api

type API struct {
	// contains filtered or unexported fields
}

type AddPermissionRequest struct {
	RoleID   string `path:"roleId" description:"Role identifier"`
	Action   string `json:"action" description:"Permission action (e.g. read, write, delete, admin)"`
	Resource string `json:"resource" description:"Permission resource (e.g. user, org, document)"`
}

type AdminAppResponse struct {
	ID             string `json:"id"`
	Name           string `json:"name"`
	Slug           string `json:"slug"`
	Logo           string `json:"logo,omitempty"`
	PublishableKey string `json:"publishable_key,omitempty"`
	IsPlatform     bool   `json:"is_platform"`
}

type AdminBanUserRequest struct {
	UserID    string  `path:"userId" description:"User identifier"`
	Reason    string  `json:"reason,omitempty" description:"Ban reason"`
	ExpiresAt *string `json:"expires_at,omitempty" description:"Ban expiration (RFC3339, omit for permanent)"`
}

type AdminCopyUserRequest struct {
	SourceUserID string `json:"source_user_id" description:"User to duplicate"`
	TargetAppID  string `json:"target_app_id" description:"Authsome App that will hold the duplicate"`
	EnvID        string `json:"env_id,omitempty" description:"Optional target environment; falls back to the App's default environment"`
}

type AdminCreateAppRequest struct {
	Name string `json:"name" description:"Human-readable app name"`
	Slug string `json:"slug" description:"URL-safe app slug (globally unique)"`
	Logo string `json:"logo,omitempty" description:"App logo URL"`
}

type AdminCreateServiceAccountAPIKeyRequest struct {
	ServiceAccountID string   `path:"serviceAccountId" description:"Service account ID"`
	Name             string   `json:"name" description:"API key name"`
	Scopes           []string `json:"scopes,omitempty" description:"Scopes for this key"`
	ExpiresAt        *string  `json:"expires_at,omitempty" description:"Optional expiration time (RFC 3339)"`
}

type AdminCreateServiceAccountRequest struct {
	AppID       string   `json:"app_id,omitempty" description:"Application ID (optional, uses default)"`
	Name        string   `json:"name" description:"Service account name (unique per app)"`
	Description string   `json:"description,omitempty" description:"Human-readable description"`
	Scopes      []string `json:"scopes,omitempty" description:"Default scopes for API keys minted for this service account"`
}

type AdminCreateUserRequest struct {
	AppID     string `json:"app_id,omitempty" description:"Application ID (optional, uses default)"`
	Email     string `json:"email" description:"User email address"`
	Password  string `json:"password" description:"User password"`
	FirstName string `json:"first_name,omitempty" description:"First/given name"`
	LastName  string `json:"last_name,omitempty" description:"Last/family name"`
	Username  string `json:"username,omitempty" description:"Unique username"`
}

type AdminDeleteAppRequest struct {
	AppID string `path:"appId" description:"Application identifier to delete"`
}

type AdminDeleteServiceAccountRequest struct {
	ServiceAccountID string `path:"serviceAccountId" description:"Service account ID"`
}

type AdminDeleteUserRequest struct {
	UserID string `path:"userId" description:"User identifier"`
}

type AdminGetServiceAccountRequest struct {
	ServiceAccountID string `path:"serviceAccountId" description:"Service account ID"`
}

type AdminGetUserRequest struct {
	UserID string `path:"userId" description:"User identifier"`
}

type AdminGrantPlatformOwnerRequest struct {
	UserID string `json:"user_id,omitempty" description:"User identifier (mutually exclusive with email)"`
	Email  string `json:"email,omitempty" description:"User email address (mutually exclusive with user_id)"`
}

type AdminImpersonateRequest struct {
	UserID string `path:"userId" description:"User identifier to impersonate"`
}

type AdminListServiceAccountsRequest struct {
	AppID  string `query:"app_id" description:"Application ID"`
	Limit  int    `query:"limit,omitempty" description:"Maximum number of results (default 20, max 100)"`
	Cursor string `query:"cursor,omitempty" description:"Pagination cursor"`
}

