api

type AccountCreateApikeyJSONRequestBody = AccountCreateApikeyRequest

type AccountCreateApikeyRequest struct {
	// AllowedScopes What the new key may do. Omit for a key that carries no named scope, which is the safe default.
	AllowedScopes *[]string `json:"allowed_scopes,omitempty"`

	// Name A label you will recognise later. Shown wherever the key is listed.
	Name string `json:"name"`
}

type AccountCreateApikeyResponse struct {
	Body         []byte
	HTTPResponse *http.Response
	// JSON200 the response for an HTTP 200 `application/json` response
	JSON200 *AccountCreatedApikey
	// JSON400 the response for an HTTP 400 `application/json` response
	JSON400 *AccountInvalid
	// JSON401 the response for an HTTP 401 `application/json` response
	JSON401 *AccountUnauthorized
	// JSON403 the response for an HTTP 403 `application/json` response
	JSON403 *AccountForbidden
}

type AccountCreatedApikey struct {
	AllowedCidrs  *[]string          `json:"allowed_cidrs,omitempty"`
	AllowedScopes *[]string          `json:"allowed_scopes,omitempty"`
	ID            openapi_types.UUID `json:"id"`

	// Key The secret. Returned once, here, and never again.
	Key       string  `json:"key"`
	KeyPrefix *string `json:"key_prefix,omitempty"`
	Name      *string `json:"name,omitempty"`
	Rc        string  `json:"rc"`
}

type AccountForbidden = AccountRc

type AccountIdentityResponse struct {
	Body         []byte
	HTTPResponse *http.Response
	// JSON200 the response for an HTTP 200 `application/json` response
	JSON200 *Identity
	// JSON401 the response for an HTTP 401 `application/json` response
	JSON401 *AccountUnauthorized
	// JSON403 the response for an HTTP 403 `application/json` response
	JSON403 *AccountForbidden
}

type AccountInvalid = AccountRc

type AccountListApikeysResponse struct {
	Body         []byte
	HTTPResponse *http.Response
	// JSON200 the response for an HTTP 200 `application/json` response
	JSON200 *ApikeyList
	// JSON401 the response for an HTTP 401 `application/json` response
	JSON401 *AccountUnauthorized
	// JSON403 the response for an HTTP 403 `application/json` response
	JSON403 *AccountForbidden
}

type AccountNotFound = AccountRc

type AccountOrg struct {
	Created *time.Time         `json:"created,omitempty"`
	ID      openapi_types.UUID `json:"id"`
	Name    *string            `json:"name,omitempty"`
}

type AccountOrgMembersResponse struct {
	Body         []byte
	HTTPResponse *http.Response
	// JSON200 the response for an HTTP 200 `application/json` response
	JSON200 *AccountRc
	// JSON401 the response for an HTTP 401 `application/json` response
	JSON401 *AccountUnauthorized
	// JSON403 the response for an HTTP 403 `application/json` response
	JSON403 *AccountForbidden
}

type AccountOrgRef struct {
	ID openapi_types.UUID `json:"id"`
}

type AccountOrgResponse struct {
	Body         []byte
	HTTPResponse *http.Response
	// JSON200 the response for an HTTP 200 `application/json` response
	JSON200 *AccountOrgWrap
	// JSON401 the response for an HTTP 401 `application/json` response
	JSON401 *AccountUnauthorized
	// JSON403 the response for an HTTP 403 `application/json` response
	JSON403 *AccountForbidden
}

type AccountOrgWrap struct {
	Org AccountOrg `json:"org"`
	Rc  string     `json:"rc"`
}

type AccountRc struct {
	// Rc The outcome. `SUCCESS` on success; otherwise the reason.
	Rc string `json:"rc"`
}

type AccountRevealApikeyResponse struct {
	Body         []byte
	HTTPResponse *http.Response
	// JSON200 the response for an HTTP 200 `application/json` response
	JSON200 *AccountRevealedApikey
	// JSON401 the response for an HTTP 401 `application/json` response
	JSON401 *AccountUnauthorized
	// JSON403 the response for an HTTP 403 `application/json` response
	JSON403 *AccountForbidden
	// JSON404 the response for an HTTP 404 `application/json` response
	JSON404 *AccountRc
}

type AccountRevealedApikey struct {
	// Key The secret.
	Key string `json:"key"`
	Rc  string `json:"rc"`
}

type AccountRevokeApikeyResponse struct {
	Body         []byte
	HTTPResponse *http.Response
	// JSON200 the response for an HTTP 200 `application/json` response
	JSON200 *AccountRc
	// JSON401 the response for an HTTP 401 `application/json` response
	JSON401 *AccountUnauthorized
	// JSON403 the response for an HTTP 403 `application/json` response
	JSON403 *AccountForbidden
	// JSON404 the response for an HTTP 404 `application/json` response
	JSON404 *AccountNotFound
}

type AccountRotateApikeyResponse struct {
	Body         []byte
	HTTPResponse *http.Response
	// JSON200 the response for an HTTP 200 `application/json` response
	JSON200 *AccountCreatedApikey
	// JSON401 the response for an HTTP 401 `application/json` response
	JSON401 *AccountUnauthorized
	// JSON403 the response for an HTTP 403 `application/json` response
	JSON403 *AccountForbidden
	// JSON404 the response for an HTTP 404 `application/json` response
	JSON404 *AccountNotFound
}

type AccountUnauthorized = AccountRc

type AccountUser struct {
	Email    *openapi_types.Email `json:"email,omitempty"`
	Fullname *string              `json:"fullname,omitempty"`
	ID       openapi_types.UUID   `json:"id"`
}

type ApikeyDetail struct {
	// AllowedCidrs Source-IP allowlist. EMPTY MEANS UNRESTRICTED, not deny-all.
	AllowedCidrs  *[]string          `json:"allowed_cidrs,omitempty"`
	AllowedScopes *[]string          `json:"allowed_scopes,omitempty"`
	Created       time.Time          `json:"created"`
	Expires       *time.Time         `json:"expires,omitempty"`
	ID            openapi_types.UUID `json:"id"`

	// KeyPrefix The leading, non-secret part, so a key is recognisable without storing it.
	KeyPrefix  string     `json:"key_prefix"`
	LastUsedAt *time.Time `json:"last_used_at,omitempty"`
	Name       string     `json:"name"`

	// Retrievable Whether this key's secret can still be read back. False permanently for a key issued before secrets were stored recoverably.
	Retrievable *bool      `json:"retrievable,omitempty"`
	RevokedAt   *time.Time `json:"revoked_at,omitempty"`
}

type ApikeyIDParam = openapi_types.UUID

type ApikeyList struct {
	Keys []ApikeyDetail `json:"keys"`
	Rc   string         `json:"rc"`
}

type Client struct {
	// The endpoint of the server conforming to this interface, with scheme,
	// https://api.deepmap.com for example. This can contain a path relative
	// to the server, such as https://api.deepmap.com/dev-test, and all the
	// paths in the swagger spec will be appended to the server.
	Server string

