From c5702f0e450bf74cff7eb1cb88ad51bb633ef2a4 Mon Sep 17 00:00:00 2001 From: "fern-api[bot]" <115122769+fern-api[bot]@users.noreply.github.com> Date: Tue, 7 Jul 2026 09:56:42 +0000 Subject: [PATCH] SDK regeneration --- reference.md | 107 +- src/management/api/requests/requests.ts | 26 +- .../resources/eventStreams/client/Client.ts | 2 +- .../resources/organizations/client/Client.ts | 6 + .../organizations/resources/index.ts | 1 + .../resources/roles/client/Client.ts | 24 + .../resources/roles/client/index.ts | 1 + .../organizations/resources/roles/index.ts | 2 + .../resources/roles/resources/index.ts | 1 + .../roles/resources/members/client/Client.ts | 148 + .../roles/resources/members/client/index.ts | 1 + .../roles/resources/members/index.ts | 1 + src/management/api/types/types.ts | 5279 ++++++++++++++++- .../wire/clientGrants/organizations.test.ts | 8 +- src/management/tests/wire/clients.test.ts | 24 +- .../tests/wire/eventStreams.test.ts | 18 +- .../wire/eventStreams/deliveries.test.ts | 4 +- .../wire/eventStreams/redeliveries.test.ts | 2 +- src/management/tests/wire/events.test.ts | 14 +- .../tests/wire/organizations.test.ts | 12 +- .../wire/organizations/roles/members.test.ts | 133 + src/management/tests/wire/userGrants.test.ts | 11 +- .../tests/wire/users/organizations.test.ts | 8 +- yarn.lock | 336 +- 24 files changed, 5794 insertions(+), 375 deletions(-) create mode 100644 src/management/api/resources/organizations/resources/roles/client/Client.ts create mode 100644 src/management/api/resources/organizations/resources/roles/client/index.ts create mode 100644 src/management/api/resources/organizations/resources/roles/index.ts create mode 100644 src/management/api/resources/organizations/resources/roles/resources/index.ts create mode 100644 src/management/api/resources/organizations/resources/roles/resources/members/client/Client.ts create mode 100644 src/management/api/resources/organizations/resources/roles/resources/members/client/index.ts create mode 100644 src/management/api/resources/organizations/resources/roles/resources/members/index.ts create mode 100644 src/management/tests/wire/organizations/roles/members.test.ts diff --git a/reference.md b/reference.md index 97fe9f5a45..d21d35cc71 100644 --- a/reference.md +++ b/reference.md @@ -3965,7 +3965,7 @@ await client.eventStreams.update("id"); ```typescript await client.eventStreams.test("id", { - event_type: "group.created", + event_type: "connection.created", }); ``` @@ -4042,7 +4042,7 @@ Subscribe to events via Server-Sent Events (SSE) const response = await client.events.subscribe({ from: "from", from_timestamp: "from_timestamp", - event_type: ["group.created"], + event_type: ["connection.created"], }); for await (const item of response) { console.log(item); @@ -25692,6 +25692,109 @@ const response = page.response; +## Organizations Roles Members + +
client.organizations.roles.members.list(id, role_id, { ...params }) -> core.Page<Management.RoleMember, Management.ListOrganizationRoleMembersResponseContent> +
+
+ +#### 📝 Description + +
+
+ +
+
+ +List the organization members assigned a specific role within the context of an organization. + +
+
+
+
+ +#### 🔌 Usage + +
+
+ +
+
+ +```typescript +const pageableResponse = await client.organizations.roles.members.list("id", "role_id", { + from: "from", + take: 1, + fields: "fields", + include_fields: true, +}); +for await (const item of pageableResponse) { + console.log(item); +} + +// Or you can manually iterate page-by-page +let page = await client.organizations.roles.members.list("id", "role_id", { + from: "from", + take: 1, + fields: "fields", + include_fields: true, +}); +while (page.hasNextPage()) { + page = page.getNextPage(); +} + +// You can also access the underlying response +const response = page.response; +``` + +
+
+
+
+ +#### ⚙️ Parameters + +
+
+ +
+
+ +**id:** `string` — ID of the organization. + +
+
+ +
+
+ +**role_id:** `string` — ID of the role to retrieve the assigned members for. + +
+
+ +
+
+ +**request:** `Management.ListOrganizationRoleMembersRequestParameters` + +
+
+ +
+
+ +**requestOptions:** `MembersClient.RequestOptions` + +
+
+
+
+ +
+
+
+ ## Prompts Rendering
client.prompts.rendering.list({ ...params }) -> core.Page<Management.ListAculsResponseContentItem, Management.ListAculsOffsetPaginatedResponseContent> diff --git a/src/management/api/requests/requests.ts b/src/management/api/requests/requests.ts index 6fd101f045..2f8d3f7c3d 100644 --- a/src/management/api/requests/requests.ts +++ b/src/management/api/requests/requests.ts @@ -808,7 +808,7 @@ export interface UpdateEventStreamRequestContent { /** * @example * { - * event_type: "group.created" + * event_type: "connection.created" * } */ export interface CreateEventStreamTestEventRequestContent { @@ -821,7 +821,7 @@ export interface CreateEventStreamTestEventRequestContent { * { * from: "from", * from_timestamp: "from_timestamp", - * event_type: ["group.created"] + * event_type: ["connection.created"] * } */ export interface SubscribeEventsRequestParameters { @@ -1252,6 +1252,7 @@ export interface CreateOrganizationRequestContent { /** Connections that will be enabled for this organization. See POST enabled_connections endpoint for the object format. (Max of 10 connections allowed) */ enabled_connections?: Management.ConnectionForOrganization[]; token_quota?: Management.CreateTokenQuota; + third_party_client_access?: Management.OrganizationThirdPartyClientAccessEnum; } /** @@ -1266,6 +1267,7 @@ export interface UpdateOrganizationRequestContent { branding?: Management.OrganizationBranding; metadata?: Management.OrganizationMetadata; token_quota?: Management.UpdateTokenQuota | null; + third_party_client_access?: Management.OrganizationThirdPartyClientAccessEnum; } /** @@ -3644,6 +3646,26 @@ export interface ListOrganizationMemberRoleSourceGroupsRequestParameters { role_id: string; } +/** + * @example + * { + * from: "from", + * take: 1, + * fields: "fields", + * include_fields: true + * } + */ +export interface ListOrganizationRoleMembersRequestParameters { + /** Optional Id from which to start selection. */ + from?: string | null; + /** Number of results per page. Defaults to 50. Values above the maximum permitted size are capped. */ + take?: number | null; + /** Comma-separated list of fields to include or exclude (based on value provided for include_fields) in the result. Leave empty to retrieve all fields. */ + fields?: string | null; + /** Whether specified fields are to be included (true) or excluded (false). Defaults to true. */ + include_fields?: boolean | null; +} + /** * @example * { diff --git a/src/management/api/resources/eventStreams/client/Client.ts b/src/management/api/resources/eventStreams/client/Client.ts index 689af456a9..5d6c605b00 100644 --- a/src/management/api/resources/eventStreams/client/Client.ts +++ b/src/management/api/resources/eventStreams/client/Client.ts @@ -461,7 +461,7 @@ export class EventStreamsClient { * * @example * await client.eventStreams.test("id", { - * event_type: "group.created" + * event_type: "connection.created" * }) */ public test( diff --git a/src/management/api/resources/organizations/client/Client.ts b/src/management/api/resources/organizations/client/Client.ts index 7d69b27a2b..ad56ad7962 100644 --- a/src/management/api/resources/organizations/client/Client.ts +++ b/src/management/api/resources/organizations/client/Client.ts @@ -15,6 +15,7 @@ import { EnabledConnectionsClient } from "../resources/enabledConnections/client import { GroupsClient } from "../resources/groups/client/Client.js"; import { InvitationsClient } from "../resources/invitations/client/Client.js"; import { MembersClient } from "../resources/members/client/Client.js"; +import { RolesClient } from "../resources/roles/client/Client.js"; export declare namespace OrganizationsClient { export type Options = BaseClientOptions; @@ -31,6 +32,7 @@ export class OrganizationsClient { protected _invitations: InvitationsClient | undefined; protected _members: MembersClient | undefined; protected _groups: GroupsClient | undefined; + protected _roles: RolesClient | undefined; constructor(options: OrganizationsClient.Options) { this._options = normalizeClientOptionsWithAuth(options); @@ -64,6 +66,10 @@ export class OrganizationsClient { return (this._groups ??= new GroupsClient(this._options)); } + public get roles(): RolesClient { + return (this._roles ??= new RolesClient(this._options)); + } + /** * Retrieve detailed list of all Organizations available in your tenant. For more information, see Auth0 Organizations. * diff --git a/src/management/api/resources/organizations/resources/index.ts b/src/management/api/resources/organizations/resources/index.ts index 8776dc947c..4b1e847ca3 100644 --- a/src/management/api/resources/organizations/resources/index.ts +++ b/src/management/api/resources/organizations/resources/index.ts @@ -5,3 +5,4 @@ export * as enabledConnections from "./enabledConnections/index.js"; export * as groups from "./groups/index.js"; export * as invitations from "./invitations/index.js"; export * as members from "./members/index.js"; +export * as roles from "./roles/index.js"; diff --git a/src/management/api/resources/organizations/resources/roles/client/Client.ts b/src/management/api/resources/organizations/resources/roles/client/Client.ts new file mode 100644 index 0000000000..6969f699cf --- /dev/null +++ b/src/management/api/resources/organizations/resources/roles/client/Client.ts @@ -0,0 +1,24 @@ +// This file was auto-generated by Fern from our API Definition. + +import type { BaseClientOptions } from "../../../../../../BaseClient.js"; +import { normalizeClientOptionsWithAuth, type NormalizedClientOptionsWithAuth } from "../../../../../../BaseClient.js"; +import * as core from "../../../../../../core/index.js"; +import * as environments from "../../../../../../environments.js"; +import { MembersClient } from "../resources/members/client/Client.js"; + +export declare namespace RolesClient { + export type Options = BaseClientOptions; +} + +export class RolesClient { + protected readonly _options: NormalizedClientOptionsWithAuth; + protected _members: MembersClient | undefined; + + constructor(options: RolesClient.Options) { + this._options = normalizeClientOptionsWithAuth(options); + } + + public get members(): MembersClient { + return (this._members ??