password" | "sso" | "unknown";
/** The current status of the session. */
export type ListUserlandUserSessionsControllerResponseDataItemStatus = "active" | "expired" | "revoked";
export interface ListUserlandUserSessionsControllerResponseDataItem {
    /** Distinguishes the session object. */
    object: string;
    /** The unique ID of the session. */
    id: string;
    /** Information about the impersonator if this session was created via impersonation. */
    impersonator?: ListUserlandUserSessionsControllerResponseDataItemImpersonator;
    /** The IP address from which the session was created. */
    ip_address: string | null;
    /** The ID of the organization this session is associated with. */
    organization_id?: string;
    /** The user agent string from the device that created the session. */
    user_agent: string | null;
    /** The ID of the user this session belongs to. */
    user_id: string;
    /** The authentication method used to create this session. */
    auth_method: ListUserlandUserSessionsControllerResponseDataItemAuthMethod;
    /** The current status of the session. */
    status: ListUserlandUserSessionsControllerResponseDataItemStatus;
    /** The timestamp when the session expires. */
    expires_at: string;
    /** The timestamp when the session ended. */
    ended_at: string | null;
    /** An ISO 8601 timestamp. */
    created_at: string;
    /** An ISO 8601 timestamp. */
    updated_at: string;
}
/** The list of records for the current page. */
export type ListUserlandUserSessionsControllerResponseDataList = Array<ListUserlandUserSessionsControllerResponseDataItem>;
export interface ListUserlandUserSessionsControllerResponse {
    /** Indicates this is a list response. */
    object?: string;
    /** Pagination cursors for navigating between pages of results. */
    list_metadata?: AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
    /** The list of records for the current page. */
    data?: ListUserlandUserSessionsControllerResponseDataList;
}
export interface ListWaitlistsControllerRequest {
}
export interface Waitlist {
    /** Distinguishes the Waitlist object. */
    object: string;
    /** The unique ID of the Waitlist. */
    id: string;
    /** An ISO 8601 timestamp. */
    created_at: string;
    /** An ISO 8601 timestamp. */
    updated_at: string;
}
/** The list of records for the current page. */
export type ListWaitlistsControllerResponseDataList = Array<Waitlist>;
/** Pagination cursors for navigating between pages of results. */
export type ListWaitlistsControllerResponseListMetadata = AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
export interface ListWaitlistsControllerResponse {
    /** Indicates this is a list response. */
    object: string;
    /** The list of records for the current page. */
    data: ListWaitlistsControllerResponseDataList;
    /** Pagination cursors for navigating between pages of results. */
    list_metadata: AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
}
export type ListWaitlistsControllerEntriesRequestState = "pending" | "approved" | "denied";
export interface ListWaitlistsControllerEntriesRequest {
    /** The unique ID of the waitlist, or the literal `default` for the environment's default waitlist. The default waitlist is created when its first entry is added, so read requests for `default` return a `404` until then. */
    id: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`. */
    before?: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`. */
    after?: string;
    /** Upper limit on the number of objects to return, between `1` and `100`. */
    limit?: number;
    /** Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. */
    order?: PaginationOrder | (string & {});
    /** Filter waitlist entries by their state. */
    state?: ListWaitlistsControllerEntriesRequestState | (string & {});
    /** Filter waitlist entries by their exact email address. */
    email?: string;
}
/** Pagination cursors for navigating between pages of results. */
export type ListWaitlistsControllerEntriesResponseListMetadata = AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
/** The list of records for the current page. */
export type ListWaitlistsControllerEntriesResponseDataList = Array<WaitlistEntry>;
export interface ListWaitlistsControllerEntriesResponse {
    /** Indicates this is a list response. */
    object?: string;
    /** Pagination cursors for navigating between pages of results. */
    list_metadata?: AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
    /** The list of records for the current page. */
    data?: ListWaitlistsControllerEntriesResponseDataList;
}
export interface ListWebhookEndpointsControllerRequest {
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`. */
    before?: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`. */
    after?: string;
    /** Upper limit on the number of objects to return, between `1` and `100`. */
    limit?: number;
    /** Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. */
    order?: PaginationOrder | (string & {});
}
/** The list of records for the current page. */
export type WebhookEndpointListDataList = Array<WebhookEndpointJson>;
/** Pagination cursors for navigating between pages of results. */
export type WebhookEndpointListListMetadata = AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
export interface WebhookEndpointList {
    /** Indicates this is a list response. */
    object?: string;
    /** The list of records for the current page. */
    data?: WebhookEndpointListDataList;
    /** Pagination cursors for navigating between pages of results. */
    list_metadata?: AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
}
export interface LogoutSsoControllerRequest {
    /** The logout token returned from the [Logout Authorize](/reference/sso/logout/authorize) endpoint. */
    token: string;
}
export interface LogoutSsoControllerResponse {
}
export interface LogoutUserlandSessionsControllerRequest {
    /** The ID of the session. This can be extracted from the `sid` claim of the access token. */
    session_id: string;
    /** The URL to redirect the user to after logout. */
    return_to?: string;
}
export interface LogoutUserlandSessionsControllerResponse {
}
export interface OrganizationsControllerFindRequest {
    /** Unique identifier of the Organization. */
    id: string;
}
export interface PatchConnectionStandardAttributesDto {
    /** The IdP attribute or claim the profile's `idp_id` is mapped from. */
    idp_id?: string;
    /** The IdP attribute or claim the profile's `email` is mapped from. */
    email?: string;
    /** The IdP attribute or claim the profile's `first_name` is mapped from. */
    first_name?: string;
    /** The IdP attribute or claim the profile's `last_name` is mapped from. */
    last_name?: string;
    /** The IdP attribute or claim the profile's `groups` are mapped from. Set to `null` to unset the mapping. */
    groups?: string | null;
    /** The IdP attribute or claim the profile's `name` is mapped from. Set to `null` to unset the mapping. */
    name?: string | null;
}
/** How IdP attributes or claims map onto custom attributes, keyed by custom attribute name. Custom attributes must already be defined in the WorkOS dashboard. Only the provided keys are updated; a `null` value unsets that mapping. */
export type PatchConnectionAttributeMapsDtoCustomAttributesMap = {
    [key: string]: string | null | undefined;
};
export interface PatchConnectionAttributeMapsDto {
    /** How IdP attributes or claims map onto the standard WorkOS profile fields. Only the provided fields are updated. */
    standard_attributes?: PatchConnectionStandardAttributesDto;
    /** How IdP attributes or claims map onto custom attributes, keyed by custom attribute name. Custom attributes must already be defined in the WorkOS dashboard. Only the provided keys are updated; a `null` value unsets that mapping. */
    custom_attributes?: PatchConnectionAttributeMapsDtoCustomAttributesMap;
}
export interface PatchConnectionSamlOptionsDto {
    /** The Identity Provider metadata URL. When provided, the IdP fields and signing certificates are re-imported from the metadata document, replacing the current set. Mutually exclusive with the manual IdP fields. Set to `null` to stop tracking a metadata URL. */
    idp_metadata_url?: string | null;
    /** A custom Assertion Consumer Service (ACS) URL override. Set to `null` to revert to the standard WorkOS-generated ACS URL. */
    acs_url?: string | null;
    /** A custom Service Provider Entity ID (audience) override. Set to `null` to revert to the connection external key. */
    sp_entity_id?: string | null;
    /** The Identity Provider Entity ID. */
    idp_entity_id?: string;
    /** The Identity Provider SSO URL. */
    idp_sso_url?: string;
}
/** The token-endpoint client authentication method. Moving to `private_key_jwt` generates a signing key pair if the connection has none; its certificate is returned in `oidc_options.jwt_signing_certs` and must be registered at the Identity Provider. */
export type PatchConnectionOidcOptionsDtoTokenAuthenticationMethod = "client_secret_post" | "client_secret_basic" | "private_key_jwt";
/** The ID-token signing algorithm. */
export type PatchConnectionOidcOptionsDtoIdTokenSignatureAlgorithm = "ES256" | "ES384" | "ES512" | "EdDSA" | "HS256" | "HS384" | "HS512" | "PS256" | "PS384" | "PS512" | "RS256" | "RS384" | "RS512";
export interface PatchConnectionOidcOptionsDto {
    /** The OIDC discovery endpoint. */
    discovery_endpoint?: string;
    /** The OIDC client ID. */
    client_id?: string;
    /** The OIDC client secret. Required when moving the connection to `client_secret_basic` or `client_secret_post`, and rejected for `private_key_jwt`, which authenticates with a key pair instead. This value is write-only and is never returned. */
    client_secret?: string | Redacted.Redacted<string>;
    /** A custom OAuth callback URL override. Set to `null` to revert to the standard WorkOS-generated redirect URI. */
    redirect_uri?: string | null;
    /** Whether PKCE is enabled for the connection. */
    pkce?: boolean;
    /** The token-endpoint client authentication method. Moving to `private_key_jwt` generates a signing key pair if the connection has none; its certificate is returned in `oidc_options.jwt_signing_certs` and must be registered at the Identity Provider. */
    token_authentication_method?: PatchConnectionOidcOptionsDtoTokenAuthenticationMethod | (string & {});
    /** The ID-token signing algorithm. */
    id_token_signature_algorithm?: PatchConnectionOidcOptionsDtoIdTokenSignatureAlgorithm | (string & {});
    /** Whether to fetch additional profile attributes from the userinfo endpoint. */
    fetch_user_info?: boolean;
}
export interface PatchConnectionsControllerRequest {
    /** Unique identifier for the Connection. */
    id: string;
    /** A human-readable name for the Connection. */
    name?: string;
    /** The customer-owned identifier for the Connection. Set to `null` to stop tracking one. */
    external_id?: string | null;
    /** The type of the Connection. Immutable after creation -- it may be sent, but only with the Connection current type. */
    connection_type?: string;
    /** How IdP attributes or claims map onto WorkOS profile fields. Only the provided fields are updated. */
    attribute_maps?: PatchConnectionAttributeMapsDto;
    /** Protocol configuration for SAML connections. Only the provided fields are updated. Mutually exclusive with `oidc_options`. */
    saml_options?: PatchConnectionSamlOptionsDto;
    /** Protocol configuration for OIDC connections. Only the provided fields are updated. Mutually exclusive with `saml_options`. */
    oidc_options?: PatchConnectionOidcOptionsDto;
}
export type ProviderControllerConfigureRequestScopesList = Array<string>;
/** Provider-specific config values to set for the organization, keyed by config field. Only fields the provider declares are accepted, and each value must match that field's pattern. Accepted only for providers whose credentials are organization-managed; for shared or custom credential providers, config belongs on the integration itself (via the data-integrations API) and supplying it here is rejected. */
export type ProviderControllerConfigureRequestConfigMap = {
    [key: string]: string | undefined;
};
export interface ProviderControllerConfigureRequest {
    /** An [Organization](/reference/organization) identifier to configure the provider for. */
    organizationId: string;
    /** The slug identifier of the provider to configure (e.g., `github`, `slack`, `notion`). */
    slug: string;
    /** Whether the provider is enabled for the organization. */
    enabled?: boolean;
    /** The OAuth scopes to request for the organization. Pass `null` to inherit the provider scopes. */
    scopes?: ProviderControllerConfigureRequestScopesList | null;
    /** The OAuth client ID of the organization's own application. Must be provided together with `client_secret`, and only for providers whose credentials are supplied by the organization. */
    client_id?: string;
    /** The OAuth client secret of the organization's own application. Must be provided together with `client_id`. */
    client_secret?: string | Redacted.Redacted<string>;
    /** Provider-specific config values to set for the organization, keyed by config field. Only fields the provider declares are accepted, and each value must match that field's pattern. Accepted only for providers whose credentials are organization-managed; for shared or custom credential providers, config belongs on the integration itself (via the data-integrations API) and supplying it here is rejected. */
    config?: ProviderControllerConfigureRequestConfigMap;
}
/** The authentication method being used. */
export type RadarStandaloneControllerAssessRequestAuthMethod = "Password" | "Passkey" | "Authenticator" | "SMS_OTP" | "Email_OTP" | "Social" | "SSO" | "Other";
/** The action being performed. */
export type RadarStandaloneControllerAssessRequestAction = "sign-up" | "sign-in";
export interface RadarStandaloneControllerAssessRequest {
    /** The IP address of the request to assess. */
    ip_address: string;
    /** The user agent string of the request to assess. */
    user_agent: string;
    /** The email address of the user making the request. */
    email: string;
    /** The authentication method being used. */
    auth_method: RadarStandaloneControllerAssessRequestAuthMethod | (string & {});
    /** The action being performed. */
    action: RadarStandaloneControllerAssessRequestAction | (string & {});
    /** An optional Radar signals ID for the request. */
    signals_id?: string;
}
/** The verdict of the risk assessment. */
export type RadarStandaloneResponseVerdict = "allow" | "block" | "challenge";
/** The Radar control that triggered the verdict. Only present if the verdict is `block` or `challenge`. */
export type RadarStandaloneResponseControl = "bot_detection" | "brute_force_attack" | "impossible_travel" | "repeat_sign_up" | "stale_account" | "unrecognized_device" | "restriction";
/** The type of blocklist entry that triggered the verdict. Only present if the control is `restriction`. */
export type RadarStandaloneResponseBlocklistType = "ip_address" | "domain" | "email" | "device" | "user_agent" | "device_fingerprint" | "country";
export interface RadarStandaloneResponse {
    /** The verdict of the risk assessment. */
    verdict?: RadarStandaloneResponseVerdict;
    /** A human-readable reason for the verdict. */
    reason?: string;
    /** Unique identifier of the authentication attempt. */
    attempt_id?: string;
    /** The Radar control that triggered the verdict. Only present if the verdict is `block` or `challenge`. */
    control?: RadarStandaloneResponseControl;
    /** The type of blocklist entry that triggered the verdict. Only present if the control is `restriction`. */
    blocklist_type?: RadarStandaloneResponseBlocklistType;
}
export type RadarStandaloneControllerDeleteRadarListEntryRequestType = "ip_address" | "domain" | "email" | "device" | "user_agent" | "device_fingerprint" | "country";
export type RadarStandaloneControllerDeleteRadarListEntryRequestAction = "block" | "allow";
export interface RadarStandaloneControllerDeleteRadarListEntryRequest {
    /** The type of the Radar list (e.g. ip_address, domain, email). */
    type: RadarStandaloneControllerDeleteRadarListEntryRequestType | (string & {});
    /** The list action indicating whether to remove the entry from the allow or block list. */
    action: RadarStandaloneControllerDeleteRadarListEntryRequestAction | (string & {});
    /** The value to remove from the list. Must match an existing entry. */
    entry: string;
}
export interface RadarStandaloneControllerDeleteRadarListEntryResponse {
}
export type RadarStandaloneControllerUpdateRadarListRequestType = "ip_address" | "domain" | "email" | "device" | "user_agent" | "device_fingerprint" | "country";
export type RadarStandaloneControllerUpdateRadarListRequestAction = "block" | "allow";
export interface RadarStandaloneControllerUpdateRadarListRequest {
    /** The type of the Radar list (e.g. ip_address, domain, email). */
    type: RadarStandaloneControllerUpdateRadarListRequestType | (string & {});
    /** The list action indicating whether to add the entry to the allow or block list. */
    action: RadarStandaloneControllerUpdateRadarListRequestAction | (string & {});
    /** The value to add to the list. Must match the format of the list type (e.g. a valid IP address for `ip_address`, a valid email for `email`). */
    entry: string;
}
export interface RadarListEntryAlreadyPresentResponse {
    /** A message indicating the entry already exists. */
    message?: string;
}
export interface RemoveAuthorizationGroupRoleAssignmentsControllerGroupRoleAssignmentRequest {
    /** The ID of the group. */
    group_id: string;
    /** The ID of the group role assignment to remove. */
    role_assignment_id: string;
}
export interface RemoveAuthorizationGroupRoleAssignmentsControllerGroupRoleAssignmentResponse {
}
export interface RemoveAuthorizationGroupRoleAssignmentsControllerGroupRoleAssignmentsRequest {
    /** The ID of the group. */
    group_id: string;
    /** The slug of the role to remove assignments for. */
    role_slug: string;
    /** The ID of the resource. Mutually exclusive with `resource_external_id` and `resource_type_slug`. */
    resource_id?: string;
    /** The external ID of the resource. */
    resource_external_id?: string;
    /** The resource type slug. */
    resource_type_slug?: string;
}
export interface RemoveAuthorizationGroupRoleAssignmentsControllerGroupRoleAssignmentsResponse {
}
export interface RemoveAuthorizationOrganizationRolePermissionsControllerPermissionRequest {
    /** The ID of the organization. */
    organizationId: string;
    /** The slug of the role. */
    slug: string;
    /** The slug of the permission to remove. */
    permissionSlug: string;
}
export interface RemoveAuthorizationRoleAssignmentsControllerRoleByCriteriaRequest {
    /** The ID of the organization membership. */
    organization_membership_id: string;
    /** The slug of the role to remove. */
    role_slug: string;
    /** The ID of the resource. Mutually exclusive with `resource_external_id` and `resource_type_slug`. */
    resource_id?: string;
    /** The external ID of the resource. Required with `resource_type_slug`. Mutually exclusive with `resource_id`. */
    resource_external_id?: string;
    /** The resource type slug. Required with `resource_external_id`. Mutually exclusive with `resource_id`. */
    resource_type_slug?: string;
}
export interface RemoveAuthorizationRoleAssignmentsControllerRoleByCriteriaResponse {
}
export interface RemoveAuthorizationRoleAssignmentsControllerRoleByIdRequest {
    /** The ID of the organization membership. */
    organization_membership_id: string;
    /** The ID of the role assignment to remove. */
    role_assignment_id: string;
}
export interface RemoveAuthorizationRoleAssignmentsControllerRoleByIdResponse {
}
export interface RemoveGroupMembershipsControllerMemberRequest {
    /** Unique identifier of the Organization. */
    organizationId: string;
    /** Unique identifier of the Group. */
    groupId: string;
    /** Unique identifier of the Organization Membership. */
    omId: string;
}
export interface RemoveGroupMembershipsControllerMemberResponse {
}
export interface ReplaceGroupRoleAssignmentEntryDto {
    /** The slug of the role to assign to the group. */
    role_slug: string;
    /** The ID of the resource. Omit along with the external-id fields to target the organization itself. */
    resource_id?: string;
    /** The external ID of the resource. */
    resource_external_id?: string;
    /** The resource type slug. */
    resource_type_slug?: string;
}
/** The list of role assignments that should exist for the group. All existing assignments will be replaced. */
export type ReplaceAuthorizationGroupRoleAssignmentsControllerGroupRoleAssignmentsRequestRoleAssignmentsList = Array<ReplaceGroupRoleAssignmentEntryDto>;
export interface ReplaceAuthorizationGroupRoleAssignmentsControllerGroupRoleAssignmentsRequest {
    /** The ID of the group. */
    group_id: string;
    /** The list of role assignments that should exist for the group. All existing assignments will be replaced. */
    role_assignments: ReplaceAuthorizationGroupRoleAssignmentsControllerGroupRoleAssignmentsRequestRoleAssignmentsList;
}
/** The locale to use when rendering the invitation email. See [supported locales](/authkit/hosted-ui/localization). */
export type ResendUserlandUserInvitesControllerRequestLocale = "af" | "am" | "ar" | "bg" | "bn" | "bs" | "ca" | "cs" | "da" | "de" | "de-DE" | "el" | "en" | "en-AU" | "en-CA" | "en-GB" | "en-US" | "es" | "es-419" | "es-ES" | "es-US" | "et" | "fa" | "fi" | "fil" | "fr" | "fr-BE" | "fr-CA" | "fr-FR" | "fy" | "gl" | "gu" | "ha" | "he" | "hi" | "hr" | "hu" | "hy" | "id" | "is" | "it" | "it-IT" | "ja" | "jv" | "ka" | "kk" | "km" | "kn" | "ko" | "lt" | "lv" | "mk" | "ml" | "mn" | "mr" | "ms" | "my" | "nb" | "ne" | "nl" | "nl-BE" | "nl-NL" | "nn" | "no" | "pa" | "pl" | "pt" | "pt-BR" | "pt-PT" | "ro" | "ru" | "sk" | "sl" | "sq" | "sr" | "sv" | "sw" | "ta" | "te" | "th" | "tr" | "uk" | "ur" | "uz" | "vi" | "zh" | "zh-CN" | "zh-HK" | "zh-TW" | "zu";
export interface ResendUserlandUserInvitesControllerRequest {
    /** The unique ID of the invitation. */
    id: string;
    /** The locale to use when rendering the invitation email. See [supported locales](/authkit/hosted-ui/localization). */
    locale?: ResendUserlandUserInvitesControllerRequestLocale | (string & {});
}
export interface ResetUserlandUsersControllerPassword0Request {
    /** The password reset token. */
    token?: string;
    /** The new password to set for the user. */
    new_password?: string | Redacted.Redacted<string>;
}
export interface ResetPasswordResponse {
    /** The user whose password was reset. */
    user?: UserlandUser;
}
export interface RevokeAgentInstanceSessionsControllerRequest {
    /** The unique ID of the agent instance session. */
    agent_instance_session_id: string;
}
export interface RevokeItContactsControllerRequest {
    /** The ID of the organization. */
    organization_id: string;
    /** The ID of the IT contact. */
    contact_id: string;
}
export interface RevokeItContactsControllerResponse {
}
export interface RevokeUserlandSessionsControllerSessionRequest {
    /** The ID of the session to revoke. This can be extracted from the `sid` claim of the access token. */
    session_id?: string;
}
export interface RevokeUserlandSessionsControllerSessionResponse {
}
export interface RevokeUserlandUserInvitesControllerRequest {
    /** The unique ID of the invitation. */
    id: string;
}
/** The state of the invitation. */
export type RevokeUserlandUserInvitesControllerResponseState = "pending" | "accepted" | "expired" | "revoked";
export interface RevokeUserlandUserInvitesControllerResponse {
    /** Distinguishes the invitation object. */
    object: string;
    /** The unique ID of the invitation. */
    id: string;
    /** The email address of the recipient. */
    email: string;
    /** The state of the invitation. */
    state: RevokeUserlandUserInvitesControllerResponseState;
    /** The timestamp when the invitation was accepted, or null if not yet accepted. */
    accepted_at: string | null;
    /** The timestamp when the invitation was revoked, or null if not revoked. */
    revoked_at: string | null;
    /** The timestamp when the invitation expires. */
    expires_at: string;
    /** The ID of the [organization](/reference/organization) that the recipient will join. */
    organization_id: string | null;
    /** The ID of the user who invited the recipient, if provided. */
    inviter_user_id: string | null;
    /** The ID of the user who accepted the invitation, once accepted. */
    accepted_user_id: string | null;
    /** Slug of the role the invitee will be assigned on acceptance. Reflects the current role on the invitee's organization membership. null when the invitation has no associated organization. */
    role_slug: string | null;
    /** An ISO 8601 timestamp. */
    created_at: string;
    /** An ISO 8601 timestamp. */
    updated_at: string;
    /** The token used to accept the invitation. */
    token: string;
    /** The URL where the recipient can accept the invitation. */
    accept_invitation_url: string;
}
export interface SendPublicRadarChallengesControllerRadarSmsChallengeRequest {
    /** The ID of the user to send the SMS challenge to. */
    user_id: string;
    /** The pending authentication token from a previous authentication attempt that triggered the Radar challenge. */
    pending_authentication_token: string;
    /** The phone number to send the SMS verification code to. */
    phone_number: string;
    /** The IP address of the user's request. */
    ip_address?: string;
    /** The user agent string from the user's request. */
    user_agent?: string;
}
export interface SendRadarSmsChallengeResponse {
    /** The ID of the SMS verification. Pass this to the authenticate endpoint to verify the code. */
    verification_id: string;
    /** The phone number the verification code was sent to. */
    phone_number: string;
}
export interface SendUserlandUsersControllerEmailChangeRequest {
    /** The unique ID of the user. */
    id: string;
    /** The new email address to change to. */
    new_email?: string;
}
export interface EmailChange {
    /** Distinguishes the email change object. */
    object?: string;
    user?: UserlandUser;
    /** The new email address the user is changing to. */
    new_email?: string;
    /** The timestamp when the email change code expires. */
    expires_at?: string;
    /** The timestamp when the email change challenge was created. */
    created_at?: string;
}
export interface SendUserlandUsersControllerVerificationEmail0Request {
    /** The ID of the user. */
    id: string;
}
export interface SendVerificationEmailResponse {
    /** The user to whom the verification email was sent. */
    user?: UserlandUser;
}
/** The permission slugs to assign to the role. */
export type SetAuthorizationOrganizationRolePermissionsControllerPermissionsRequestPermissionsList = Array<string>;
export interface SetAuthorizationOrganizationRolePermissionsControllerPermissionsRequest {
    /** The ID of the organization. */
    organizationId: string;
    /** The slug of the role. */
    slug: string;
    /** The permission slugs to assign to the role. */
    permissions?: SetAuthorizationOrganizationRolePermissionsControllerPermissionsRequestPermissionsList;
}
/** Whether the role is scoped to the environment or an organization (custom role). */
export type SetAuthorizationOrganizationRolePermissionsControllerPermissionsResponseType = "EnvironmentRole" | "OrganizationRole";
/** The permission slugs assigned to the role. */
export type SetAuthorizationOrganizationRolePermissionsControllerPermissionsResponsePermissionsList = Array<string>;
export interface SetAuthorizationOrganizationRolePermissionsControllerPermissionsResponse {
    /** A unique slug for the role. */
    slug: string;
    /** Distinguishes the role object. */
    object: string;
    /** Unique identifier of the role. */
    id: string;
    /** A descriptive name for the role. */
    name: string;
    /** An optional description of the role. */
    description: string | null;
    /** Whether the role is scoped to the environment or an organization (custom role). */
    type: SetAuthorizationOrganizationRolePermissionsControllerPermissionsResponseType;
    /** The slug of the resource type the role is scoped to. */
    resource_type_slug: string;
    /** The permission slugs assigned to the role. */
    permissions: SetAuthorizationOrganizationRolePermissionsControllerPermissionsResponsePermissionsList;
    /** An ISO 8601 timestamp. */
    created_at: string;
    /** An ISO 8601 timestamp. */
    updated_at: string;
}
/** The permission slugs to assign to the role. */
export type SetAuthorizationRolePermissionsControllerPermissionsRequestPermissionsList = Array<string>;
export interface SetAuthorizationRolePermissionsControllerPermissionsRequest {
    /** The slug of the environment role. */
    slug: string;
    /** The permission slugs to assign to the role. */
    permissions?: SetAuthorizationRolePermissionsControllerPermissionsRequestPermissionsList;
}
/** Whether the role is scoped to the environment or an organization (custom role). */
export type SetAuthorizationRolePermissionsControllerPermissionsResponseType = "EnvironmentRole" | "OrganizationRole";
/** The permission slugs assigned to the role. */
export type SetAuthorizationRolePermissionsControllerPermissionsResponsePermissionsList = Array<string>;
export interface SetAuthorizationRolePermissionsControllerPermissionsResponse {
    /** A unique slug for the role. */
    slug: string;
    /** Distinguishes the role object. */
    object: string;
    /** Unique identifier of the role. */
    id: string;
    /** A descriptive name for the role. */
    name: string;
    /** An optional description of the role. */
    description: string | null;
    /** Whether the role is scoped to the environment or an organization (custom role). */
    type: SetAuthorizationRolePermissionsControllerPermissionsResponseType;
    /** The slug of the resource type the role is scoped to. */
    resource_type_slug: string;
    /** The permission slugs assigned to the role. */
    permissions: SetAuthorizationRolePermissionsControllerPermissionsResponsePermissionsList;
    /** An ISO 8601 timestamp. */
    created_at: string;
    /** An ISO 8601 timestamp. */
    updated_at: string;
}
export interface SsoControllerJsonWebKeySetRequest {
    /** Identifies the application making the request to the WorkOS server. You can obtain your client ID from the [API Keys](https://dashboard.workos.com/api-keys) page in the dashboard. */