	// Doer for performing requests, typically a *http.Client with any
	// customized settings, such as certificate chains.
	Client HttpRequestDoer

	// A list of callbacks for modifying requests which are generated before sending over
	// the network.
	RequestEditors []RequestEditorFn
}

type ClientInterface interface {

	// OauthMetadata Discovery
	//
	// RFC 8414 authorization server metadata: the endpoints, the grant types
	// and the scopes this server supports.
	//
	// Read this rather than hardcoding endpoints. It is also served at
	// `/.well-known/openid-configuration`, identically, because several
	// clients probe that path first.
	//
	// Corresponds with GET /.well-known/oauth-authorization-server (the `OauthMetadata` operationId).
	OauthMetadata(ctx context.Context, reqEditors ...RequestEditorFn) (*http.Response, error)

	// AccountListApikeys List
	//
	// Metadata only. A key's secret is never in a list - not here and not in
	// the console - because a list is the response that ends up in logs,
	// caches and support tickets.
	//
	// `retrievable` says whether the secret could still be read back at all.
	// A key issued before this product stored secrets recoverably was never
	// kept, so `reveal` will refuse it permanently; rotating produces one
	// that can be read.
	//
	// Corresponds with GET /api/v1/iam/apikeys (the `AccountListApikeys` operationId).
	AccountListApikeys(ctx context.Context, reqEditors ...RequestEditorFn) (*http.Response, error)

	// AccountCreateApikeyWithBody Create
	//
	// Creates a key and returns its secret.
	//
	// This is the ONLY response that ever carries the secret, and only
	// because this is the moment it comes into existence. Store it now.
	//
	// Takes any type of body and a specified content type.
	//
	// Corresponds with POST /api/v1/iam/apikeys (the `AccountCreateApikey` operationId).
	AccountCreateApikeyWithBody(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*http.Response, error)

	// AccountCreateApikey Create
	//
	// Creates a key and returns its secret.
	//
	// This is the ONLY response that ever carries the secret, and only
	// because this is the moment it comes into existence. Store it now.
	//
	// Takes a body of the `application/json` content type.
	//
	// Corresponds with POST /api/v1/iam/apikeys (the `AccountCreateApikey` operationId).
	AccountCreateApikey(ctx context.Context, body AccountCreateApikeyJSONRequestBody, reqEditors ...RequestEditorFn) (*http.Response, error)

	// AccountRevealApikey Reveal
	//
	// Returns an existing key's secret.
	//
	// Its own scope rather than part of `apikeys.manage`, because the two are
	// different acts: rotating replaces a secret you never see, while this
	// hands one over.
	//
	// Refused with `NOT_RETRIEVABLE` for a key issued before this product
	// stored secrets recoverably - that secret was never kept, so no retry
	// will ever produce it. Rotate the key instead.
	//
	// Corresponds with POST /api/v1/iam/apikeys/{id}/reveal (the `AccountRevealApikey` operationId).
	AccountRevealApikey(ctx context.Context, id ApikeyIDParam, reqEditors ...RequestEditorFn) (*http.Response, error)

	// AccountRevokeApikey Revoke
	//
	// Stops the key working. Revocation is soft: the key stays listed with a
	// `revoked_at`, because the organization still owns whatever it did while
	// it was alive.
	//
	// Corresponds with POST /api/v1/iam/apikeys/{id}/revoke (the `AccountRevokeApikey` operationId).
	AccountRevokeApikey(ctx context.Context, id ApikeyIDParam, reqEditors ...RequestEditorFn) (*http.Response, error)

	// AccountRotateApikey Rotate
	//
	// Replaces the secret behind a key, keeping its id, name and settings.
	// The previous secret stops working immediately.
	//
	// Corresponds with POST /api/v1/iam/apikeys/{id}/rotate (the `AccountRotateApikey` operationId).
	AccountRotateApikey(ctx context.Context, id ApikeyIDParam, reqEditors ...RequestEditorFn) (*http.Response, error)

	// AccountIdentity Identity
	//
	// The identity behind this credential: what it is, the organization it is
	// scoped to, and the scopes it currently holds.
	//
	// `user` is present for an OAuth token and ABSENT for an API key, which
	// has an organization but no person behind it. `credential.kind` says
	// which you are holding, so a client can branch without guessing from a
	// missing field.
	//
	// Narrower than what the console shows its own user on purpose: an
	// integration needs a name to display and an organization to address, not
	// a profile. The `scopes` array is what the credential may do RIGHT NOW,
	// so a client can render its own capabilities rather than discovering
	// them from a 403.
	//
	// Corresponds with GET /api/v1/iam/identity (the `AccountIdentity` operationId).
	AccountIdentity(ctx context.Context, reqEditors ...RequestEditorFn) (*http.Response, error)

	// AccountOrg Organization
	//
	// The organization this credential is scoped to.
	//
	// There is no way to name a different one. A credential describes exactly
	// one organization, so an identifier in the path could only ever be your
	// own or a refusal.
	//
	// Corresponds with GET /api/v1/iam/org (the `AccountOrg` operationId).
	AccountOrg(ctx context.Context, reqEditors ...RequestEditorFn) (*http.Response, error)

	// AccountOrgMembers Members
	//
	// Read-only. Adding or removing a member is an invitation flow with email
	// in the middle rather than a POST, and modelling it as one here would
	// promise something this API does not do.
	//
	// Corresponds with GET /api/v1/iam/org/members (the `AccountOrgMembers` operationId).
	AccountOrgMembers(ctx context.Context, reqEditors ...RequestEditorFn) (*http.Response, error)

	// DatabaseChecksumV2 Checksums
	//
	// Checksums for one published file, so a download can be verified after it lands.
	//
	// Corresponds with GET /api/v2/database/checksum (the `DatabaseChecksumV2` operationId).
	DatabaseChecksumV2(ctx context.Context, params *DatabaseChecksumV2Params, reqEditors ...RequestEditorFn) (*http.Response, error)

	// DownloadDatabaseV2 Download
	//
	// Answers `302`; the bytes come straight from object storage rather than
	// through this API. Follow the redirect.
	//
	// Corresponds with GET /api/v2/database/download (the `DownloadDatabaseV2` operationId).
	DownloadDatabaseV2(ctx context.Context, params *DownloadDatabaseV2Params, reqEditors ...RequestEditorFn) (*http.Response, error)