type AdminListUsersRequest struct {
	AppID  string `query:"app_id" description:"Application ID"`
	Email  string `query:"email" description:"Filter by email (partial match)" optional:"true"`
	Cursor string `query:"cursor" description:"Pagination cursor" optional:"true"`
	Limit  int    `query:"limit" description:"Maximum number of results (default 20, max 100)" default:"20" optional:"true"`
}

type AdminPlatformOwnerResponse struct {
	UserID string `json:"user_id"`
	RoleID string `json:"role_id"`
	Status string `json:"status"`
}

type AdminRevokePlatformOwnerRequest struct {
	UserID string `path:"userID" description:"User identifier to revoke platform-owner role from"`
}

type AdminServiceAccountAPIKeyResponse struct {
	ID              string     `json:"id"`
	Key             string     `json:"key"`
	KeyPrefix       string     `json:"key_prefix"`
	PublicKey       string     `json:"public_key,omitempty"`
	PublicKeyPrefix string     `json:"public_key_prefix,omitempty"`
	Name            string     `json:"name"`
	Scopes          []string   `json:"scopes,omitempty"`
	ExpiresAt       *time.Time `json:"expires_at,omitempty"`
	CreatedAt       time.Time  `json:"created_at"`
}

type AdminServiceAccountListResponse struct {
	ServiceAccounts []*AdminServiceAccountResponse `json:"service_accounts"`
	Total           int                            `json:"total"`
	NextCursor      string                         `json:"next_cursor,omitempty"`
}

type AdminServiceAccountResponse struct {
	ID          string    `json:"id"`
	AppID       string    `json:"app_id"`
	Name        string    `json:"name"`
	Description string    `json:"description,omitempty"`
	Scopes      []string  `json:"scopes,omitempty"`
	Active      bool      `json:"active"`
	CreatedAt   time.Time `json:"created_at"`
	UpdatedAt   time.Time `json:"updated_at"`
}

type AdminStatsRequest struct {
	AppID string `query:"app_id" description:"Application ID"`
}

type AdminStatsResponse struct {
	TotalUsers int `json:"total_users" description:"Total number of users"`
}

type AdminStopImpersonationRequest struct{}

type AdminUnbanUserRequest struct {
	UserID string `path:"userId" description:"User identifier"`
}

type AdminUnlockUserRequest struct {
	UserID string `path:"userId" description:"User identifier"`
}

type AdminUpdateUserRequest struct {
	UserID        string  `path:"userId" description:"User identifier"`
	FirstName     *string `json:"first_name,omitempty" description:"First/given name"`
	LastName      *string `json:"last_name,omitempty" description:"Last/family name"`
	Username      *string `json:"username,omitempty" description:"Unique username"`
	EmailVerified *bool   `json:"email_verified,omitempty" description:"Email verification status"`
}

type AdminUserListResponse struct {
	Users      any    `json:"users" description:"List of users"`
	NextCursor string `json:"next_cursor,omitempty" description:"Pagination cursor for next page"`
	Total      int    `json:"total" description:"Total number of matching users"`
}

type AssignRoleRequest struct {
	RoleID string `path:"roleId" description:"Role identifier"`
	UserID string `json:"user_id" description:"User identifier"`
	OrgID  string `json:"org_id,omitempty" description:"Optional organization scope"`
}

type AuthResponse struct {
	User         any    `json:"user" description:"User object"`
	SessionToken string `json:"session_token" description:"JWT session token"`
	RefreshToken string `json:"refresh_token" description:"Refresh token"`
	ExpiresAt    string `json:"expires_at" description:"Token expiration time"`
}

type BulkImportUser struct {
	Email        string        `json:"email" description:"User email address"`
	FirstName    string        `json:"first_name,omitempty" description:"First/given name"`
	LastName     string        `json:"last_name,omitempty" description:"Last/family name"`
	Username     string        `json:"username,omitempty" description:"Unique username"`
	PasswordHash string        `json:"password_hash" description:"Pre-hashed password (bcrypt or argon2id)"`
	Metadata     user.Metadata `json:"metadata,omitempty" description:"Arbitrary user metadata"`
}

type BulkImportUsersRequest struct {
	AppID string           `json:"app_id,omitempty" description:"Application ID (optional, uses default)"`
	Users []BulkImportUser `json:"users" description:"Array of users to import (max 1000)"`
}