    clientId: string;
}
/** X.509 certificate chain. */
export type JwksResponseKeysItemX5cList = Array<string>;
export interface JwksResponseKeysItem {
    /** Algorithm. */
    alg: string;
    /** Key type. */
    kty: string;
    /** Key use (signature). */
    use: string;
    /** X.509 certificate chain. */
    x5c: JwksResponseKeysItemX5cList;
    /** RSA modulus. */
    n: string;
    /** RSA exponent. */
    e: string;
    /** Key ID. */
    kid: string;
    /** X.509 certificate SHA-256 thumbprint. */
    x5t_S256: string;
}
/** The public keys used for verifying access tokens. */
export type JwksResponseKeysList = Array<JwksResponseKeysItem>;
export interface JwksResponse {
    /** The public keys used for verifying access tokens. */
    keys?: JwksResponseKeysList;
}
export interface SsoControllerLogoutAuthorizeRequest {
    /** The unique ID of the profile to log out. */
    profile_id: string;
}
export interface SsoLogoutAuthorizeResponse {
    /** The URL to redirect the user to in order to log out ([Logout Redirect](/reference/sso/logout) endpoint ready to use). */
    logout_url?: string;
    /** The logout token to be used in the [Logout Redirect](/reference/sso/logout) endpoint. */
    logout_token?: string;
}
export type SsoControllerTokenRequestGrantType = "authorization_code" | "urn:ietf:params:oauth:grant-type:token-exchange";
export interface SsoControllerTokenRequest {
    /** The client ID of the WorkOS environment. */
    client_id: string;
    /** The client secret of the WorkOS environment. */
    client_secret: string;
    /** The authorization code received from the authorization callback. Required when `grant_type` is `authorization_code`. */
    code?: string;
    /** The grant type for the token request. */
    grant_type: SsoControllerTokenRequestGrantType | (string & {});
    /** The PKCE code verifier matching the `code_challenge` sent with the authorization request. Required when the authorization request included a `code_challenge`. Must be sent in the request body. */
    code_verifier?: string;
    /** The OIDC ID token to exchange. Required when `grant_type` is `urn:ietf:params:oauth:grant-type:token-exchange`. Must be sent in the request body. */
    subject_token?: string;
    /** The type of the subject token. Required when `grant_type` is `urn:ietf:params:oauth:grant-type:token-exchange`. Must be sent in the request body. */
    subject_token_type?: string;
    /** The ID of the organization whose connection the subject token is validated against. Required when `grant_type` is `urn:ietf:params:oauth:grant-type:token-exchange`. Must be sent in the request body. */
    organization_id?: string;
}
/** A list of OAuth scopes for which the access token is authorized. */
export type SsoTokenResponseOauthTokensScopesList = Array<string>;
/** OAuth tokens issued by the identity provider, if available. */
export interface SsoTokenResponseOauthTokens {
    /** The OAuth provider used for authentication. */
    provider: string;
    /** The refresh token from the OAuth provider. */
    refresh_token: string | Redacted.Redacted<string>;
    /** The access token from the OAuth provider. */
    access_token: string | Redacted.Redacted<string>;
    /** The timestamp at which the access token expires. */
    expires_at: number;
    /** A list of OAuth scopes for which the access token is authorized. */
    scopes: SsoTokenResponseOauthTokensScopesList;
}
export interface SsoTokenResponse {
    /** The type of token issued. */
    token_type?: string;
    /** An access token that can be exchanged for a user profile. Access tokens are short-lived -- see the `expires_in` field for the exact lifetime. */
    access_token?: string | Redacted.Redacted<string>;
    /** The lifetime of the access token in seconds. */
    expires_in?: number;
    /** The user profile returned by the identity provider. */
    profile?: Profile;
    /** OAuth tokens issued by the identity provider, if available. */
    oauth_tokens?: SsoTokenResponseOauthTokens;
}
export interface SyncDirectoriesControllerDirectoryRequest {
    /** Unique identifier for the Directory. */
    id: string;
}
export interface SyncDirectoriesControllerDirectoryResponse {
}
/** Permission slugs forming the ceiling on what sessions minted from this blueprint may do. Each slug must exist in the environment. */
export type UpdateAgentBlueprintsControllerRequestPermissionsList = Array<string>;
/** Role slugs whose members may mint user-delegated sessions from this blueprint. An empty list allows any member. */
export type UpdateAgentBlueprintsControllerRequestInvocableByRoleSlugsList = Array<string>;
/** Organizations in which sessions may be minted from this blueprint, enforced on user-delegated, autonomous, and agent-delegated mints. An empty list allows any organization in the environment. */
export type UpdateAgentBlueprintsControllerRequestInvocableByOrganizationIdsList = Array<string>;
/** Who may mint sessions from this blueprint. Omitted lists are left unchanged. */
export interface UpdateAgentBlueprintsControllerRequestInvocableBy {
    /** Role slugs whose members may mint user-delegated sessions from this blueprint. An empty list allows any member. */
    role_slugs?: UpdateAgentBlueprintsControllerRequestInvocableByRoleSlugsList;
    /** Organizations in which sessions may be minted from this blueprint, enforced on user-delegated, autonomous, and agent-delegated mints. An empty list allows any organization in the environment. */
    organization_ids?: UpdateAgentBlueprintsControllerRequestInvocableByOrganizationIdsList;
}
export type UpdateAgentBlueprintsControllerRequestInvocableAsInstanceTypesItem = "delegated" | "autonomous";
/** Instance types that may be minted from this blueprint: `delegated` and/or `autonomous`. At least one is required; existing sessions of a removed type are refused at their next refresh. */
export type UpdateAgentBlueprintsControllerRequestInvocableAsInstanceTypesList = Array<UpdateAgentBlueprintsControllerRequestInvocableAsInstanceTypesItem | (string & {})>;
/** How sessions may be minted from this blueprint. Omitted lists are left unchanged. */
export interface UpdateAgentBlueprintsControllerRequestInvocableAs {
    /** Instance types that may be minted from this blueprint: `delegated` and/or `autonomous`. At least one is required; existing sessions of a removed type are refused at their next refresh. */
    instance_types?: UpdateAgentBlueprintsControllerRequestInvocableAsInstanceTypesList;
}
/** Token and session lifetimes for sessions minted from this blueprint. Omitted fields are left unchanged. */
export interface UpdateAgentBlueprintsControllerRequestSessionSettings {
    /** Maximum lifetime of a session in seconds; refreshes never extend a session past this. At most 31,536,000 (365 days). */
    max_age_seconds?: number;
    /** Lifetime of each minted access token in seconds. At most 3,600 (1 hour). */
    access_token_ttl_seconds?: number;
    /** Lifetime of each rotated refresh token in seconds. At most 5,184,000 (60 days). */
    refresh_token_ttl_seconds?: number;
}
export interface UpdateAgentBlueprintsControllerRequest {
    /** The unique ID of the agent blueprint. */
    agent_blueprint_id: string;
    /** Human-readable name of the agent blueprint. */
    name?: string;
    /** Human-readable description of the agent blueprint. Pass `null` to clear it. */
    description?: string | null;
    /** Permission slugs forming the ceiling on what sessions minted from this blueprint may do. Each slug must exist in the environment. */
    permissions?: UpdateAgentBlueprintsControllerRequestPermissionsList;
    /** Who may mint sessions from this blueprint. Omitted lists are left unchanged. */
    invocable_by?: UpdateAgentBlueprintsControllerRequestInvocableBy;
    /** How sessions may be minted from this blueprint. Omitted lists are left unchanged. */
    invocable_as?: UpdateAgentBlueprintsControllerRequestInvocableAs;
    /** Token and session lifetimes for sessions minted from this blueprint. Omitted fields are left unchanged. */
    session_settings?: UpdateAgentBlueprintsControllerRequestSessionSettings;
}
/** The OAuth scopes granted to the application. */
export type UpdateApplicationsControllerRequestScopesList = Array<string>;
/** Updated redirect URIs for the application. OAuth applications only. */
export type UpdateApplicationsControllerRequestRedirectUrisList = Array<RedirectUriDto>;
export interface UpdateApplicationsControllerRequest {
    /** The application ID or client ID of the Connect Application. */
    id: string;
    /** The name of the application. */
    name?: string;
    /** A description for the application. */
    description?: string | null;
    /** The OAuth scopes granted to the application. */
    scopes?: UpdateApplicationsControllerRequestScopesList | null;
    /** Updated redirect URIs for the application. OAuth applications only. */
    redirect_uris?: UpdateApplicationsControllerRequestRedirectUrisList | null;
}
/** The scopes available for this application. */
export type UpdateApplicationsControllerResponseScopesList = Array<string>;
export type UpdateApplicationsControllerResponseRedirectUrisItem = ApplicationsControllerFindResponseRedirectUrisItem;
/** The redirect URIs configured for this application. */
export type UpdateApplicationsControllerResponseRedirectUrisList = Array<ApplicationsControllerFindResponseRedirectUrisItem>;
export interface UpdateApplicationsControllerResponse {
    /** Distinguishes the connect application object. */
    object: string;
    /** The unique ID of the connect application. */
    id: string;
    /** The client ID of the connect application. */
    client_id: string;
    /** A description of the connect application. */
    description: string | null;
    /** The name of the connect application. */
    name: string;
    /** The scopes available for this application. */
    scopes: UpdateApplicationsControllerResponseScopesList;
    /** An ISO 8601 timestamp. */
    created_at: string;
    /** An ISO 8601 timestamp. */
    updated_at: string;
    /** The type of the application. */
    application_type?: string;
    /** The redirect URIs configured for this application. */
    redirect_uris?: UpdateApplicationsControllerResponseRedirectUrisList;
    /** Whether the application uses PKCE for authorization. */
    uses_pkce?: boolean;
    /** Whether the application is a first-party application. */
    is_first_party?: boolean;
    /** Whether the application was dynamically registered. */
    was_dynamically_registered?: boolean;
    /** The ID of the organization the application belongs to. */
    organization_id?: string;
}
/** The period Audit Log events will be retained. Valid values are `1_MONTH` through `11_MONTHS` in one-month increments and `1_YEAR` through `10_YEARS` in one-year increments. Mutually exclusive with `retention_period_in_days`. */
export type UpdateAuditLogsRetentionDtoCase0RetentionPeriod = "1_MONTH" | "2_MONTHS" | "3_MONTHS" | "4_MONTHS" | "5_MONTHS" | "6_MONTHS" | "7_MONTHS" | "8_MONTHS" | "9_MONTHS" | "10_MONTHS" | "11_MONTHS" | "1_YEAR" | "2_YEARS" | "3_YEARS" | "4_YEARS" | "5_YEARS" | "6_YEARS" | "7_YEARS" | "8_YEARS" | "9_YEARS" | "10_YEARS";
export interface UpdateAuditLogsRetentionDtoCase0 {
    /** The period Audit Log events will be retained. Valid values are `1_MONTH` through `11_MONTHS` in one-month increments and `1_YEAR` through `10_YEARS` in one-year increments. Mutually exclusive with `retention_period_in_days`. */
    retention_period: UpdateAuditLogsRetentionDtoCase0RetentionPeriod | (string & {});
}
export interface UpdateAuditLogsRetentionDtoCase1 {
    /** The number of days Audit Log events will be retained. Valid values are `30` through `330` in 30-day increments and `365` through `3650` in 365-day increments. Deprecated: use `retention_period` instead. Mutually exclusive with `retention_period`. */
    retention_period_in_days: number;
}
export type UpdateAuditLogsRetentionDto = UpdateAuditLogsRetentionDtoCase0 | UpdateAuditLogsRetentionDtoCase1;
export interface UpdateAuditLogsRetentionControllerAuditLogsRetentionRequest {
    /** Unique identifier of the Organization. */
    id: string;
    body: UpdateAuditLogsRetentionDto;
}
export interface UpdateAuthorizationOrganizationRolesControllerRequest {
    /** The ID of the organization. */
    organizationId: string;
    /** The slug of the role. */
    slug: string;
    /** A descriptive name for the role. */
    name?: string;
    /** An optional description of the role's purpose. */
    description?: string | null;
}
/** Whether the role is scoped to the environment or an organization (custom role). */
export type UpdateAuthorizationOrganizationRolesControllerResponseType = "EnvironmentRole" | "OrganizationRole";
/** The permission slugs assigned to the role. */
export type UpdateAuthorizationOrganizationRolesControllerResponsePermissionsList = Array<string>;
export interface UpdateAuthorizationOrganizationRolesControllerResponse {
    /** A unique slug for the role. */
    slug: string;
    /** Distinguishes the role object. */
    object: string;
    /** Unique identifier of the role. */
    id: string;
    /** A descriptive name for the role. */
    name: string;
    /** An optional description of the role. */
    description: string | null;
    /** Whether the role is scoped to the environment or an organization (custom role). */
    type: UpdateAuthorizationOrganizationRolesControllerResponseType;
    /** The slug of the resource type the role is scoped to. */
    resource_type_slug: string;
    /** The permission slugs assigned to the role. */
    permissions: UpdateAuthorizationOrganizationRolesControllerResponsePermissionsList;
    /** An ISO 8601 timestamp. */
    created_at: string;
    /** An ISO 8601 timestamp. */
    updated_at: string;
}
export interface UpdateAuthorizationPermissionsControllerRequest {
    /** A unique key to reference the permission. Must be lowercase and contain only letters, numbers, hyphens, underscores, colons, periods, and asterisks. */
    slug: string;
    /** A descriptive name for the Permission. */
    name?: string;
    /** An optional description of the Permission. */
    description?: string | null;
}
export interface UpdateAuthorizationResourcesByExternalIdControllerByExternalIdRequest {
    /** The ID of the organization that owns the resource. */
    organization_id: string;
    /** The slug of the resource type. */
    resource_type_slug: string;
    /** An identifier you provide to reference the resource in your system. */
    external_id: string;
    /** A display name for the resource. */
    name?: string;
    /** An optional description of the resource. */
    description?: string | null;
    /** The ID of the parent resource. Mutually exclusive with `parent_resource_external_id` and `parent_resource_type_slug`. */
    parent_resource_id?: string;
    /** The external ID of the parent resource. Required with `parent_resource_type_slug`. Mutually exclusive with `parent_resource_id`. */
    parent_resource_external_id?: string;
    /** The resource type slug of the parent resource. Required with `parent_resource_external_id`. Mutually exclusive with `parent_resource_id`. */
    parent_resource_type_slug?: string;
}
export interface UpdateAuthorizationResourcesByExternalIdControllerByExternalIdResponse {
    /** Distinguishes the Resource object. */
    object: string;
    /** A human-readable name for the Resource. */
    name: string;
    /** An optional description of the Resource. */
    description: string | null;
    /** The ID of the organization that owns the resource. */
    organization_id: string;
    /** The ID of the parent resource, if this resource is nested. */
    parent_resource_id: string | null;
    /** The unique ID of the Resource. */
    id: string;
    /** An identifier you provide to reference the resource in your system. */
    external_id: string;
    /** The slug of the resource type this resource belongs to. */
    resource_type_slug: string;
    /** An ISO 8601 timestamp. */
    created_at: string;
    /** An ISO 8601 timestamp. */
    updated_at: string;
}
export interface UpdateAuthorizationResourcesControllerRequest {
    /** The ID of the authorization resource. */
    resource_id: string;
    /** A display name for the resource. */
    name?: string;
    /** An optional description of the resource. */
    description?: string | null;
    /** The ID of the parent resource. Mutually exclusive with `parent_resource_external_id` and `parent_resource_type_slug`. */
    parent_resource_id?: string;
    /** The external ID of the parent resource. Required with `parent_resource_type_slug`. Mutually exclusive with `parent_resource_id`. */
    parent_resource_external_id?: string;
    /** The resource type slug of the parent resource. Required with `parent_resource_external_id`. Mutually exclusive with `parent_resource_id`. */
    parent_resource_type_slug?: string;
}
export interface UpdateAuthorizationResourcesControllerResponse {
    /** Distinguishes the Resource object. */
    object: string;
    /** A human-readable name for the Resource. */
    name: string;
    /** An optional description of the Resource. */
    description: string | null;
    /** The ID of the organization that owns the resource. */
    organization_id: string;
    /** The ID of the parent resource, if this resource is nested. */
    parent_resource_id: string | null;
    /** The unique ID of the Resource. */
    id: string;
    /** An identifier you provide to reference the resource in your system. */
    external_id: string;
    /** The slug of the resource type this resource belongs to. */
    resource_type_slug: string;
    /** An ISO 8601 timestamp. */
    created_at: string;
    /** An ISO 8601 timestamp. */
    updated_at: string;
}
export interface UpdateAuthorizationRolesControllerRequest {
    /** The slug of the environment role. */
    slug: string;
    /** A descriptive name for the role. */
    name?: string;
    /** An optional description of the role. */
    description?: string | null;
}
/** Whether the role is scoped to the environment or an organization (custom role). */
export type UpdateAuthorizationRolesControllerResponseType = "EnvironmentRole" | "OrganizationRole";
/** The permission slugs assigned to the role. */
export type UpdateAuthorizationRolesControllerResponsePermissionsList = Array<string>;
export interface UpdateAuthorizationRolesControllerResponse {
    /** A unique slug for the role. */
    slug: string;
    /** Distinguishes the role object. */
    object: string;
    /** Unique identifier of the role. */
    id: string;
    /** A descriptive name for the role. */
    name: string;
    /** An optional description of the role. */
    description: string | null;
    /** Whether the role is scoped to the environment or an organization (custom role). */
    type: UpdateAuthorizationRolesControllerResponseType;
    /** The slug of the resource type the role is scoped to. */
    resource_type_slug: string;
    /** The permission slugs assigned to the role. */
    permissions: UpdateAuthorizationRolesControllerResponsePermissionsList;
    /** An ISO 8601 timestamp. */
    created_at: string;
    /** An ISO 8601 timestamp. */
    updated_at: string;
}
/** The OAuth scopes to request for the Data Integration. Pass `null` to reset to the provider's configured scopes. */
export type UpdateDataIntegrationsManagementControllerDataIntegrationRequestScopesList = Array<string>;
/** Additional static query parameters appended to the authorization request. */
export type UpdateCustomProviderDefinitionDtoAdditionalAuthorizationParametersMap = {
    [key: string]: string | undefined;
};
/** How client credentials are sent when exchanging authorization codes and refreshing tokens. */
export type UpdateCustomProviderDefinitionDtoAuthenticateVia = "request_body" | "basic_auth_header";
export interface UpdateCustomProviderDefinitionDto {
    /** A descriptive name for the custom provider. */
    name?: string;
    /** The provider's OAuth authorization endpoint. Must be a static URL: `${config....}` placeholders are resolved against a provider's declared config fields, which custom providers cannot declare. */
    authorization_url?: string;
    /** The provider's OAuth token endpoint. Must be a static URL: `${config....}` placeholders are resolved against a provider's declared config fields, which custom providers cannot declare. */
    token_url?: string;
    /** The endpoint used to refresh tokens, if different from the token endpoint. Must be a static URL, like the other endpoints. */
    refresh_token_url?: string | null;
    /** Whether PKCE is used during the authorization code flow. */
    pkce_enabled?: boolean;
    /** The separator used to join requested scopes. */
    request_scope_separator?: string;
    /** Whether at least one scope must be selected when connecting an account. */
    scopes_required?: boolean;
    /** Whether a client secret is required for this provider. */
    client_secret_required?: boolean;
    /** Additional static query parameters appended to the authorization request. */
    additional_authorization_parameters?: UpdateCustomProviderDefinitionDtoAdditionalAuthorizationParametersMap;
    /** The Content-Type used when exchanging the token request. */
    token_body_content_type?: string;
    /** How client credentials are sent when exchanging authorization codes and refreshing tokens. */
    authenticate_via?: UpdateCustomProviderDefinitionDtoAuthenticateVia | (string & {});
}
export interface UpdateDataIntegrationsManagementControllerDataIntegrationRequest {
    /** The slug identifier of the data integration. */
    slug: string;
    /** An optional description of the Data Integration. */
    description?: string | null;
    /** Whether the Data Integration is enabled. */
    enabled?: boolean;
    /** The OAuth scopes to request for the Data Integration. Pass `null` to reset to the provider's configured scopes. */
    scopes?: UpdateDataIntegrationsManagementControllerDataIntegrationRequestScopesList | null;
    /** New OAuth credentials for the Data Integration. When provided, rotates the stored client secret. Mutually exclusive with `api_key`. */
    credentials?: DataIntegrationCredentialsDto;
    /** An API key to install or rotate for a tenant on an `api_key` integration. Upserts the tenant installation identified by `user_id` (and optional `organization_id`). */
    api_key?: ApiKeyInstallationDto;
    /** Updates to a custom provider's OAuth definition. Only valid for custom-provider integrations. */
    custom_provider?: UpdateCustomProviderDefinitionDto;
}
/** The OAuth scopes to request for the Data Integration. Pass `null` to reset to the provider's configured scopes. */
export type UpdateDataIntegrationsManagementControllerOrganizationDataIntegrationRequestScopesList = Array<string>;
export interface UpdateDataIntegrationsManagementControllerOrganizationDataIntegrationRequest {
    /** The slug identifier of the data integration. */
    slug: string;
    /** An optional description of the Data Integration. */
    description?: string | null;
    /** Whether the Data Integration is enabled. */
    enabled?: boolean;
    /** The OAuth scopes to request for the Data Integration. Pass `null` to reset to the provider's configured scopes. */
    scopes?: UpdateDataIntegrationsManagementControllerOrganizationDataIntegrationRequestScopesList | null;
    /** New OAuth credentials for the Data Integration. When provided, rotates the stored client secret. Mutually exclusive with `api_key`. */
    credentials?: DataIntegrationCredentialsDto;
    /** An API key to install or rotate for a tenant on an `api_key` integration. Upserts the tenant installation identified by `user_id` (and optional `organization_id`). */
    api_key?: ApiKeyInstallationDto;
    /** Updates to a custom provider's OAuth definition. Only valid for custom-provider integrations. */
    custom_provider?: UpdateCustomProviderDefinitionDto;
}
/** The OAuth scopes granted for this connection. */
export type UpdateDataIntegrationsOrganizationControllerOrganizationDataInstallationRequestScopesList = Array<string>;
/** Explicitly set the state of the connected account. When omitted, the state is derived from the token combination provided. */
export type UpdateDataIntegrationsOrganizationControllerOrganizationDataInstallationRequestState = "connected" | "needs_reauthorization";
export interface UpdateDataIntegrationsOrganizationControllerOrganizationDataInstallationRequest {
    /** An [Organization](/reference/organization) identifier. */
    organization_id: string;
    /** The slug identifier of the provider (e.g., `github`, `slack`, `notion`). */
    slug: string;
    /** Accepted for compatibility; does not change update targeting. Omit intent and selector to update the compatibility connection, or supply `connected_account_id` to update an exact connection. */
    supports_multiple_connections?: boolean;
    /** A [connected account](/reference/pipes/connected-account) identifier. Use this to select the connection to update. */
    connected_account_id?: string;
    /** Set to `reauthorize` with `connected_account_id` to update one exact connection. The intent may be omitted when supplying an ID. Omit both for permanent compatibility behavior. */
    connection_intent?: string;
    /** A mutable, non-unique connection label; null clears it. Not an account identifier. */
    account_display_name?: string | null;
    /** A developer-attested account identifier; null clears it. */
    account_identifier?: string | null;
    /** The OAuth access token for the connected account. */
    access_token?: string | Redacted.Redacted<string>;
    /** The OAuth refresh token for the connected account. */
    refresh_token?: string | Redacted.Redacted<string>;
    /** The ISO-8601 timestamp when the access token expires. Required when `access_token` is provided for tokens that expire. */
    expires_at?: string;
    /** The OAuth scopes granted for this connection. */
    scopes?: UpdateDataIntegrationsOrganizationControllerOrganizationDataInstallationRequestScopesList;
    /** Explicitly set the state of the connected account. When omitted, the state is derived from the token combination provided. */
    state?: UpdateDataIntegrationsOrganizationControllerOrganizationDataInstallationRequestState | (string & {});
    /** The [User](/reference/authkit/user) identifier of the organization member on whose behalf the connected account is being imported or updated. The user must be an active member of the organization. */
    user_id: string;
}
/** The OAuth scopes granted for this connection. */
export type UpdateDataIntegrationsUserManagementControllerUserDataInstallationRequestScopesList = Array<string>;
/** Explicitly set the state of the connected account. When omitted, the state is derived from the token combination provided. */
export type UpdateDataIntegrationsUserManagementControllerUserDataInstallationRequestState = "connected" | "needs_reauthorization";
export interface UpdateDataIntegrationsUserManagementControllerUserDataInstallationRequest {
    /** A [User](/reference/authkit/user) identifier. */
    user_id: string;
    /** The slug identifier of the provider (e.g., `github`, `slack`, `notion`). */
    slug: string;
    /** An [Organization](/reference/organization) identifier. Optional parameter if the connection is scoped to an organization. */
    organization_id?: string;
    /** Accepted for compatibility; does not change update targeting. Omit intent and selector to update the compatibility connection, or supply `connected_account_id` to update an exact connection. */
    supports_multiple_connections?: boolean;
    /** A [connected account](/reference/pipes/connected-account) identifier. Use this to select the connection to update. */
    connected_account_id?: string;
    /** Set to `reauthorize` with `connected_account_id` to update one exact connection. The intent may be omitted when supplying an ID. Omit both for permanent compatibility behavior. */
    connection_intent?: string;
    /** A mutable, non-unique connection label; null clears it. Not an account identifier. */
    account_display_name?: string | null;
    /** A developer-attested account identifier; null clears it. */
    account_identifier?: string | null;
    /** The OAuth access token for the connected account. */
    access_token?: string | Redacted.Redacted<string>;
    /** The OAuth refresh token for the connected account. */
    refresh_token?: string | Redacted.Redacted<string>;
    /** The ISO-8601 timestamp when the access token expires. Required when `access_token` is provided for tokens that expire. */
    expires_at?: string;
    /** The OAuth scopes granted for this connection. */
    scopes?: UpdateDataIntegrationsUserManagementControllerUserDataInstallationRequestScopesList;
    /** Explicitly set the state of the connected account. When omitted, the state is derived from the token combination provided. */
    state?: UpdateDataIntegrationsUserManagementControllerUserDataInstallationRequestState | (string & {});
}
export interface UpdateGroupsControllerRequest {
    /** The ID of the organization. */
    organizationId: string;
    /** The ID of the group. */
    groupId: string;
    /** The name of the Group. */
    name?: string;
    /** An optional description of the Group. */
    description?: string | null;
}
export interface UpdateJumpWireWebDataVaultControllerRequest {
    /** Unique identifier of the object. */
    id: string;
    /** New plaintext value. */
    value: string;
    /** ID of the expected current version for optimistic locking. */
    version_check?: string | null;
}
export interface UpdateJwtTemplatesControllerJwtTemplateRequest {
    /** The JWT template content as a Liquid template string. */
    content?: string;
}
/** The domains associated with the organization. Deprecated in favor of `domain_data`. */
export type UpdateOrganizationsControllerOrganizationRequestDomainsList = Array<string>;
/** The domains associated with the organization, including verification state. */
export type UpdateOrganizationsControllerOrganizationRequestDomainDataList = Array<OrganizationDomainDataDto>;
/** Object containing [metadata](/authkit/metadata) key/value pairs associated with the Organization. */
export type UpdateOrganizationsControllerOrganizationRequestMetadataMap = {
    [key: string]: string | undefined;
};
export interface UpdateOrganizationsControllerOrganizationRequest {
    /** Unique identifier of the Organization. */
    id: string;
    /** The name of the organization. */
    name?: string;
    /** Whether the organization allows profiles from outside the organization to sign in. */
    allow_profiles_outside_organization?: boolean;