	// ListDownloads History
	//
	// Refusals are listed too: a denial is what answers "it stopped working",
	// and its absence answers nothing.
	//
	// Corresponds with GET /api/v2/database/downloads (the `ListDownloads` operationId).
	ListDownloads(ctx context.Context, params *ListDownloadsParams, reqEditors ...RequestEditorFn) (*http.Response, error)

	// ListDatabases List
	//
	// The whole published catalog, with your organization's license beside
	// each entry, so `standing` says whether a database is yours today
	// (`licensed`), was (`expired`), or has never been bought (`unlicensed`).
	// An `open` database downloads whatever its `standing`.
	//
	// Corresponds with GET /api/v2/database/list (the `ListDatabases` operationId).
	ListDatabases(ctx context.Context, reqEditors ...RequestEditorFn) (*http.Response, error)

	// DatabaseMetadataV2 Metadata
	//
	// Poll this to decide whether today's build is worth fetching: it carries
	// `updated` and `entries` without downloading anything.
	//
	// No `format` parameter - one document describes every format the database
	// is built in. Needs no license: it answers for every database `list`
	// returns, whatever its `standing`.
	//
	// Corresponds with GET /api/v2/database/metadata (the `DatabaseMetadataV2` operationId).
	DatabaseMetadataV2(ctx context.Context, params *DatabaseMetadataV2Params, reqEditors ...RequestEditorFn) (*http.Response, error)

	// OauthAuthorize Authorize
	//
	// The browser entry point for the authorization-code flow. This is a
	// redirect target, not something to call from code.
	//
	// Any client may sign in without registering first by using a Client ID
	// Metadata Document: make `client_id` an https URL that serves your
	// client's metadata as JSON, naming that same URL as its `client_id`,
	// with `token_endpoint_auth_method` `none` and your `redirect_uris`. An
	// https redirect URI must be on the same origin as the `client_id`; a
	// loopback one (`http://127.0.0.1`, `http://[::1]`, `http://localhost`)
	// matches on any port. Such a client is granted `apikeys.use` at most.
	//
	// An unknown `client_id` or an unregistered `redirect_uri` is shown to the
	// USER and never redirected, because sending an error to an address we
	// have not verified belongs to you is how an open redirector works.
	// Everything else comes back to your `redirect_uri` with `error`, your
	// `state`, and `iss`.
	//
	// Corresponds with GET /oauth/authorize (the `OauthAuthorize` operationId).
	OauthAuthorize(ctx context.Context, params *OauthAuthorizeParams, reqEditors ...RequestEditorFn) (*http.Response, error)

	// OauthDeviceAuthorizationWithBody Device authorization
	//
	// Starts the device flow. Show the `user_code` to the person and send them
	// to `verification_uri`; `verification_uri_complete` has the code already
	// embedded, which is what to open if you can open a browser at all.
	//
	// Then poll `/oauth/token`, no faster than `interval` seconds.
	//
	// Takes any type of body and a specified content type.
	//
	// Corresponds with POST /oauth/device_authorization (the `OauthDeviceAuthorization` operationId).
	OauthDeviceAuthorizationWithBody(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*http.Response, error)

	// OauthDeviceAuthorizationWithFormdataBody Device authorization
	//
	// Starts the device flow. Show the `user_code` to the person and send them
	// to `verification_uri`; `verification_uri_complete` has the code already
	// embedded, which is what to open if you can open a browser at all.
	//
	// Then poll `/oauth/token`, no faster than `interval` seconds.
	//
	// Takes a body of the `application/x-www-form-urlencoded` content type.
	//
	// Corresponds with POST /oauth/device_authorization (the `OauthDeviceAuthorization` operationId).
	OauthDeviceAuthorizationWithFormdataBody(ctx context.Context, body OauthDeviceAuthorizationFormdataRequestBody, reqEditors ...RequestEditorFn) (*http.Response, error)

	// OauthRevokeWithBody Revoke
	//
	// RFC 7009. Always answers 200, including for a token that was never
	// valid - an endpoint that distinguished the two would be a way to test
	// whether a stolen string is a live credential.
	//
	// Revoking a REFRESH token ends the whole authorization and takes its
	// access tokens with it. Revoking an access token affects only that token.
	//
	// Takes any type of body and a specified content type.
	//
	// Corresponds with POST /oauth/revoke (the `OauthRevoke` operationId).
	OauthRevokeWithBody(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*http.Response, error)

	// OauthRevokeWithFormdataBody Revoke
	//
	// RFC 7009. Always answers 200, including for a token that was never
	// valid - an endpoint that distinguished the two would be a way to test
	// whether a stolen string is a live credential.
	//
	// Revoking a REFRESH token ends the whole authorization and takes its
	// access tokens with it. Revoking an access token affects only that token.
	//
	// Takes a body of the `application/x-www-form-urlencoded` content type.
	//
	// Corresponds with POST /oauth/revoke (the `OauthRevoke` operationId).
	OauthRevokeWithFormdataBody(ctx context.Context, body OauthRevokeFormdataRequestBody, reqEditors ...RequestEditorFn) (*http.Response, error)

	// OauthTokenWithBody Token
	//
	// Three grant types.
	//
	// `urn:ietf:params:oauth:grant-type:device_code` polls a device
	// authorization. Until the person approves it answers
	// `authorization_pending`; poll faster than `interval` and it answers
	// `slow_down`, which means widen your interval and keep it widened.
	//
	// `authorization_code` exchanges a code from `/oauth/authorize`, with the
	// `code_verifier` matching the challenge you sent and the same
	// `redirect_uri`. A code works once: presenting it again also revokes
	// what the first exchange issued.
	//
	// `refresh_token` exchanges a refresh token. The presented token is
	// consumed whatever happens next, so store the new one before using it.
	// Presenting a consumed refresh token again ends the whole authorization,
	// since it means the token was copied.
	//
	// Takes any type of body and a specified content type.
	//
	// Corresponds with POST /oauth/token (the `OauthToken` operationId).
	OauthTokenWithBody(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*http.Response, error)