type BulkRevokeSessionsRequest struct {
	UserID string `query:"user_id" description:"User ID whose sessions to revoke"`
}

type BulkRevokeSessionsResponse struct {
	Revoked int    `json:"revoked" description:"Number of sessions revoked"`
	UserID  string `json:"user_id" description:"User whose sessions were revoked"`
}

type ChangePasswordRequest struct {
	CurrentPassword string `json:"current_password" description:"Current password"`
	NewPassword     string `json:"new_password" description:"New password"`
}

type CloneEnvironmentRequest struct {
	EnvID              string                `path:"envId" description:"Source environment identifier"`
	Name               string                `json:"name" description:"Name for the cloned environment"`
	Slug               string                `json:"slug" description:"URL-safe slug for the cloned environment"`
	Type               string                `json:"type" description:"Environment type (development, staging, production)"`
	Description        string                `json:"description,omitempty" description:"Description for the cloned environment"`
	Settings           *environment.Settings `json:"settings,omitempty" description:"Settings overrides for the cloned environment"`
	WebhookURLOverride string                `json:"webhook_url_override,omitempty" description:"Override URL for cloned webhooks"`
}

type CloneEnvironmentResponse struct {
	Environment       any               `json:"environment" description:"Newly created environment"`
	RolesCloned       int               `json:"roles_cloned" description:"Number of roles cloned"`
	PermissionsCloned int               `json:"permissions_cloned" description:"Number of permissions cloned"`
	WebhooksCloned    int               `json:"webhooks_cloned" description:"Number of webhooks cloned"`
	RoleIDMap         map[string]string `json:"role_id_map" description:"Mapping of old role IDs to new role IDs"`
}

type CreateEnvironmentRequest struct {
	AppID       string                `json:"app_id,omitempty" description:"Application ID (optional, uses default)"`
	Name        string                `json:"name" description:"Environment name"`
	Slug        string                `json:"slug" description:"URL-safe environment slug"`
	Type        string                `json:"type" description:"Environment type (development, staging, production)"`
	Color       string                `json:"color,omitempty" description:"UI badge color (hex, defaults to type color)"`
	Description string                `json:"description,omitempty" description:"Environment description"`
	Settings    *environment.Settings `json:"settings,omitempty" description:"Per-environment settings overrides"`
}

type CreateRoleRequest struct {
	AppID       string `json:"app_id,omitempty" description:"Application ID (optional, uses default)"`
	Name        string `json:"name" description:"Role name"`
	Slug        string `json:"slug" description:"URL-safe role slug"`
	Description string `json:"description,omitempty" description:"Role description"`
	ParentID    string `json:"parent_id,omitempty" description:"Must be omitted; creating a role with a parent is refused with 400"`
}

type CreateWebhookRequest struct {
	AppID  string   `json:"app_id,omitempty" description:"Application ID (optional, uses default)"`
	URL    string   `json:"url" description:"Webhook endpoint URL"`
	Events []string `json:"events" description:"Event types to subscribe to"`
}

type CreateWebhookResponse struct {
	Webhook any    `json:"webhook" description:"The created webhook"`
	Secret  string `json:"secret" description:"Signing secret, shown only in this response"`
}

type DefinitionGroup struct {
	Namespace   string                 `json:"namespace" description:"Plugin namespace"`
	Category    string                 `json:"category" description:"Settings category"`
	Definitions []*settings.Definition `json:"definitions" description:"Setting definitions in this group"`
}

type DelegationListResponse struct {
	Delegations []DelegationResponse `json:"delegations"`
}

type DelegationResponse struct {
	ID        string   `json:"id"`
	Actor     string   `json:"actor" description:"kind:id of the principal that may act"`
	Subject   string   `json:"subject" description:"kind:id of the principal being acted for"`
	GrantKind string   `json:"grant_kind"`
	Scopes    []string `json:"scopes,omitempty"`
	GrantedBy string   `json:"granted_by" description:"kind:id of who consented to this grant"`
	ExpiresAt string   `json:"expires_at,omitempty" description:"RFC 3339; absent means no expiry"`
	CreatedAt string   `json:"created_at"`
}

type DeleteAccountRequest struct{}

type DeleteAppClientConfigRequest struct {
	AppID string `path:"appId" description:"Application identifier"`
}