    /** The domains associated with the organization. Deprecated in favor of `domain_data`. */
    domains?: UpdateOrganizationsControllerOrganizationRequestDomainsList;
    /** The domains associated with the organization, including verification state. */
    domain_data?: UpdateOrganizationsControllerOrganizationRequestDomainDataList;
    /** The Stripe customer ID associated with the organization. */
    stripe_customer_id?: string;
    /** Object containing [metadata](/authkit/metadata) key/value pairs associated with the Organization. */
    metadata?: UpdateOrganizationsControllerOrganizationRequestMetadataMap | null;
    /** An external identifier for the Organization. */
    external_id?: string | null;
}
export interface UpdateRadarStandaloneControllerRadarAttemptRequest {
    /** The unique identifier of the Radar attempt to update. */
    id: string;
    /** Set to `"success"` to mark the challenge as completed. */
    challenge_status?: string;
    /** Set to `"success"` to mark the authentication attempt as successful. */
    attempt_status?: string;
}
export interface UpdateRadarStandaloneControllerRadarAttemptResponse {
}
export interface UpdateUserlandUserOrganizationMembershipDtoCase1 {
    /** A single role identifier. Defaults to `member` or the explicit default role. Mutually exclusive with `role_slugs`. */
    role_slug: string;
}
/** An array of role identifiers. Limited to one role when Multiple Roles is disabled. Mutually exclusive with `role_slug`. */
export type UpdateUserlandUserOrganizationMembershipDtoCase2RoleSlugsList = Array<string>;
export interface UpdateUserlandUserOrganizationMembershipDtoCase2 {
    /** An array of role identifiers. Limited to one role when Multiple Roles is disabled. Mutually exclusive with `role_slug`. */
    role_slugs: UpdateUserlandUserOrganizationMembershipDtoCase2RoleSlugsList;
}
export type UpdateUserlandUserOrganizationMembershipDto = unknown | UpdateUserlandUserOrganizationMembershipDtoCase1 | UpdateUserlandUserOrganizationMembershipDtoCase2;
export interface UpdateUserlandUserOrganizationMembershipsControllerRequest {
    /** The unique ID of the organization membership. */
    id: string;
    body: UpdateUserlandUserOrganizationMembershipDto;
}
/** Whether the Webhook Endpoint is enabled or disabled. */
export type UpdateWebhookEndpointsControllerRequestStatus = "enabled" | "disabled";
export type UpdateWebhookEndpointsControllerRequestEventsItem = "agent.blueprint.created" | "agent.blueprint.deleted" | "agent.blueprint.updated" | "agent.instance.created" | "agent.instance.deleted" | "agent.instance.session.created" | "agent.instance.session.revoked" | "agent.registration.created" | "agent.registration.claim.attempt.created" | "agent.registration.claim.completed" | "agent.registration.credential.issued" | "agent.registration.deleted" | "agent.registration.refreshed" | "agent.registration.expired" | "agent.registration.organization.switched" | "agent.registration.revoked" | "authentication.email_verification_succeeded" | "authentication.magic_auth_failed" | "authentication.magic_auth_succeeded" | "authentication.mfa_succeeded" | "authentication.oauth_failed" | "authentication.oauth_succeeded" | "authentication.password_failed" | "authentication.password_succeeded" | "authentication.passkey_failed" | "authentication.passkey_succeeded" | "authentication.sso_failed" | "authentication.sso_started" | "authentication.sso_succeeded" | "authentication.sso_timed_out" | "radar.challenge_created" | "authentication.radar_risk_detected" | "authentication.reauthentication_succeeded" | "api_key.created" | "api_key.revoked" | "api_key.updated" | "connection.activated" | "connection.deactivated" | "connection.saml_certificate_renewal_required" | "connection.saml_certificate_renewed" | "connection.deleted" | "dsync.activated" | "dsync.deleted" | "dsync.group.created" | "dsync.group.deleted" | "dsync.group.updated" | "dsync.group.user_added" | "dsync.group.user_removed" | "dsync.user.created" | "dsync.user.deleted" | "dsync.user.updated" | "email_verification.created" | "group.created" | "group.deleted" | "group.member_added" | "group.member_removed" | "group.updated" | "flag.created" | "flag.deleted" | "flag.updated" | "flag.rule_updated" | "invitation.accepted" | "invitation.created" | "invitation.resent" | "invitation.revoked" | "magic_auth.created" | "organization.created" | "organization.deleted" | "organization.updated" | "organization_domain.created" | "organization_domain.deleted" | "organization_domain.updated" | "organization_domain.verified" | "organization_domain.verification_failed" | "password_reset.created" | "password_reset.succeeded" | "user.created" | "user.updated" | "user.deleted" | "organization_membership.created" | "organization_membership.deleted" | "organization_membership.updated" | "role.created" | "role.deleted" | "role.updated" | "organization_role.created" | "organization_role.deleted" | "organization_role.updated" | "permission.created" | "permission.deleted" | "permission.updated" | "pipes.account_connection.add_failed" | "pipes.account_connection.connected" | "pipes.account_connection.connection_failed" | "pipes.account_connection.disconnected" | "pipes.account_connection.reauthorization_needed" | "pipes.connected_account.connected" | "pipes.connected_account.connection_failed" | "pipes.connected_account.disconnected" | "pipes.connected_account.reauthorization_needed" | "session.created" | "session.revoked" | "waitlist_user.approved" | "waitlist_user.created" | "waitlist_user.denied";
/** The events that the Webhook Endpoint is subscribed to. */
export type UpdateWebhookEndpointsControllerRequestEventsList = Array<UpdateWebhookEndpointsControllerRequestEventsItem | (string & {})>;
export interface UpdateWebhookEndpointsControllerRequest {
    /** Unique identifier of the Webhook Endpoint. */
    id: string;
    /** The HTTPS URL where webhooks will be sent. */
    endpoint_url?: string;
    /** Whether the Webhook Endpoint is enabled or disabled. */
    status?: UpdateWebhookEndpointsControllerRequestStatus | (string & {});
    /** The events that the Webhook Endpoint is subscribed to. */
    events?: UpdateWebhookEndpointsControllerRequestEventsList;
}
/** Whose connection to create or rotate. `user` (the default) addresses the connection owned by `user_id`. `organization` addresses the connection shared by every member of `organization_id`; `user_id` then identifies the member performing the request and must be an active member of the organization. */
export type UpsertDataIntegrationsControllerApiKeyRequestBodyCase0ConnectionOwner = "user" | "organization";
export interface UpsertDataIntegrationsControllerApiKeyRequestBodyCase0 {
    /** A mutable, non-unique label. Omit to preserve an existing label; null clears it. Labels are never account identifiers. */
    account_display_name?: string | null;
    /** A developer-attested provider account identifier, never inferred from a label or credential. Omit to preserve an existing identifier; null clears it. */
    account_identifier?: string | null;
    /** A [User](/reference/authkit/user) identifier. */
    user_id: string;
    /** An [Organization](/reference/organization) identifier. Optional parameter to scope the connection to a specific organization. Required when `connection_owner` is `organization`. */
    organization_id?: string;
    /** Whose connection to create or rotate. `user` (the default) addresses the connection owned by `user_id`. `organization` addresses the connection shared by every member of `organization_id`; `user_id` then identifies the member performing the request and must be an active member of the organization. */
    connection_owner?: UpsertDataIntegrationsControllerApiKeyRequestBodyCase0ConnectionOwner | (string & {});
    /** The API key secret to store for this integration. */
    secret: string | Redacted.Redacted<string>;
}
/** Whose connection to create or rotate. `user` (the default) addresses the connection owned by `user_id`. `organization` addresses the connection shared by every member of `organization_id`; `user_id` then identifies the member performing the request and must be an active member of the organization. */
export type UpsertDataIntegrationsControllerApiKeyRequestBodyCase1ConnectionOwner = "user" | "organization";
export interface UpsertDataIntegrationsControllerApiKeyRequestBodyCase1 {
    /** A mutable, non-unique label. Omit to preserve an existing label; null clears it. Labels are never account identifiers. */
    account_display_name?: string | null;
    /** A developer-attested provider account identifier, never inferred from a label or credential. Omit to preserve an existing identifier; null clears it. */
    account_identifier?: string | null;
    /** A [User](/reference/authkit/user) identifier. */
    user_id: string;
    /** An [Organization](/reference/organization) identifier. Optional parameter to scope the connection to a specific organization. Required when `connection_owner` is `organization`. */
    organization_id?: string;
    /** Whose connection to create or rotate. `user` (the default) addresses the connection owned by `user_id`. `organization` addresses the connection shared by every member of `organization_id`; `user_id` then identifies the member performing the request and must be an active member of the organization. */
    connection_owner?: UpsertDataIntegrationsControllerApiKeyRequestBodyCase1ConnectionOwner | (string & {});
    /** The API key secret to store for this integration. */
    secret: string | Redacted.Redacted<string>;
    /** Reauthorize exactly the connection named by `connected_account_id`. */
    connection_intent: string;
    /** The exact connected account to reauthorize. Required with `connection_intent: reauthorize`. */
    connected_account_id: string;
}
/** Whose connection to create or rotate. `user` (the default) addresses the connection owned by `user_id`. `organization` addresses the connection shared by every member of `organization_id`; `user_id` then identifies the member performing the request and must be an active member of the organization. */
export type UpsertDataIntegrationsControllerApiKeyRequestBodyCase2ConnectionOwner = "user" | "organization";
export interface UpsertDataIntegrationsControllerApiKeyRequestBodyCase2 {
    /** A mutable, non-unique label. Omit to preserve an existing label; null clears it. Labels are never account identifiers. */
    account_display_name?: string | null;
    /** A developer-attested provider account identifier, never inferred from a label or credential. Omit to preserve an existing identifier; null clears it. */
    account_identifier?: string | null;
    /** A [User](/reference/authkit/user) identifier. */
    user_id: string;
    /** An [Organization](/reference/organization) identifier. Optional parameter to scope the connection to a specific organization. Required when `connection_owner` is `organization`. */
    organization_id?: string;
    /** Whose connection to create or rotate. `user` (the default) addresses the connection owned by `user_id`. `organization` addresses the connection shared by every member of `organization_id`; `user_id` then identifies the member performing the request and must be an active member of the organization. */
    connection_owner?: UpsertDataIntegrationsControllerApiKeyRequestBodyCase2ConnectionOwner | (string & {});
    /** The API key secret to store for this integration. */
    secret: string | Redacted.Redacted<string>;
    /** The exact connected account to reauthorize. The reauthorize intent may be omitted for compatibility. */
    connected_account_id: string;
}
export type UpsertDataIntegrationsControllerApiKeyRequestBody = UpsertDataIntegrationsControllerApiKeyRequestBodyCase0 | UpsertDataIntegrationsControllerApiKeyRequestBodyCase1 | UpsertDataIntegrationsControllerApiKeyRequestBodyCase2;
export interface UpsertDataIntegrationsControllerApiKeyRequest {
    /** The identifier of the integration. */
    slug: string;
    body: UpsertDataIntegrationsControllerApiKeyRequestBody;
}
/** Whose connection to create or rotate. `user` (the default) addresses the connection owned by `user_id`. `organization` addresses the connection shared by every member of `organization_id`; `user_id` then identifies the member performing the request and must be an active member of the organization. */
export type UpsertDataIntegrationsControllerClientCredentialsRequestBodyCase0ConnectionOwner = "user" | "organization";
/** Provider-specific configuration values collected for this installation, keyed by the provider's config field descriptors. */
export type UpsertDataIntegrationsControllerClientCredentialsRequestBodyCase0ConfigMap = {
    [key: string]: string | undefined;
};
export interface UpsertDataIntegrationsControllerClientCredentialsRequestBodyCase0 {
    /** A mutable, non-unique label. Omit to preserve an existing label; null clears it. Labels are never account identifiers. */
    account_display_name?: string | null;
    /** A developer-attested provider account identifier, never inferred from a label or credential. Omit to preserve an existing identifier; null clears it. */
    account_identifier?: string | null;
    /** A [User](/reference/authkit/user) identifier. */
    user_id: string;
    /** An [Organization](/reference/organization) identifier. Optional parameter to scope the connection to a specific organization. Required when `connection_owner` is `organization`. */
    organization_id?: string;
    /** Whose connection to create or rotate. `user` (the default) addresses the connection owned by `user_id`. `organization` addresses the connection shared by every member of `organization_id`; `user_id` then identifies the member performing the request and must be an active member of the organization. */
    connection_owner?: UpsertDataIntegrationsControllerClientCredentialsRequestBodyCase0ConnectionOwner | (string & {});
    /** The OAuth client ID to store for this integration. */
    client_id: string;
    /** The OAuth client secret to store for this integration. */
    client_secret: string | Redacted.Redacted<string>;
    /** Provider-specific configuration values collected for this installation, keyed by the provider's config field descriptors. */
    config?: UpsertDataIntegrationsControllerClientCredentialsRequestBodyCase0ConfigMap;
}
/** Whose connection to create or rotate. `user` (the default) addresses the connection owned by `user_id`. `organization` addresses the connection shared by every member of `organization_id`; `user_id` then identifies the member performing the request and must be an active member of the organization. */
export type UpsertDataIntegrationsControllerClientCredentialsRequestBodyCase1ConnectionOwner = "user" | "organization";
/** Provider-specific configuration values collected for this installation, keyed by the provider's config field descriptors. */
export type UpsertDataIntegrationsControllerClientCredentialsRequestBodyCase1ConfigMap = {
    [key: string]: string | undefined;
};
export interface UpsertDataIntegrationsControllerClientCredentialsRequestBodyCase1 {
    /** A mutable, non-unique label. Omit to preserve an existing label; null clears it. Labels are never account identifiers. */
    account_display_name?: string | null;
    /** A developer-attested provider account identifier, never inferred from a label or credential. Omit to preserve an existing identifier; null clears it. */
    account_identifier?: string | null;
    /** A [User](/reference/authkit/user) identifier. */
    user_id: string;
    /** An [Organization](/reference/organization) identifier. Optional parameter to scope the connection to a specific organization. Required when `connection_owner` is `organization`. */
    organization_id?: string;
    /** Whose connection to create or rotate. `user` (the default) addresses the connection owned by `user_id`. `organization` addresses the connection shared by every member of `organization_id`; `user_id` then identifies the member performing the request and must be an active member of the organization. */
    connection_owner?: UpsertDataIntegrationsControllerClientCredentialsRequestBodyCase1ConnectionOwner | (string & {});
    /** The OAuth client ID to store for this integration. */
    client_id: string;
    /** The OAuth client secret to store for this integration. */
    client_secret: string | Redacted.Redacted<string>;
    /** Provider-specific configuration values collected for this installation, keyed by the provider's config field descriptors. */
    config?: UpsertDataIntegrationsControllerClientCredentialsRequestBodyCase1ConfigMap;
    /** Reauthorize exactly the connection named by `connected_account_id`. */
    connection_intent: string;
    /** The exact connected account to reauthorize. Required with `connection_intent: reauthorize`. */
    connected_account_id: string;
}
/** Whose connection to create or rotate. `user` (the default) addresses the connection owned by `user_id`. `organization` addresses the connection shared by every member of `organization_id`; `user_id` then identifies the member performing the request and must be an active member of the organization. */
export type UpsertDataIntegrationsControllerClientCredentialsRequestBodyCase2ConnectionOwner = "user" | "organization";
/** Provider-specific configuration values collected for this installation, keyed by the provider's config field descriptors. */
export type UpsertDataIntegrationsControllerClientCredentialsRequestBodyCase2ConfigMap = {
    [key: string]: string | undefined;
};
export interface UpsertDataIntegrationsControllerClientCredentialsRequestBodyCase2 {
    /** A mutable, non-unique label. Omit to preserve an existing label; null clears it. Labels are never account identifiers. */
    account_display_name?: string | null;
    /** A developer-attested provider account identifier, never inferred from a label or credential. Omit to preserve an existing identifier; null clears it. */
    account_identifier?: string | null;
    /** A [User](/reference/authkit/user) identifier. */
    user_id: string;
    /** An [Organization](/reference/organization) identifier. Optional parameter to scope the connection to a specific organization. Required when `connection_owner` is `organization`. */
    organization_id?: string;
    /** Whose connection to create or rotate. `user` (the default) addresses the connection owned by `user_id`. `organization` addresses the connection shared by every member of `organization_id`; `user_id` then identifies the member performing the request and must be an active member of the organization. */
    connection_owner?: UpsertDataIntegrationsControllerClientCredentialsRequestBodyCase2ConnectionOwner | (string & {});
    /** The OAuth client ID to store for this integration. */
    client_id: string;
    /** The OAuth client secret to store for this integration. */
    client_secret: string | Redacted.Redacted<string>;
    /** Provider-specific configuration values collected for this installation, keyed by the provider's config field descriptors. */
    config?: UpsertDataIntegrationsControllerClientCredentialsRequestBodyCase2ConfigMap;
    /** The exact connected account to reauthorize. The reauthorize intent may be omitted for compatibility. */
    connected_account_id: string;
}
export type UpsertDataIntegrationsControllerClientCredentialsRequestBody = UpsertDataIntegrationsControllerClientCredentialsRequestBodyCase0 | UpsertDataIntegrationsControllerClientCredentialsRequestBodyCase1 | UpsertDataIntegrationsControllerClientCredentialsRequestBodyCase2;
export interface UpsertDataIntegrationsControllerClientCredentialsRequest {
    /** The identifier of the integration. */
    slug: string;
    body: UpsertDataIntegrationsControllerClientCredentialsRequestBody;
}
export interface UserlandMagicAuthControllerSendMagicAuthCodeAndReturnRequest {
    /** The email address to send the magic code to. */
    email?: string;
    /** The invitation token to associate with this magic code. */
    invitation_token?: string;
    /** The IP address of the user's request. */
    ip_address?: string;
    /** The user agent string from the user's request. */
    user_agent?: string;
    /** The ID of an existing Radar authentication attempt to associate with this request. */
    radar_auth_attempt_id?: string;
    /** An optional Radar signals ID to correlate client-side signals with this request. */
    signals_id?: string;
}
export interface UserlandMagicAuthControllerSendMagicAuthCodeAndReturnResponse {
    /** Distinguishes the Magic Auth object. */
    object?: string;
    /** The unique ID of the Magic Auth code. */
    id?: string;
    /** The unique ID of the user. */
    user_id?: string;
    /** The email address of the user. */
    email?: string;
    /** The timestamp when the Magic Auth code expires. */
    expires_at?: string;
    /** An ISO 8601 timestamp. */
    created_at?: string;
    /** An ISO 8601 timestamp. */
    updated_at?: string;
    /** The code used to verify the Magic Auth code. */
    code?: string;
    /** The ID of the Radar authentication attempt created for this request when Radar is enabled. Pass this value to the authenticate endpoint to associate the subsequent authentication with this Radar attempt. */
    radar_auth_attempt_id?: string;
}
export interface UserlandSessionsControllerAuthenticate0RequestBodyCase0 {
    /** The client ID of the application. */
    client_id: string;
    /** The client secret of the application. May be omitted by public clients that authenticate through other means, such as a PKCE `code_verifier`. */
    client_secret?: string | Redacted.Redacted<string>;
    grant_type: string;
    /** The authorization code received from the redirect. */
    code: string;
    /** The PKCE code verifier used to derive the code challenge passed to the authorization URL. */
    code_verifier?: string;
    /** An invitation token to accept during authentication. */
    invitation_token?: string;
    /** The IP address of the user's request. */
    ip_address?: string;
    /** A unique identifier for the device. */
    device_id?: string;
    /** The user agent string from the user's browser. */
    user_agent?: string;
    /** An optional Radar signals ID to correlate client-side signals with this authentication attempt. */
    signals_id?: string;
}
export interface UserlandSessionsControllerAuthenticate0RequestBodyCase1 {
    /** The client ID of the application. */
    client_id: string;
    /** The client secret of the application. */
    client_secret: string | Redacted.Redacted<string>;
    grant_type: string;
    /** The user's email address. */
    email: string;
    /** The user's password. */
    password: string | Redacted.Redacted<string>;
    /** An invitation token to accept during authentication. */
    invitation_token?: string;
    /** The IP address of the user's request. */
    ip_address?: string;
    /** A unique identifier for the device. */
    device_id?: string;
    /** The user agent string from the user's browser. */
    user_agent?: string;
    /** An optional Radar signals ID to correlate client-side signals with this authentication attempt. */
    signals_id?: string;
    /** The ID of an existing Radar authentication attempt to associate with this authentication. */
    radar_auth_attempt_id?: string;
}
export interface UserlandSessionsControllerAuthenticate0RequestBodyCase2 {
    /** The client ID of the application. */
    client_id: string;
    /** The client secret of the application. May be omitted by public clients that authenticate through other means, such as a PKCE `code_verifier`. */
    client_secret?: string | Redacted.Redacted<string>;
    grant_type: string;
    /** The refresh token to exchange for new tokens. */
    refresh_token: string | Redacted.Redacted<string>;
    /** The ID of the organization to scope the session to. */
    organization_id?: string;
    /** The IP address of the user's request. */
    ip_address?: string;
    /** A unique identifier for the device. */
    device_id?: string;
    /** The user agent string from the user's browser. */
    user_agent?: string;
}
export interface UserlandSessionsControllerAuthenticate0RequestBodyCase3 {
    /** The client ID of the application. */
    client_id: string;
    /** The client secret of the application. */
    client_secret: string | Redacted.Redacted<string>;
    grant_type: string;
    /** The one-time code for Magic Auth authentication. */
    code: string;
    /** The user's email address. */
    email: string;
    /** An invitation token to accept during authentication. */
    invitation_token?: string;
    /** The IP address of the user's request. */
    ip_address?: string;
    /** A unique identifier for the device. */
    device_id?: string;
    /** The user agent string from the user's browser. */
    user_agent?: string;
    /** The ID of an existing Radar authentication attempt to associate with this authentication. */
    radar_auth_attempt_id?: string;
}
export interface UserlandSessionsControllerAuthenticate0RequestBodyCase4 {
    /** The client ID of the application. */
    client_id: string;
    /** The client secret of the application. */
    client_secret: string | Redacted.Redacted<string>;
    grant_type: string;
    /** The email verification code. */
    code: string;
    /** The pending authentication token from a previous authentication attempt. */
    pending_authentication_token: string;
    /** The IP address of the user's request. */
    ip_address?: string;
    /** A unique identifier for the device. */
    device_id?: string;
    /** The user agent string from the user's browser. */
    user_agent?: string;
}
export interface UserlandSessionsControllerAuthenticate0RequestBodyCase5 {
    /** The client ID of the application. */
    client_id: string;
    /** The client secret of the application. */
    client_secret: string | Redacted.Redacted<string>;
    grant_type: string;
    /** The TOTP code from the authenticator app. */
    code: string;
    /** The pending authentication token from a previous authentication attempt. */
    pending_authentication_token: string;
    /** The ID of the MFA authentication challenge. */
    authentication_challenge_id: string;
    /** The IP address of the user's request. */
    ip_address?: string;
    /** A unique identifier for the device. */
    device_id?: string;
    /** The user agent string from the user's browser. */
    user_agent?: string;
}
export interface UserlandSessionsControllerAuthenticate0RequestBodyCase6 {
    /** The client ID of the application. */
    client_id: string;
    /** The client secret of the application. */
    client_secret: string | Redacted.Redacted<string>;
    grant_type: string;
    /** The token from the `email_completion_required` response. */
    email_completion_token: string;
    /** The email address the user supplied for a profile the identity provider left without one. */
    email: string;
    /** The IP address of the user's request. */
    ip_address?: string;
    /** A unique identifier for the device. */
    device_id?: string;
    /** The user agent string from the user's browser. */
    user_agent?: string;
    /** An optional Radar signals ID to correlate client-side signals with this authentication attempt. */
    signals_id?: string;
}
export interface UserlandSessionsControllerAuthenticate0RequestBodyCase7 {
    /** The client ID of the application. */
    client_id: string;
    /** The client secret of the application. */
    client_secret: string | Redacted.Redacted<string>;
    grant_type: string;
    /** The pending authentication token from a previous authentication attempt. */
    pending_authentication_token: string;
    /** The ID of the organization the user selected. */
    organization_id: string;
    /** The IP address of the user's request. */
    ip_address?: string;
    /** A unique identifier for the device. */
    device_id?: string;
    /** The user agent string from the user's browser. */
    user_agent?: string;
}
export interface UserlandSessionsControllerAuthenticate0RequestBodyCase8 {
    /** The client ID of the application. */
    client_id: string;
    /** The client secret of the application. */
    client_secret: string | Redacted.Redacted<string>;
    grant_type: string;
    /** The one-time code from the Radar email challenge. */
    code: string;
    /** The ID of the Radar email challenge being verified. */
    radar_challenge_id: string;
    /** The pending authentication token from a previous authentication attempt. */
    pending_authentication_token: string;
    /** The IP address of the user's request. */
    ip_address?: string;
    /** A unique identifier for the device. */
    device_id?: string;
    /** The user agent string from the user's browser. */
    user_agent?: string;
}
export interface UserlandSessionsControllerAuthenticate0RequestBodyCase9 {
    /** The client ID of the application. */
    client_id: string;
    /** The client secret of the application. */
    client_secret: string | Redacted.Redacted<string>;
    grant_type: string;
    /** The one-time code from the Radar SMS challenge. */
    code: string;
    /** The ID of the Radar SMS verification being confirmed. Required for sign-up challenges; omitted for sign-in challenges, where the verification is resolved server-side. */
    verification_id?: string;
    /** The phone number the Radar SMS challenge was sent to. Required for sign-up challenges; omitted for sign-in challenges, where the phone number on file is resolved server-side. */
    phone_number?: string;
    /** The pending authentication token from a previous authentication attempt. */
    pending_authentication_token: string;
    /** The IP address of the user's request. */
    ip_address?: string;
    /** A unique identifier for the device. */
    device_id?: string;
    /** The user agent string from the user's browser. */
    user_agent?: string;
}
export interface UserlandSessionsControllerAuthenticate0RequestBodyCase10 {
    /** The client ID of the application. */
    client_id: string;
    grant_type: string;
    /** The device verification code. */
    device_code: string;
    /** The IP address of the user's request. */
    ip_address?: string;
    /** A unique identifier for the device. */
    device_id?: string;
    /** The user agent string from the user's browser. */
    user_agent?: string;
}
export type UserlandSessionsControllerAuthenticate0RequestBody = UserlandSessionsControllerAuthenticate0RequestBodyCase0 | UserlandSessionsControllerAuthenticate0RequestBodyCase1 | UserlandSessionsControllerAuthenticate0RequestBodyCase2 | UserlandSessionsControllerAuthenticate0RequestBodyCase3 | UserlandSessionsControllerAuthenticate0RequestBodyCase4 | UserlandSessionsControllerAuthenticate0RequestBodyCase5 | UserlandSessionsControllerAuthenticate0RequestBodyCase6 | UserlandSessionsControllerAuthenticate0RequestBodyCase7 | UserlandSessionsControllerAuthenticate0RequestBodyCase8 | UserlandSessionsControllerAuthenticate0RequestBodyCase9 | UserlandSessionsControllerAuthenticate0RequestBodyCase10;