= new MembersClient(this._options)); + } +} diff --git a/src/management/api/resources/organizations/resources/roles/client/index.ts b/src/management/api/resources/organizations/resources/roles/client/index.ts new file mode 100644 index 0000000000..cb0ff5c3b5 --- /dev/null +++ b/src/management/api/resources/organizations/resources/roles/client/index.ts @@ -0,0 +1 @@ +export {}; diff --git a/src/management/api/resources/organizations/resources/roles/index.ts b/src/management/api/resources/organizations/resources/roles/index.ts new file mode 100644 index 0000000000..9eb1192dcc --- /dev/null +++ b/src/management/api/resources/organizations/resources/roles/index.ts @@ -0,0 +1,2 @@ +export * from "./client/index.js"; +export * from "./resources/index.js"; diff --git a/src/management/api/resources/organizations/resources/roles/resources/index.ts b/src/management/api/resources/organizations/resources/roles/resources/index.ts new file mode 100644 index 0000000000..88a930fad1 --- /dev/null +++ b/src/management/api/resources/organizations/resources/roles/resources/index.ts @@ -0,0 +1 @@ +export * as members from "./members/index.js"; diff --git a/src/management/api/resources/organizations/resources/roles/resources/members/client/Client.ts b/src/management/api/resources/organizations/resources/roles/resources/members/client/Client.ts new file mode 100644 index 0000000000..939696ad4b --- /dev/null +++ b/src/management/api/resources/organizations/resources/roles/resources/members/client/Client.ts @@ -0,0 +1,148 @@ +// This file was auto-generated by Fern from our API Definition. + +import type { BaseClientOptions, BaseRequestOptions } from "../../../../../../../../BaseClient.js"; +import { + normalizeClientOptionsWithAuth, + type NormalizedClientOptionsWithAuth, +} from "../../../../../../../../BaseClient.js"; +import * as core from "../../../../../../../../core/index.js"; +import { mergeHeaders } from "../../../../../../../../core/headers.js"; +import * as environments from "../../../../../../../../environments.js"; +import { handleNonStatusCodeError } from "../../../../../../../../errors/handleNonStatusCodeError.js"; +import * as errors from "../../../../../../../../errors/index.js"; +import * as Management from "../../../../../../../index.js"; + +export declare namespace MembersClient { + export type Options = BaseClientOptions; + + export interface RequestOptions extends BaseRequestOptions {} +} + +export class MembersClient { + protected readonly _options: NormalizedClientOptionsWithAuth; + + constructor(options: MembersClient.Options) { + this._options = normalizeClientOptionsWithAuth(options); + } + + /** + * List the organization members assigned a specific role within the context of an organization. + * + * @param {string} id - ID of the organization. + * @param {string} role_id - ID of the role to retrieve the assigned members for. + * @param {Management.ListOrganizationRoleMembersRequestParameters} request + * @param {MembersClient.RequestOptions} requestOptions - Request-specific configuration. + * + * @throws {@link Management.BadRequestError} + * @throws {@link Management.UnauthorizedError} + * @throws {@link Management.ForbiddenError} + * @throws {@link Management.NotFoundError} + * @throws {@link Management.TooManyRequestsError} + * + * @example + * await client.organizations.roles.members.list("id", "role_id", { + * from: "from", + * take: 1, + * fields: "fields", + * include_fields: true + * }) + */ + public async list( + id: string, + role_id: string, + request: Management.ListOrganizationRoleMembersRequestParameters = {}, + requestOptions?: MembersClient.RequestOptions, + ): Promise> { + const list = core.HttpResponsePromise.interceptFunction( + async ( + request: Management.ListOrganizationRoleMembersRequestParameters, + ): Promise> => { + const { from: from_, take = 50, fields, include_fields: includeFields = true } = request; + const _queryParams: Record = { + from: from_, + take, + fields, + include_fields: includeFields, + }; + const _authRequest: core.AuthRequest = await this._options.authProvider.getAuthRequest(); + let _headers: core.Fetcher.Args["headers"] = mergeHeaders( + _authRequest.headers, + this._options?.headers, + requestOptions?.headers, + ); + const _response = await (this._options.fetcher ?? core.fetcher)({ + url: core.url.join( + (await core.Supplier.get(this._options.baseUrl)) ?? + (await core.Supplier.get(this._options.environment)) ?? + environments.ManagementEnvironment.Default, + `organizations/${core.url.encodePathParam(id)}/roles/${core.url.encodePathParam(role_id)}/members`, + ), + method: "GET", + headers: _headers, + queryString: core.url + .queryBuilder() + .addMany(_queryParams) + .mergeAdditional(requestOptions?.queryParams) + .build(), + timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1000, + maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries, + abortSignal: requestOptions?.abortSignal, + fetchFn: this._options?.fetch, + logging: this._options.logging, + }); + if (_response.ok) { + return { + data: _response.body as Management.ListOrganizationRoleMembersResponseContent, + rawResponse: _response.rawResponse, + }; + } + if (_response.error.reason === "status-code") { + switch (_response.error.statusCode) { + case 400: + throw new Management.BadRequestError( + _response.error.body as unknown, + _response.rawResponse, + ); + case 401: + throw new Management.UnauthorizedError( + _response.error.body as unknown, + _response.rawResponse, + ); + case 403: + throw new Management.ForbiddenError(_response.error.body as unknown, _response.rawResponse); + case 404: + throw new Management.NotFoundError(_response.error.body as unknown, _response.rawResponse); + case 429: + throw new Management.TooManyRequestsError( + _response.error.body as unknown, + _response.rawResponse, + ); + default: + throw new errors.ManagementError({ + statusCode: _response.error.statusCode, + body: _response.error.body, + rawResponse: _response.rawResponse, + }); + } + } + return handleNonStatusCodeError( + _response.error, + _response.rawResponse, + "GET", + "/organizations/{id}/roles/{role_id}/members", + ); + }, + ); + const dataWithRawResponse = await list(request).withRawResponse(); + return new core.Page({ + response: dataWithRawResponse.data, + rawResponse: dataWithRawResponse.rawResponse, + hasNextPage: (response) => + response?.next != null && !(typeof response?.next === "string" && response?.next === ""), + getItems: (response) => response?.members ?? [], + loadPage: (response) => { + return list(core.setObjectProperty(request, "from", response?.next)); + }, + }); + } +} diff --git a/src/management/api/resources/organizations/resources/roles/resources/members/client/index.ts b/src/management/api/resources/organizations/resources/roles/resources/members/client/index.ts new file mode 100644 index 0000000000..cb0ff5c3b5 --- /dev/null +++ b/src/management/api/resources/organizations/resources/roles/resources/members/client/index.ts @@ -0,0 +1 @@ +export {}; diff --git a/src/management/api/resources/organizations/resources/roles/resources/members/index.ts b/src/management/api/resources/organizations/resources/roles/resources/members/index.ts new file mode 100644 index 0000000000..914b8c3c72 --- /dev/null +++ b/src/management/api/resources/organizations/resources/roles/resources/members/index.ts @@ -0,0 +1 @@ +export * from "./client/index.js"; diff --git a/src/management/api/types/types.ts b/src/management/api/types/types.ts index 8eef937ed3..2ff132ae75 100644 --- a/src/management/api/types/types.ts +++ b/src/management/api/types/types.ts @@ -720,6 +720,32 @@ export const OauthScope = { } as const; export type OauthScope = (typeof OauthScope)[keyof typeof OauthScope]; +export interface NotFoundErrorBody { + message: string; + statusCode: string; + error: NotFoundErrorBody.Error_; +} + +export namespace NotFoundErrorBody { + export const Error_ = { + NotFound: "Not Found", + } as const; + export type Error_ = (typeof Error_)[keyof typeof Error_]; +} + +export interface TooManyRequestsErrorBody { + message: string; + statusCode: string; + error: TooManyRequestsErrorBody.Error_; +} + +export namespace TooManyRequestsErrorBody { + export const Error_ = { + TooManyRequests: "Too Many Requests", + } as const; + export type Error_ = (typeof Error_)[keyof typeof Error_]; +} + export interface Action { /** The unique ID of the action. */ id?: string | undefined; @@ -3200,6 +3226,7 @@ export type ClientTokenExchangeTypeEnum = export interface ClientTokenVaultPrivilegedAccessWithCredentialId { credentials: Management.CredentialId[]; ip_allowlist?: Management.TokenVaultPrivilegedAccessIpAllowlistEntry[] | undefined; + grants?: Management.TokenVaultPrivilegedAccessGrant[] | undefined; } /** @@ -3208,6 +3235,7 @@ export interface ClientTokenVaultPrivilegedAccessWithCredentialId { export interface ClientTokenVaultPrivilegedAccessWithPublicKey { credentials: Management.PublicKeyCredential[]; ip_allowlist?: Management.TokenVaultPrivilegedAccessIpAllowlistEntry[] | undefined; + grants?: Management.TokenVaultPrivilegedAccessGrant[] | undefined; } export interface ConnectedAccount { @@ -3324,12 +3352,6 @@ export interface ConnectionAssertionDecryptionSettings { algorithm_exceptions?: string[] | undefined; } -export interface ConnectionAttributeIdentifier { - /** Determines if the attribute is used for identification */ - active?: boolean | undefined; - default_method?: Management.DefaultMethodEmailIdentifierEnum | undefined; -} - /** * Object containing mapping details for incoming claims */ @@ -6113,6 +6135,8 @@ export interface ConnectionPropertiesOptions { token_endpoint_auth_signing_alg?: (Management.ConnectionTokenEndpointAuthSigningAlgEnum | null) | undefined; token_endpoint_jwtca_aud_format?: Management.ConnectionTokenEndpointJwtcaAudFormatEnumOidc | undefined; id_token_session_expiry_supported?: Management.ConnectionIdTokenSessionExpirySupported | undefined; + discovery_url?: ((Management.ConnectionsDiscoveryUrl | undefined) | null) | undefined; + oidc_metadata?: (Management.ConnectionsOidcMetadata | null) | undefined; /** Accepts any additional properties */ [key: string]: any; } @@ -7710,11 +7734,98 @@ export const ConnectionWaadProtocolEnumAzureAd = { export type ConnectionWaadProtocolEnumAzureAd = (typeof ConnectionWaadProtocolEnumAzureAd)[keyof typeof ConnectionWaadProtocolEnumAzureAd]; +/** + * URL of the identity provider's OIDC Discovery endpoint (/.well-known/openid-configuration). When provided and oidc_metadata is empty, Auth0 automatically retrieves the provider's configuration including endpoints and supported features. Only applicable when strategy=oidc, okta, or samlp. + */ +export type ConnectionsDiscoveryUrl = (string | null) | undefined; + /** * Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed. */ export type ConnectionsMetadata = Record; +/** + * Additional OIDC metadata to include in the discovery document. Only applicable when strategy=oidc, okta, or samlp. + */ +export interface ConnectionsOidcMetadata { + /** The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider. */ + issuer?: string | undefined; + /** URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow. */ + authorization_endpoint?: string | undefined; + /** URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow. */ + token_endpoint?: string | undefined; + /** Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token. */ + userinfo_endpoint?: string | undefined; + /** URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures. */ + jwks_uri?: string | undefined; + /** URL of the OPs Dynamic Client Registration Endpoint. RECOMMENDED but not REQUIRED. https://openid.net/specs/openid-connect-discovery-1_0.html#OpenID.Registration */ + registration_endpoint?: string | undefined; + /** A list of the OAuth 2.0 [RFC6749] scope values that this server supports. The server MUST support the openid scope value. Servers MAY choose not to advertise some supported scope values even when this parameter is used, although those defined in [OpenID.Core] SHOULD be listed, if supported. RECOMMENDED but not REQUIRED */ + scopes_supported?: (string[] | null) | undefined; + /** A list of the OAuth 2.0 response_mode values that this OP supports. If omitted, the default for Dynamic OpenID Providers is ["query", "fragment"] */ + response_modes_supported?: string[] | undefined; + /** A list of the OAuth 2.0 response_type values that this OP supports. Dynamic OpenID Providers MUST support the code, id_token, and the token id_token Response Type values */ + response_types_supported?: string[] | undefined; + /** A list of the OAuth 2.0 Grant Type values that this OP supports. Dynamic OpenID Providers MUST support the authorization_code and implicit Grant Type values and MAY support other Grant Types. If omitted, the default value is ["authorization_code", "implicit"]. */ + grant_types_supported?: string[] | undefined; + /** A list of the Authentication Context Class References that this OP supports */ + acr_values_supported?: string[] | undefined; + /** A list of the Subject Identifier types that this OP supports. Valid types include pairwise and public */ + subject_types_supported?: (string[] | null) | undefined; + /** A list of the JWS signing algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT. The algorithm RS256 MUST be included. The value none MAY be supported, but MUST NOT be used unless the Response Type used returns no ID Token from the Authorization Endpoint (such as when using the Authorization Code Flow). https://datatracker.ietf.org/doc/html/rfc7518 */ + id_token_signing_alg_values_supported?: string[] | undefined; + /** JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT */ + id_token_encryption_alg_values_supported?: string[] | undefined; + /** JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for the ID Token to encode the Claims in a JWT [JWT]. */ + id_token_encryption_enc_values_supported?: string[] | undefined; + /** JSON array containing a list of the JWS [JWS] signing algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. The value none MAY be included. */ + userinfo_signing_alg_values_supported?: string[] | undefined; + /** JSON array containing a list of the JWE [JWE] encryption algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. */ + userinfo_encryption_alg_values_supported?: string[] | undefined; + /** JSON array containing a list of the JWE encryption algorithms (enc values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. */ + userinfo_encryption_enc_values_supported?: string[] | undefined; + /** JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for Request Objects, which are described in Section 6.1 of OpenID Connect Core 1.0 [OpenID.Core]. These algorithms are used both when the Request Object is passed by value (using the request parameter) and when it is passed by reference (using the request_uri parameter). Servers SHOULD support none and RS256. */ + request_object_signing_alg_values_supported?: string[] | undefined; + /** JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference. */ + request_object_encryption_alg_values_supported?: string[] | undefined; + /** JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference. */ + request_object_encryption_enc_values_supported?: string[] | undefined; + /** JSON array containing a list of Client Authentication methods supported by this Token Endpoint. The options are client_secret_post, client_secret_basic, client_secret_jwt, and private_key_jwt, as described in Section 9 of OpenID Connect Core 1.0 [OpenID.Core]. Other authentication methods MAY be defined by extensions. If omitted, the default is client_secret_basic -- the HTTP Basic Authentication Scheme specified in Section 2.3.1 of OAuth 2.0 [RFC6749]. */ + token_endpoint_auth_methods_supported?: string[] | undefined; + /** JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used. */ + token_endpoint_auth_signing_alg_values_supported?: string[] | undefined; + /** JSON array containing a list of the display parameter values that the OpenID Provider supports. These values are described in Section 3.1.2.1 of OpenID Connect Core 1.0 [OpenID.Core] */ + display_values_supported?: string[] | undefined; + /** JSON array containing a list of the Claim Types that the OpenID Provider supports. These Claim Types are described in Section 5.6 of OpenID Connect Core 1.0 [OpenID.Core]. If omitted, the implementation supports only normal Claims. */ + claim_types_supported?: string[] | undefined; + /** JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply values for. Note that for privacy or other reasons, this might not be an exhaustive list. */ + claims_supported?: string[] | undefined; + /** URL of a page containing human-readable information that developers might want or need to know when using the OpenID Provider. In particular, if the OpenID Provider does not support Dynamic Client Registration, then information on how to register Clients needs to be provided in this documentation. */ + service_documentation?: string | undefined; + /** Languages and scripts supported for values in Claims being returned, represented as a JSON array of BCP47 [RFC5646] language tag values. Not all languages and scripts are necessarily supported for all Claim values. */ + claims_locales_supported?: string[] | undefined; + /** Languages and scripts supported for the user interface, represented as a JSON array of BCP47 [RFC5646] language tag values. */ + ui_locales_supported?: string[] | undefined; + /** Boolean value specifying whether the OP supports use of the claims parameter, with true indicating support. If omitted, the default value is false. */ + claims_parameter_supported?: boolean | undefined; + /** Boolean value specifying whether the OP supports use of the request parameter, with true indicating support. If omitted, the default value is false. */ + request_parameter_supported?: boolean | undefined; + /** Boolean value specifying whether the OP supports use of the request_uri parameter, with true indicating support. If omitted, the default value is false. */ + request_uri_parameter_supported?: boolean | undefined; + /** Boolean value specifying whether the OP requires use of the request_uri parameter. If omitted, the default value is false. */ + require_request_uri_registration?: boolean | undefined; + /** URL that the OpenID Provider provides to the person registering the Client to read about the OPs requirements on how the Relying Party can use the data provided by the OP. The registration process SHOULD display this URL to the person registering the Client if it is given. */ + op_policy_uri?: string | undefined; + /** URL that the OpenID Provider provides to the person registering the Client to read about OpenID Providers terms of service. The registration process SHOULD display this URL to the person registering the Client if it is given. */ + op_tos_uri?: string | undefined; + /** URL of the identity provider's logout/end session endpoint. When configured as a static URL, users are redirected here after logging out from Auth0. Must use HTTPS scheme. */ + end_session_endpoint?: string | undefined; + /** JSON array containing a list of the JWS signing algorithms (alg values) supported for DPoP proof JWT signing. */ + dpop_signing_alg_values_supported?: string[] | undefined; + /** Accepts any additional properties */ + [key: string]: any; +} + /** * Content Security Policy configuration with multi-policy support. */ @@ -9806,6 +9917,7 @@ export interface CreateOrganizationResponseContent { branding?: Management.OrganizationBranding | undefined; metadata?: Management.OrganizationMetadata | undefined; token_quota?: Management.TokenQuota | undefined; + third_party_client_access?: Management.OrganizationThirdPartyClientAccessEnum | undefined; enabled_connections?: Management.OrganizationEnabledConnection[] | undefined; /** Accepts any additional properties */ [key: string]: any; @@ -10445,6 +10557,14 @@ export const DefaultMethodEmailIdentifierEnum = { export type DefaultMethodEmailIdentifierEnum = (typeof DefaultMethodEmailIdentifierEnum)[keyof typeof DefaultMethodEmailIdentifierEnum]; +/** Default authentication method for phone_number identifier */ +export const DefaultMethodPhoneNumberIdentifierEnum = { + Password: "password", + PhoneOtp: "phone_otp", +} as const; +export type DefaultMethodPhoneNumberIdentifierEnum = + (typeof DefaultMethodPhoneNumberIdentifierEnum)[keyof typeof DefaultMethodPhoneNumberIdentifierEnum]; + /** * Token Quota configuration, to configure quotas for token issuance for clients and organizations. Applied to all clients and organizations unless overridden in individual client or organization settings. */ @@ -10690,7 +10810,7 @@ export type DomainVerificationStatusEnum = * Configuration for the email attribute for users. */ export interface EmailAttribute { - identifier?: Management.ConnectionAttributeIdentifier | undefined; + identifier?: Management.EmailAttributeIdentifier | undefined; /** Determines if the attribute is unique in a given connection */ unique?: boolean | undefined; /** Determines if property should be required for users */ @@ -10699,6 +10819,12 @@ export interface EmailAttribute { signup?: Management.SignupVerified | undefined; } +export interface EmailAttributeIdentifier { + /** Determines if the attribute is used for identification */ + active?: boolean | undefined; + default_method?: Management.DefaultMethodEmailIdentifierEnum | undefined; +} + /** Set to eu if your domain is provisioned to use Mailgun's EU region. Otherwise, set to null. */ export const EmailMailgunRegionEnum = { Eu: "eu", @@ -10779,151 +10905,4900 @@ export type EmailProviderNameEnum = (typeof EmailProviderNameEnum)[keyof typeof export type EmailProviderSettings = Record; /** - * SMTP host. + * SMTP host. + */ +export type EmailSmtpHost = string; + +/** Set to eu to use SparkPost service hosted in Western Europe. To use SparkPost hosted in North America, set it to null. */ +export const EmailSparkPostRegionEnum = { + Eu: "eu", +} as const; +export type EmailSparkPostRegionEnum = (typeof EmailSparkPostRegionEnum)[keyof typeof EmailSparkPostRegionEnum]; + +/** + * Specific provider setting + */ +export type EmailSpecificProviderSettingsWithAdditionalProperties = (Record | null) | undefined; + +/** Template name. Can be `verify_email`, `verify_email_by_code`, `auth_email_by_code`, `reset_email`, `reset_email_by_code`, `welcome_email`, `blocked_account`, `stolen_credentials`, `enrollment_email`, `mfa_oob_code`, `user_invitation`, `async_approval`, `change_password` (legacy), or `password_reset` (legacy). */ +export const EmailTemplateNameEnum = { + VerifyEmail: "verify_email", + VerifyEmailByCode: "verify_email_by_code", + AuthEmailByCode: "auth_email_by_code", + ResetEmail: "reset_email", + ResetEmailByCode: "reset_email_by_code", + WelcomeEmail: "welcome_email", + BlockedAccount: "blocked_account", + StolenCredentials: "stolen_credentials", + EnrollmentEmail: "enrollment_email", + MfaOobCode: "mfa_oob_code", + UserInvitation: "user_invitation", + ChangePassword: "change_password", + PasswordReset: "password_reset", + AsyncApproval: "async_approval", +} as const; +export type EmailTemplateNameEnum = (typeof EmailTemplateNameEnum)[keyof typeof EmailTemplateNameEnum]; + +/** Enum for enabled features. */ +export const EnabledFeaturesEnum = { + Scim: "scim", + UniversalLogout: "universal_logout", +} as const; +export type EnabledFeaturesEnum = (typeof EnabledFeaturesEnum)[keyof typeof EnabledFeaturesEnum]; + +/** + * Encryption key + */ +export interface EncryptionKey { + /** Key ID */ + kid: string; + type: Management.EncryptionKeyType; + state: Management.EncryptionKeyState; + /** Key creation timestamp */ + created_at: string; + /** Key update timestamp */ + updated_at: string; + /** ID of parent wrapping key */ + parent_kid?: (string | null) | undefined; + /** Public key in PEM format */ + public_key?: (string | null) | undefined; +} + +/** Encryption algorithm that shall be used to wrap your key material */ +export const EncryptionKeyPublicWrappingAlgorithm = { + CkmRsaAesKeyWrap: "CKM_RSA_AES_KEY_WRAP", +} as const; +export type EncryptionKeyPublicWrappingAlgorithm = + (typeof EncryptionKeyPublicWrappingAlgorithm)[keyof typeof EncryptionKeyPublicWrappingAlgorithm]; + +/** Key state */ +export const EncryptionKeyState = { + PreActivation: "pre-activation", + Active: "active", + Deactivated: "deactivated", + Destroyed: "destroyed", +} as const; +export type EncryptionKeyState = (typeof EncryptionKeyState)[keyof typeof EncryptionKeyState]; + +/** Key type */ +export const EncryptionKeyType = { + CustomerProvidedRootKey: "customer-provided-root-key", + EnvironmentRootKey: "environment-root-key", + TenantMasterKey: "tenant-master-key", + TenantEncryptionKey: "tenant-encryption-key", +} as const; +export type EncryptionKeyType = (typeof EncryptionKeyType)[keyof typeof EncryptionKeyType]; + +/** + * Configuration specific to an action destination. + */ +export interface EventStreamActionConfiguration { + /** Action ID for the action destination. */ + action_id: string; +} + +export interface EventStreamActionDestination { + type: Management.EventStreamActionDestinationTypeEnum; + configuration: Management.EventStreamActionConfiguration; +} + +export