type DeleteAppSessionConfigRequest struct {
	AppID string `path:"appId" description:"Application identifier"`
}

type DeleteDeviceRequest struct {
	DeviceID string `path:"deviceId" description:"Device identifier"`
}

type DeleteEnvironmentRequest struct {
	EnvID string `path:"envId" description:"Environment identifier"`
}

type DeleteRoleRequest struct {
	RoleID string `path:"roleId" description:"Role identifier"`
}

type DeleteSettingRequest struct {
	Key     string `path:"key" description:"Setting key"`
	Scope   string `query:"scope" description:"Target scope (global, app, org, user)"`
	ScopeID string `query:"scope_id" description:"Entity ID at the target scope"`
}

type DeleteWebhookRequest struct {
	WebhookID string `path:"webhookId" description:"Webhook identifier"`
}

type DeviceListResponse struct {
	Devices any `json:"devices" description:"List of devices"`
}

type EnforceSettingRequest struct {
	Key     string          `path:"key" description:"Setting key"`
	Value   json.RawMessage `json:"value" description:"Setting value (JSON)"`
	Scope   string          `json:"scope" description:"Target scope (global, app, org, user)"`
	ScopeID string          `json:"scope_id,omitempty" description:"Entity ID at the target scope"`
	AppID   string          `json:"app_id,omitempty" description:"Application ID"`
	OrgID   string          `json:"org_id,omitempty" description:"Organization ID"`
}

type EnvironmentListResponse struct {
	Environments any `json:"environments" description:"List of environments"`
	Total        int `json:"total" description:"Total number of environments"`
}

type EnvironmentSettingsResponse struct {
	Settings     *environment.Settings `json:"settings" description:"Resolved effective settings"`
	TypeDefaults *environment.Settings `json:"type_defaults" description:"Default settings for the environment type"`
	Overrides    *environment.Settings `json:"overrides" description:"Per-environment overrides (nil fields inherit type defaults)"`
}

type ExportDataRequest struct{}

type ForgotPasswordRequest struct {
	AppID string `json:"app_id,omitempty" description:"Application ID (optional, uses default)"`
	Email string `json:"email" description:"Email address of the account"`
}

type ForgotPasswordResponse struct {
	Status string `json:"status" description:"Always 'ok' regardless of email existence"`
}

type GetAppClientConfigRequest struct {
	AppID string `path:"appId" description:"Application identifier"`
}

type GetAppSessionConfigRequest struct {
	AppID string `path:"appId" description:"Application identifier"`
}

type GetClientConfigRequest struct {
	Key string `query:"key" optional:"true" description:"Publishable key to resolve the app"`
}

type GetDeviceRequest struct {
	DeviceID string `path:"deviceId" description:"Device identifier"`
}

type GetEnvironmentRequest struct {
	EnvID string `path:"envId" description:"Environment identifier"`
}

type GetEnvironmentSettingsRequest struct {
	EnvID string `path:"envId" description:"Environment identifier"`
}

type GetMeRequest struct{}

type GetRoleRequest struct {
	RoleID string `path:"roleId" description:"Role identifier"`
}

type GetWebhookRequest struct {
	WebhookID string `path:"webhookId" description:"Webhook identifier"`
}

type HealthResponse struct {
	Status string `json:"status" description:"Service health status"`
	Error  string `json:"error,omitempty" description:"Error details if unhealthy"`
}

type IntrospectConfirmation struct {
	JKT string `json:"jkt" description:"RFC 7638 thumbprint of the confirmation key"`
}

type IntrospectRequest struct {
	Token string `json:"token" description:"Token to introspect (JWT or opaque session token)"`
}

type IntrospectResponse struct {
	Active    bool            `json:"active" description:"Whether the token is valid and active"`
	UserID    string          `json:"user_id,omitempty" description:"Authenticated user ID"`
	AppID     string          `json:"app_id,omitempty" description:"Application ID"`
	OrgID     string          `json:"org_id,omitempty" description:"Organization ID"`
	EnvID     string          `json:"env_id,omitempty" description:"Environment ID"`
	SessionID string          `json:"session_id,omitempty" description:"Session ID"`
	ExpiresAt string          `json:"expires_at,omitempty" description:"Token expiration time (RFC 3339)"`
	Audience  []string        `json:"aud,omitempty" description:"Resource identifiers this token is valid for (RFC 8707)"`
	Scope     string          `json:"scope,omitempty" description:"Space-separated scopes the token was issued with"`
	User      *IntrospectUser `json:"user,omitempty" description:"Resolved user details (callers with manage on app only)"`