	// OauthTokenWithFormdataBody Token
	//
	// Three grant types.
	//
	// `urn:ietf:params:oauth:grant-type:device_code` polls a device
	// authorization. Until the person approves it answers
	// `authorization_pending`; poll faster than `interval` and it answers
	// `slow_down`, which means widen your interval and keep it widened.
	//
	// `authorization_code` exchanges a code from `/oauth/authorize`, with the
	// `code_verifier` matching the challenge you sent and the same
	// `redirect_uri`. A code works once: presenting it again also revokes
	// what the first exchange issued.
	//
	// `refresh_token` exchanges a refresh token. The presented token is
	// consumed whatever happens next, so store the new one before using it.
	// Presenting a consumed refresh token again ends the whole authorization,
	// since it means the token was copied.
	//
	// Takes a body of the `application/x-www-form-urlencoded` content type.
	//
	// Corresponds with POST /oauth/token (the `OauthToken` operationId).
	OauthTokenWithFormdataBody(ctx context.Context, body OauthTokenFormdataRequestBody, reqEditors ...RequestEditorFn) (*http.Response, error)
}

type ClientOption func(*Client) error

type ClientWithResponses struct {
	ClientInterface
}

type ClientWithResponsesInterface interface {

	// OauthMetadataWithResponse Discovery
	//
	// RFC 8414 authorization server metadata: the endpoints, the grant types
	// and the scopes this server supports.
	//
	// Read this rather than hardcoding endpoints. It is also served at
	// `/.well-known/openid-configuration`, identically, because several
	// clients probe that path first.
	//
	// Returns a wrapper object for the known response body format(s).
	//
	// Corresponds with GET /.well-known/oauth-authorization-server (the `OauthMetadata` operationId).
	OauthMetadataWithResponse(ctx context.Context, reqEditors ...RequestEditorFn) (*OauthMetadataResponse, error)

	// AccountListApikeysWithResponse List
	//
	// Metadata only. A key's secret is never in a list - not here and not in
	// the console - because a list is the response that ends up in logs,
	// caches and support tickets.
	//
	// `retrievable` says whether the secret could still be read back at all.
	// A key issued before this product stored secrets recoverably was never
	// kept, so `reveal` will refuse it permanently; rotating produces one
	// that can be read.
	//
	// Returns a wrapper object for the known response body format(s).
	//
	// Corresponds with GET /api/v1/iam/apikeys (the `AccountListApikeys` operationId).
	AccountListApikeysWithResponse(ctx context.Context, reqEditors ...RequestEditorFn) (*AccountListApikeysResponse, error)

	// AccountCreateApikeyWithBodyWithResponse Create
	//
	// Creates a key and returns its secret.
	//
	// This is the ONLY response that ever carries the secret, and only
	// because this is the moment it comes into existence. Store it now.
	//
	// Takes any type of body and a specified content type, and returns a wrapper object for the known response body format(s).
	//
	// Corresponds with POST /api/v1/iam/apikeys (the `AccountCreateApikey` operationId).
	AccountCreateApikeyWithBodyWithResponse(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*AccountCreateApikeyResponse, error)

	// AccountCreateApikeyWithResponse Create
	//
	// Creates a key and returns its secret.
	//
	// This is the ONLY response that ever carries the secret, and only
	// because this is the moment it comes into existence. Store it now.
	//
	// Takes a body of the `application/json` content type, and returns a wrapper object for the known response body format(s).
	//
	// Corresponds with POST /api/v1/iam/apikeys (the `AccountCreateApikey` operationId).
	AccountCreateApikeyWithResponse(ctx context.Context, body AccountCreateApikeyJSONRequestBody, reqEditors ...RequestEditorFn) (*AccountCreateApikeyResponse, error)

	// AccountRevealApikeyWithResponse Reveal
	//
	// Returns an existing key's secret.
	//
	// Its own scope rather than part of `apikeys.manage`, because the two are
	// different acts: rotating replaces a secret you never see, while this
	// hands one over.
	//
	// Refused with `NOT_RETRIEVABLE` for a key issued before this product
	// stored secrets recoverably - that secret was never kept, so no retry
	// will ever produce it. Rotate the key instead.
	//
	// Returns a wrapper object for the known response body format(s).
	//
	// Corresponds with POST /api/v1/iam/apikeys/{id}/reveal (the `AccountRevealApikey` operationId).
	AccountRevealApikeyWithResponse(ctx context.Context, id ApikeyIDParam, reqEditors ...RequestEditorFn) (*AccountRevealApikeyResponse, error)

	// AccountRevokeApikeyWithResponse Revoke
	//
	// Stops the key working. Revocation is soft: the key stays listed with a
	// `revoked_at`, because the organization still owns whatever it did while
	// it was alive.
	//
	// Returns a wrapper object for the known response body format(s).
	//
	// Corresponds with POST /api/v1/iam/apikeys/{id}/revoke (the `AccountRevokeApikey` operationId).
	AccountRevokeApikeyWithResponse(ctx context.Context, id ApikeyIDParam, reqEditors ...RequestEditorFn) (*AccountRevokeApikeyResponse, error)

	// AccountRotateApikeyWithResponse Rotate
	//
	// Replaces the secret behind a key, keeping its id, name and settings.
	// The previous secret stops working immediately.
	//
	// Returns a wrapper object for the known response body format(s).
	//
	// Corresponds with POST /api/v1/iam/apikeys/{id}/rotate (the `AccountRotateApikey` operationId).
	AccountRotateApikeyWithResponse(ctx context.Context, id ApikeyIDParam, reqEditors ...RequestEditorFn) (*AccountRotateApikeyResponse, error)

	// AccountIdentityWithResponse Identity
	//
	// The identity behind this credential: what it is, the organization it is
	// scoped to, and the scopes it currently holds.
	//
	// `user` is present for an OAuth token and ABSENT for an API key, which
	// has an organization but no person behind it. `credential.kind` says
	// which you are holding, so a client can branch without guessing from a
	// missing field.
	//
	// Narrower than what the console shows its own user on purpose: an
	// integration needs a name to display and an organization to address, not
	// a profile. The `scopes` array is what the credential may do RIGHT NOW,
	// so a client can render its own capabilities rather than discovering
	// them from a 403.
	//
	// Returns a wrapper object for the known response body format(s).
	//
	// Corresponds with GET /api/v1/iam/identity (the `AccountIdentity` operationId).
	AccountIdentityWithResponse(ctx context.Context, reqEditors ...RequestEditorFn) (*AccountIdentityResponse, error)

	// AccountOrgWithResponse Organization
	//
	// The organization this credential is scoped to.
	//
	// There is no way to name a different one. A credential describes exactly
	// one organization, so an identifier in the path could only ever be your
	// own or a refusal.
	//
	// Returns a wrapper object for the known response body format(s).
	//
	// Corresponds with GET /api/v1/iam/org (the `AccountOrg` operationId).
	AccountOrgWithResponse(ctx context.Context, reqEditors ...RequestEditorFn) (*AccountOrgResponse, error)

	// AccountOrgMembersWithResponse Members
	//
	// Read-only. Adding or removing a member is an invitation flow with email
	// in the middle rather than a POST, and modelling it as one here would
	// promise something this API does not do.
	//
	// Returns a wrapper object for the known response body format(s).
	//
	// Corresponds with GET /api/v1/iam/org/members (the `AccountOrgMembers` operationId).
	AccountOrgMembersWithResponse(ctx context.Context, reqEditors ...RequestEditorFn) (*AccountOrgMembersResponse, error)