export interface UserlandSessionsControllerAuthenticate0Request {
    body: UserlandSessionsControllerAuthenticate0RequestBody;
}
/** The authentication method used to initiate the session. */
export type UserlandAuthenticateResponseAuthenticationMethod = "SSO" | "Password" | "Passkey" | "AppleOAuth" | "BitbucketOAuth" | "CrossAppAuth" | "ExternalAuth" | "GitHubOAuth" | "GitLabOAuth" | "GoogleOAuth" | "IntuitOAuth" | "LinkedInOAuth" | "MicrosoftOAuth" | "SalesforceOAuth" | "SlackOAuth" | "VercelMarketplaceOAuth" | "VercelOAuth" | "XeroOAuth" | "MagicAuth" | "Impersonation" | "MigratedSession";
/** Information about the impersonator if this session was created via impersonation. */
export type UserlandAuthenticateResponseImpersonator = ListUserlandUserSessionsControllerResponseDataItemImpersonator;
/** A list of OAuth scopes for which the access token is authorized. */
export type UserlandAuthenticateResponseOauthTokensScopesList = Array<string>;
/** The OAuth tokens from the identity provider, if applicable. */
export interface UserlandAuthenticateResponseOauthTokens {
    /** The OAuth provider used for authentication. */
    provider: string;
    /** The refresh token from the OAuth provider. */
    refresh_token: string | Redacted.Redacted<string>;
    /** The access token from the OAuth provider. */
    access_token: string | Redacted.Redacted<string>;
    /** The timestamp at which the access token expires. */
    expires_at: number;
    /** A list of OAuth scopes for which the access token is authorized. */
    scopes: UserlandAuthenticateResponseOauthTokensScopesList;
}
export interface UserlandAuthenticateResponse {
    /** The corresponding [user](/reference/authkit/user) object. */
    user?: UserlandUser;
    /** The ID of the organization the user selected to sign in to. */
    organization_id?: string;
    /** An authorization code that can be exchanged for tokens by a different application. */
    authkit_authorization_code?: string;
    /** A JWT containing information about the current session. */
    access_token?: string | Redacted.Redacted<string>;
    /** [Exchange this token](/reference/authkit/authentication/refresh-token) for a new access token. */
    refresh_token?: string | Redacted.Redacted<string>;
    /** The authentication method used to initiate the session. */
    authentication_method?: UserlandAuthenticateResponseAuthenticationMethod;
    /** Information about the impersonator if this session was created via impersonation. */
    impersonator?: ListUserlandUserSessionsControllerResponseDataItemImpersonator;
    /** The OAuth tokens from the identity provider, if applicable. */
    oauth_tokens?: UserlandAuthenticateResponseOauthTokens;
}
export interface UserlandSsoControllerDeviceAuthorizationRequest {
    /** The WorkOS client ID for your application. */
    client_id: string;
}
export interface DeviceAuthorizationResponse {
    /** The device verification code. */
    device_code?: string;
    /** The end-user verification code. */
    user_code?: string;
    /** The end-user verification URI. */
    verification_uri?: string;
    /** Verification URI that includes the user code. */
    verification_uri_complete?: string;
    /** Lifetime in seconds of the codes. */
    expires_in?: number;
    /** Minimum polling interval in seconds. */
    interval?: number;
}
export interface UserlandUserAuthenticationFactorsControllerCreate0Request {
    /** The ID of the [user](/reference/authkit/user). */
    userlandUserId: string;
    /** The type of the factor to enroll. */
    type?: string;
    /** Your application or company name displayed in the user's authenticator app. */
    totp_issuer?: string;
    /** The user's account name displayed in their authenticator app. */
    totp_user?: string;
    /** The Base32-encoded shared secret for TOTP factors. This can be provided when creating the auth factor, otherwise it will be generated. The algorithm used to derive TOTP codes is SHA-1, the code length is 6 digits, and the timestep is 30 seconds - the secret must be compatible with these parameters. */
    totp_secret?: string | Redacted.Redacted<string>;
}
export interface UserlandUserAuthenticationFactorEnrollResponse {
    /** The [authentication factor](/reference/authkit/mfa/authentication-factor) object that represents the additional authentication method used on top of the existing authentication strategy. */
    authentication_factor?: AuthenticationFactorEnrolled;
    /** The [authentication challenge](/reference/authkit/mfa/authentication-challenge) object that is used to complete the authentication process. */
    authentication_challenge?: AuthenticationChallenge;
}
export interface UserlandUserAuthenticationFactorsControllerList0Request {
    /** The ID of the [user](/reference/authkit/user). */
    userlandUserId: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. */
    before?: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. */
    after?: string;
    /** Upper limit on the number of objects to return, between `1` and `100`. */
    limit?: number;
    /** Order the results by the creation time. Defaults to `normal`. */
    order?: PaginationOrder | (string & {});
}
/** The list of records for the current page. */
export type UserlandUserAuthenticationFactorListDataList = Array<AuthenticationFactor>;
/** Pagination cursors for navigating between pages of results. */
export type UserlandUserAuthenticationFactorListListMetadata = AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
export interface UserlandUserAuthenticationFactorList {
    /** Indicates this is a list response. */
    object?: string;
    /** The list of records for the current page. */
    data?: UserlandUserAuthenticationFactorListDataList;
    /** Pagination cursors for navigating between pages of results. */
    list_metadata?: AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
}
export interface UserlandUserOrganizationMembershipsControllerReactivateRequest {
    /** The unique ID of the organization membership. */
    id: string;
}
/** Object containing metadata key/value pairs associated with the user. */
export type UserlandUsersControllerCreate0RequestMetadataMap = {
    [key: string]: string | undefined;
};
/** The algorithm originally used to hash the password, used when providing a `password_hash`. Required with `password_hash`. Mutually exclusive with `password`. */
export type UserlandUsersControllerCreate0RequestPasswordHashType = "bcrypt" | "firebase-scrypt" | "ssha" | "ssha256" | "scrypt" | "pbkdf2" | "argon2";
/** The position of the salt relative to the password when the `password_hash` digest was computed: `prefix` for `hash(salt + password)` or `suffix` for `hash(password + salt)`. Only supported with the `ssha256` hash type and only valid when a `password_hash` is provided. Defaults to `suffix`. Mutually exclusive with `password`. */
export type UserlandUsersControllerCreate0RequestPasswordSaltPosition = "prefix" | "suffix";
export interface UserlandUsersControllerCreate0Request {
    /** The email address of the user. WorkOS trims whitespace and converts the address to lowercase before storing it. */
    email: string;
    /** The first name of the user. */
    first_name?: string | null;
    /** The last name of the user. */
    last_name?: string | null;
    /** The user's full name. */
    name?: string | null;
    /** Whether the user's email has been verified. */
    email_verified?: boolean | null;
    /** Object containing metadata key/value pairs associated with the user. */
    metadata?: UserlandUsersControllerCreate0RequestMetadataMap | null;
    /** The external ID of the user. */
    external_id?: string | null;
    /** The IP address of the user's request. */
    ip_address?: string | null;
    /** The user agent string from the user's request. */
    user_agent?: string | null;
    /** An optional Radar signals ID to correlate client-side signals with this request. */
    signals_id?: string;
    /** The password to set for the user. Mutually exclusive with `password_hash`, `password_hash_type`, and `password_salt_position`. */
    password?: string | Redacted.Redacted<string> | null;
    /** The hashed password to set for the user. Required with `password_hash_type`. Mutually exclusive with `password`. */
    password_hash?: string | Redacted.Redacted<string>;
    /** The algorithm originally used to hash the password, used when providing a `password_hash`. Required with `password_hash`. Mutually exclusive with `password`. */
    password_hash_type?: UserlandUsersControllerCreate0RequestPasswordHashType | (string & {});
    /** The position of the salt relative to the password when the `password_hash` digest was computed: `prefix` for `hash(salt + password)` or `suffix` for `hash(password + salt)`. Only supported with the `ssha256` hash type and only valid when a `password_hash` is provided. Defaults to `suffix`. Mutually exclusive with `password`. */
    password_salt_position?: UserlandUsersControllerCreate0RequestPasswordSaltPosition | (string & {});
}
/** Object containing metadata key/value pairs associated with the user. */
export type UserlandUsersControllerCreate0ResponseMetadataMap = {
    [key: string]: string | undefined;
};
export interface UserlandUsersControllerCreate0Response {
    /** Distinguishes the user object. */
    object?: string;
    /** The unique ID of the user. */
    id?: string;
    /** The first name of the user. */
    first_name?: string | null;
    /** The last name of the user. */
    last_name?: string | null;
    /** The user's full name. */
    name?: string | null;
    /** A URL reference to an image representing the user. */
    profile_picture_url?: string | null;
    /** The email address of the user. */
    email?: string;
    /** Whether the user's email has been verified. */
    email_verified?: boolean;
    /** The external ID of the user. */
    external_id?: string | null;
    /** Object containing metadata key/value pairs associated with the user. */
    metadata?: UserlandUsersControllerCreate0ResponseMetadataMap;
    /** The timestamp when the user last signed in. */
    last_sign_in_at?: string | null;
    /** The user's preferred locale. */
    locale?: string | null;
    /** An ISO 8601 timestamp. */
    created_at?: string;
    /** An ISO 8601 timestamp. */
    updated_at?: string;
    /** The ID of the Radar authentication attempt created for this request when Radar is enabled. Pass this value to the authenticate endpoint to associate the subsequent authentication with this Radar attempt. */
    radar_auth_attempt_id?: string;
}
export interface UserlandUsersControllerCreatePasswordResetTokenRequest {
    /** The email address of the user requesting a password reset. */
    email?: string;
}
export interface PasswordReset {
    /** Distinguishes the password reset object. */
    object?: string;
    /** The unique ID of the password reset object. */
    id?: string;
    /** The unique ID of the user. */
    user_id?: string;
    /** The email address of the user. */
    email?: string;
    /** The timestamp when the password reset token expires. */
    expires_at?: string;
    /** The timestamp when the password reset token was created. */
    created_at?: string;
    /** The token used to reset the password. */
    password_reset_token?: string | Redacted.Redacted<string>;
    /** The URL where the user can reset their password. */
    password_reset_url?: string | Redacted.Redacted<string>;
}
export interface UserlandUsersControllerDelete0Request {
    /** The unique ID of the user. */
    id: string;
}
export interface UserlandUsersControllerDelete0Response {
}
export interface UserlandUsersControllerEmailVerification0Request {
    /** The ID of the user. */
    id: string;
    /** The one-time email verification code. */
    code?: string;
}
export interface VerifyEmailResponse {
    /** The user whose email was verified. */
    user?: UserlandUser;
}
export interface UserlandUsersControllerGet0Request {
    /** The unique ID of the user. */
    id: string;
}
export interface UserlandUsersControllerGetPasswordResetRequest {
    /** The ID of the password reset token. */
    id: string;
}
export interface UserlandUsersControllerList0Request {
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`. */
    before?: string;
    /** An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`. */
    after?: string;
    /** Upper limit on the number of objects to return, between `1` and `100`. */
    limit?: number;
    /** Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `desc`. */
    order?: PaginationOrder | (string & {});
    /** Filter users by the organization they are a member of. Deprecated in favor of `organization_id`. */
    organization?: string;
    /** Filter users by the organization they are a member of. */
    organization_id?: string;
    /** Filter users by their email address. */
    email?: string;
}
/** The list of records for the current page. */
export type UserlandUserListDataList = Array<UserlandUser>;
/** Pagination cursors for navigating between pages of results. */
export type UserlandUserListListMetadata = AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
export interface UserlandUserList {
    /** Indicates this is a list response. */
    object?: string;
    /** The list of records for the current page. */
    data?: UserlandUserListDataList;
    /** Pagination cursors for navigating between pages of results. */
    list_metadata?: AuditLogValidatorVersionsControllerSchemasResponseListMetadata;
}
/** Object containing metadata key/value pairs associated with the user. */
export type UserlandUsersControllerUpdate0RequestMetadataMap = {
    [key: string]: string | undefined;
};
/** The algorithm originally used to hash the password, used when providing a `password_hash`. Required with `password_hash`. Mutually exclusive with `password`. */
export type UserlandUsersControllerUpdate0RequestPasswordHashType = "bcrypt" | "firebase-scrypt" | "ssha" | "ssha256" | "scrypt" | "pbkdf2" | "argon2";
/** The position of the salt relative to the password when the `password_hash` digest was computed: `prefix` for `hash(salt + password)` or `suffix` for `hash(password + salt)`. Only supported with the `ssha256` hash type and only valid when a `password_hash` is provided. Defaults to `suffix`. Mutually exclusive with `password`. */
export type UserlandUsersControllerUpdate0RequestPasswordSaltPosition = "prefix" | "suffix";
export interface UserlandUsersControllerUpdate0Request {
    /** The unique ID of the user. */
    id: string;
    /** The email address of the user. */
    email?: string;
    /** The first name of the user. */
    first_name?: string;
    /** The last name of the user. */
    last_name?: string;
    /** The user's full name. */
    name?: string;
    /** Whether the user's email has been verified. */
    email_verified?: boolean;
    /** Object containing metadata key/value pairs associated with the user. */
    metadata?: UserlandUsersControllerUpdate0RequestMetadataMap | null;
    /** The external ID of the user. */
    external_id?: string | null;
    /** The user's preferred locale. */
    locale?: string | null;
    /** The password to set for the user. Mutually exclusive with `password_hash`, `password_hash_type`, and `password_salt_position`. */
    password?: string | Redacted.Redacted<string>;
    /** The hashed password to set for the user. Required with `password_hash_type`. Mutually exclusive with `password`. */
    password_hash?: string | Redacted.Redacted<string>;
    /** The algorithm originally used to hash the password, used when providing a `password_hash`. Required with `password_hash`. Mutually exclusive with `password`. */
    password_hash_type?: UserlandUsersControllerUpdate0RequestPasswordHashType | (string & {});
    /** The position of the salt relative to the password when the `password_hash` digest was computed: `prefix` for `hash(salt + password)` or `suffix` for `hash(password + salt)`. Only supported with the `ssha256` hash type and only valid when a `password_hash` is provided. Defaults to `suffix`. Mutually exclusive with `password`. */
    password_salt_position?: UserlandUsersControllerUpdate0RequestPasswordSaltPosition | (string & {});
}
export interface ValidateAgentAdminControllerCredentialRequestBodyCase0 {
    /** The kind of credential being validated -- an agent API key or an agent access token. */
    type: string;
    /** The credential value to validate: the API key value for `api_key`, or the access token (JWT) for `access_token`. */
    credential: string;
}
export interface ValidateAgentAdminControllerCredentialRequestBodyCase1 {
    /** The kind of credential being validated -- an agent API key or an agent access token. */
    type: string;
    /** The credential value to validate: the API key value for `api_key`, or the access token (JWT) for `access_token`. */
    credential: string;
    /** When provided, the access token's `aud` claim is verified against this value. Tokens issued for a different resource are rejected. */
    audience?: string;
}
/** The agent credential to validate. Either an `api_key` or an `access_token`, discriminated by `type`. */
export type ValidateAgentAdminControllerCredentialRequestBody = ValidateAgentAdminControllerCredentialRequestBodyCase0 | ValidateAgentAdminControllerCredentialRequestBodyCase1;
export interface ValidateAgentAdminControllerCredentialRequest {
    body: ValidateAgentAdminControllerCredentialRequestBody;
}
export interface AgentCredentialValidation {
    /** Whether the presented credential is valid. */
    valid: boolean;
    /** Identifier of the agent registration the credential belongs to, or `null` when the credential is invalid. */
    registration_id: string | null;
    /** The timestamp when the credential expires, or `null` when the credential is invalid. */
    expires_at: string | null;
}
export interface ValidateAgentBlueprintsTokenControllerTokenRequest {
    /** The unique ID of the agent blueprint. */
    agent_blueprint_id: string;
    /** The agent access token (a JWT) to validate. */
    agent_access_token: string;
}
/** The effective permission slugs carried by the token. */
export type AgentTokenValidationPermissionsList = Array<string>;
export interface AgentTokenValidation {
    /** Always `true`: an invalid token is reported as an error with a stable code, never as a `200`. */
    valid: boolean;
    /** The agent instance the token was minted for. */
    agent_instance_id: string;
    /** The agent instance session backing the token. */
    agent_instance_session_id: string;
    /** The organization the agent acts within. */
    organization_id: string;
    /** The effective permission slugs carried by the token. */
    permissions: AgentTokenValidationPermissionsList;
    /** The caller-supplied context echoed into the token at mint time, or `null` when none was given. */
    intent: string | null;
    /** The delegating user carried in the `act.sub` claim of the token, or `null` for autonomous sessions. */
    acting_user_id: string | null;
    /** When the backing agent instance session expires. */
    session_expires_at: string;
}
export interface ValidateApiKeysControllerApiKeyRequest {
    /** The value for an API key. */
    value?: string;
}
export interface ApiKeyValidationResponse {
    api_key?: ApiKey | null;
    /** The ID of the agent registration this API Key was issued for. Present only when the API Key is assigned to an agent registration. */
    agent_registration_id?: string;
}
export interface VerifyAuthenticationChallengesControllerRequest {
    /** The unique ID of the Authentication Challenge. */
    id: string;
    /** The one-time code to verify. */
    code: string;
}
export interface AuthenticationChallengeVerifyResponse {
    /** The authentication challenge object. */
    challenge?: AuthenticationChallenge;
    /** Whether the code was valid. */
    valid?: boolean;
}
export interface VerifyOrganizationDomainsControllerRequest {
    /** Unique identifier of the organization domain. */
    id: string;
}
export interface WaitlistEntriesControllerDenyRequest {
    /** The unique ID of the waitlist entry. */
    id: string;
}
/** The state of the waitlist entry. */
export type WaitlistEntriesControllerDenyResponseState = "pending" | "approved" | "denied";
/** Additional fields submitted when the user joined the waitlist. Values are user-provided -- treat them as untrusted input when rendering or exporting. */
export type WaitlistEntriesControllerDenyResponseAdditionalFieldsMap = {
    [key: string]: string | undefined;
};
export interface WaitlistEntriesControllerDenyResponse {
    /** The unique ID of the waitlist entry. */
    id: string;
    /** The email address of the user on the waitlist. */
    email: string;
    /** The state of the waitlist entry. */
    state: WaitlistEntriesControllerDenyResponseState;
    /** The timestamp when the entry was approved, or null if not yet approved. */
    approved_at: string | null;
    /** Additional fields submitted when the user joined the waitlist. Values are user-provided -- treat them as untrusted input when rendering or exporting. */
    additional_fields?: WaitlistEntriesControllerDenyResponseAdditionalFieldsMap;
    /** The unique ID of the waitlist the entry belongs to. */
    waitlist_id?: string | null;
    /** An ISO 8601 timestamp. */
    created_at: string;
    /** An ISO 8601 timestamp. */
    updated_at: string;
    /** Distinguishes the Waitlist Entry object. */
    object: string;
}
export interface WaitlistsControllerFindRequest {
    /** The unique ID of the waitlist, or the literal `default` for the environment's default waitlist. The default waitlist is created when its first entry is added, so read requests for `default` return a `404` until then. */
    id: string;
}
export type WidgetsPublicControllerIssueWidgetSessionTokenRequestScopesItem = "widgets:users-table:manage" | "widgets:domain-verification:manage" | "widgets:sso:manage" | "widgets:api-keys:manage" | "widgets:dsync:manage" | "widgets:audit-log-streaming:manage" | "widgets:pipes:manage";
/** The scopes to grant the widget session. */
export type WidgetsPublicControllerIssueWidgetSessionTokenRequestScopesList = Array<WidgetsPublicControllerIssueWidgetSessionTokenRequestScopesItem | (string & {})>;
export interface WidgetsPublicControllerIssueWidgetSessionTokenRequest {
    /** The ID of the organization to scope the widget session to. Required when scopes are provided. Optional when issuing a token for user-only widgets (e.g. `UserProfile`, `UserSecurity`) that do not require organization context. */
    organization_id?: string;
    /** The ID of the user to issue the widget session token for. */
    user_id?: string;
    /** The scopes to grant the widget session. */
    scopes?: WidgetsPublicControllerIssueWidgetSessionTokenRequestScopesList;
}
export interface WidgetSessionTokenResponse {
    /** The widget session token. */
    token?: string;
}
export type AcceptUserlandUserInvitesControllerError = BadRequest | NotFound | WorkosOpError;
/** Accept an invitation Accepts an invitation and, if linked to an organization, activates the user's membership in that organization. */
export declare const AcceptUserlandUserInvitesController: API.OperationMethod<AcceptUserlandUserInvitesControllerRequest, AcceptUserlandUserInvitesControllerResponse, AcceptUserlandUserInvitesControllerError, WorkosOpContext>;
export type AddAuthorizationOrganizationRolePermissionsControllerPermissionError = BadRequest | Forbidden | NotFound | UnprocessableEntity | WorkosOpError;
/** Add a permission to a custom role Add a single permission to a custom role. If the permission is already assigned to the role, this operation has no effect. */
export declare const AddAuthorizationOrganizationRolePermissionsControllerPermission: API.OperationMethod<AddAuthorizationOrganizationRolePermissionsControllerPermissionRequest, AddAuthorizationOrganizationRolePermissionsControllerPermissionResponse, AddAuthorizationOrganizationRolePermissionsControllerPermissionError, WorkosOpContext>;
export type AddAuthorizationRolePermissionsControllerPermissionError = BadRequest | Forbidden | NotFound | UnprocessableEntity | WorkosOpError;
/** Add a permission to an environment role Add a single permission to an environment role. If the permission is already assigned to the role, this operation has no effect. */
export declare const AddAuthorizationRolePermissionsControllerPermission: API.OperationMethod<AddAuthorizationRolePermissionsControllerPermissionRequest, AddAuthorizationRolePermissionsControllerPermissionResponse, AddAuthorizationRolePermissionsControllerPermissionError, WorkosOpContext>;
export type AddGroupMembershipsControllerMemberError = BadRequest | Forbidden | NotFound | UnprocessableEntity | WorkosOpError;
/** Add a member to a Group Add an organization membership to a group. */
export declare const AddGroupMembershipsControllerMember: API.OperationMethod<AddGroupMembershipsControllerMemberRequest, Group, AddGroupMembershipsControllerMemberError, WorkosOpContext>;
export type AgentAdminControllerLinkClaimAttemptToExternalUserError = BadRequest | Forbidden | Conflict | WorkosOpError;
/** Link a claim attempt to an external user Link an external user to a claim attempt and retrieve the code needed for the agent to complete the claim. The user is looked up by external ID; if no user exists, one is created. When the user belongs to multiple organizations, an explicit organization must be provided. */
export declare const AgentAdminControllerLinkClaimAttemptToExternalUser: API.OperationMethod<AgentAdminControllerLinkClaimAttemptToExternalUserRequest, ClaimViewResponse, AgentAdminControllerLinkClaimAttemptToExternalUserError, WorkosOpContext>;
export type AgentBlueprintsTokenControllerMintTokenError = BadRequest | Forbidden | NotFound | WorkosOpError;
/** Mint an agent token Mint an agent access token (and backing session) from an agent blueprint. The session can be user-delegated (exchanging a user access token), autonomous (the agent acting as itself in an organization), agent-delegated (the agent exchanging its own access token for a new session on the same instance), or a refresh of a previously issued refresh token. */
export declare const AgentBlueprintsTokenControllerMintToken: API.OperationMethod<AgentBlueprintsTokenControllerMintTokenRequest, AgentToken, AgentBlueprintsTokenControllerMintTokenError, WorkosOpContext>;
export type ApiKeysControllerExpireError = NotFound | Conflict | UnprocessableEntity | WorkosOpError;
/** Expire an API key Expire an API key immediately, schedule a future expiration, or clear a scheduled future expiration. */
export declare const ApiKeysControllerExpire: API.OperationMethod<ApiKeysControllerExpireRequest, ApiKey, ApiKeysControllerExpireError, WorkosOpContext>;
export type ApplicationsControllerFindError = NotFound | WorkosOpError;
/** Get a Connect Application Retrieve details for a specific Connect Application by ID or client ID. */
export declare const ApplicationsControllerFind: API.OperationMethod<ApplicationsControllerFindRequest, ApplicationsControllerFindResponse, ApplicationsControllerFindError, WorkosOpContext>;
export type ApproveWaitlistEntriesControllerError = NotFound | UnprocessableEntity | WorkosOpError;
/** Approve a waitlist entry Approve a waitlist entry, create an invitation for its email address, and send the invitation email. Approving a denied entry reverses the denial. The approval is saved even when the invitation steps fail, so instead of retrying the approval, recover based on the outcome: - `200` -- the entry is approved. If invitation creation failed, no invitation exists yet; [send](/reference/authkit/invitation/send) one. - `422` with code `invitation_email_not_sent` -- the entry is approved and an invitation exists, but its email was not sent; [resend](/reference/authkit/invitation/resend) it. - `422` with code `invalid_state` -- the entry was already approved. */
export declare const ApproveWaitlistEntriesController: API.OperationMethod<ApproveWaitlistEntriesControllerRequest, ApproveWaitlistEntriesControllerResponse, ApproveWaitlistEntriesControllerError, WorkosOpContext>;
export type AssignAuthorizationRoleAssignmentsControllerRoleError = Forbidden | NotFound | UnprocessableEntity | WorkosOpError;
/** Assign a role Assign a role to an organization membership on a specific resource. */
export declare const AssignAuthorizationRoleAssignmentsControllerRole: API.OperationMethod<AssignAuthorizationRoleAssignmentsControllerRoleRequest, UserRoleAssignment, AssignAuthorizationRoleAssignmentsControllerRoleError, WorkosOpContext>;
export type AuditLogExportsControllerExportsError = BadRequest | NotFound | WorkosOpError;
/** Create Export Create an Audit Log Export. Exports are scoped to a single organization within a specified date range. */
export declare const AuditLogExportsControllerExports: API.OperationMethod<AuditLogExportsControllerExportsRequest, AuditLogExportJson, AuditLogExportsControllerExportsError, WorkosOpContext>;
export type AuditLogsRetentionControllerAuditLogsRetentionError = NotFound | WorkosOpError;
/** Get Retention Get the configured event retention period for the given Organization. */
export declare const AuditLogsRetentionControllerAuditLogsRetention: API.OperationMethod<AuditLogsRetentionControllerAuditLogsRetentionRequest, AuditLogsRetentionJson, AuditLogsRetentionControllerAuditLogsRetentionError, WorkosOpContext>;
export type AuditLogValidatorVersionsControllerSchemasError = NotFound | UnprocessableEntity | WorkosOpError;
/** List Schemas Get a list of all schemas for the Audit Logs action identified by `:name`. */
export declare const AuditLogValidatorVersionsControllerSchemas: API.OperationMethod<AuditLogValidatorVersionsControllerSchemasRequest, AuditLogValidatorVersionsControllerSchemasResponse, AuditLogValidatorVersionsControllerSchemasError, WorkosOpContext>;
export type AuthenticationFactorsControllerChallengeError = NotFound | UnprocessableEntity | WorkosOpError;
/** Challenge Factor Creates a Challenge for an Authentication Factor. */
export declare const AuthenticationFactorsControllerChallenge: API.OperationMethod<AuthenticationFactorsControllerChallengeRequest, AuthenticationChallenge, AuthenticationFactorsControllerChallengeError, WorkosOpContext>;
export type AuthorizationPermissionsControllerFindError = NotFound | WorkosOpError;
/** Get a permission Retrieve a permission by its unique slug. */
export declare const AuthorizationPermissionsControllerFind: API.OperationMethod<AuthorizationPermissionsControllerFindRequest, AuthorizationPermission, AuthorizationPermissionsControllerFindError, WorkosOpContext>;