	// Confirmation carries the RFC 7800 cnf claim for a DPoP-bound token
	// (RFC 9449 section 7.3). A resource server that validates tokens by
	// introspection has no other way to learn the token is bound, so
	// omitting this leaves it accepting a stolen token as an ordinary
	// bearer token. Absent means unbound.
	Confirmation *IntrospectConfirmation `json:"cnf,omitempty" description:"Proof-of-possession confirmation for a DPoP-bound token"`
}

type IntrospectUser struct {
	ID        string `json:"id" description:"User ID"`
	Email     string `json:"email" description:"User email"`
	FirstName string `json:"first_name,omitempty" description:"First name"`
	LastName  string `json:"last_name,omitempty" description:"Last name"`
	Username  string `json:"username,omitempty" description:"Username"`
}

type JWK struct {
	KTY string `json:"kty"`
	Use string `json:"use"`
	KID string `json:"kid,omitempty"`
	ALG string `json:"alg,omitempty"`
	N   string `json:"n,omitempty"`   // RSA modulus
	E   string `json:"e,omitempty"`   // RSA exponent
	CRV string `json:"crv,omitempty"` // EC curve
	X   string `json:"x,omitempty"`   // EC x coordinate
	Y   string `json:"y,omitempty"`   // EC y coordinate
}

type JWKSResponse struct {
	Keys []JWK `json:"keys"`
}

type ListAuthMethodsRequest struct{}

type ListAuthMethodsResponse struct {
	Methods []*plugin.AuthMethod `json:"methods"`
}

type ListDefinitionsResponse struct {
	Groups []DefinitionGroup `json:"groups" description:"Definitions grouped by namespace and category"`
	Total  int               `json:"total" description:"Total number of definitions"`
}

type ListDevicesRequest struct{}

type ListEnvironmentsRequest struct {
	AppID string `query:"app_id" description:"Application ID"`
}

type ListNamespaceDefinitionsRequest struct {
	Namespace string `path:"namespace" description:"Plugin namespace"`
}

type ListRolePermissionsRequest struct {
	RoleID string `path:"roleId" description:"Role identifier"`
}

type ListRolesRequest struct {
	AppID string `query:"app_id" description:"Application ID"`
}

type ListSessionsRequest struct {
	Limit  int    `query:"limit" description:"Page size (default 50, max 200)" optional:"true"`
	Cursor string `query:"cursor" description:"Cursor from the previous page's next_cursor" optional:"true"`
}

type ListSettingsDefinitionsRequest struct {
	Namespace string `query:"namespace" description:"Filter by plugin namespace"`
	Category  string `query:"category" description:"Filter by category"`
}

type ListUserRolesRequest struct {
	UserID string `path:"userId" description:"User identifier"`
	AppID  string `query:"app_id" description:"Optional app scope; defaults to the platform app" optional:"true"`
}

type ListWebhooksRequest struct {
	AppID string `query:"app_id" description:"Application ID"`
}

type Manifest map[string]any

type MeResponse struct {
	*user.User

	// Roles are the slugs the user holds in the session's app right now.
	// Read live rather than off the session: a role change re-stamps every
	// live session (Engine.restampUserSessions), so the two agree, and the
	// live list is the one a client can rely on straight after a change.
	Roles []string `json:"roles"`
}

type MintChildRequest struct {
	ID         string   `path:"id" description:"The calling parent principal's own ID"`
	Name       string   `json:"name" description:"Name for the ephemeral child"`
	Scopes     []string `json:"scopes,omitempty" description:"Scopes for the child; must be a subset of the parent's own scopes"`
	TTLSeconds int      `json:"ttl_seconds" description:"How long the child may live, in seconds. Capped by the parent's own expiry, if it has one"`
}