	// DatabaseChecksumV2WithResponse Checksums
	//
	// Checksums for one published file, so a download can be verified after it lands.
	//
	// Returns a wrapper object for the known response body format(s).
	//
	// Corresponds with GET /api/v2/database/checksum (the `DatabaseChecksumV2` operationId).
	DatabaseChecksumV2WithResponse(ctx context.Context, params *DatabaseChecksumV2Params, reqEditors ...RequestEditorFn) (*DatabaseChecksumV2Response, error)

	// DownloadDatabaseV2WithResponse Download
	//
	// Answers `302`; the bytes come straight from object storage rather than
	// through this API. Follow the redirect.
	//
	// Returns a wrapper object for the known response body format(s).
	//
	// Corresponds with GET /api/v2/database/download (the `DownloadDatabaseV2` operationId).
	DownloadDatabaseV2WithResponse(ctx context.Context, params *DownloadDatabaseV2Params, reqEditors ...RequestEditorFn) (*DownloadDatabaseV2Response, error)

	// ListDownloadsWithResponse History
	//
	// Refusals are listed too: a denial is what answers "it stopped working",
	// and its absence answers nothing.
	//
	// Returns a wrapper object for the known response body format(s).
	//
	// Corresponds with GET /api/v2/database/downloads (the `ListDownloads` operationId).
	ListDownloadsWithResponse(ctx context.Context, params *ListDownloadsParams, reqEditors ...RequestEditorFn) (*ListDownloadsResponse, error)

	// ListDatabasesWithResponse List
	//
	// The whole published catalog, with your organization's license beside
	// each entry, so `standing` says whether a database is yours today
	// (`licensed`), was (`expired`), or has never been bought (`unlicensed`).
	// An `open` database downloads whatever its `standing`.
	//
	// Returns a wrapper object for the known response body format(s).
	//
	// Corresponds with GET /api/v2/database/list (the `ListDatabases` operationId).
	ListDatabasesWithResponse(ctx context.Context, reqEditors ...RequestEditorFn) (*ListDatabasesResponse, error)

	// DatabaseMetadataV2WithResponse Metadata
	//
	// Poll this to decide whether today's build is worth fetching: it carries
	// `updated` and `entries` without downloading anything.
	//
	// No `format` parameter - one document describes every format the database
	// is built in. Needs no license: it answers for every database `list`
	// returns, whatever its `standing`.
	//
	// Returns a wrapper object for the known response body format(s).
	//
	// Corresponds with GET /api/v2/database/metadata (the `DatabaseMetadataV2` operationId).
	DatabaseMetadataV2WithResponse(ctx context.Context, params *DatabaseMetadataV2Params, reqEditors ...RequestEditorFn) (*DatabaseMetadataV2Response, error)

	// OauthAuthorizeWithResponse Authorize
	//
	// The browser entry point for the authorization-code flow. This is a
	// redirect target, not something to call from code.
	//
	// Any client may sign in without registering first by using a Client ID
	// Metadata Document: make `client_id` an https URL that serves your
	// client's metadata as JSON, naming that same URL as its `client_id`,
	// with `token_endpoint_auth_method` `none` and your `redirect_uris`. An
	// https redirect URI must be on the same origin as the `client_id`; a
	// loopback one (`http://127.0.0.1`, `http://[::1]`, `http://localhost`)
	// matches on any port. Such a client is granted `apikeys.use` at most.
	//
	// An unknown `client_id` or an unregistered `redirect_uri` is shown to the
	// USER and never redirected, because sending an error to an address we
	// have not verified belongs to you is how an open redirector works.
	// Everything else comes back to your `redirect_uri` with `error`, your
	// `state`, and `iss`.
	//
	// Returns a wrapper object for the known response body format(s).
	//
	// Corresponds with GET /oauth/authorize (the `OauthAuthorize` operationId).
	OauthAuthorizeWithResponse(ctx context.Context, params *OauthAuthorizeParams, reqEditors ...RequestEditorFn) (*OauthAuthorizeResponse, error)

	// OauthDeviceAuthorizationWithBodyWithResponse Device authorization
	//
	// Starts the device flow. Show the `user_code` to the person and send them
	// to `verification_uri`; `verification_uri_complete` has the code already
	// embedded, which is what to open if you can open a browser at all.
	//
	// Then poll `/oauth/token`, no faster than `interval` seconds.
	//
	// Takes any type of body and a specified content type, and returns a wrapper object for the known response body format(s).
	//
	// Corresponds with POST /oauth/device_authorization (the `OauthDeviceAuthorization` operationId).
	OauthDeviceAuthorizationWithBodyWithResponse(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*OauthDeviceAuthorizationResponse, error)

	// OauthDeviceAuthorizationWithFormdataBodyWithResponse Device authorization
	//
	// Starts the device flow. Show the `user_code` to the person and send them
	// to `verification_uri`; `verification_uri_complete` has the code already
	// embedded, which is what to open if you can open a browser at all.
	//
	// Then poll `/oauth/token`, no faster than `interval` seconds.
	//
	// Takes a body of the `application/x-www-form-urlencoded` content type, and returns a wrapper object for the known response body format(s).
	//
	// Corresponds with POST /oauth/device_authorization (the `OauthDeviceAuthorization` operationId).
	OauthDeviceAuthorizationWithFormdataBodyWithResponse(ctx context.Context, body OauthDeviceAuthorizationFormdataRequestBody, reqEditors ...RequestEditorFn) (*OauthDeviceAuthorizationResponse, error)

	// OauthRevokeWithBodyWithResponse Revoke
	//
	// RFC 7009. Always answers 200, including for a token that was never
	// valid - an endpoint that distinguished the two would be a way to test
	// whether a stolen string is a live credential.
	//
	// Revoking a REFRESH token ends the whole authorization and takes its
	// access tokens with it. Revoking an access token affects only that token.
	//
	// Takes any type of body and a specified content type, and returns a wrapper object for the known response body format(s).
	//
	// Corresponds with POST /oauth/revoke (the `OauthRevoke` operationId).
	OauthRevokeWithBodyWithResponse(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*OauthRevokeResponse, error)

	// OauthRevokeWithFormdataBodyWithResponse Revoke
	//
	// RFC 7009. Always answers 200, including for a token that was never
	// valid - an endpoint that distinguished the two would be a way to test
	// whether a stolen string is a live credential.
	//
	// Revoking a REFRESH token ends the whole authorization and takes its
	// access tokens with it. Revoking an access token affects only that token.
	//
	// Takes a body of the `application/x-www-form-urlencoded` content type, and returns a wrapper object for the known response body format(s).
	//
	// Corresponds with POST /oauth/revoke (the `OauthRevoke` operationId).
	OauthRevokeWithFormdataBodyWithResponse(ctx context.Context, body OauthRevokeFormdataRequestBody, reqEditors ...RequestEditorFn) (*OauthRevokeResponse, error)