export type AuthorizationResourcesControllerFindByIdError = Forbidden | NotFound | UnprocessableEntity | WorkosOpError;
/** Get a resource Retrieve the details of an authorization resource by its ID. */
export declare const AuthorizationResourcesControllerFindById: API.OperationMethod<AuthorizationResourcesControllerFindByIdRequest, AuthorizationResource, AuthorizationResourcesControllerFindByIdError, WorkosOpContext>;
export type AuthorizeSsoControllerError = WorkosOpError;
/** Initiate SSO Initiates the single sign-on flow. */
export declare const AuthorizeSsoController: API.OperationMethod<AuthorizeSsoControllerRequest, SsoAuthorizeUrlResponse, AuthorizeSsoControllerError, WorkosOpContext>;
export type AuthorizeUserlandSsoControllerError = WorkosOpError;
/** Get an authorization URL Generates an OAuth 2.0 authorization URL to authenticate a user with AuthKit or SSO. */
export declare const AuthorizeUserlandSsoController: API.OperationMethod<AuthorizeUserlandSsoControllerRequest, AuthorizeUserlandSsoControllerResponse, AuthorizeUserlandSsoControllerError, WorkosOpContext>;
export type CheckAuthorizationControllerError = Forbidden | NotFound | UnprocessableEntity | WorkosOpError;
/** Check authorization Check if an organization membership has a specific permission on a resource. Supports identification by resource_id OR by resource_external_id + resource_type_slug. */
export declare const CheckAuthorizationController: API.OperationMethod<CheckAuthorizationControllerRequest, AuthorizationCheck, CheckAuthorizationControllerError, WorkosOpContext>;
export type ClientApiTokenControllerIssueClientApiTokenError = BadRequest | NotFound | UnprocessableEntity | WorkosOpError;
/** Generate a Client API token Generate a short-lived, session-bound token for the Client GraphQL API, scoped to an organization and user. */
export declare const ClientApiTokenControllerIssueClientApiToken: API.OperationMethod<ClientApiTokenControllerIssueClientApiTokenRequest, ClientApiTokenResponse, ClientApiTokenControllerIssueClientApiTokenError, WorkosOpContext>;
export type CompleteExternalAuthControllerLoginError = BadRequest | NotFound | UnprocessableEntity | WorkosOpError;
/** Complete external authentication Completes an external authentication flow and returns control to AuthKit. This endpoint is used with [Standalone Connect](/authkit/connect/standalone) to bridge your existing authentication system with the Connect OAuth API infrastructure. After successfully authenticating a user in your application, calling this endpoint will: - Create or update the user in AuthKit, using the given `id` as its `external_id`. - Return a `redirect_uri` your application should redirect to in order for AuthKit to complete the flow Users are automatically created or updated based on the `id` and `email` provided. If a user with the same `id` exists, their information is updated. Otherwise, a new user is created. If you provide a new `id` with an `email` that already belongs to an existing user, the request will fail with an error as email addresses are unique to a user. */
export declare const CompleteExternalAuthControllerLogin: API.OperationMethod<CompleteExternalAuthControllerLoginRequest, ExternalAuthCompleteResponse, CompleteExternalAuthControllerLoginError, WorkosOpContext>;
export type ConfirmUserlandUsersControllerEmailChangeError = BadRequest | NotFound | Conflict | UnprocessableEntity | WorkosOpError;
/** Confirm email change Confirms an email change using the one-time code received by the user. */
export declare const ConfirmUserlandUsersControllerEmailChange: API.OperationMethod<ConfirmUserlandUsersControllerEmailChangeRequest, ConfirmUserlandUsersControllerEmailChangeResponse, ConfirmUserlandUsersControllerEmailChangeError, WorkosOpContext>;
export type ConnectionsControllerFindError = Forbidden | NotFound | WorkosOpError;
/** Get a Connection Get the details of an existing connection. */
export declare const ConnectionsControllerFind: API.OperationMethod<ConnectionsControllerFindRequest, Connection, ConnectionsControllerFindError, WorkosOpContext>;
export type CreateAgentBlueprintsControllerError = BadRequest | Conflict | UnprocessableEntity | WorkosOpError;
/** Create an agent blueprint Creates an agent blueprint: the template describing what an agent may do (its permission ceiling), who may invoke it, and the lifetimes of its sessions. */
export declare const CreateAgentBlueprintsController: API.OperationMethod<CreateAgentBlueprintsControllerRequest, AgentBlueprint, CreateAgentBlueprintsControllerError, WorkosOpContext>;
export type CreateApplicationCredentialsControllerError = NotFound | UnprocessableEntity | WorkosOpError;
/** Create a new client secret for a Connect Application Create new secrets for a Connect Application. */
export declare const CreateApplicationCredentialsController: API.OperationMethod<CreateApplicationCredentialsControllerRequest, NewConnectApplicationSecret, CreateApplicationCredentialsControllerError, WorkosOpContext>;
export type CreateApplicationsControllerError = NotFound | UnprocessableEntity | WorkosOpError;
/** Create a Connect Application Create a new Connect Application. Supports both OAuth and Machine-to-Machine (M2M) application types. */
export declare const CreateApplicationsController: API.OperationMethod<CreateApplicationsControllerRequest, CreateApplicationsControllerResponse, CreateApplicationsControllerError, WorkosOpContext>;
export type CreateAuditLogEventsControllerError = BadRequest | NotFound | UnprocessableEntity | WorkosOpError;
/** Create Event Create an Audit Log Event. This API supports idempotency which guarantees that performing the same operation multiple times will have the same result as if the operation were performed only once. This is handy in situations where you may need to retry a request due to a failure or prevent accidental duplicate requests from creating more than one resource. To achieve idempotency, you can add `Idempotency-Key` request header to a Create Event request with a unique string as the value. Each subsequent request matching this unique string will return the same response. We suggest using [v4 UUIDs](https://en.wikipedia.org/wiki/Universally_unique_identifier) for idempotency keys to avoid collisions. Idempotency keys expire after 24 hours. The API will generate a new response if you submit a request with an expired key. */
export declare const CreateAuditLogEventsController: API.OperationMethod<CreateAuditLogEventsControllerRequest, AuditLogEventCreateResponse, CreateAuditLogEventsControllerError, WorkosOpContext>;
export type CreateAuditLogValidatorVersionsControllerError = UnprocessableEntity | WorkosOpError;
/** Create Schema Creates a new Audit Log schema used to validate the payload of incoming Audit Log Events. If the `action` does not exist, it will also be created. */
export declare const CreateAuditLogValidatorVersionsController: API.OperationMethod<CreateAuditLogValidatorVersionsControllerRequest, AuditLogSchemaJson, CreateAuditLogValidatorVersionsControllerError, WorkosOpContext>;
export type CreateAuthenticationFactorsControllerError = UnprocessableEntity | WorkosOpError;
/** Enroll Factor Enrolls an Authentication Factor to be used as an additional factor of authentication. The returned ID should be used to create an authentication Challenge. */
export declare const CreateAuthenticationFactorsController: API.OperationMethod<CreateAuthenticationFactorsControllerRequest, AuthenticationFactorEnrolled, CreateAuthenticationFactorsControllerError, WorkosOpContext>;
export type CreateAuthkitOauthResourcesControllerError = UnprocessableEntity | WorkosOpError;
/** Create an MCP resource indicator Adds an MCP resource indicator (RFC 8707) to an environment, leaving any others in place. */
export declare const CreateAuthkitOauthResourcesController: API.OperationMethod<CreateAuthkitOauthResourcesControllerRequest, AuthkitOauthResource, CreateAuthkitOauthResourcesControllerError, WorkosOpContext>;
export type CreateAuthorizationGroupRoleAssignmentsControllerError = Forbidden | NotFound | Conflict | UnprocessableEntity | WorkosOpError;
/** Assign a role to a group Assign a role to a group on a specific resource. */
export declare const CreateAuthorizationGroupRoleAssignmentsController: API.OperationMethod<CreateAuthorizationGroupRoleAssignmentsControllerRequest, GroupRoleAssignment, CreateAuthorizationGroupRoleAssignmentsControllerError, WorkosOpContext>;
export type CreateAuthorizationOrganizationRolesControllerError = BadRequest | Forbidden | NotFound | Conflict | UnprocessableEntity | WorkosOpError;
/** Create a custom role Create a new custom role for this organization. */
export declare const CreateAuthorizationOrganizationRolesController: API.OperationMethod<CreateAuthorizationOrganizationRolesControllerRequest, CreateAuthorizationOrganizationRolesControllerResponse, CreateAuthorizationOrganizationRolesControllerError, WorkosOpContext>;
export type CreateAuthorizationPermissionsControllerError = BadRequest | NotFound | Conflict | UnprocessableEntity | WorkosOpError;
/** Create a permission Create a new permission in your WorkOS environment. The permission can then be assigned to environment roles and custom roles. */
export declare const CreateAuthorizationPermissionsController: API.OperationMethod<CreateAuthorizationPermissionsControllerRequest, CreateAuthorizationPermissionsControllerResponse, CreateAuthorizationPermissionsControllerError, WorkosOpContext>;
export type CreateAuthorizationResourcesControllerError = BadRequest | Forbidden | NotFound | Conflict | UnprocessableEntity | WorkosOpError;
/** Create an authorization resource Create a new authorization resource. */
export declare const CreateAuthorizationResourcesController: API.OperationMethod<CreateAuthorizationResourcesControllerRequest, CreateAuthorizationResourcesControllerResponse, CreateAuthorizationResourcesControllerError, WorkosOpContext>;
export type CreateAuthorizationRolesControllerError = BadRequest | Forbidden | NotFound | Conflict | UnprocessableEntity | WorkosOpError;
/** Create an environment role Create a new environment role. */
export declare const CreateAuthorizationRolesController: API.OperationMethod<CreateAuthorizationRolesControllerRequest, CreateAuthorizationRolesControllerResponse, CreateAuthorizationRolesControllerError, WorkosOpContext>;
export type CreateConnectionsControllerError = BadRequest | Forbidden | NotFound | Conflict | UnprocessableEntity | WorkosOpError;
/** Create a Connection Creates a new connection for an organization. Provide `saml_options` or `oidc_options` to configure the identity provider. When `external_id` matches an existing connection in the organization, that connection is returned instead of creating a duplicate. */
export declare const CreateConnectionsController: API.OperationMethod<CreateConnectionsControllerRequest, Connection, CreateConnectionsControllerError, WorkosOpContext>;
export type CreateCorsOriginsControllerCorsOriginError = Conflict | UnprocessableEntity | WorkosOpError;
/** Create a CORS origin Creates a new CORS origin for the API key's application. CORS origins allow browser-based applications to make requests to the WorkOS API. */
export declare const CreateCorsOriginsControllerCorsOrigin: API.OperationMethod<CreateCorsOriginsControllerCorsOriginRequest, CorsOriginResponse, CreateCorsOriginsControllerCorsOriginError, WorkosOpContext>;
export type CreateDataIntegrationsControllerApiKeyConnectionError = BadRequest | Forbidden | NotFound | Conflict | WorkosOpError;
/** Create another API key connected account Creates another API key-based connected account for the specified integration, owned by the user or, when `connection_owner` is `organization`, shared by the organization. Requires `connection_intent: add` and does not accept `connected_account_id`; use PUT to create or rotate the compatibility connection or to update an exact connection. Creating an additional connection is not yet available: until it is, this endpoint succeeds only when the owner has no connection for this integration, which creates the compatibility connection, and otherwise returns 404 `multiple_connections_unavailable`. */
export declare const CreateDataIntegrationsControllerApiKeyConnection: API.OperationMethod<CreateDataIntegrationsControllerApiKeyConnectionRequest, ConnectedAccountWriteResponse, CreateDataIntegrationsControllerApiKeyConnectionError, WorkosOpContext>;
export type CreateDataIntegrationsControllerClientCredentialsConnectionError = BadRequest | Forbidden | NotFound | Conflict | WorkosOpError;
/** Create another client credentials connected account Creates another client credentials-based connected account for the specified integration, owned by the user or, when `connection_owner` is `organization`, shared by the organization. Requires `connection_intent: add` and does not accept `connected_account_id`; use PUT to create or rotate the compatibility connection or to update an exact connection. Creating an additional connection is not yet available: until it is, this endpoint succeeds only when the owner has no connection for this integration, which creates the compatibility connection, and otherwise returns 404 `multiple_connections_unavailable`. */
export declare const CreateDataIntegrationsControllerClientCredentialsConnection: API.OperationMethod<CreateDataIntegrationsControllerClientCredentialsConnectionRequest, ConnectedAccountWriteResponse, CreateDataIntegrationsControllerClientCredentialsConnectionError, WorkosOpContext>;
export type CreateDataIntegrationsManagementControllerDataIntegrationError = BadRequest | Forbidden | NotFound | Conflict | UnprocessableEntity | WorkosOpError;
/** Create a data integration Creates a data integration for a provider. Set `credentials.type` to `custom` to use your own OAuth app credentials or `organization` to have each organization supply its own. Set `auth_methods` to `["api_key"]` to create an API key integration; you may optionally supply an `api_key` block to install a first tenant in the same call. Set `auth_methods` to `["client_credentials"]` to create a client-credentials integration; client credentials are installed per-tenant afterwards. Set `ownership` to `organization` to create the integration organizations connect to instead of the default user-owned one; a provider may have one of each. For a built-in provider, pass its slug as `provider`. For a custom provider, pass a new slug plus a `custom_provider` definition, or the slug of an existing custom provider (without `custom_provider`) to add the other ownership. */
export declare const CreateDataIntegrationsManagementControllerDataIntegration: API.OperationMethod<CreateDataIntegrationsManagementControllerDataIntegrationRequest, DataIntegration, CreateDataIntegrationsManagementControllerDataIntegrationError, WorkosOpContext>;
export type CreateDataIntegrationsOrganizationControllerOrganizationDataInstallationError = Forbidden | NotFound | Conflict | UnprocessableEntity | WorkosOpError;
/** Import an organization connected account Imports an organization-owned [connected account](/reference/pipes/connected-account) by providing OAuth tokens directly. Omit `connection_intent` to create only the compatibility connection, or set it to `add` to explicitly create another connection. This creation-only endpoint does not accept `connected_account_id` or reauthorization intent. */
export declare const CreateDataIntegrationsOrganizationControllerOrganizationDataInstallation: API.OperationMethod<CreateDataIntegrationsOrganizationControllerOrganizationDataInstallationRequest, ConnectedAccountWriteResponse, CreateDataIntegrationsOrganizationControllerOrganizationDataInstallationError, WorkosOpContext>;
export type CreateDataIntegrationsUserManagementControllerUserDataInstallationError = NotFound | Conflict | UnprocessableEntity | WorkosOpError;
/** Import a connected account Imports a [connected account](/reference/pipes/connected-account) for a user by providing OAuth tokens directly. Use this to migrate existing connections or set up connections without going through the OAuth flow. */
export declare const CreateDataIntegrationsUserManagementControllerUserDataInstallation: API.OperationMethod<CreateDataIntegrationsUserManagementControllerUserDataInstallationRequest, ConnectedAccountWriteResponse, CreateDataIntegrationsUserManagementControllerUserDataInstallationError, WorkosOpContext>;
export type CreateFlagTargetsControllerTargetError = BadRequest | Forbidden | NotFound | WorkosOpError;
/** Add a feature flag target Enables a feature flag for a specific target in the current environment. Currently, supported targets include users and organizations. */
export declare const CreateFlagTargetsControllerTarget: API.OperationMethod<CreateFlagTargetsControllerTargetRequest, CreateFlagTargetsControllerTargetResponse, CreateFlagTargetsControllerTargetError, WorkosOpContext>;
export type CreateGroupsControllerError = BadRequest | Forbidden | NotFound | UnprocessableEntity | WorkosOpError;
/** Create a group Create a new group within an organization. */
export declare const CreateGroupsController: API.OperationMethod<CreateGroupsControllerRequest, Group, CreateGroupsControllerError, WorkosOpContext>;
export type CreateItContactsControllerError = Forbidden | NotFound | Conflict | UnprocessableEntity | WorkosOpError;
/** Create an IT contact Add an IT contact to an organization. No Admin Portal invitation is sent, though the contact is notified if the organization has a connection certificate nearing expiry. */
export declare const CreateItContactsController: API.OperationMethod<CreateItContactsControllerRequest, ItContact, CreateItContactsControllerError, WorkosOpContext>;
export type CreateJumpWireWebDataVaultControllerError = BadRequest | Conflict | UnprocessableEntity | WorkosOpError;
/** Create an object Encrypt and store a new key-value object. */
export declare const CreateJumpWireWebDataVaultController: API.OperationMethod<CreateJumpWireWebDataVaultControllerRequest, ObjectMetadata, CreateJumpWireWebDataVaultControllerError, WorkosOpContext>;
export type CreateOrganizationApiKeysControllerError = NotFound | UnprocessableEntity | WorkosOpError;
/** Create an API key for an organization Create a new API key for an organization. */
export declare const CreateOrganizationApiKeysController: API.OperationMethod<CreateOrganizationApiKeysControllerRequest, OrganizationApiKeyWithValue, CreateOrganizationApiKeysControllerError, WorkosOpContext>;
export type CreateOrganizationDomainsControllerError = Conflict | WorkosOpError;
/** Create an Organization Domain Creates a new Organization Domain. */
export declare const CreateOrganizationDomainsController: API.OperationMethod<CreateOrganizationDomainsControllerRequest, CreateOrganizationDomainsControllerResponse, CreateOrganizationDomainsControllerError, WorkosOpContext>;
export type CreateOrganizationsControllerError = BadRequest | Conflict | UnprocessableEntity | WorkosOpError;
/** Create an Organization Creates a new organization in the current environment. */
export declare const CreateOrganizationsController: API.OperationMethod<CreateOrganizationsControllerRequest, Organization, CreateOrganizationsControllerError, WorkosOpContext>;
export type CreatePortalSessionsControllerError = BadRequest | Forbidden | NotFound | UnprocessableEntity | WorkosOpError;
/** Generate a Portal Link Generate a Portal Link scoped to an Organization. */
export declare const CreatePortalSessionsController: API.OperationMethod<CreatePortalSessionsControllerRequest, PortalLinkResponse, CreatePortalSessionsControllerError, WorkosOpContext>;
export type CreateRedirectUrisControllerError = BadRequest | UnprocessableEntity | WorkosOpError;
/** Create a redirect URI Creates a new redirect URI for an application. */
export declare const CreateRedirectUrisController: API.OperationMethod<CreateRedirectUrisControllerRequest, RedirectUri, CreateRedirectUrisControllerError, WorkosOpContext>;
export type CreateSamlIdpSigningCertificatesControllerError = BadRequest | Forbidden | NotFound | UnprocessableEntity | WorkosOpError;
/** Create an IdP signing certificate Adds an Identity Provider signing certificate to the connection, so SAML responses signed with its key can be verified. Use this to import a new certificate ahead of an Identity Provider rotation -- the existing certificates keep working until they are deleted or expire. */
export declare const CreateSamlIdpSigningCertificatesController: API.OperationMethod<CreateSamlIdpSigningCertificatesControllerRequest, SamlIdpSigningCertificate, CreateSamlIdpSigningCertificatesControllerError, WorkosOpContext>;
export type CreateSamlSpEncryptionCertificatesControllerError = BadRequest | Forbidden | NotFound | Conflict | WorkosOpError;
/** Create an SP encryption certificate Generates a new encryption key pair for the connection and returns its public certificate. WorkOS holds the private key, so the request takes no body -- to bring your own key pairs, provide `saml_options.sp_encryption_key_pairs` when creating the connection instead. Creating a certificate appends rather than replaces: every active private key is tried when decrypting, which lets a rotation overlap the old and new certificates. */
export declare const CreateSamlSpEncryptionCertificatesController: API.OperationMethod<CreateSamlSpEncryptionCertificatesControllerRequest, SamlSpEncryptionCertificate, CreateSamlSpEncryptionCertificatesControllerError, WorkosOpContext>;
export type CreateSamlSpSigningCertificatesControllerError = BadRequest | Forbidden | NotFound | Conflict | WorkosOpError;
/** Create an SP signing certificate Generates a new request signing key pair for the connection and returns its public certificate. WorkOS holds the private key, so the request takes no body -- to bring your own key pair, provide `saml_options.sp_signing_key_pair` when creating the connection instead. A connection signs with one key pair at a time: delete the existing certificate before creating its replacement. */
export declare const CreateSamlSpSigningCertificatesController: API.OperationMethod<CreateSamlSpSigningCertificatesControllerRequest, SamlSpSigningCertificate, CreateSamlSpSigningCertificatesControllerError, WorkosOpContext>;
export type CreateTeamsControllerTeamError = Conflict | UnprocessableEntity | WorkosOpError;
/** Create a team Creates a team along with its default project, a staging environment, and a production environment. An admin invitation is sent to `admin_email`, onboarding is marked complete with AuthKit enabled, and the calling platform is authorized to act inside the team. */
export declare const CreateTeamsControllerTeam: API.OperationMethod<CreateTeamsControllerTeamRequest, Team, CreateTeamsControllerTeamError, WorkosOpContext>;
export type CreateUserApiKeysControllerError = BadRequest | NotFound | UnprocessableEntity | WorkosOpError;
/** Create an API key for a user Create a new API key owned by a user. The user must have an active membership in the specified organization. */
export declare const CreateUserApiKeysController: API.OperationMethod<CreateUserApiKeysControllerRequest, UserApiKeyWithValue, CreateUserApiKeysControllerError, WorkosOpContext>;
export type CreateUserlandUserInvitesControllerError = BadRequest | NotFound | UnprocessableEntity | WorkosOpError;
/** Send an invitation Sends an invitation email to the recipient. */
export declare const CreateUserlandUserInvitesController: API.OperationMethod<CreateUserlandUserInvitesControllerRequest, UserlandUserInvite, CreateUserlandUserInvitesControllerError, WorkosOpContext>;
export type CreateUserlandUserOrganizationMembershipsControllerError = BadRequest | NotFound | UnprocessableEntity | WorkosOpError;
/** Create an organization membership Creates a new `active` organization membership for the given organization and user. Calling this API with an organization and user that match an `inactive` organization membership will activate the membership with the specified role(s). */
export declare const CreateUserlandUserOrganizationMembershipsController: API.OperationMethod<CreateUserlandUserOrganizationMembershipsControllerRequest, CreateUserlandUserOrganizationMembershipsControllerResponse, CreateUserlandUserOrganizationMembershipsControllerError, WorkosOpContext>;
export type CreateWaitlistsControllerEntryError = NotFound | UnprocessableEntity | WorkosOpError;
/** Create a waitlist entry Add an email address to the waitlist. Email addresses are normalized and unique per environment: a request for an email address already on the waitlist returns the existing entry unchanged (still with status `201`) and does not send another confirmation email. If a user with the email address already exists in the environment, the request fails with the code `user_already_exists`. */
export declare const CreateWaitlistsControllerEntry: API.OperationMethod<CreateWaitlistsControllerEntryRequest, WaitlistEntry, CreateWaitlistsControllerEntryError, WorkosOpContext>;
export type CreateWebhookEndpointsControllerError = Conflict | UnprocessableEntity | WorkosOpError;
/** Create a Webhook Endpoint Create a new webhook endpoint to receive event notifications. */
export declare const CreateWebhookEndpointsController: API.OperationMethod<CreateWebhookEndpointsControllerRequest, WebhookEndpointJson, CreateWebhookEndpointsControllerError, WorkosOpContext>;
export type DataIntegrationsControllerGetDataIntegrationAuthorizeUrlError = BadRequest | Forbidden | NotFound | Conflict | UnprocessableEntity | WorkosOpError;
/** Get authorization URL Generates an OAuth authorization URL to initiate the connection flow for a user. Redirect the user to the returned URL to begin the OAuth flow with the third-party provider. */
export declare const DataIntegrationsControllerGetDataIntegrationAuthorizeUrl: API.OperationMethod<DataIntegrationsControllerGetDataIntegrationAuthorizeUrlRequest, DataIntegrationAuthorizeUrlResponse, DataIntegrationsControllerGetDataIntegrationAuthorizeUrlError, WorkosOpContext>;
export type DataIntegrationsControllerVendCredentialsError = BadRequest | Forbidden | NotFound | Conflict | UnprocessableEntity | WorkosOpError;
/** Vend credentials for a connected account Returns credentials for a user's connected account. Branches on the installation's `auth_method`: OAuth installations return an access token (refreshed if needed); API-key installations return the stored secret. Every active credential includes `config`: provider-declared, non-secret values from the installation snapshot, with current provider defaults for unset fields. Editing integration or organization configuration does not change the snapshot; reconnect or explicitly rebind the connection to adopt those edits. Defaults remain live, so a changed default can appear in `config` before a cached token is refreshed or re-minted. Credentials that never refresh require a reconnect or rebind when a default changes their routing. */
export declare const DataIntegrationsControllerVendCredentials: API.OperationMethod<DataIntegrationsControllerVendCredentialsRequest, DataIntegrationsControllerVendCredentialsResponse, DataIntegrationsControllerVendCredentialsError, WorkosOpContext>;
export type DeactivateUserlandUserOrganizationMembershipsControllerError = BadRequest | NotFound | UnprocessableEntity | WorkosOpError;
/** Deactivate an organization membership Deactivates an `active` organization membership. Emits an [organization_membership.updated](/events/organization-membership) event upon successful deactivation. - Deactivating an `inactive` membership is a no-op and does not emit an event. - Deactivating a `pending` membership returns an error. This membership should be [deleted](/reference/authkit/organization-membership/delete) instead. See the [membership management documentation](/authkit/users-organizations/organizations/membership-management) for additional details. */
export declare const DeactivateUserlandUserOrganizationMembershipsController: API.OperationMethod<DeactivateUserlandUserOrganizationMembershipsControllerRequest, DeactivateUserlandUserOrganizationMembershipsControllerResponse, DeactivateUserlandUserOrganizationMembershipsControllerError, WorkosOpContext>;
export type DecryptJumpWireWebKeyControllerError = BadRequest | WorkosOpError;
/** Decrypt a data key Decrypt a previously encrypted data key from WorkOS Vault. */
export declare const DecryptJumpWireWebKeyController: API.OperationMethod<DecryptJumpWireWebKeyControllerRequest, DecryptResponse, DecryptJumpWireWebKeyControllerError, WorkosOpContext>;
export type DeleteAgentBlueprintsControllerError = NotFound | WorkosOpError;
/** Delete an agent blueprint Deletes an agent blueprint along with its configuration, instances, and sessions. */
export declare const DeleteAgentBlueprintsController: API.OperationMethod<DeleteAgentBlueprintsControllerRequest, DeleteAgentBlueprintsControllerResponse, DeleteAgentBlueprintsControllerError, WorkosOpContext>;
export type DeleteAgentInstancesControllerError = NotFound | WorkosOpError;
/** Delete an agent instance Deletes an agent instance along with its sessions, invalidating their refresh tokens. */
export declare const DeleteAgentInstancesController: API.OperationMethod<DeleteAgentInstancesControllerRequest, DeleteAgentInstancesControllerResponse, DeleteAgentInstancesControllerError, WorkosOpContext>;
export type DeleteApiKeysControllerError = NotFound | WorkosOpError;
/** Delete an API key Permanently deletes an API key. This action cannot be undone. Once deleted, any requests using this API key will fail authentication. */
export declare const DeleteApiKeysController: API.OperationMethod<DeleteApiKeysControllerRequest, DeleteApiKeysControllerResponse, DeleteApiKeysControllerError, WorkosOpContext>;
export type DeleteApplicationCredentialsControllerError = NotFound | WorkosOpError;
/** Delete a Client Secret Delete (revoke) an existing client secret. */
export declare const DeleteApplicationCredentialsController: API.OperationMethod<DeleteApplicationCredentialsControllerRequest, DeleteApplicationCredentialsControllerResponse, DeleteApplicationCredentialsControllerError, WorkosOpContext>;
export type DeleteApplicationsControllerError = NotFound | WorkosOpError;
/** Delete a Connect Application Delete an existing Connect Application. */
export declare const DeleteApplicationsController: API.OperationMethod<DeleteApplicationsControllerRequest, DeleteApplicationsControllerResponse, DeleteApplicationsControllerError, WorkosOpContext>;
export type DeleteAuthenticationFactorsControllerError = NotFound | WorkosOpError;
/** Delete Factor Permanently deletes an Authentication Factor. It cannot be undone. */
export declare const DeleteAuthenticationFactorsController: API.OperationMethod<DeleteAuthenticationFactorsControllerRequest, DeleteAuthenticationFactorsControllerResponse, DeleteAuthenticationFactorsControllerError, WorkosOpContext>;
export type DeleteAuthkitOauthResourcesControllerError = NotFound | WorkosOpError;