type MintChildResponse struct {
	ID        string     `json:"id"`
	ParentID  string     `json:"parent_id"`
	Name      string     `json:"name"`
	Scopes    []string   `json:"scopes,omitempty"`
	ExpiresAt *time.Time `json:"expires_at,omitempty"`
	Key       string     `json:"key" description:"Plaintext API key secret; returned once and never stored"`
	KeyPrefix string     `json:"key_prefix"`
	CreatedAt time.Time  `json:"created_at"`
}

type OpenAPIDocument map[string]any

type PermissionListResponse struct {
	Permissions any `json:"permissions" description:"List of permissions"`
}

type RefreshRequest struct {
	RefreshToken string `` /* 135-byte string literal not displayed */
}

type RemovePermissionRequest struct {
	RoleID       string `path:"roleId" description:"Role identifier"`
	PermissionID string `path:"permissionId" description:"Permission identifier"`
}

type ResendVerificationRequest struct {
	AppID string `json:"app_id,omitempty" description:"Application ID (optional, uses default)"`
	Email string `json:"email" description:"Email address of the account requesting a fresh verification token"`
}

type ResetPasswordRequest struct {
	Token       string `json:"token" description:"Password reset token"`
	NewPassword string `json:"new_password" description:"New password"`
}

type ResolveSettingRequest struct {
	Key    string `path:"key" description:"Setting key (e.g. password.min_length)"`
	AppID  string `query:"app_id" description:"Application ID for scope context"`
	OrgID  string `query:"org_id" description:"Organization ID for scope context"`
	UserID string `query:"user_id" description:"User ID for scope context"`
}

type ResolveSettingsRequest struct {
	Namespace string `query:"namespace" description:"Filter by plugin namespace"`
	AppID     string `query:"app_id" description:"Application ID for scope context"`
	OrgID     string `query:"org_id" description:"Organization ID for scope context"`
	UserID    string `query:"user_id" description:"User ID for scope context"`
}

type ResolvedSettingResponse struct {
	Setting *settings.ResolvedSetting `json:"setting" description:"Resolved setting with scope cascade details"`
}

type ResolvedSettingsResponse struct {
	Settings []*settings.ResolvedSetting `json:"settings" description:"Resolved settings with scope cascade details"`
}

type RevokeOtherSessionsRequest struct{}

type RevokeSessionRequest struct {
	SessionID string `path:"sessionId" description:"Session identifier"`
}

type RoleListResponse struct {
	Roles any `json:"roles" description:"List of roles"`
}

type RotateWebhookSecretRequest struct {
	WebhookID string `path:"webhookId" description:"Webhook identifier"`
}

type RotateWebhookSecretResponse struct {
	Secret string `json:"secret" description:"New signing secret, shown only in this response"`
}

type SessionListResponse struct {
	Sessions any `json:"sessions" description:"List of sessions"`
	// NextCursor is set when more remain; pass it as cursor to continue.
	NextCursor string `json:"next_cursor,omitempty" description:"Cursor for the next page, absent on the last"`
}

type SetAppClientConfigRequest struct {
	AppID                    string   `path:"appId" description:"Application identifier"`
	SignupEnabled            *bool    `json:"signup_enabled,omitempty" description:"Enable new user signup (nil = enabled by default)"`
	PasswordEnabled          *bool    `json:"password_enabled,omitempty" description:"Enable password auth (nil = inherit)"`
	PasskeyEnabled           *bool    `json:"passkey_enabled,omitempty" description:"Enable passkey auth (nil = inherit)"`
	MagicLinkEnabled         *bool    `json:"magic_link_enabled,omitempty" description:"Enable magic link auth (nil = inherit)"`
	MFAEnabled               *bool    `json:"mfa_enabled,omitempty" description:"Enable MFA (nil = inherit)"`
	MFARequired              *bool    `json:"mfa_required,omitempty" description:"Require MFA on every sign-in (nil = false)"`
	SSOEnabled               *bool    `json:"sso_enabled,omitempty" description:"Enable SSO (nil = inherit)"`
	SocialEnabled            *bool    `json:"social_enabled,omitempty" description:"Enable social auth (nil = inherit)"`
	WaitlistEnabled          *bool    `json:"waitlist_enabled,omitempty" description:"Enable waitlist (nil = inherit)"`
	RequireEmailVerification *bool    `json:"require_email_verification,omitempty" description:"Block sign-in until email is verified (nil = inherit)"`
	SocialProviders          []string `json:"social_providers,omitempty" description:"Allowed social providers"`
	MFAMethods               []string `json:"mfa_methods,omitempty" description:"Allowed MFA methods"`
	AppName                  *string  `json:"app_name,omitempty" description:"Branding app name override"`
	LogoURL                  *string  `json:"logo_url,omitempty" description:"Branding logo URL override"`
}