	// OauthTokenWithBodyWithResponse Token
	//
	// Three grant types.
	//
	// `urn:ietf:params:oauth:grant-type:device_code` polls a device
	// authorization. Until the person approves it answers
	// `authorization_pending`; poll faster than `interval` and it answers
	// `slow_down`, which means widen your interval and keep it widened.
	//
	// `authorization_code` exchanges a code from `/oauth/authorize`, with the
	// `code_verifier` matching the challenge you sent and the same
	// `redirect_uri`. A code works once: presenting it again also revokes
	// what the first exchange issued.
	//
	// `refresh_token` exchanges a refresh token. The presented token is
	// consumed whatever happens next, so store the new one before using it.
	// Presenting a consumed refresh token again ends the whole authorization,
	// since it means the token was copied.
	//
	// Takes any type of body and a specified content type, and returns a wrapper object for the known response body format(s).
	//
	// Corresponds with POST /oauth/token (the `OauthToken` operationId).
	OauthTokenWithBodyWithResponse(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*OauthTokenResponse, error)

	// OauthTokenWithFormdataBodyWithResponse Token
	//
	// Three grant types.
	//
	// `urn:ietf:params:oauth:grant-type:device_code` polls a device
	// authorization. Until the person approves it answers
	// `authorization_pending`; poll faster than `interval` and it answers
	// `slow_down`, which means widen your interval and keep it widened.
	//
	// `authorization_code` exchanges a code from `/oauth/authorize`, with the
	// `code_verifier` matching the challenge you sent and the same
	// `redirect_uri`. A code works once: presenting it again also revokes
	// what the first exchange issued.
	//
	// `refresh_token` exchanges a refresh token. The presented token is
	// consumed whatever happens next, so store the new one before using it.
	// Presenting a consumed refresh token again ends the whole authorization,
	// since it means the token was copied.
	//
	// Takes a body of the `application/x-www-form-urlencoded` content type, and returns a wrapper object for the known response body format(s).
	//
	// Corresponds with POST /oauth/token (the `OauthToken` operationId).
	OauthTokenWithFormdataBodyWithResponse(ctx context.Context, body OauthTokenFormdataRequestBody, reqEditors ...RequestEditorFn) (*OauthTokenResponse, error)
}

type DBChecksums struct {
	// Md5 Hex-encoded MD5 digest.
	Md5 string `json:"md5"`

	// Sha1 Hex-encoded SHA-1 digest.
	Sha1 string `json:"sha1"`

	// Sha256 Hex-encoded SHA-256 digest.
	Sha256 string `json:"sha256"`

	// Sha512 Hex-encoded SHA-512 digest.
	Sha512 string `json:"sha512"`
}

type DBFormat = DatabaseFormat

type DBID = string

type Database struct {
	// Base The family, e.g. `vpn_ip`. What a license is held against.
	//
	// Example: vpn_ip
	Base string `json:"base"`

	// Expires A hard stop. Null when the license has no end date, which is the normal case for a rolling agreement, and when there is no license. A rolling license reports its turnover date in renews_at instead.
	Expires *time.Time `json:"expires"`

	// LicenseType What your license permits you to do with the data. Null when there
	// is no license, which is every family with standing `unlicensed`.
	LicenseType *DatabaseLicenseType `json:"license_type"`

	// Name Example: VPN IP
	Name string `json:"name"`

	// NoticeDueAt The last day notice of non-renewal can be given for the term ending at renews_at. Null whenever renews_at is, and when the agreement records no notice period.
	NoticeDueAt *time.Time `json:"notice_due_at"`

	// Open An Open database: any organization downloads it, and fetches its
	// checksums, with no license, under CC BY-SA 4.0 (credit
	// InternetData, https://internetdata.io, and share what you build
	// from it under the same license). `standing` still reports your
	// own license, which grants more where you hold one.
	Open bool `json:"open"`

	// RenewsAt When a rolling license next renews. Null when the license has no defined term, when expires sets a hard stop instead, and when there is no license.
	RenewsAt *time.Time `json:"renews_at"`

	// Standing Where your license for a database family stands today. `licensed` is a
	// live grant, `expired` one whose term has ended, and `unlicensed` a
	// database published but never bought. An Open database (`open`)
	// downloads whatever this says.
	Standing Standing   `json:"standing"`
	Starts   *time.Time `json:"starts"`

	// Summary One line on what the newest version contains.
	Summary string `json:"summary"`

	// Versions Every published version of this family, oldest first. Old versions
	// are frozen rather than migrated, so both stay downloadable.
	Versions []DatabaseVersion `json:"versions"`
}

type DatabaseChecksumV2Params struct {
	// ID Database identifier (e.g. `vpn_ip_v1`, `resproxy_provider_v1`).
	ID DBID `form:"id" json:"id"`

	// Format Database file format.
	Format DBFormat `form:"format" json:"format"`
}

type DatabaseChecksumV2Response struct {
	Body         []byte
	HTTPResponse *http.Response
	// JSON200 the response for an HTTP 200 `application/json` response
	JSON200 *struct {
		Checksums DBChecksums `json:"checksums"`

		// Format A file format a database version is published in.
		//
		// Example: mmdb
		Format DatabaseFormat `json:"format"`
		ID     string         `json:"id"`
	}
	// JSON400 the response for an HTTP 400 `application/json` response
	JSON400 *Error
	// JSON401 the response for an HTTP 401 `application/json` response
	JSON401 *V2Unauthorized
	// JSON403 the response for an HTTP 403 `application/json` response
	JSON403 *V2NotLicensed
	// JSON404 the response for an HTTP 404 `application/json` response
	JSON404 *V2UnknownDatabase
	// JSON503 the response for an HTTP 503 `application/json` response
	JSON503 *V2NotAvailable
}

type DatabaseFormat string

type DatabaseLicenseType string

type DatabaseMetadata struct {
	// Entries Row count in the current build.
	Entries int64  `json:"entries"`
	ID      string `json:"id"`

	// Sample A few real rows, keyed by format.
	Sample *map[string][]map[string]interface{} `json:"sample,omitempty"`

	// SampleEntries Row count in the evaluation sample.
	SampleEntries *int `json:"sample_entries,omitempty"`

	// SampleSize Bytes per format of the evaluation sample, where one is published.
	SampleSize *map[string]int64 `json:"sample_size,omitempty"`

	// Schema Columns, keyed by format.
	Schema map[string][]DatabaseMetadataColumn `json:"schema"`