/** Delete an MCP resource indicator Removes an MCP resource indicator from an environment. Any application consents granted against it are removed too. */
export declare const DeleteAuthkitOauthResourcesController: API.OperationMethod<DeleteAuthkitOauthResourcesControllerRequest, DeleteAuthkitOauthResourcesControllerResponse, DeleteAuthkitOauthResourcesControllerError, WorkosOpContext>;
export type DeleteAuthorizationOrganizationRolesControllerError = BadRequest | Forbidden | NotFound | Conflict | WorkosOpError;
/** Delete a custom role Delete an existing custom role. */
export declare const DeleteAuthorizationOrganizationRolesController: API.OperationMethod<DeleteAuthorizationOrganizationRolesControllerRequest, DeleteAuthorizationOrganizationRolesControllerResponse, DeleteAuthorizationOrganizationRolesControllerError, WorkosOpContext>;
export type DeleteAuthorizationPermissionsControllerError = Forbidden | NotFound | WorkosOpError;
/** Delete a permission Delete an existing permission. System permissions cannot be deleted. */
export declare const DeleteAuthorizationPermissionsController: API.OperationMethod<DeleteAuthorizationPermissionsControllerRequest, DeleteAuthorizationPermissionsControllerResponse, DeleteAuthorizationPermissionsControllerError, WorkosOpContext>;
export type DeleteAuthorizationResourcesByExternalIdControllerByExternalIdError = BadRequest | Forbidden | NotFound | Conflict | WorkosOpError;
/** Delete an authorization resource by external ID Delete an authorization resource by organization, resource type, and external ID. This also deletes all descendant resources. */
export declare const DeleteAuthorizationResourcesByExternalIdControllerByExternalId: API.OperationMethod<DeleteAuthorizationResourcesByExternalIdControllerByExternalIdRequest, DeleteAuthorizationResourcesByExternalIdControllerByExternalIdResponse, DeleteAuthorizationResourcesByExternalIdControllerByExternalIdError, WorkosOpContext>;
export type DeleteAuthorizationResourcesControllerError = BadRequest | Forbidden | NotFound | Conflict | WorkosOpError;
/** Delete an authorization resource Delete an authorization resource and all its descendants. */
export declare const DeleteAuthorizationResourcesController: API.OperationMethod<DeleteAuthorizationResourcesControllerRequest, DeleteAuthorizationResourcesControllerResponse, DeleteAuthorizationResourcesControllerError, WorkosOpContext>;
export type DeleteAuthorizedApplicationsControllerError = NotFound | WorkosOpError;
/** Delete an authorized application Delete an existing Authorized Connect Application. */
export declare const DeleteAuthorizedApplicationsController: API.OperationMethod<DeleteAuthorizedApplicationsControllerRequest, DeleteAuthorizedApplicationsControllerResponse, DeleteAuthorizedApplicationsControllerError, WorkosOpContext>;
export type DeleteConnectionsControllerError = Forbidden | NotFound | WorkosOpError;
/** Delete a Connection Permanently deletes an existing connection. It cannot be undone. */
export declare const DeleteConnectionsController: API.OperationMethod<DeleteConnectionsControllerRequest, DeleteConnectionsControllerResponse, DeleteConnectionsControllerError, WorkosOpContext>;
export type DeleteDataIntegrationsManagementControllerDataIntegrationError = NotFound | WorkosOpError;
/** Delete a data integration Deletes the user-owned data integration and all of its connected installations. For a custom provider, the provider definition is deleted once no organization-owned root references it either. */
export declare const DeleteDataIntegrationsManagementControllerDataIntegration: API.OperationMethod<DeleteDataIntegrationsManagementControllerDataIntegrationRequest, DeleteDataIntegrationsManagementControllerDataIntegrationResponse, DeleteDataIntegrationsManagementControllerDataIntegrationError, WorkosOpContext>;
export type DeleteDataIntegrationsManagementControllerOrganizationDataIntegrationError = NotFound | WorkosOpError;
/** Delete an organization-owned data integration Deletes the organization-owned data integration for a provider and all of its connected installations. For a custom provider, the provider definition is deleted once no user-owned root references it either. The `/organization` suffix selects the environment-level organization-owned root for the provider; it does not name a particular organization. */
export declare const DeleteDataIntegrationsManagementControllerOrganizationDataIntegration: API.OperationMethod<DeleteDataIntegrationsManagementControllerOrganizationDataIntegrationRequest, DeleteDataIntegrationsManagementControllerOrganizationDataIntegrationResponse, DeleteDataIntegrationsManagementControllerOrganizationDataIntegrationError, WorkosOpContext>;
export type DeleteDataIntegrationsOrganizationControllerOrganizationDataInstallationError = BadRequest | NotFound | Conflict | WorkosOpError;
/** Delete an organization connected account Disconnects the organization's account for the provider, including removing any stored access and refresh tokens. A member will need to reauthorize if the organization wants to reconnect. This does not revoke access on the provider side. */
export declare const DeleteDataIntegrationsOrganizationControllerOrganizationDataInstallation: API.OperationMethod<DeleteDataIntegrationsOrganizationControllerOrganizationDataInstallationRequest, DeleteDataIntegrationsOrganizationControllerOrganizationDataInstallationResponse, DeleteDataIntegrationsOrganizationControllerOrganizationDataInstallationError, WorkosOpContext>;
export type DeleteDataIntegrationsUserManagementControllerUserDataInstallationError = BadRequest | NotFound | Conflict | WorkosOpError;
/** Delete a connected account Disconnects WorkOS's account for the user, including removing any stored access and refresh tokens. The user will need to reauthorize if they want to reconnect. Access is not revoked on the provider side, except for the WorkOS OAuth provider, whose underlying AuthKit grant is revoked. */
export declare const DeleteDataIntegrationsUserManagementControllerUserDataInstallation: API.OperationMethod<DeleteDataIntegrationsUserManagementControllerUserDataInstallationRequest, DeleteDataIntegrationsUserManagementControllerUserDataInstallationResponse, DeleteDataIntegrationsUserManagementControllerUserDataInstallationError, WorkosOpContext>;
export type DeleteDirectoriesControllerDirectoryError = Forbidden | NotFound | WorkosOpError;
/** Delete a Directory Permanently deletes an existing directory. It cannot be undone. */
export declare const DeleteDirectoriesControllerDirectory: API.OperationMethod<DeleteDirectoriesControllerDirectoryRequest, DeleteDirectoriesControllerDirectoryResponse, DeleteDirectoriesControllerDirectoryError, WorkosOpContext>;
export type DeleteFlagTargetsControllerTargetError = BadRequest | Forbidden | NotFound | WorkosOpError;
/** Remove a feature flag target Removes a target from the feature flag's target list in the current environment. Currently, supported targets include users and organizations. */
export declare const DeleteFlagTargetsControllerTarget: API.OperationMethod<DeleteFlagTargetsControllerTargetRequest, DeleteFlagTargetsControllerTargetResponse, DeleteFlagTargetsControllerTargetError, WorkosOpContext>;
export type DeleteGroupsControllerError = Forbidden | NotFound | WorkosOpError;
/** Delete a group Delete a group from an organization. */
export declare const DeleteGroupsController: API.OperationMethod<DeleteGroupsControllerRequest, DeleteGroupsControllerResponse, DeleteGroupsControllerError, WorkosOpContext>;
export type DeleteItContactsControllerError = Forbidden | NotFound | WorkosOpError;
/** Delete an IT contact Remove an IT contact from an organization and revoke the contact's active setup links. */
export declare const DeleteItContactsController: API.OperationMethod<DeleteItContactsControllerRequest, DeleteItContactsControllerResponse, DeleteItContactsControllerError, WorkosOpContext>;
export type DeleteJumpWireWebDataVaultControllerError = NotFound | Conflict | WorkosOpError;
/** Delete an object Delete an encrypted object. */
export declare const DeleteJumpWireWebDataVaultController: API.OperationMethod<DeleteJumpWireWebDataVaultControllerRequest, DeleteObjectResponse, DeleteJumpWireWebDataVaultControllerError, WorkosOpContext>;
export type DeleteOrganizationDomainsControllerError = NotFound | WorkosOpError;
/** Delete an Organization Domain Permanently deletes an organization domain. It cannot be undone. */
export declare const DeleteOrganizationDomainsController: API.OperationMethod<DeleteOrganizationDomainsControllerRequest, DeleteOrganizationDomainsControllerResponse, DeleteOrganizationDomainsControllerError, WorkosOpContext>;
export type DeleteOrganizationsControllerOrganizationError = Forbidden | NotFound | WorkosOpError;
/** Delete an Organization Permanently deletes an organization in the current environment. It cannot be undone. */
export declare const DeleteOrganizationsControllerOrganization: API.OperationMethod<DeleteOrganizationsControllerOrganizationRequest, DeleteOrganizationsControllerOrganizationResponse, DeleteOrganizationsControllerOrganizationError, WorkosOpContext>;
export type DeleteRedirectUrisControllerError = NotFound | Conflict | WorkosOpError;
/** Delete a redirect URI Deletes a redirect URI from an application. */
export declare const DeleteRedirectUrisController: API.OperationMethod<DeleteRedirectUrisControllerRequest, DeleteRedirectUrisControllerResponse, DeleteRedirectUrisControllerError, WorkosOpContext>;
export type DeleteSamlIdpSigningCertificatesControllerError = BadRequest | Forbidden | NotFound | WorkosOpError;
/** Delete an IdP signing certificate Removes an Identity Provider signing certificate from the connection. The last remaining certificate cannot be deleted. A certificate still published in the Identity Provider metadata may be restored by a metadata refresh. */
export declare const DeleteSamlIdpSigningCertificatesController: API.OperationMethod<DeleteSamlIdpSigningCertificatesControllerRequest, DeleteSamlIdpSigningCertificatesControllerResponse, DeleteSamlIdpSigningCertificatesControllerError, WorkosOpContext>;
export type DeleteSamlSpEncryptionCertificatesControllerError = Forbidden | NotFound | WorkosOpError;
/** Delete an SP encryption certificate Removes an encryption key pair from the connection. SAML responses encrypted with its certificate can no longer be decrypted, so remove the certificate from the Identity Provider first when rotating. */
export declare const DeleteSamlSpEncryptionCertificatesController: API.OperationMethod<DeleteSamlSpEncryptionCertificatesControllerRequest, DeleteSamlSpEncryptionCertificatesControllerResponse, DeleteSamlSpEncryptionCertificatesControllerError, WorkosOpContext>;
export type DeleteSamlSpSigningCertificatesControllerError = Forbidden | NotFound | WorkosOpError;
/** Delete the SP signing certificate Removes the request signing key pair from the connection, after which SAML requests are sent unsigned. Delete the certificate before creating its replacement when rotating. */
export declare const DeleteSamlSpSigningCertificatesController: API.OperationMethod<DeleteSamlSpSigningCertificatesControllerRequest, DeleteSamlSpSigningCertificatesControllerResponse, DeleteSamlSpSigningCertificatesControllerError, WorkosOpContext>;
export type DeleteUserlandUserOrganizationMembershipsControllerError = NotFound | UnprocessableEntity | WorkosOpError;
/** Delete an organization membership Permanently deletes an existing organization membership. It cannot be undone. */
export declare const DeleteUserlandUserOrganizationMembershipsController: API.OperationMethod<DeleteUserlandUserOrganizationMembershipsControllerRequest, DeleteUserlandUserOrganizationMembershipsControllerResponse, DeleteUserlandUserOrganizationMembershipsControllerError, WorkosOpContext>;
export type DeleteWaitlistEntriesControllerError = NotFound | WorkosOpError;
/** Delete a waitlist entry Remove the entry from the waitlist. Its email address can join again unless a user with that email now exists in the environment. Deleting the entry does not revoke an invitation created by approving it -- [revoke that invitation](/reference/authkit/invitation/revoke) separately to withdraw access. */
export declare const DeleteWaitlistEntriesController: API.OperationMethod<DeleteWaitlistEntriesControllerRequest, DeleteWaitlistEntriesControllerResponse, DeleteWaitlistEntriesControllerError, WorkosOpContext>;
export type DeleteWebhookEndpointsControllerError = NotFound | WorkosOpError;
/** Delete a Webhook Endpoint Delete an existing webhook endpoint. */
export declare const DeleteWebhookEndpointsController: API.OperationMethod<DeleteWebhookEndpointsControllerRequest, DeleteWebhookEndpointsControllerResponse, DeleteWebhookEndpointsControllerError, WorkosOpContext>;
export type DescribeJumpWireWebDataVaultControllerError = BadRequest | NotFound | WorkosOpError;
/** Describe an object Fetch metadata for an object without decrypting it. */
export declare const DescribeJumpWireWebDataVaultController: API.OperationMethod<DescribeJumpWireWebDataVaultControllerRequest, ObjectWithoutValue, DescribeJumpWireWebDataVaultControllerError, WorkosOpContext>;
export type DirectoriesControllerFindError = Forbidden | NotFound | WorkosOpError;
/** Get a Directory Get the details of an existing directory. */
export declare const DirectoriesControllerFind: API.OperationMethod<DirectoriesControllerFindRequest, Directory, DirectoriesControllerFindError, WorkosOpContext>;
export type DirectoryGroupsControllerFindError = Forbidden | NotFound | WorkosOpError;
/** Get a Directory Group Get the details of an existing Directory Group. */
export declare const DirectoryGroupsControllerFind: API.OperationMethod<DirectoryGroupsControllerFindRequest, DirectoryGroup, DirectoryGroupsControllerFindError, WorkosOpContext>;
export type DirectoryUsersControllerFindError = Forbidden | NotFound | WorkosOpError;
/** Get a Directory User Get the details of an existing Directory User. */
export declare const DirectoryUsersControllerFind: API.OperationMethod<DirectoryUsersControllerFindRequest, DirectoryUserWithGroups, DirectoryUsersControllerFindError, WorkosOpContext>;
export type DisableFeatureFlagsControllerFlagError = NotFound | WorkosOpError;
/** Disable a feature flag Disables a feature flag in the current environment. */
export declare const DisableFeatureFlagsControllerFlag: API.OperationMethod<DisableFeatureFlagsControllerFlagRequest, DisableFeatureFlagsControllerFlagResponse, DisableFeatureFlagsControllerFlagError, WorkosOpContext>;
export type EnableFeatureFlagsControllerFlagError = NotFound | WorkosOpError;
/** Enable a feature flag Enables a feature flag in the current environment. */
export declare const EnableFeatureFlagsControllerFlag: API.OperationMethod<EnableFeatureFlagsControllerFlagRequest, EnableFeatureFlagsControllerFlagResponse, EnableFeatureFlagsControllerFlagError, WorkosOpContext>;
export type ExportAuditLogExportsControllerError = NotFound | WorkosOpError;
/** Get Export Get an Audit Log Export. The URL will expire after 10 minutes. If the export is needed again at a later time, refetching the export will regenerate the URL. */
export declare const ExportAuditLogExportsController: API.OperationMethod<ExportAuditLogExportsControllerRequest, AuditLogExportJson, ExportAuditLogExportsControllerError, WorkosOpContext>;
export type FeatureFlagsControllerFindBySlugError = NotFound | WorkosOpError;
/** Get a feature flag Get the details of an existing feature flag by its slug. */
export declare const FeatureFlagsControllerFindBySlug: API.OperationMethod<FeatureFlagsControllerFindBySlugRequest, Flag, FeatureFlagsControllerFindBySlugError, WorkosOpContext>;
export type GetAgentAdminControllerRegistrationError = NotFound | WorkosOpError;
/** Get an agent registration Retrieve the details of an agent registration by ID. The registration is scoped to the environment of the API key used to authenticate the request. */
export declare const GetAgentAdminControllerRegistration: API.OperationMethod<GetAgentAdminControllerRegistrationRequest, AgentRegistration, GetAgentAdminControllerRegistrationError, WorkosOpContext>;
export type GetAgentBlueprintsControllerError = NotFound | WorkosOpError;
/** Get an agent blueprint Retrieves an agent blueprint by ID. */
export declare const GetAgentBlueprintsController: API.OperationMethod<GetAgentBlueprintsControllerRequest, AgentBlueprint, GetAgentBlueprintsControllerError, WorkosOpContext>;
export type GetAgentInstancesControllerError = NotFound | WorkosOpError;
/** Get an agent instance Retrieves an agent instance by ID. */
export declare const GetAgentInstancesController: API.OperationMethod<GetAgentInstancesControllerRequest, AgentInstance, GetAgentInstancesControllerError, WorkosOpContext>;
export type GetAgentInstanceSessionsControllerError = NotFound | WorkosOpError;
/** Get an agent instance session Retrieves an agent instance session by ID. */
export declare const GetAgentInstanceSessionsController: API.OperationMethod<GetAgentInstanceSessionsControllerRequest, AgentInstanceSession, GetAgentInstanceSessionsControllerError, WorkosOpContext>;
export type GetAuthenticationFactorsControllerError = NotFound | WorkosOpError;
/** Get Factor Gets an Authentication Factor. */
export declare const GetAuthenticationFactorsController: API.OperationMethod<GetAuthenticationFactorsControllerRequest, AuthenticationFactor, GetAuthenticationFactorsControllerError, WorkosOpContext>;
export type GetAuthorizationGroupRoleAssignmentsControllerError = Forbidden | NotFound | WorkosOpError;
/** Get a group role assignment Get a specific role assignment for a group by its ID. */
export declare const GetAuthorizationGroupRoleAssignmentsController: API.OperationMethod<GetAuthorizationGroupRoleAssignmentsControllerRequest, GroupRoleAssignment, GetAuthorizationGroupRoleAssignmentsControllerError, WorkosOpContext>;
export type GetAuthorizationOrganizationRolesControllerError = Forbidden | NotFound | WorkosOpError;
/** Get a custom role Retrieve a role that applies to an organization by its slug. This can return either an environment role or a custom role. */
export declare const GetAuthorizationOrganizationRolesController: API.OperationMethod<GetAuthorizationOrganizationRolesControllerRequest, GetAuthorizationOrganizationRolesControllerResponse, GetAuthorizationOrganizationRolesControllerError, WorkosOpContext>;
export type GetAuthorizationResourcesByExternalIdControllerByExternalIdError = Forbidden | NotFound | WorkosOpError;
/** Get a resource by external ID Retrieve the details of an authorization resource by its external ID, organization, and resource type. This is useful when you only have the external ID from your system and need to fetch the full resource details. */
export declare const GetAuthorizationResourcesByExternalIdControllerByExternalId: API.OperationMethod<GetAuthorizationResourcesByExternalIdControllerByExternalIdRequest, AuthorizationResource, GetAuthorizationResourcesByExternalIdControllerByExternalIdError, WorkosOpContext>;
export type GetAuthorizationRolesControllerError = Forbidden | NotFound | WorkosOpError;
/** Get an environment role Get an environment role by its slug. */
export declare const GetAuthorizationRolesController: API.OperationMethod<GetAuthorizationRolesControllerRequest, Role, GetAuthorizationRolesControllerError, WorkosOpContext>;
export type GetDataIntegrationsControllerUserlandUserTokenError = BadRequest | Forbidden | NotFound | Conflict | UnprocessableEntity | WorkosOpError;
/** Get an access token for a connected account Fetches a valid OAuth access token for a user's connected account. WorkOS automatically handles token refresh, ensuring you always receive a valid, non-expired token. */
export declare const GetDataIntegrationsControllerUserlandUserToken: API.OperationMethod<GetDataIntegrationsControllerUserlandUserTokenRequest, GetDataIntegrationsControllerUserlandUserTokenResponse, GetDataIntegrationsControllerUserlandUserTokenError, WorkosOpContext>;
export type GetDataIntegrationsManagementControllerDataIntegrationError = NotFound | WorkosOpError;
/** Get a data integration Retrieves the user-owned data integration by its slug. */
export declare const GetDataIntegrationsManagementControllerDataIntegration: API.OperationMethod<GetDataIntegrationsManagementControllerDataIntegrationRequest, DataIntegration, GetDataIntegrationsManagementControllerDataIntegrationError, WorkosOpContext>;
export type GetDataIntegrationsManagementControllerOrganizationDataIntegrationError = NotFound | WorkosOpError;
/** Get an organization-owned data integration Retrieves the organization-owned data integration for a provider by its slug. The `/organization` suffix selects the environment-level organization-owned root for the provider; it does not name a particular organization. */
export declare const GetDataIntegrationsManagementControllerOrganizationDataIntegration: API.OperationMethod<GetDataIntegrationsManagementControllerOrganizationDataIntegrationRequest, DataIntegration, GetDataIntegrationsManagementControllerOrganizationDataIntegrationError, WorkosOpContext>;
export type GetDataIntegrationsOrganizationControllerOrganizationDataInstallationError = BadRequest | NotFound | Conflict | WorkosOpError;
/** Get an organization connected account Retrieves an organization's [connected account](/reference/pipes/connected-account) for a specific provider. */
export declare const GetDataIntegrationsOrganizationControllerOrganizationDataInstallation: API.OperationMethod<GetDataIntegrationsOrganizationControllerOrganizationDataInstallationRequest, ConnectedAccount, GetDataIntegrationsOrganizationControllerOrganizationDataInstallationError, WorkosOpContext>;
export type GetDataIntegrationsOrganizationControllerOrganizationDataIntegrationsError = NotFound | WorkosOpError;
/** List providers for an organization Retrieves the organization-owned providers configured for your environment and the organization's [connected account](/reference/pipes/connected-account) information for each. Providers owned by individual users are not included. */
export declare const GetDataIntegrationsOrganizationControllerOrganizationDataIntegrations: API.OperationMethod<GetDataIntegrationsOrganizationControllerOrganizationDataIntegrationsRequest, DataIntegrationsListResponse, GetDataIntegrationsOrganizationControllerOrganizationDataIntegrationsError, WorkosOpContext>;
export type GetDataIntegrationsUserManagementControllerUserDataInstallationError = BadRequest | NotFound | Conflict | WorkosOpError;
/** Get a connected account Retrieves a user's [connected account](/reference/pipes/connected-account) for a specific provider. */
export declare const GetDataIntegrationsUserManagementControllerUserDataInstallation: API.OperationMethod<GetDataIntegrationsUserManagementControllerUserDataInstallationRequest, ConnectedAccount, GetDataIntegrationsUserManagementControllerUserDataInstallationError, WorkosOpContext>;
export type GetDataIntegrationsUserManagementControllerUserDataIntegrationsError = NotFound | WorkosOpError;
/** List providers for a user Retrieves a list of available providers and the user's connection status for each. Returns all providers configured for your environment, along with the user's [connected account](/reference/pipes/connected-account) information where applicable. */
export declare const GetDataIntegrationsUserManagementControllerUserDataIntegrations: API.OperationMethod<GetDataIntegrationsUserManagementControllerUserDataIntegrationsRequest, DataIntegrationsListResponse, GetDataIntegrationsUserManagementControllerUserDataIntegrationsError, WorkosOpContext>;
export type GetGroupsControllerError = Forbidden | NotFound | WorkosOpError;
/** Get a group Retrieve a group by its ID within an organization. */
export declare const GetGroupsController: API.OperationMethod<GetGroupsControllerRequest, Group, GetGroupsControllerError, WorkosOpContext>;
export type GetJwtTemplatesControllerJwtTemplateError = NotFound | WorkosOpError;
/** Get JWT template Get the JWT template for the current environment. */
export declare const GetJwtTemplatesControllerJwtTemplate: API.OperationMethod<GetJwtTemplatesControllerJwtTemplateRequest, JwtTemplate, GetJwtTemplatesControllerJwtTemplateError, WorkosOpContext>;
export type GetOrganizationDomainsControllerError = NotFound | WorkosOpError;
/** Get an Organization Domain Get the details of an existing organization domain. */
export declare const GetOrganizationDomainsController: API.OperationMethod<GetOrganizationDomainsControllerRequest, OrganizationDomainStandAlone, GetOrganizationDomainsControllerError, WorkosOpContext>;
export type GetOrganizationsControllerAuditLogConfigurationError = NotFound | WorkosOpError;
/** Get Audit Log Configuration Get the unified view of audit log trail and stream configuration for an organization. */
export declare const GetOrganizationsControllerAuditLogConfiguration: API.OperationMethod<GetOrganizationsControllerAuditLogConfigurationRequest, AuditLogConfiguration, GetOrganizationsControllerAuditLogConfigurationError, WorkosOpContext>;
export type GetOrganizationsControllerByExternalIdError = NotFound | WorkosOpError;
/** Get an Organization by External ID Get the details of an existing organization by an [external identifier](/authkit/metadata/external-identifiers). */
export declare const GetOrganizationsControllerByExternalId: API.OperationMethod<GetOrganizationsControllerByExternalIdRequest, Organization, GetOrganizationsControllerByExternalIdError, WorkosOpContext>;
export type GetPublicRadarChallengesControllerError = NotFound | WorkosOpError;
/** Get Radar Challenge details Get the details of an existing Radar Challenge, including the OTP code. */
export declare const GetPublicRadarChallengesController: API.OperationMethod<GetPublicRadarChallengesControllerRequest, RadarChallenge, GetPublicRadarChallengesControllerError, WorkosOpContext>;
export type GetSamlSpSigningCertificatesControllerError = BadRequest | Forbidden | NotFound | WorkosOpError;
/** Get the SP signing certificate Returns the public certificate the Identity Provider can use to verify the signature of SAML requests sent by WorkOS. Responds with `404` when the connection has no request signing key pair. */
export declare const GetSamlSpSigningCertificatesController: API.OperationMethod<GetSamlSpSigningCertificatesControllerRequest, SamlSpSigningCertificate, GetSamlSpSigningCertificatesControllerError, WorkosOpContext>;
export type GetSsoControllerProfileError = NotFound | WorkosOpError;
/** Get a User Profile Exchange an access token for a user's [Profile](/reference/sso/profile). Because this profile is returned in the [Get a Profile and Token endpoint](/reference/sso/profile/get-profile-and-token) your application usually does not need to call this endpoint. It is available for any authentication flows that require an additional endpoint to retrieve a user's profile. */
export declare const GetSsoControllerProfile: API.OperationMethod<GetSsoControllerProfileRequest, Profile, GetSsoControllerProfileError, WorkosOpContext>;
export type GetTeamsControllerTeamError = NotFound | WorkosOpError;
/** Get a team Returns a team, and doubles as a health check on the platform's access to it. Read `production_state` before attempting to create a production environment. */
export declare const GetTeamsControllerTeam: API.OperationMethod<GetTeamsControllerTeamRequest, Team, GetTeamsControllerTeamError, WorkosOpContext>;
export type GetUserlandMagicAuthControllerError = NotFound | WorkosOpError;
/** Get Magic Auth code details Get the details of an existing [Magic Auth](/reference/authkit/magic-auth) code that can be used to send an email to a user for authentication. */
export declare const GetUserlandMagicAuthController: API.OperationMethod<GetUserlandMagicAuthControllerRequest, MagicAuth, GetUserlandMagicAuthControllerError, WorkosOpContext>;
export type GetUserlandUserIdentitiesControllerError = NotFound | WorkosOpError;
/** Get user identities Get a list of identities associated with the user. A user can have multiple associated identities after going through [identity linking](/authkit/identity-linking). Currently only OAuth identities are supported. More provider types may be added in the future. */
export declare const GetUserlandUserIdentitiesController: API.OperationMethod<GetUserlandUserIdentitiesControllerRequest, GetUserlandUserIdentitiesControllerResponse, GetUserlandUserIdentitiesControllerError, WorkosOpContext>;
export type GetUserlandUserInvitesControllerError = NotFound | WorkosOpError;
/** Get an invitation Get the details of an existing invitation. */
export declare const GetUserlandUserInvitesController: API.OperationMethod<GetUserlandUserInvitesControllerRequest, UserlandUserInvite, GetUserlandUserInvitesControllerError, WorkosOpContext>;
export type GetUserlandUserInvitesControllerByTokenError = NotFound | WorkosOpError;
/** Find an invitation by token Retrieve an existing invitation using the token. */
export declare const GetUserlandUserInvitesControllerByToken: API.OperationMethod<GetUserlandUserInvitesControllerByTokenRequest, UserlandUserInvite, GetUserlandUserInvitesControllerByTokenError, WorkosOpContext>;
export type GetUserlandUserOrganizationMembershipsControllerError = NotFound | WorkosOpError;
/** Get an organization membership Get the details of an existing organization membership. */
export declare const GetUserlandUserOrganizationMembershipsController: API.OperationMethod<GetUserlandUserOrganizationMembershipsControllerRequest, UserlandUserOrganizationMembership, GetUserlandUserOrganizationMembershipsControllerError, WorkosOpContext>;
export type GetUserlandUsersControllerByExternalIdError = NotFound | WorkosOpError;
/** Get a user by external ID Get the details of an existing user by an [external identifier](/authkit/metadata/external-identifiers). */
export declare const GetUserlandUsersControllerByExternalId: API.OperationMethod<GetUserlandUsersControllerByExternalIdRequest, UserlandUser, GetUserlandUsersControllerByExternalIdError, WorkosOpContext>;
export type GetUserlandUsersControllerEmailVerificationError = NotFound | WorkosOpError;
/** Get an email verification code Get the details of an existing email verification code that can be used to send an email to a user for verification. */
export declare const GetUserlandUsersControllerEmailVerification: API.OperationMethod<GetUserlandUsersControllerEmailVerificationRequest, EmailVerification, GetUserlandUsersControllerEmailVerificationError, WorkosOpContext>;
export type InviteItContactsControllerError = Forbidden | NotFound | Conflict | UnprocessableEntity | WorkosOpError;
/** Invite an IT contact Create an Admin Portal setup link and email it to the IT contact. An organization can have at most one active invitation. */
export declare const InviteItContactsController: API.OperationMethod<InviteItContactsControllerRequest, InviteItContactsControllerResponse, InviteItContactsControllerError, WorkosOpContext>;
export type JumpWireWebDataVaultControllerIndexError = BadRequest | WorkosOpError;