type SetAppSessionConfigRequest struct {
	AppID                   string `path:"appId" description:"Application identifier"`
	TokenTTLSeconds         *int   `json:"token_ttl_seconds,omitempty" description:"Token TTL in seconds (nil = inherit)"`
	RefreshTokenTTLSeconds  *int   `json:"refresh_token_ttl_seconds,omitempty" description:"Refresh token TTL in seconds (nil = inherit)"`
	TokenExchangeTTLSeconds *int   `json:"token_exchange_ttl_seconds,omitempty" description:"RFC 8693 token exchange TTL in seconds (nil = inherit)"`
	MaxActiveSessions       *int   `json:"max_active_sessions,omitempty" description:"Maximum active sessions per user (nil = inherit)"`
	RotateRefreshToken      *bool  `json:"rotate_refresh_token,omitempty" description:"Rotate refresh token on use (nil = inherit)"`
	BindToIP                *bool  `json:"bind_to_ip,omitempty" description:"Bind sessions to IP address (nil = inherit)"`
	BindToDevice            *bool  `json:"bind_to_device,omitempty" description:"Bind sessions to device (nil = inherit)"`
	TokenFormat             string `json:"token_format,omitempty" description:"Token format: opaque or jwt (empty = inherit)"`
}

type SetDefaultEnvironmentRequest struct {
	EnvID string `path:"envId" description:"Environment identifier"`
}

type SetSettingRequest struct {
	Key     string          `path:"key" description:"Setting key"`
	Value   json.RawMessage `json:"value" description:"Setting value (JSON)"`
	Scope   string          `json:"scope" description:"Target scope (global, app, org, user)"`
	ScopeID string          `json:"scope_id,omitempty" description:"Entity ID at the target scope"`
	AppID   string          `json:"app_id,omitempty" description:"Application ID"`
	OrgID   string          `json:"org_id,omitempty" description:"Organization ID"`
}

type SettingValueResponse struct {
	Key     string          `json:"key" description:"Setting key"`
	Value   json.RawMessage `json:"value" description:"Setting value"`
	Scope   string          `json:"scope" description:"Scope where the value was set"`
	ScopeID string          `json:"scope_id,omitempty" description:"Scope entity ID"`
	Status  string          `json:"status" description:"Operation status"`
}

type SignInRequest struct {
	AppID        string `json:"app_id,omitempty" description:"Application ID (optional, uses default)"`
	Email        string `json:"email,omitempty" description:"User email address"`
	Username     string `json:"username,omitempty" description:"Username (alternative to email)"`
	Password     string `json:"password" description:"User password"`
	CaptchaToken string `` /* 213-byte string literal not displayed */
}

type SignOutRequest struct{}

type SignUpRequest struct {
	AppID        string            `json:"app_id,omitempty" description:"Application ID (optional, uses default)"`
	Email        string            `json:"email" description:"User email address"`
	Password     string            `json:"password" description:"User password"`
	FirstName    string            `json:"first_name,omitempty" description:"First/given name"`
	LastName     string            `json:"last_name,omitempty" description:"Last/family name"`
	Username     string            `json:"username,omitempty" description:"Unique username"`
	Metadata     map[string]string `json:"metadata,omitempty" description:"Custom signup form field values"`
	CaptchaToken string            `` /* 213-byte string literal not displayed */
}

type StatusResponse struct {
	Status string `json:"status" description:"Operation status"`
}

type SwitchOrgRequest struct {
	OrgID string `json:"org_id" description:"Organization ID to activate; empty to clear"`
}

type SwitchOrgResponse struct {
	SessionID string `json:"session_id"`
	OrgID     string `json:"org_id,omitempty"`
}

type TokenExchangeRequest struct {
	Subject string   `json:"subject" description:"User ID the exchanged session should act on behalf of"`
	Scopes  []string `` /* 180-byte string literal not displayed */
}