	// Size Bytes per format.
	Size map[string]int64 `json:"size"`

	// UpdateFreq How often a new build is published.
	UpdateFreq *string `json:"update_freq,omitempty"`

	// Updated ISO-8601 date (YYYY-MM-DD) the published build was generated on.
	//
	// Example: 2026-09-04
	Updated openapi_types.Date `json:"updated"`
}

type DatabaseMetadataColumn struct {
	Description *string `json:"description,omitempty"`
	Name        string  `json:"name"`
	Type        string  `json:"type"`
}

type DatabaseMetadataV2Params struct {
	// ID Database identifier (e.g. `vpn_ip_v1`, `resproxy_provider_v1`).
	ID DBID `form:"id" json:"id"`
}

type DatabaseMetadataV2Response struct {
	Body         []byte
	HTTPResponse *http.Response
	// JSON200 the response for an HTTP 200 `application/json` response
	JSON200 *DatabaseMetadata
	// JSON401 the response for an HTTP 401 `application/json` response
	JSON401 *V2Unauthorized
	// JSON404 the response for an HTTP 404 `application/json` response
	JSON404 *V2UnknownDatabase
	// JSON503 the response for an HTTP 503 `application/json` response
	JSON503 *V2NotAvailable
}

type DatabaseVersion struct {
	// Formats The formats this version is BUILT in. Asking for another is a 400,
	// not a gap - the `_provider` catalogs are keyed by provider id, so no
	// MMDB exists for them.
	Formats []DatabaseFormat `json:"formats"`

	// ID The versioned id. Pass this to `download`, `checksum` and `metadata`.
	//
	// Example: vpn_ip_v1
	ID string `json:"id"`

	// SampleFormats The formats an evaluation sample is published in, if any.
	SampleFormats *[]DatabaseFormat `json:"sample_formats,omitempty"`
	Summary       string            `json:"summary"`

	// Version Example: 1
	Version int `json:"version"`
}

type DeviceAuthorization struct {
	// DeviceCode Yours. Poll with it; never show it to anyone.
	DeviceCode string `json:"device_code"`

	// ExpiresIn Seconds until both codes expire.
	ExpiresIn int `json:"expires_in"`

	// Interval Seconds between polls.
	Interval int `json:"interval"`

	// UserCode Short and typable. This is what the person confirms.
	UserCode        string `json:"user_code"`
	VerificationURI string `json:"verification_uri"`

	// VerificationURIComplete The same page with the code already filled in.
	VerificationURIComplete *string `json:"verification_uri_complete,omitempty"`
}

type DeviceAuthorizationRequest struct {
	ClientID string `json:"client_id"`

	// Resource RFC 8707: what the token is for.
	Resource *string `json:"resource,omitempty"`

	// Scope Space-delimited. Anything your client is not registered for is dropped rather than refused.
	Scope *string `json:"scope,omitempty"`
}

type Download struct {
	// ApikeyID The key that made the request. Null when it could not be resolved.
	ApikeyID *string `json:"apikey_id"`

	// Bytes Object size at redirect time, NOT bytes delivered: the transfer is a
	// presigned redirect straight to object storage, so we never observe
	// how much of it was taken.
	Bytes      *int64    `json:"bytes"`
	ClientIP   *string   `json:"client_ip"`
	Created    time.Time `json:"created"`
	DatasetID  string    `json:"dataset_id"`
	Format     string    `json:"format"`
	HTTPStatus *int      `json:"http_status"`

	// Open Taken under the Open license rather than one of your licenses: an
	// Open database downloaded while your organization held no license
	// in term for it.
	Open    bool            `json:"open"`
	Outcome DownloadOutcome `json:"outcome"`

	// Sample The evaluation sample rather than the database itself.
	Sample    bool    `json:"sample"`
	UserAgent *string `json:"user_agent"`
}

type DownloadDatabaseV2Params struct {
	// ID Database identifier (e.g. `vpn_ip_v1`, `resproxy_provider_v1`).
	ID DBID `form:"id" json:"id"`

	// Format Database file format.
	Format DBFormat `form:"format" json:"format"`
}

type DownloadDatabaseV2Response struct {
	Body         []byte
	HTTPResponse *http.Response
	// JSON400 the response for an HTTP 400 `application/json` response
	JSON400 *Error
	// JSON401 the response for an HTTP 401 `application/json` response
	JSON401 *V2Unauthorized
	// JSON403 the response for an HTTP 403 `application/json` response
	JSON403 *V2NotLicensed
	// JSON404 the response for an HTTP 404 `application/json` response
	JSON404 *V2UnknownDatabase
	// JSON503 the response for an HTTP 503 `application/json` response
	JSON503 *V2NotAvailable
	// Headers302 the parsed response headers for an HTTP 302 response
	Headers302 *DownloadDatabaseV2Response302Headers
}

type DownloadDatabaseV2Response302Headers struct {
	Location *string
}

type DownloadOutcome string

type Error struct {
	// Rc A machine-readable result code. Deliberately not an enum: a code
	// added later must stay parseable by a client generated today.
	Rc string `json:"rc"`
}

type HttpRequestDoer interface {
	Do(req *http.Request) (*http.Response, error)
}

type Identity struct {
	Org AccountOrgRef `json:"org"`
	Rc  string        `json:"rc"`

	// Scopes What this credential may do right now.
	Scopes []string    `json:"scopes"`
	User   AccountUser `json:"user"`
}

type ListDatabasesResponse struct {
	Body         []byte
	HTTPResponse *http.Response
	// JSON200 the response for an HTTP 200 `application/json` response
	JSON200 *struct {
		Databases []Database `json:"databases"`
	}
	// JSON401 the response for an HTTP 401 `application/json` response
	JSON401 *V2Unauthorized
}

type ListDownloadsParams struct {
	// Limit How many attempts to return. Clamped to 200.
	Limit *int `form:"limit,omitempty" json:"limit,omitempty"`
}

type ListDownloadsResponse struct {
	Body         []byte
	HTTPResponse *http.Response
	// JSON200 the response for an HTTP 200 `application/json` response
	JSON200 *struct {
		Downloads []Download `json:"downloads"`
	}
	// JSON401 the response for an HTTP 401 `application/json` response
	JSON401 *V2Unauthorized
}

type OauthAuthorizeParams struct {
	ClientID      string                           `form:"client_id" json:"client_id"`
	RedirectURI   string                           `form:"redirect_uri" json:"redirect_uri"`
	ResponseType  OauthAuthorizeParamsResponseType `form:"response_type" json:"response_type"`
	CodeChallenge string                           `form:"code_challenge" json:"code_challenge"`