/** List objects List all encrypted objects with cursor-based pagination. */
export declare const JumpWireWebDataVaultControllerIndex: API.OperationMethod<JumpWireWebDataVaultControllerIndexRequest, ObjectListResponse, JumpWireWebDataVaultControllerIndexError, WorkosOpContext>;
export type JumpWireWebDataVaultControllerShowByIdError = BadRequest | NotFound | WorkosOpError;
/** Read an object by ID Fetch and decrypt an object by its unique identifier. */
export declare const JumpWireWebDataVaultControllerShowById: API.OperationMethod<JumpWireWebDataVaultControllerShowByIdRequest, Object, JumpWireWebDataVaultControllerShowByIdError, WorkosOpContext>;
export type JumpWireWebDataVaultControllerShowByNameError = BadRequest | NotFound | WorkosOpError;
/** Read an object by name Fetch and decrypt an object by its unique name. */
export declare const JumpWireWebDataVaultControllerShowByName: API.OperationMethod<JumpWireWebDataVaultControllerShowByNameRequest, Object, JumpWireWebDataVaultControllerShowByNameError, WorkosOpContext>;
export type JumpWireWebDataVaultControllerVersionsError = BadRequest | NotFound | WorkosOpError;
/** List object versions Retrieve all versions for a specific object. */
export declare const JumpWireWebDataVaultControllerVersions: API.OperationMethod<JumpWireWebDataVaultControllerVersionsRequest, VersionListResponse, JumpWireWebDataVaultControllerVersionsError, WorkosOpContext>;
export type JumpWireWebKeyControllerCreateDataKeyError = BadRequest | UnprocessableEntity | WorkosOpError;
/** Create a data key Generate an isolated encryption key for local encryption operations. */
export declare const JumpWireWebKeyControllerCreateDataKey: API.OperationMethod<JumpWireWebKeyControllerCreateDataKeyRequest, CreateDataKeyResponse, JumpWireWebKeyControllerCreateDataKeyError, WorkosOpContext>;
export type JumpWireWebKeyControllerRekeyError = BadRequest | UnprocessableEntity | WorkosOpError;
/** Re-encrypt a data key Decrypt an existing data key and re-encrypt it under a new key context. */
export declare const JumpWireWebKeyControllerRekey: API.OperationMethod<JumpWireWebKeyControllerRekeyRequest, CreateDataKeyResponse, JumpWireWebKeyControllerRekeyError, WorkosOpContext>;
export type ListAgentBlueprintsControllerError = WorkosOpError;
/** List agent blueprints Lists the agent blueprints in the current environment. */
export declare const ListAgentBlueprintsController: API.OperationMethod<ListAgentBlueprintsControllerRequest, ListAgentBlueprintsControllerResponse, ListAgentBlueprintsControllerError, WorkosOpContext>;
export type ListAgentInstancesControllerError = WorkosOpError;
/** List agent instances Lists the agent instances in the current environment. Instances are created implicitly when tokens are minted. */
export declare const ListAgentInstancesController: API.OperationMethod<ListAgentInstancesControllerRequest, ListAgentInstancesControllerResponse, ListAgentInstancesControllerError, WorkosOpContext>;
export type ListAgentInstanceSessionsControllerError = UnprocessableEntity | WorkosOpError;
/** List agent instance sessions Lists the agent instance sessions in the current environment. Sessions are created when tokens are minted. */
export declare const ListAgentInstanceSessionsController: API.OperationMethod<ListAgentInstanceSessionsControllerRequest, ListAgentInstanceSessionsControllerResponse, ListAgentInstanceSessionsControllerError, WorkosOpContext>;
export type ListApplicationCredentialsControllerError = NotFound | WorkosOpError;
/** List Client Secrets for a Connect Application List all client secrets associated with a Connect Application. */
export declare const ListApplicationCredentialsController: API.OperationMethod<ListApplicationCredentialsControllerRequest, ListApplicationCredentialsControllerResponse, ListApplicationCredentialsControllerError, WorkosOpContext>;
export type ListApplicationsControllerError = UnprocessableEntity | WorkosOpError;
/** List Connect Applications List all Connect Applications in the current environment with optional filtering. */
export declare const ListApplicationsController: API.OperationMethod<ListApplicationsControllerRequest, ConnectApplicationList, ListApplicationsControllerError, WorkosOpContext>;
export type ListAuditLogValidatorsControllerError = NotFound | UnprocessableEntity | WorkosOpError;
/** List Actions Get a list of all Audit Log actions in the current environment. */
export declare const ListAuditLogValidatorsController: API.OperationMethod<ListAuditLogValidatorsControllerRequest, ListAuditLogValidatorsControllerResponse, ListAuditLogValidatorsControllerError, WorkosOpContext>;
export type ListAuthkitOauthResourcesControllerError = WorkosOpError;
/** List MCP resource indicators Lists the MCP resource indicators configured for an environment. */
export declare const ListAuthkitOauthResourcesController: API.OperationMethod<ListAuthkitOauthResourcesControllerRequest, ListAuthkitOauthResourcesControllerResponse, ListAuthkitOauthResourcesControllerError, WorkosOpContext>;
export type ListAuthorizationControllerEffectivePermissionsError = Forbidden | NotFound | UnprocessableEntity | WorkosOpError;
/** List effective permissions for an organization membership on a resource Returns all permissions the organization membership effectively has on a resource, including permissions inherited through roles assigned to ancestor resources. Results are not filtered by the resource type: a permission is returned whenever a check for it on this resource would be authorized, and each permission is labeled with the resource type it is declared on. */
export declare const ListAuthorizationControllerEffectivePermissions: API.OperationMethod<ListAuthorizationControllerEffectivePermissionsRequest, AuthorizationPermissionList, ListAuthorizationControllerEffectivePermissionsError, WorkosOpContext>;
export type ListAuthorizationControllerEffectivePermissionsByExternalIdError = Forbidden | NotFound | UnprocessableEntity | WorkosOpError;
/** List effective permissions for an organization membership on a resource by external ID Returns all permissions the organization membership effectively has on a resource identified by its external ID, including permissions inherited through roles assigned to ancestor resources. Results are not filtered by the resource type: a permission is returned whenever a check for it on this resource would be authorized, and each permission is labeled with the resource type it is declared on. */
export declare const ListAuthorizationControllerEffectivePermissionsByExternalId: API.OperationMethod<ListAuthorizationControllerEffectivePermissionsByExternalIdRequest, AuthorizationPermissionList, ListAuthorizationControllerEffectivePermissionsByExternalIdError, WorkosOpContext>;
export type ListAuthorizationControllerResourcesForMembershipError = BadRequest | Forbidden | NotFound | UnprocessableEntity | WorkosOpError;
/** List resources for organization membership Returns all child resources of a parent resource where the organization membership has a specific permission. This is useful for resource discovery--answering "What projects can this user access in this workspace?" You must provide either `parent_resource_id` or both `parent_resource_external_id` and `parent_resource_type_slug` to identify the parent resource. */
export declare const ListAuthorizationControllerResourcesForMembership: API.OperationMethod<ListAuthorizationControllerResourcesForMembershipRequest, AuthorizationResourceList, ListAuthorizationControllerResourcesForMembershipError, WorkosOpContext>;
export type ListAuthorizationGroupRoleAssignmentsControllerError = Forbidden | NotFound | WorkosOpError;
/** List role assignments for a group List all role assignments granted to a group. Each assignment represents a role granted to the group on a resource. */
export declare const ListAuthorizationGroupRoleAssignmentsController: API.OperationMethod<ListAuthorizationGroupRoleAssignmentsControllerRequest, GroupRoleAssignmentList, ListAuthorizationGroupRoleAssignmentsControllerError, WorkosOpContext>;
export type ListAuthorizationOrganizationRolesControllerError = Forbidden | NotFound | WorkosOpError;
/** List custom roles Get a list of all roles that apply to an organization. This includes both environment roles and custom roles, returned in priority order. */
export declare const ListAuthorizationOrganizationRolesController: API.OperationMethod<ListAuthorizationOrganizationRolesControllerRequest, RoleList, ListAuthorizationOrganizationRolesControllerError, WorkosOpContext>;
export type ListAuthorizationPermissionsControllerError = NotFound | WorkosOpError;
/** List permissions Get a list of all permissions in your WorkOS environment. */
export declare const ListAuthorizationPermissionsController: API.OperationMethod<ListAuthorizationPermissionsControllerRequest, AuthorizationPermissionList, ListAuthorizationPermissionsControllerError, WorkosOpContext>;
export type ListAuthorizationResourcesByExternalIdControllerOrganizationMembershipsForResourceByExternalIdError = BadRequest | Forbidden | NotFound | UnprocessableEntity | WorkosOpError;
/** List memberships for a resource by external ID Returns all organization memberships that have a specific permission on a resource, using the resource's external ID. This is useful for answering "Who can access this resource?" when you only have the external ID. */
export declare const ListAuthorizationResourcesByExternalIdControllerOrganizationMembershipsForResourceByExternalId: API.OperationMethod<ListAuthorizationResourcesByExternalIdControllerOrganizationMembershipsForResourceByExternalIdRequest, UserlandUserOrganizationMembershipBaseWithUserList, ListAuthorizationResourcesByExternalIdControllerOrganizationMembershipsForResourceByExternalIdError, WorkosOpContext>;
export type ListAuthorizationResourcesControllerError = BadRequest | Forbidden | UnprocessableEntity | WorkosOpError;
/** List resources Get a paginated list of authorization resources. */
export declare const ListAuthorizationResourcesController: API.OperationMethod<ListAuthorizationResourcesControllerRequest, AuthorizationResourceList, ListAuthorizationResourcesControllerError, WorkosOpContext>;
export type ListAuthorizationResourcesControllerOrganizationMembershipsForResourceError = BadRequest | Forbidden | NotFound | UnprocessableEntity | WorkosOpError;
/** List organization memberships for resource Returns all organization memberships that have a specific permission on a resource instance. This is useful for answering "Who can access this resource?". */
export declare const ListAuthorizationResourcesControllerOrganizationMembershipsForResource: API.OperationMethod<ListAuthorizationResourcesControllerOrganizationMembershipsForResourceRequest, UserlandUserOrganizationMembershipBaseWithUserList, ListAuthorizationResourcesControllerOrganizationMembershipsForResourceError, WorkosOpContext>;
export type ListAuthorizationRoleAssignmentsControllerRoleAssignmentsError = Forbidden | NotFound | WorkosOpError;
/** List role assignments List all role assignments for an organization membership. This returns all roles that have been assigned to the user on resources, including organization-level and sub-resource roles. */
export declare const ListAuthorizationRoleAssignmentsControllerRoleAssignments: API.OperationMethod<ListAuthorizationRoleAssignmentsControllerRoleAssignmentsRequest, UserRoleAssignmentList, ListAuthorizationRoleAssignmentsControllerRoleAssignmentsError, WorkosOpContext>;
export type ListAuthorizationRoleAssignmentsControllerRoleAssignmentsForResourceError = Forbidden | NotFound | WorkosOpError;
/** List role assignments for a resource List all role assignments granted on a specific resource instance. Each assignment includes the organization membership it was granted to. */
export declare const ListAuthorizationRoleAssignmentsControllerRoleAssignmentsForResource: API.OperationMethod<ListAuthorizationRoleAssignmentsControllerRoleAssignmentsForResourceRequest, UserRoleAssignmentList, ListAuthorizationRoleAssignmentsControllerRoleAssignmentsForResourceError, WorkosOpContext>;
export type ListAuthorizationRoleAssignmentsControllerRoleAssignmentsForResourceByExternalIdError = Forbidden | NotFound | WorkosOpError;
/** List role assignments for a resource by external ID List all role assignments granted on a resource, identified by its external ID. Each assignment includes the organization membership it was granted to. */
export declare const ListAuthorizationRoleAssignmentsControllerRoleAssignmentsForResourceByExternalId: API.OperationMethod<ListAuthorizationRoleAssignmentsControllerRoleAssignmentsForResourceByExternalIdRequest, UserRoleAssignmentList, ListAuthorizationRoleAssignmentsControllerRoleAssignmentsForResourceByExternalIdError, WorkosOpContext>;
export type ListAuthorizationRolesControllerError = Forbidden | WorkosOpError;
/** List environment roles List all environment roles in priority order. */
export declare const ListAuthorizationRolesController: API.OperationMethod<ListAuthorizationRolesControllerRequest, RoleList, ListAuthorizationRolesControllerError, WorkosOpContext>;
export type ListAuthorizedApplicationsControllerError = NotFound | UnprocessableEntity | WorkosOpError;
/** List authorized applications Get a list of all Connect applications that the user has authorized. */
export declare const ListAuthorizedApplicationsController: API.OperationMethod<ListAuthorizedApplicationsControllerRequest, AuthorizedConnectApplicationList, ListAuthorizedApplicationsControllerError, WorkosOpContext>;
export type ListConnectionsControllerError = Forbidden | UnprocessableEntity | WorkosOpError;
/** List Connections Get a list of all of your existing connections matching the criteria specified. */
export declare const ListConnectionsController: API.OperationMethod<ListConnectionsControllerRequest, ConnectionList, ListConnectionsControllerError, WorkosOpContext>;
export type ListCorsOriginsControllerError = WorkosOpError;
/** List CORS origins Lists the CORS origins for the current environment. */
export declare const ListCorsOriginsController: API.OperationMethod<ListCorsOriginsControllerRequest, ListCorsOriginsControllerResponse, ListCorsOriginsControllerError, WorkosOpContext>;
export type ListDataIntegrationsManagementControllerDataIntegrationsError = NotFound | UnprocessableEntity | WorkosOpError;
/** List data integrations Lists the environment's data integrations configured with `custom` or `organization` credentials, including custom providers and API key integrations. Both user-owned and organization-owned roots are returned, each as its own row with an `ownership`; filter with `ownership` to return only one kind. */
export declare const ListDataIntegrationsManagementControllerDataIntegrations: API.OperationMethod<ListDataIntegrationsManagementControllerDataIntegrationsRequest, DataIntegrationList, ListDataIntegrationsManagementControllerDataIntegrationsError, WorkosOpContext>;
export type ListDirectoriesControllerError = Forbidden | UnprocessableEntity | WorkosOpError;
/** List Directories Get a list of all of your existing directories matching the criteria specified. */
export declare const ListDirectoriesController: API.OperationMethod<ListDirectoriesControllerRequest, DirectoryList, ListDirectoriesControllerError, WorkosOpContext>;
export type ListDirectoryGroupsControllerError = Forbidden | NotFound | UnprocessableEntity | WorkosOpError;
/** List Directory Groups Get a list of all of existing directory groups matching the criteria specified. */
export declare const ListDirectoryGroupsController: API.OperationMethod<ListDirectoryGroupsControllerRequest, DirectoryGroupList, ListDirectoryGroupsControllerError, WorkosOpContext>;
export type ListDirectoryUsersControllerError = Forbidden | NotFound | UnprocessableEntity | WorkosOpError;
/** List Directory Users Get a list of all of existing Directory Users matching the criteria specified. */
export declare const ListDirectoryUsersController: API.OperationMethod<ListDirectoryUsersControllerRequest, DirectoryUserList, ListDirectoryUsersControllerError, WorkosOpContext>;
export type ListEventsControllerError = BadRequest | UnprocessableEntity | WorkosOpError;
/** List events List events for the current environment. */
export declare const ListEventsController: API.OperationMethod<ListEventsControllerRequest, EventList, ListEventsControllerError, WorkosOpContext>;
export type ListFeatureFlagsControllerError = BadRequest | NotFound | UnprocessableEntity | WorkosOpError;
/** List feature flags Get a list of all of your existing feature flags matching the criteria specified. */
export declare const ListFeatureFlagsController: API.OperationMethod<ListFeatureFlagsControllerRequest, FlagList, ListFeatureFlagsControllerError, WorkosOpContext>;
export type ListGroupMembershipsControllerMembersError = Forbidden | NotFound | WorkosOpError;
/** List Group members Get a list of organization memberships in a group. */
export declare const ListGroupMembershipsControllerMembers: API.OperationMethod<ListGroupMembershipsControllerMembersRequest, UserlandUserOrganizationMembershipBaseList, ListGroupMembershipsControllerMembersError, WorkosOpContext>;
export type ListGroupsControllerError = Forbidden | NotFound | WorkosOpError;
/** List groups Get a paginated list of groups within an organization. */
export declare const ListGroupsController: API.OperationMethod<ListGroupsControllerRequest, GroupList, ListGroupsControllerError, WorkosOpContext>;
export type ListItContactsControllerError = Forbidden | NotFound | WorkosOpError;
/** List IT contacts Get the IT contacts for an organization. */
export declare const ListItContactsController: API.OperationMethod<ListItContactsControllerRequest, ItContactList, ListItContactsControllerError, WorkosOpContext>;
export type ListOrganizationApiKeysControllerError = NotFound | WorkosOpError;
/** List API keys for an organization Get a list of all API keys for an organization. */
export declare const ListOrganizationApiKeysController: API.OperationMethod<ListOrganizationApiKeysControllerRequest, OrganizationApiKeyList, ListOrganizationApiKeysControllerError, WorkosOpContext>;
export type ListOrganizationAuthorizedApplicationsControllerError = NotFound | UnprocessableEntity | WorkosOpError;
/** List authorized applications Get a list of all Connect applications that users in the organization have authorized. */
export declare const ListOrganizationAuthorizedApplicationsController: API.OperationMethod<ListOrganizationAuthorizedApplicationsControllerRequest, OrganizationAuthorizedConnectApplicationList, ListOrganizationAuthorizedApplicationsControllerError, WorkosOpContext>;
export type ListOrganizationFeatureFlagsControllerError = NotFound | WorkosOpError;
/** List enabled feature flags for an organization Get a list of all enabled feature flags for an organization. */
export declare const ListOrganizationFeatureFlagsController: API.OperationMethod<ListOrganizationFeatureFlagsControllerRequest, FlagList, ListOrganizationFeatureFlagsControllerError, WorkosOpContext>;
export type ListOrganizationMembershipGroupsControllerGroupsError = NotFound | WorkosOpError;
/** List groups Get a list of groups that an organization membership belongs to. */
export declare const ListOrganizationMembershipGroupsControllerGroups: API.OperationMethod<ListOrganizationMembershipGroupsControllerGroupsRequest, GroupList, ListOrganizationMembershipGroupsControllerGroupsError, WorkosOpContext>;
export type ListOrganizationsControllerError = UnprocessableEntity | WorkosOpError;
/** List Organizations Get a list of all of your existing organizations matching the criteria specified. */
export declare const ListOrganizationsController: API.OperationMethod<ListOrganizationsControllerRequest, OrganizationList, ListOrganizationsControllerError, WorkosOpContext>;
export type ListProviderControllerForOrganizationError = NotFound | WorkosOpError;
/** List providers for an organization Returns a list of all providers available to the specified organization, along with any configured custom OAuth scopes, enabled state, and organization-managed credentials where applicable. */
export declare const ListProviderControllerForOrganization: API.OperationMethod<ListProviderControllerForOrganizationRequest, DataIntegrationConfigurationListResponse, ListProviderControllerForOrganizationError, WorkosOpContext>;
export type ListRedirectUrisControllerError = WorkosOpError;
/** List redirect URIs Lists the redirect URIs for an environment. */
export declare const ListRedirectUrisController: API.OperationMethod<ListRedirectUrisControllerRequest, ListRedirectUrisControllerResponse, ListRedirectUrisControllerError, WorkosOpContext>;
export type ListSamlIdpSigningCertificatesControllerError = BadRequest | Forbidden | NotFound | WorkosOpError;
/** List IdP signing certificates Lists every Identity Provider signing certificate on the connection, including expired ones, oldest first. */
export declare const ListSamlIdpSigningCertificatesController: API.OperationMethod<ListSamlIdpSigningCertificatesControllerRequest, SamlIdpSigningCertificateList, ListSamlIdpSigningCertificatesControllerError, WorkosOpContext>;
export type ListSamlSpEncryptionCertificatesControllerError = BadRequest | Forbidden | NotFound | WorkosOpError;
/** List SP encryption certificates Lists the public certificates the Identity Provider can use to encrypt SAML responses sent to WorkOS, including expired ones, oldest first. */
export declare const ListSamlSpEncryptionCertificatesController: API.OperationMethod<ListSamlSpEncryptionCertificatesControllerRequest, SamlSpEncryptionCertificateList, ListSamlSpEncryptionCertificatesControllerError, WorkosOpContext>;
export type ListUserApiKeysControllerError = NotFound | WorkosOpError;
/** List API keys for a user Get a list of API keys owned by a specific user. */
export declare const ListUserApiKeysController: API.OperationMethod<ListUserApiKeysControllerRequest, UserApiKeyList, ListUserApiKeysControllerError, WorkosOpContext>;
export type ListUserlandUserFeatureFlagsControllerError = NotFound | WorkosOpError;
/** List enabled feature flags for a user Get a list of all enabled feature flags for the provided user. This includes feature flags enabled specifically for the user as well as any organizations that the user is a member of. */
export declare const ListUserlandUserFeatureFlagsController: API.OperationMethod<ListUserlandUserFeatureFlagsControllerRequest, FlagList, ListUserlandUserFeatureFlagsControllerError, WorkosOpContext>;
export type ListUserlandUserInvitesControllerError = UnprocessableEntity | WorkosOpError;
/** List invitations Get a list of all of invitations matching the criteria specified. */
export declare const ListUserlandUserInvitesController: API.OperationMethod<ListUserlandUserInvitesControllerRequest, UserlandUserInviteList, ListUserlandUserInvitesControllerError, WorkosOpContext>;
export type ListUserlandUserOrganizationMembershipsControllerError = BadRequest | NotFound | UnprocessableEntity | WorkosOpError;
/** List organization memberships Get a list of all organization memberships matching the criteria specified. At least one of `user_id` or `organization_id` must be provided. By default only active memberships are returned. Use the `statuses` parameter to filter by other statuses. */
export declare const ListUserlandUserOrganizationMembershipsController: API.OperationMethod<ListUserlandUserOrganizationMembershipsControllerRequest, UserlandUserOrganizationMembershipList, ListUserlandUserOrganizationMembershipsControllerError, WorkosOpContext>;
export type ListUserlandUserSessionsControllerError = NotFound | UnprocessableEntity | WorkosOpError;
/** List sessions Get a list of all active sessions for a specific user. */
export declare const ListUserlandUserSessionsController: API.OperationMethod<ListUserlandUserSessionsControllerRequest, ListUserlandUserSessionsControllerResponse, ListUserlandUserSessionsControllerError, WorkosOpContext>;
export type ListWaitlistsControllerError = WorkosOpError;
/** List waitlists Get a list of the waitlists in the environment. All waitlists are returned in a single response -- this endpoint is not paginated, so the `list_metadata` cursors are always `null`. */
export declare const ListWaitlistsController: API.OperationMethod<ListWaitlistsControllerRequest, ListWaitlistsControllerResponse, ListWaitlistsControllerError, WorkosOpContext>;
export type ListWaitlistsControllerEntriesError = NotFound | UnprocessableEntity | WorkosOpError;
/** List waitlist entries Get a list of entries on a waitlist matching the criteria specified. */
export declare const ListWaitlistsControllerEntries: API.OperationMethod<ListWaitlistsControllerEntriesRequest, ListWaitlistsControllerEntriesResponse, ListWaitlistsControllerEntriesError, WorkosOpContext>;
export type ListWebhookEndpointsControllerError = WorkosOpError;
/** List Webhook Endpoints Get a list of all of your existing webhook endpoints. */
export declare const ListWebhookEndpointsController: API.OperationMethod<ListWebhookEndpointsControllerRequest, WebhookEndpointList, ListWebhookEndpointsControllerError, WorkosOpContext>;
export type LogoutSsoControllerError = NotFound | WorkosOpError;
/** Logout Redirect Logout allows to sign out a user from your application by triggering the identity provider sign out flow. This `GET` endpoint should be a redirection, since the identity provider user will be identified in the browser session. Before redirecting to this endpoint, you need to generate a short-lived logout token using the [Logout Authorize](/reference/sso/logout/authorize) endpoint. */
export declare const LogoutSsoController: API.OperationMethod<LogoutSsoControllerRequest, LogoutSsoControllerResponse, LogoutSsoControllerError, WorkosOpContext>;
export type LogoutUserlandSessionsControllerError = UnprocessableEntity | WorkosOpError;
/** Logout Logout a user from the current [session](/reference/authkit/session). */
export declare const LogoutUserlandSessionsController: API.OperationMethod<LogoutUserlandSessionsControllerRequest, LogoutUserlandSessionsControllerResponse, LogoutUserlandSessionsControllerError, WorkosOpContext>;
export type OrganizationsControllerFindError = NotFound | WorkosOpError;
/** Get an Organization Get the details of an existing organization. */
export declare const OrganizationsControllerFind: API.OperationMethod<OrganizationsControllerFindRequest, Organization, OrganizationsControllerFindError, WorkosOpContext>;
export type PatchConnectionsControllerError = BadRequest | Forbidden | NotFound | Conflict | UnprocessableEntity | WorkosOpError;
/** Update a Connection Updates an existing connection. Only the provided fields are changed; fields that accept `null` are reset to their default behavior. */
export declare const PatchConnectionsController: API.OperationMethod<PatchConnectionsControllerRequest, Connection, PatchConnectionsControllerError, WorkosOpContext>;
export type ProviderControllerConfigureError = BadRequest | NotFound | UnprocessableEntity | WorkosOpError;
/** Configure a provider for an organization Creates or updates an organization's provider configuration. Use this endpoint to enable or disable a provider, set custom OAuth scopes, or supply organization-managed OAuth credentials. */
export declare const ProviderControllerConfigure: API.OperationMethod<ProviderControllerConfigureRequest, DataIntegrationConfigurationResponse, ProviderControllerConfigureError, WorkosOpContext>;
export type RadarStandaloneControllerAssessError = BadRequest | WorkosOpError;
/** Create an attempt Assess a request for risk using the Radar engine and receive a verdict. */
export declare const RadarStandaloneControllerAssess: API.OperationMethod<RadarStandaloneControllerAssessRequest, RadarStandaloneResponse, RadarStandaloneControllerAssessError, WorkosOpContext>;
export type RadarStandaloneControllerDeleteRadarListEntryError = BadRequest | NotFound | WorkosOpError;
/** Remove an entry from a Radar list Remove an entry from a Radar list. */
export declare const RadarStandaloneControllerDeleteRadarListEntry: API.OperationMethod<RadarStandaloneControllerDeleteRadarListEntryRequest, RadarStandaloneControllerDeleteRadarListEntryResponse, RadarStandaloneControllerDeleteRadarListEntryError, WorkosOpContext>;
export type RadarStandaloneControllerUpdateRadarListError = BadRequest | WorkosOpError;
/** Add an entry to a Radar list Add an entry to a Radar list. */
export declare const RadarStandaloneControllerUpdateRadarList: API.OperationMethod<RadarStandaloneControllerUpdateRadarListRequest, RadarListEntryAlreadyPresentResponse, RadarStandaloneControllerUpdateRadarListError, WorkosOpContext>;
export type RemoveAuthorizationGroupRoleAssignmentsControllerGroupRoleAssignmentError = Forbidden | NotFound | WorkosOpError;
/** Remove a group role assignment Remove a specific role assignment from a group by its ID. */
export declare const RemoveAuthorizationGroupRoleAssignmentsControllerGroupRoleAssignment: API.OperationMethod<RemoveAuthorizationGroupRoleAssignmentsControllerGroupRoleAssignmentRequest, RemoveAuthorizationGroupRoleAssignmentsControllerGroupRoleAssignmentResponse, RemoveAuthorizationGroupRoleAssignmentsControllerGroupRoleAssignmentError, WorkosOpContext>;
export type RemoveAuthorizationGroupRoleAssignmentsControllerGroupRoleAssignmentsError = Forbidden | NotFound | UnprocessableEntity | WorkosOpError;
/** Remove group role assignments by criteria Remove role assignments from a group that match the provided criteria. Returns 404 when no matching active assignment is found. */
export declare const RemoveAuthorizationGroupRoleAssignmentsControllerGroupRoleAssignments: API.OperationMethod<RemoveAuthorizationGroupRoleAssignmentsControllerGroupRoleAssignmentsRequest, RemoveAuthorizationGroupRoleAssignmentsControllerGroupRoleAssignmentsResponse, RemoveAuthorizationGroupRoleAssignmentsControllerGroupRoleAssignmentsError, WorkosOpContext>;
export type RemoveAuthorizationOrganizationRolePermissionsControllerPermissionError = Forbidden | NotFound | WorkosOpError;
/** Remove a permission from a custom role Remove a single permission from a custom role by its slug. */
export declare const RemoveAuthorizationOrganizationRolePermissionsControllerPermission: API.OperationMethod<RemoveAuthorizationOrganizationRolePermissionsControllerPermissionRequest, Role, RemoveAuthorizationOrganizationRolePermissionsControllerPermissionError, WorkosOpContext>;
export type RemoveAuthorizationRoleAssignmentsControllerRoleByCriteriaError = Forbidden | NotFound | UnprocessableEntity | WorkosOpError;
/** Remove a role assignment Remove a role assignment by role slug and resource. */
export declare const RemoveAuthorizationRoleAssignmentsControllerRoleByCriteria: API.OperationMethod<RemoveAuthorizationRoleAssignmentsControllerRoleByCriteriaRequest, RemoveAuthorizationRoleAssignmentsControllerRoleByCriteriaResponse, RemoveAuthorizationRoleAssignmentsControllerRoleByCriteriaError, WorkosOpContext>;