type TokenExchangeResponse struct {
	AccessToken     string   `json:"access_token" description:"The exchanged session token"`
	IssuedTokenType string   `json:"issued_token_type" description:"RFC 8693 token type URN"`
	TokenType       string   `json:"token_type" description:"Always \"Bearer\""`
	ExpiresIn       int64    `json:"expires_in" description:"Seconds until the exchanged token expires"`
	Scopes          []string `json:"scopes,omitempty" description:"Scopes granted on the exchanged session"`
	Subject         string   `json:"subject" description:"The principal this session acts for"`
	Actor           string   `json:"actor" description:"The principal exercising the delegation"`
}

type TokenResponse struct {
	SessionToken string `json:"session_token" description:"New session token"`
	RefreshToken string `json:"refresh_token" description:"New refresh token"`
	ExpiresAt    string `json:"expires_at" description:"Token expiration time"`
}

type TrustDeviceRequest struct {
	DeviceID string `path:"deviceId" description:"Device identifier"`
}

type UnassignRoleRequest struct {
	RoleID string `path:"roleId" description:"Role identifier"`
	UserID string `json:"user_id" description:"User identifier"`
}

type UnenforceSettingRequest struct {
	Key     string `path:"key" description:"Setting key"`
	Scope   string `query:"scope" description:"Target scope (global, app, org, user)"`
	ScopeID string `query:"scope_id" description:"Entity ID at the target scope"`
}

type UnlinkAuthMethodRequest struct {
	Provider string `path:"provider" description:"Auth method provider (password, google, ...)"`
}

type UnlinkAuthMethodResponse struct {
	Status string `json:"status"`
}

type UpdateEnvironmentRequest struct {
	EnvID       string  `path:"envId" description:"Environment identifier"`
	Name        *string `json:"name,omitempty" description:"Environment name"`
	Description *string `json:"description,omitempty" description:"Environment description"`
	Color       *string `json:"color,omitempty" description:"UI badge color (hex)"`
}

type UpdateEnvironmentSettingsRequest struct {
	EnvID string `path:"envId" description:"Environment identifier"`
	environment.Settings
}

type UpdateMeRequest struct {
	FirstName *string `json:"first_name,omitempty" description:"First/given name"`
	LastName  *string `json:"last_name,omitempty" description:"Last/family name"`
	Image     *string `json:"image,omitempty" description:"Profile image URL"`
	Username  *string `json:"username,omitempty" description:"Unique username"`
}

type UpdateRoleRequest struct {
	RoleID      string  `path:"roleId" description:"Role identifier"`
	Name        *string `json:"name,omitempty" description:"Role name"`
	Description *string `json:"description,omitempty" description:"Role description"`
	ParentID    *string `json:"parent_id,omitempty" description:"Must be omitted or equal the role's current parent; re-parenting is refused with 400"`
}

type UpdateWebhookRequest struct {
	WebhookID string   `path:"webhookId" description:"Webhook identifier"`
	URL       *string  `json:"url,omitempty" description:"Webhook endpoint URL"`
	Events    []string `json:"events,omitempty" description:"Event types to subscribe to"`
	Active    *bool    `json:"active,omitempty" description:"Whether the webhook is active"`
}

type UserDataExport map[string]any

type UserRoleListResponse struct {
	Roles any `json:"roles" description:"List of roles assigned to the user"`
}

type VerifyEmailRequest struct {
	Code  string `json:"code,omitempty" description:"6-digit OTP code (verifies the authenticated user's email)"`
	Token string `json:"token,omitempty" description:"Email verification token (link-based flows)"`
	// Email scopes an OTP code to a specific user when the request is not
	// authenticated (e.g. cross-origin signup where the session cookie is not
	// carried). The code is still verified against that user's active
	// verification with per-user attempt limiting, so it is not brute-forceable.
	// Enables auto-login: on success a fresh session is issued and returned.
	Email string `json:"email,omitempty" description:"Email to scope the OTP code to when unauthenticated (enables auto-login)"`
	AppID string `json:"app_id,omitempty" description:"App ID (optional; resolved from publishable key when omitted)"`
}

type WebhookListResponse struct {
	Webhooks any `json:"webhooks" description:"List of webhooks"`
}