	// CodeChallengeMethod S256, named explicitly. `plain`, or no method at all, is refused rather than downgraded.
	CodeChallengeMethod OauthAuthorizeParamsCodeChallengeMethod `form:"code_challenge_method" json:"code_challenge_method"`
	Scope               *string                                 `form:"scope,omitempty" json:"scope,omitempty"`

	// State Returned unchanged. Use it to bind the response to your request.
	State *string `form:"state,omitempty" json:"state,omitempty"`

	// Resource RFC 8707. What the token is FOR, so it cannot be replayed elsewhere:
	// this brand's MCP server, the only resource it issues tokens for.
	// Anything else answers `invalid_target`. A client that names none is
	// given that server.
	Resource *string `form:"resource,omitempty" json:"resource,omitempty"`
}

type OauthAuthorizeParamsCodeChallengeMethod string

type OauthAuthorizeParamsResponseType string

type OauthAuthorizeResponse struct {
	Body         []byte
	HTTPResponse *http.Response
}

type OauthDeviceAuthorizationFormdataRequestBody = DeviceAuthorizationRequest

type OauthDeviceAuthorizationResponse struct {
	Body         []byte
	HTTPResponse *http.Response
	// JSON200 the response for an HTTP 200 `application/json` response
	JSON200 *DeviceAuthorization
	// JSON400 the response for an HTTP 400 `application/json` response
	JSON400 *OauthError
	// JSON401 the response for an HTTP 401 `application/json` response
	JSON401 *OauthError
}

type OauthError struct {
	Error            string  `json:"error"`
	ErrorDescription *string `json:"error_description,omitempty"`
}

type OauthMetadata struct {
	AuthorizationEndpoint string `json:"authorization_endpoint"`

	// AuthorizationResponseIssParameterSupported RFC 9207. A redirect back from the authorization endpoint carries `iss`.
	AuthorizationResponseIssParameterSupported *bool `json:"authorization_response_iss_parameter_supported,omitempty"`

	// ClientIDMetadataDocumentSupported Any client may sign in with an https `client_id` serving its own metadata.
	ClientIDMetadataDocumentSupported *bool     `json:"client_id_metadata_document_supported,omitempty"`
	CodeChallengeMethodsSupported     *[]string `json:"code_challenge_methods_supported,omitempty"`
	DeviceAuthorizationEndpoint       *string   `json:"device_authorization_endpoint,omitempty"`
	GrantTypesSupported               *[]string `json:"grant_types_supported,omitempty"`
	Issuer                            string    `json:"issuer"`
	ResponseTypesSupported            *[]string `json:"response_types_supported,omitempty"`
	RevocationEndpoint                *string   `json:"revocation_endpoint,omitempty"`
	ScopesSupported                   *[]string `json:"scopes_supported,omitempty"`
	ServiceDocumentation              *string   `json:"service_documentation,omitempty"`
	TokenEndpoint                     string    `json:"token_endpoint"`

	// TokenEndpointAuthMethodsSupported Always `none`. Every client is public and has no secret.
	TokenEndpointAuthMethodsSupported *[]string `json:"token_endpoint_auth_methods_supported,omitempty"`
}

type OauthMetadataResponse struct {
	Body         []byte
	HTTPResponse *http.Response
	// JSON200 the response for an HTTP 200 `application/json` response
	JSON200 *OauthMetadata
}

type OauthRevokeFormdataRequestBody = RevokeRequest

type OauthRevokeResponse struct {
	Body         []byte
	HTTPResponse *http.Response
	// JSON200 the response for an HTTP 200 `application/json` response
	JSON200 *map[string]interface{}
}

type OauthTokenFormdataRequestBody = TokenRequest

type OauthTokenResponse struct {
	Body         []byte
	HTTPResponse *http.Response
	// JSON200 the response for an HTTP 200 `application/json` response
	JSON200 *TokenResponse
	// JSON400 the response for an HTTP 400 `application/json` response
	JSON400 *OauthError
	// JSON401 the response for an HTTP 401 `application/json` response
	JSON401 *OauthError
}

type RequestEditorFn func(ctx context.Context, req *http.Request) error

type RevokeRequest struct {
	// ClientID Accepted and not checked.
	ClientID *string `json:"client_id,omitempty"`

	// Token An access token or a refresh token.
	Token string `json:"token"`
}

type Standing string

type TokenRequest struct {
	ClientID string `json:"client_id"`

	// Code Required by the authorization code grant.
	Code *string `json:"code,omitempty"`

	// CodeVerifier Required by the authorization code grant.
	CodeVerifier *string `json:"code_verifier,omitempty"`

	// DeviceCode Required by the device code grant.
	DeviceCode *string `json:"device_code,omitempty"`

	// GrantType `urn:ietf:params:oauth:grant-type:device_code`, `authorization_code` or `refresh_token`.
	GrantType string `json:"grant_type"`

	// RedirectURI Required by the authorization code grant: the `redirect_uri` the code was issued against, exactly.
	RedirectURI *string `json:"redirect_uri,omitempty"`

	// RefreshToken Required by the refresh token grant.
	RefreshToken *string `json:"refresh_token,omitempty"`

	// Resource Authorization code grant, optional: RFC 8707, and it must name what was authorized.
	Resource *string `json:"resource,omitempty"`
}

type TokenResponse struct {
	AccessToken string `json:"access_token"`

	// ExpiresIn Seconds until the access token expires.
	ExpiresIn int `json:"expires_in"`

	// MslmApikey Not part of OAuth, and only for our own clients: a client that signed
	// in with a Client ID Metadata Document never receives a key. The API
	// key itself, so a device ends up holding an ordinary key. Returned by
	// the device code and authorization code grants only, never by a
	// refresh, and only alongside
	// `mslm:apikey_id`. Absent when that key's secret cannot be read back,
	// which is the case for a key created before keys could be shown again
	// in the console; a rotated key can be.
	MslmApikey *string `json:"mslm:apikey,omitempty"`

	// MslmApikeyID Not part of OAuth, and only for our own clients. The ID of the API
	// key the person picked when they approved, returned by every grant
	// while this authorization may still read that key back. Absent when
	// no key was picked, or when the person's role no longer allows
	// reading keys back.
	MslmApikeyID *string `json:"mslm:apikey_id,omitempty"`

	// RefreshToken Always returned. A refresh consumes the token it presents, so keep this one.
	RefreshToken *string `json:"refresh_token,omitempty"`

	// Scope What was actually granted, which may be narrower than what was asked for.
	Scope *string `json:"scope,omitempty"`

	// TokenType Always `Bearer`.
	TokenType string `json:"token_type"`
}

type V2NotAvailable = Error

type V2NotLicensed = Error

type V2Unauthorized = Error

type V2UnknownDatabase = Error