export type RemoveAuthorizationRoleAssignmentsControllerRoleByIdError = Forbidden | NotFound | WorkosOpError;
/** Remove a role assignment by ID Remove a role assignment using its ID. */
export declare const RemoveAuthorizationRoleAssignmentsControllerRoleById: API.OperationMethod<RemoveAuthorizationRoleAssignmentsControllerRoleByIdRequest, RemoveAuthorizationRoleAssignmentsControllerRoleByIdResponse, RemoveAuthorizationRoleAssignmentsControllerRoleByIdError, WorkosOpContext>;
export type RemoveGroupMembershipsControllerMemberError = Forbidden | NotFound | WorkosOpError;
/** Remove a member from a Group Remove an organization membership from a group. */
export declare const RemoveGroupMembershipsControllerMember: API.OperationMethod<RemoveGroupMembershipsControllerMemberRequest, RemoveGroupMembershipsControllerMemberResponse, RemoveGroupMembershipsControllerMemberError, WorkosOpContext>;
export type ReplaceAuthorizationGroupRoleAssignmentsControllerGroupRoleAssignmentsError = Forbidden | NotFound | UnprocessableEntity | WorkosOpError;
/** Replace all role assignments for a group Replace all role assignments for a group with the provided list. Existing assignments not in the list will be removed. */
export declare const ReplaceAuthorizationGroupRoleAssignmentsControllerGroupRoleAssignments: API.OperationMethod<ReplaceAuthorizationGroupRoleAssignmentsControllerGroupRoleAssignmentsRequest, GroupRoleAssignmentList, ReplaceAuthorizationGroupRoleAssignmentsControllerGroupRoleAssignmentsError, WorkosOpContext>;
export type ResendUserlandUserInvitesControllerError = BadRequest | NotFound | UnprocessableEntity | WorkosOpError;
/** Resend an invitation Resends an invitation email to the recipient. The invitation must be in a pending state. */
export declare const ResendUserlandUserInvitesController: API.OperationMethod<ResendUserlandUserInvitesControllerRequest, UserlandUserInvite, ResendUserlandUserInvitesControllerError, WorkosOpContext>;
export type ResetUserlandUsersControllerPassword0Error = BadRequest | Forbidden | NotFound | UnprocessableEntity | WorkosOpError;
/** Reset the password Sets a new password using the `token` query parameter from the link that the user received. Successfully resetting the password will verify a user's email, if it hasn't been verified yet. */
export declare const ResetUserlandUsersControllerPassword0: API.OperationMethod<ResetUserlandUsersControllerPassword0Request, ResetPasswordResponse, ResetUserlandUsersControllerPassword0Error, WorkosOpContext>;
export type RevokeAgentInstanceSessionsControllerError = NotFound | WorkosOpError;
/** Revoke an agent instance session Revokes an agent instance session, invalidating its refresh token and every access token minted under it. Revocation is idempotent: revoking an already-revoked session keeps the original `revoked_at`, and revoking an already-expired session returns the session with `status: expired` and a null `revoked_at`. */
export declare const RevokeAgentInstanceSessionsController: API.OperationMethod<RevokeAgentInstanceSessionsControllerRequest, AgentInstanceSession, RevokeAgentInstanceSessionsControllerError, WorkosOpContext>;
export type RevokeItContactsControllerError = Forbidden | NotFound | WorkosOpError;
/** Revoke an IT contact's invitation Revoke the organization's active Admin Portal invitation. */
export declare const RevokeItContactsController: API.OperationMethod<RevokeItContactsControllerRequest, RevokeItContactsControllerResponse, RevokeItContactsControllerError, WorkosOpContext>;
export type RevokeUserlandSessionsControllerSessionError = BadRequest | WorkosOpError;
/** Revoke Session Revoke a [user session](/reference/authkit/session). */
export declare const RevokeUserlandSessionsControllerSession: API.OperationMethod<RevokeUserlandSessionsControllerSessionRequest, RevokeUserlandSessionsControllerSessionResponse, RevokeUserlandSessionsControllerSessionError, WorkosOpContext>;
export type RevokeUserlandUserInvitesControllerError = BadRequest | WorkosOpError;
/** Revoke an invitation Revokes an existing invitation. */
export declare const RevokeUserlandUserInvitesController: API.OperationMethod<RevokeUserlandUserInvitesControllerRequest, RevokeUserlandUserInvitesControllerResponse, RevokeUserlandUserInvitesControllerError, WorkosOpContext>;
export type SendPublicRadarChallengesControllerRadarSmsChallengeError = WorkosOpError;
/** Send a Radar SMS challenge Sends a one-time verification code over SMS to a user as part of a Radar challenge. Use the returned `verification_id` to authenticate the user with the `urn:workos:oauth:grant-type:radar-sms-challenge:code` grant type. */
export declare const SendPublicRadarChallengesControllerRadarSmsChallenge: API.OperationMethod<SendPublicRadarChallengesControllerRadarSmsChallengeRequest, SendRadarSmsChallengeResponse, SendPublicRadarChallengesControllerRadarSmsChallengeError, WorkosOpContext>;
export type SendUserlandUsersControllerEmailChangeError = NotFound | Conflict | UnprocessableEntity | WorkosOpError;
/** Send email change code Sends an email that contains a one-time code used to change a user's email address. */
export declare const SendUserlandUsersControllerEmailChange: API.OperationMethod<SendUserlandUsersControllerEmailChangeRequest, EmailChange, SendUserlandUsersControllerEmailChangeError, WorkosOpContext>;
export type SendUserlandUsersControllerVerificationEmail0Error = BadRequest | NotFound | WorkosOpError;
/** Send verification email Sends an email that contains a one-time code used to verify a user's email address. */
export declare const SendUserlandUsersControllerVerificationEmail0: API.OperationMethod<SendUserlandUsersControllerVerificationEmail0Request, SendVerificationEmailResponse, SendUserlandUsersControllerVerificationEmail0Error, WorkosOpContext>;
export type SetAuthorizationOrganizationRolePermissionsControllerPermissionsError = Forbidden | NotFound | UnprocessableEntity | WorkosOpError;
/** Set permissions for a custom role Replace all permissions on a custom role with the provided list. */
export declare const SetAuthorizationOrganizationRolePermissionsControllerPermissions: API.OperationMethod<SetAuthorizationOrganizationRolePermissionsControllerPermissionsRequest, SetAuthorizationOrganizationRolePermissionsControllerPermissionsResponse, SetAuthorizationOrganizationRolePermissionsControllerPermissionsError, WorkosOpContext>;
export type SetAuthorizationRolePermissionsControllerPermissionsError = BadRequest | Forbidden | NotFound | UnprocessableEntity | WorkosOpError;
/** Set permissions for an environment role Replace all permissions on an environment role with the provided list. */
export declare const SetAuthorizationRolePermissionsControllerPermissions: API.OperationMethod<SetAuthorizationRolePermissionsControllerPermissionsRequest, SetAuthorizationRolePermissionsControllerPermissionsResponse, SetAuthorizationRolePermissionsControllerPermissionsError, WorkosOpContext>;
export type SsoControllerJsonWebKeySetError = NotFound | WorkosOpError;
/** Get JWKS Returns the JSON Web Key Set (JWKS) containing the public keys used for verifying access tokens. */
export declare const SsoControllerJsonWebKeySet: API.OperationMethod<SsoControllerJsonWebKeySetRequest, JwksResponse, SsoControllerJsonWebKeySetError, WorkosOpContext>;
export type SsoControllerLogoutAuthorizeError = BadRequest | NotFound | WorkosOpError;
/** Logout Authorize You should call this endpoint from your server to generate a logout token which is required for the [Logout Redirect](/reference/sso/logout) endpoint. */
export declare const SsoControllerLogoutAuthorize: API.OperationMethod<SsoControllerLogoutAuthorizeRequest, SsoLogoutAuthorizeResponse, SsoControllerLogoutAuthorizeError, WorkosOpContext>;
export type SsoControllerTokenError = BadRequest | NotFound | UnprocessableEntity | WorkosOpError;
/** Get a Profile and Token Get an access token along with the user [Profile](/reference/sso/profile) using the code passed to your [Redirect URI](/reference/sso/get-authorization-url/redirect-uri). */
export declare const SsoControllerToken: API.OperationMethod<SsoControllerTokenRequest, SsoTokenResponse, SsoControllerTokenError, WorkosOpContext>;
export type SyncDirectoriesControllerDirectoryError = Forbidden | NotFound | Conflict | UnprocessableEntity | WorkosOpError;
/** Sync a Directory Request an asynchronous sync from the directory provider. Currently supports Google Workspace directories in linked or validating state. Manual requests share a five-minute per-directory cooldown across the API, Dashboard, Admin Portal, and MCP. Acceptance means the request was queued, not that the sync has started or completed. A running sync prevents another request from being queued. */
export declare const SyncDirectoriesControllerDirectory: API.OperationMethod<SyncDirectoriesControllerDirectoryRequest, SyncDirectoriesControllerDirectoryResponse, SyncDirectoriesControllerDirectoryError, WorkosOpContext>;
export type UpdateAgentBlueprintsControllerError = BadRequest | NotFound | Conflict | UnprocessableEntity | WorkosOpError;
/** Update an agent blueprint Updates an agent blueprint. Omitted fields are left unchanged; provided lists replace the existing configuration. */
export declare const UpdateAgentBlueprintsController: API.OperationMethod<UpdateAgentBlueprintsControllerRequest, AgentBlueprint, UpdateAgentBlueprintsControllerError, WorkosOpContext>;
export type UpdateApplicationsControllerError = NotFound | UnprocessableEntity | WorkosOpError;
/** Update a Connect Application Update an existing Connect Application. For OAuth applications, you can update redirect URIs. For all applications, you can update the name, description, and scopes. */
export declare const UpdateApplicationsController: API.OperationMethod<UpdateApplicationsControllerRequest, UpdateApplicationsControllerResponse, UpdateApplicationsControllerError, WorkosOpContext>;
export type UpdateAuditLogsRetentionControllerAuditLogsRetentionError = NotFound | UnprocessableEntity | WorkosOpError;
/** Set Retention Set the event retention period for the given Organization. */
export declare const UpdateAuditLogsRetentionControllerAuditLogsRetention: API.OperationMethod<UpdateAuditLogsRetentionControllerAuditLogsRetentionRequest, AuditLogsRetentionJson, UpdateAuditLogsRetentionControllerAuditLogsRetentionError, WorkosOpContext>;
export type UpdateAuthorizationOrganizationRolesControllerError = BadRequest | Forbidden | NotFound | UnprocessableEntity | WorkosOpError;
/** Update a custom role Update an existing custom role. Only the fields provided in the request body will be updated. */
export declare const UpdateAuthorizationOrganizationRolesController: API.OperationMethod<UpdateAuthorizationOrganizationRolesControllerRequest, UpdateAuthorizationOrganizationRolesControllerResponse, UpdateAuthorizationOrganizationRolesControllerError, WorkosOpContext>;
export type UpdateAuthorizationPermissionsControllerError = Forbidden | NotFound | UnprocessableEntity | WorkosOpError;
/** Update a permission Update an existing permission. Only the fields provided in the request body will be updated. */
export declare const UpdateAuthorizationPermissionsController: API.OperationMethod<UpdateAuthorizationPermissionsControllerRequest, AuthorizationPermission, UpdateAuthorizationPermissionsControllerError, WorkosOpContext>;
export type UpdateAuthorizationResourcesByExternalIdControllerByExternalIdError = BadRequest | Forbidden | NotFound | Conflict | UnprocessableEntity | WorkosOpError;
/** Update a resource by external ID Update an existing authorization resource using its external ID. */
export declare const UpdateAuthorizationResourcesByExternalIdControllerByExternalId: API.OperationMethod<UpdateAuthorizationResourcesByExternalIdControllerByExternalIdRequest, UpdateAuthorizationResourcesByExternalIdControllerByExternalIdResponse, UpdateAuthorizationResourcesByExternalIdControllerByExternalIdError, WorkosOpContext>;
export type UpdateAuthorizationResourcesControllerError = BadRequest | Forbidden | NotFound | Conflict | UnprocessableEntity | WorkosOpError;
/** Update a resource Update an existing authorization resource. */
export declare const UpdateAuthorizationResourcesController: API.OperationMethod<UpdateAuthorizationResourcesControllerRequest, UpdateAuthorizationResourcesControllerResponse, UpdateAuthorizationResourcesControllerError, WorkosOpContext>;
export type UpdateAuthorizationRolesControllerError = BadRequest | Forbidden | NotFound | UnprocessableEntity | WorkosOpError;
/** Update an environment role Update an existing environment role. */
export declare const UpdateAuthorizationRolesController: API.OperationMethod<UpdateAuthorizationRolesControllerRequest, UpdateAuthorizationRolesControllerResponse, UpdateAuthorizationRolesControllerError, WorkosOpContext>;
export type UpdateDataIntegrationsManagementControllerDataIntegrationError = BadRequest | Forbidden | NotFound | Conflict | UnprocessableEntity | WorkosOpError;
/** Update a data integration Updates the description, enabled state, or custom credentials of the user-owned data integration. For custom providers, `custom_provider` updates the OAuth definition. */
export declare const UpdateDataIntegrationsManagementControllerDataIntegration: API.OperationMethod<UpdateDataIntegrationsManagementControllerDataIntegrationRequest, DataIntegration, UpdateDataIntegrationsManagementControllerDataIntegrationError, WorkosOpContext>;
export type UpdateDataIntegrationsManagementControllerOrganizationDataIntegrationError = BadRequest | Forbidden | NotFound | Conflict | UnprocessableEntity | WorkosOpError;
/** Update an organization-owned data integration Updates the description, enabled state, or custom credentials of the organization-owned data integration for a provider. For custom providers, `custom_provider` updates the OAuth definition, which is shared with the user-owned root. The `/organization` suffix selects the environment-level organization-owned root for the provider; it does not name a particular organization. */
export declare const UpdateDataIntegrationsManagementControllerOrganizationDataIntegration: API.OperationMethod<UpdateDataIntegrationsManagementControllerOrganizationDataIntegrationRequest, DataIntegration, UpdateDataIntegrationsManagementControllerOrganizationDataIntegrationError, WorkosOpContext>;
export type UpdateDataIntegrationsOrganizationControllerOrganizationDataInstallationError = BadRequest | Forbidden | NotFound | Conflict | UnprocessableEntity | WorkosOpError;
/** Update an organization connected account Updates an organization's [connected account](/reference/pipes/connected-account) tokens, scopes, or state for a specific provider. */
export declare const UpdateDataIntegrationsOrganizationControllerOrganizationDataInstallation: API.OperationMethod<UpdateDataIntegrationsOrganizationControllerOrganizationDataInstallationRequest, ConnectedAccountWriteResponse, UpdateDataIntegrationsOrganizationControllerOrganizationDataInstallationError, WorkosOpContext>;
export type UpdateDataIntegrationsUserManagementControllerUserDataInstallationError = BadRequest | NotFound | Conflict | UnprocessableEntity | WorkosOpError;
/** Update a connected account Updates a user's [connected account](/reference/pipes/connected-account) tokens, scopes, or state for a specific provider. */
export declare const UpdateDataIntegrationsUserManagementControllerUserDataInstallation: API.OperationMethod<UpdateDataIntegrationsUserManagementControllerUserDataInstallationRequest, ConnectedAccountWriteResponse, UpdateDataIntegrationsUserManagementControllerUserDataInstallationError, WorkosOpContext>;
export type UpdateGroupsControllerError = BadRequest | Forbidden | NotFound | UnprocessableEntity | WorkosOpError;
/** Update a group Update an existing group. Only the fields provided in the request body will be updated. */
export declare const UpdateGroupsController: API.OperationMethod<UpdateGroupsControllerRequest, Group, UpdateGroupsControllerError, WorkosOpContext>;
export type UpdateJumpWireWebDataVaultControllerError = BadRequest | Conflict | WorkosOpError;
/** Update an object Update the value of an existing encrypted object. */
export declare const UpdateJumpWireWebDataVaultController: API.OperationMethod<UpdateJumpWireWebDataVaultControllerRequest, ObjectWithoutValue, UpdateJumpWireWebDataVaultControllerError, WorkosOpContext>;
export type UpdateJwtTemplatesControllerJwtTemplateError = UnprocessableEntity | WorkosOpError;
/** Update JWT template Update the JWT template for the current environment. */
export declare const UpdateJwtTemplatesControllerJwtTemplate: API.OperationMethod<UpdateJwtTemplatesControllerJwtTemplateRequest, JwtTemplate, UpdateJwtTemplatesControllerJwtTemplateError, WorkosOpContext>;
export type UpdateOrganizationsControllerOrganizationError = BadRequest | Forbidden | NotFound | Conflict | UnprocessableEntity | WorkosOpError;
/** Update an Organization Updates an organization in the current environment. */
export declare const UpdateOrganizationsControllerOrganization: API.OperationMethod<UpdateOrganizationsControllerOrganizationRequest, Organization, UpdateOrganizationsControllerOrganizationError, WorkosOpContext>;
export type UpdateRadarStandaloneControllerRadarAttemptError = BadRequest | NotFound | WorkosOpError;
/** Update a Radar attempt You may optionally inform Radar that an authentication attempt or challenge was successful using this endpoint. Some Radar controls depend on tracking recent successful attempts, such as impossible travel. */
export declare const UpdateRadarStandaloneControllerRadarAttempt: API.OperationMethod<UpdateRadarStandaloneControllerRadarAttemptRequest, UpdateRadarStandaloneControllerRadarAttemptResponse, UpdateRadarStandaloneControllerRadarAttemptError, WorkosOpContext>;
export type UpdateUserlandUserOrganizationMembershipsControllerError = NotFound | UnprocessableEntity | WorkosOpError;
/** Update an organization membership Update the details of an existing organization membership. */
export declare const UpdateUserlandUserOrganizationMembershipsController: API.OperationMethod<UpdateUserlandUserOrganizationMembershipsControllerRequest, UserlandUserOrganizationMembership, UpdateUserlandUserOrganizationMembershipsControllerError, WorkosOpContext>;
export type UpdateWebhookEndpointsControllerError = NotFound | Conflict | UnprocessableEntity | WorkosOpError;
/** Update a Webhook Endpoint Update the properties of an existing webhook endpoint. */
export declare const UpdateWebhookEndpointsController: API.OperationMethod<UpdateWebhookEndpointsControllerRequest, WebhookEndpointJson, UpdateWebhookEndpointsControllerError, WorkosOpContext>;
export type UpsertDataIntegrationsControllerApiKeyError = BadRequest | Forbidden | NotFound | Conflict | UnprocessableEntity | WorkosOpError;
/** Upsert an API key for a connected account Creates or updates an API-key-based installation for the specified integration, owned by the user or, when `connection_owner` is `organization`, shared by the organization. If an installation already exists, the stored API key is rotated to the new value. To create another connection, use POST. */
export declare const UpsertDataIntegrationsControllerApiKey: API.OperationMethod<UpsertDataIntegrationsControllerApiKeyRequest, ConnectedAccountWriteResponse, UpsertDataIntegrationsControllerApiKeyError, WorkosOpContext>;
export type UpsertDataIntegrationsControllerClientCredentialsError = BadRequest | Forbidden | NotFound | Conflict | UnprocessableEntity | WorkosOpError;
/** Upsert client credentials for a connected account Creates or updates a client-credentials-based installation for the specified integration, owned by the user or, when `connection_owner` is `organization`, shared by the organization. If an installation already exists, the stored client credentials are rotated to the new values. To create another connection, use POST. */
export declare const UpsertDataIntegrationsControllerClientCredentials: API.OperationMethod<UpsertDataIntegrationsControllerClientCredentialsRequest, ConnectedAccountWriteResponse, UpsertDataIntegrationsControllerClientCredentialsError, WorkosOpContext>;
export type UserlandMagicAuthControllerSendMagicAuthCodeAndReturnError = BadRequest | UnprocessableEntity | WorkosOpError;
/** Create a Magic Auth code Creates a one-time authentication code that can be sent to the user's email address. The code expires in 10 minutes. To verify the code, [authenticate the user with Magic Auth](/reference/authkit/authentication/magic-auth). */
export declare const UserlandMagicAuthControllerSendMagicAuthCodeAndReturn: API.OperationMethod<UserlandMagicAuthControllerSendMagicAuthCodeAndReturnRequest, UserlandMagicAuthControllerSendMagicAuthCodeAndReturnResponse, UserlandMagicAuthControllerSendMagicAuthCodeAndReturnError, WorkosOpContext>;
export type UserlandSessionsControllerAuthenticate0Error = BadRequest | Forbidden | NotFound | UnprocessableEntity | WorkosOpError;
/** Authenticate Authenticate a user with a specified [authentication method](/reference/authkit/authentication). */
export declare const UserlandSessionsControllerAuthenticate0: API.OperationMethod<UserlandSessionsControllerAuthenticate0Request, UserlandAuthenticateResponse, UserlandSessionsControllerAuthenticate0Error, WorkosOpContext>;
export type UserlandSsoControllerDeviceAuthorizationError = BadRequest | Forbidden | WorkosOpError;
/** Get device authorization URL Initiates the CLI Auth flow by requesting a device code and verification URLs. This endpoint implements the OAuth 2.0 Device Authorization Flow ([RFC 8628](https://datatracker.ietf.org/doc/html/rfc8628)) and is designed for command-line applications or other devices with limited input capabilities. */
export declare const UserlandSsoControllerDeviceAuthorization: API.OperationMethod<UserlandSsoControllerDeviceAuthorizationRequest, DeviceAuthorizationResponse, UserlandSsoControllerDeviceAuthorizationError, WorkosOpContext>;
export type UserlandUserAuthenticationFactorsControllerCreate0Error = UnprocessableEntity | WorkosOpError;
/** Enroll an authentication factor Enrolls a user in a new [authentication factor](/reference/authkit/mfa/authentication-factor). */
export declare const UserlandUserAuthenticationFactorsControllerCreate0: API.OperationMethod<UserlandUserAuthenticationFactorsControllerCreate0Request, UserlandUserAuthenticationFactorEnrollResponse, UserlandUserAuthenticationFactorsControllerCreate0Error, WorkosOpContext>;
export type UserlandUserAuthenticationFactorsControllerList0Error = UnprocessableEntity | WorkosOpError;
/** List authentication factors Lists the [authentication factors](/reference/authkit/mfa/authentication-factor) for a user. */
export declare const UserlandUserAuthenticationFactorsControllerList0: API.OperationMethod<UserlandUserAuthenticationFactorsControllerList0Request, UserlandUserAuthenticationFactorList, UserlandUserAuthenticationFactorsControllerList0Error, WorkosOpContext>;
export type UserlandUserOrganizationMembershipsControllerReactivateError = BadRequest | NotFound | UnprocessableEntity | WorkosOpError;
/** Reactivate an organization membership Reactivates an `inactive` organization membership, retaining the pre-existing role(s). Emits an [organization_membership.updated](/events/organization-membership) event upon successful reactivation. - Reactivating an `active` membership is a no-op and does not emit an event. - Reactivating a `pending` membership returns an error. The user needs to [accept the invitation](/authkit/invitations) instead. See the [membership management documentation](/authkit/users-organizations/organizations/membership-management) for additional details. */
export declare const UserlandUserOrganizationMembershipsControllerReactivate: API.OperationMethod<UserlandUserOrganizationMembershipsControllerReactivateRequest, UserlandUserOrganizationMembership, UserlandUserOrganizationMembershipsControllerReactivateError, WorkosOpContext>;
export type UserlandUsersControllerCreate0Error = BadRequest | NotFound | UnprocessableEntity | WorkosOpError;
/** Create a user Create a new user in the current environment. */
export declare const UserlandUsersControllerCreate0: API.OperationMethod<UserlandUsersControllerCreate0Request, UserlandUsersControllerCreate0Response, UserlandUsersControllerCreate0Error, WorkosOpContext>;
export type UserlandUsersControllerCreatePasswordResetTokenError = Forbidden | NotFound | UnprocessableEntity | WorkosOpError;
/** Create a password reset token Creates a one-time token that can be used to reset a user's password. */
export declare const UserlandUsersControllerCreatePasswordResetToken: API.OperationMethod<UserlandUsersControllerCreatePasswordResetTokenRequest, PasswordReset, UserlandUsersControllerCreatePasswordResetTokenError, WorkosOpContext>;
export type UserlandUsersControllerDelete0Error = NotFound | WorkosOpError;
/** Delete a user Permanently deletes a user in the current environment. It cannot be undone. */
export declare const UserlandUsersControllerDelete0: API.OperationMethod<UserlandUsersControllerDelete0Request, UserlandUsersControllerDelete0Response, UserlandUsersControllerDelete0Error, WorkosOpContext>;
export type UserlandUsersControllerEmailVerification0Error = BadRequest | NotFound | UnprocessableEntity | WorkosOpError;
/** Verify email Verifies an email address using the one-time code received by the user. */
export declare const UserlandUsersControllerEmailVerification0: API.OperationMethod<UserlandUsersControllerEmailVerification0Request, VerifyEmailResponse, UserlandUsersControllerEmailVerification0Error, WorkosOpContext>;
export type UserlandUsersControllerGet0Error = NotFound | WorkosOpError;
/** Get a user Get the details of an existing user. */
export declare const UserlandUsersControllerGet0: API.OperationMethod<UserlandUsersControllerGet0Request, UserlandUser, UserlandUsersControllerGet0Error, WorkosOpContext>;
export type UserlandUsersControllerGetPasswordResetError = NotFound | WorkosOpError;
/** Get a password reset token Get the details of an existing password reset token that can be used to reset a user's password. */
export declare const UserlandUsersControllerGetPasswordReset: API.OperationMethod<UserlandUsersControllerGetPasswordResetRequest, PasswordReset, UserlandUsersControllerGetPasswordResetError, WorkosOpContext>;
export type UserlandUsersControllerList0Error = UnprocessableEntity | WorkosOpError;
/** List users Get a list of all of your existing users matching the criteria specified. */
export declare const UserlandUsersControllerList0: API.OperationMethod<UserlandUsersControllerList0Request, UserlandUserList, UserlandUsersControllerList0Error, WorkosOpContext>;
export type UserlandUsersControllerUpdate0Error = BadRequest | UnprocessableEntity | WorkosOpError;
/** Update a user Updates properties of a user. The omitted properties will be left unchanged. */
export declare const UserlandUsersControllerUpdate0: API.OperationMethod<UserlandUsersControllerUpdate0Request, UserlandUser, UserlandUsersControllerUpdate0Error, WorkosOpContext>;
export type ValidateAgentAdminControllerCredentialError = BadRequest | WorkosOpError;
/** Validate an agent credential Validate an agent credential -- an API key or access token -- against the environment of the API key used to authenticate the request. This is a read-only check: it never consumes or mutates the credential. */
export declare const ValidateAgentAdminControllerCredential: API.OperationMethod<ValidateAgentAdminControllerCredentialRequest, AgentCredentialValidation, ValidateAgentAdminControllerCredentialError, WorkosOpContext>;
export type ValidateAgentBlueprintsTokenControllerTokenError = BadRequest | NotFound | WorkosOpError;
/** Validate an agent token Validates an agent access token: verifies its signature against the environment, that it was minted under this blueprint, and that the backing session is live (not revoked or expired, and -- for delegated sessions -- that the delegating user session has not ended). Returns the token claims and session metadata when valid; invalid tokens are reported as errors with stable codes. */
export declare const ValidateAgentBlueprintsTokenControllerToken: API.OperationMethod<ValidateAgentBlueprintsTokenControllerTokenRequest, AgentTokenValidation, ValidateAgentBlueprintsTokenControllerTokenError, WorkosOpContext>;
export type ValidateApiKeysControllerApiKeyError = UnprocessableEntity | WorkosOpError;
/** Validate API key Validate an API key value and return the API key object if valid. */
export declare const ValidateApiKeysControllerApiKey: API.OperationMethod<ValidateApiKeysControllerApiKeyRequest, ApiKeyValidationResponse, ValidateApiKeysControllerApiKeyError, WorkosOpContext>;
export type VerifyAuthenticationChallengesControllerError = BadRequest | NotFound | UnprocessableEntity | WorkosOpError;
/** Verify Challenge Verifies an Authentication Challenge. */
export declare const VerifyAuthenticationChallengesController: API.OperationMethod<VerifyAuthenticationChallengesControllerRequest, AuthenticationChallengeVerifyResponse, VerifyAuthenticationChallengesControllerError, WorkosOpContext>;
export type VerifyOrganizationDomainsControllerError = BadRequest | WorkosOpError;
/** Verify an Organization Domain Initiates verification process for an Organization Domain. */
export declare const VerifyOrganizationDomainsController: API.OperationMethod<VerifyOrganizationDomainsControllerRequest, OrganizationDomainStandAlone, VerifyOrganizationDomainsControllerError, WorkosOpContext>;
export type WaitlistEntriesControllerDenyError = NotFound | UnprocessableEntity | WorkosOpError;
/** Deny a waitlist entry Deny a pending waitlist entry. Denying an entry that is not pending fails with the code `invalid_state`. A denial can be reversed by approving the entry. */
export declare const WaitlistEntriesControllerDeny: API.OperationMethod<WaitlistEntriesControllerDenyRequest, WaitlistEntriesControllerDenyResponse, WaitlistEntriesControllerDenyError, WorkosOpContext>;
export type WaitlistsControllerFindError = NotFound | WorkosOpError;
/** Get a waitlist Get the details of an existing waitlist. */
export declare const WaitlistsControllerFind: API.OperationMethod<WaitlistsControllerFindRequest, Waitlist, WaitlistsControllerFindError, WorkosOpContext>;
export type WidgetsPublicControllerIssueWidgetSessionTokenError = BadRequest | NotFound | UnprocessableEntity | WorkosOpError;
/** Generate a widget token Generate a widget token for a user, optionally scoped to an organization. When an organization is specified, org-scoped widgets are enabled; omitting it issues a user-only token for widgets like `UserProfile` and `UserSecurity`. */
export declare const WidgetsPublicControllerIssueWidgetSessionToken: API.OperationMethod<WidgetsPublicControllerIssueWidgetSessionTokenRequest, WidgetSessionTokenResponse, WidgetsPublicControllerIssueWidgetSessionTokenError, WorkosOpContext>;
//# sourceMappingURL=workos.d.ts.map