const EventStreamActionDestinationTypeEnum = { + Action: "action", +} as const; +export type EventStreamActionDestinationTypeEnum = + (typeof EventStreamActionDestinationTypeEnum)[keyof typeof EventStreamActionDestinationTypeEnum]; + +export interface EventStreamActionResponseContent { + /** Unique identifier for the event stream. */ + id?: string | undefined; + /** Name of the event stream. */ + name?: string | undefined; + /** List of event types subscribed to in this stream. */ + subscriptions?: Management.EventStreamSubscription[] | undefined; + destination?: Management.EventStreamActionDestination | undefined; + status?: Management.EventStreamStatusEnum | undefined; + /** Timestamp when the event stream was created. */ + created_at?: string | undefined; + /** Timestamp when the event stream was last updated. */ + updated_at?: string | undefined; +} + +/** + * Event content. This will only be set if delivery failed. + */ +export interface EventStreamCloudEvent { + /** Unique identifier for the event */ + id?: string | undefined; + /** Where the event originated */ + source?: string | undefined; + /** Version of CloudEvents spec */ + specversion?: string | undefined; + /** Type of the event (e.g., user.created) */ + type?: string | undefined; + /** Timestamp at which the event was generated */ + time?: string | undefined; + /** Event contents encoded as a string. */ + data?: string | undefined; +} + +/** + * The purpose of this event. This field will typically appear only in special cases + * such as sending a test event. For normal events, this field will be omitted. + */ +export const EventStreamCloudEventA0PurposeEnum = { + Test: "test", +} as const; +export type EventStreamCloudEventA0PurposeEnum = + (typeof EventStreamCloudEventA0PurposeEnum)[keyof typeof EventStreamCloudEventA0PurposeEnum]; + +/** + * SSE message for connection.created. + */ +export interface EventStreamCloudEventConnectionCreated { + /** Opaque cursor representing position in the stream. Pass as the `from` query parameter to resume. */ + offset: string; + event: Management.EventStreamCloudEventConnectionCreatedCloudEvent; +} + +/** + * Represents an event that occurs when a connection is created. + */ +export interface EventStreamCloudEventConnectionCreatedCloudEvent { + specversion: Management.EventStreamCloudEventSpecVersionEnum; + type: Management.EventStreamCloudEventConnectionCreatedCloudEventTypeEnum; + /** The source of the event. This will take the form 'urn:auth0:.'. */ + source: string; + /** A unique identifier for the event. */ + id: string; + /** An ISO-8601 timestamp indicating when the event physically occurred. */ + time: string; + data: Management.EventStreamCloudEventConnectionCreatedData; + /** The auth0 tenant ID to which the event is associated. */ + a0tenant: string; + /** The auth0 event stream ID of the stream the event was delivered on. */ + a0stream: string; + a0purpose?: Management.EventStreamCloudEventA0PurposeEnum | undefined; +} + +/** The type of the event which has happened. */ +export const EventStreamCloudEventConnectionCreatedCloudEventTypeEnum = { + ConnectionCreated: "connection.created", +} as const; +export type EventStreamCloudEventConnectionCreatedCloudEventTypeEnum = + (typeof EventStreamCloudEventConnectionCreatedCloudEventTypeEnum)[keyof typeof EventStreamCloudEventConnectionCreatedCloudEventTypeEnum]; + +/** + * The event payload. + */ +export interface EventStreamCloudEventConnectionCreatedData { + object: Management.EventStreamCloudEventConnectionCreatedObject; + context?: Management.EventStreamCloudEventContext | undefined; +} + +/** + * The event content. + */ +export type EventStreamCloudEventConnectionCreatedObject = + | Management.EventStreamCloudEventConnectionCreatedObject0 + | Management.EventStreamCloudEventConnectionCreatedObject1 + | Management.EventStreamCloudEventConnectionCreatedObject2 + | Management.EventStreamCloudEventConnectionCreatedObject3 + | Management.EventStreamCloudEventConnectionCreatedObject4 + | Management.EventStreamCloudEventConnectionCreatedObject5 + | Management.EventStreamCloudEventConnectionCreatedObject6 + | Management.EventStreamCloudEventConnectionCreatedObject7; + +export interface EventStreamCloudEventConnectionCreatedObject0 { + authentication?: Management.EventStreamCloudEventConnectionCreatedObject0Authentication | undefined; + /** Connection name used in the new universal login experience */ + display_name?: string | undefined; + /** Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients. */ + enabled_clients?: string[] | undefined; + /** The connection's identifier */ + id: string; + /** true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.) */ + is_domain_connection?: boolean | undefined; + metadata?: Management.EventStreamCloudEventConnectionCreatedObject0Metadata | undefined; + /** The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128 */ + name: string; + /** Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm. */ + realms?: string[] | undefined; + connected_accounts?: Management.EventStreamCloudEventConnectionCreatedObject0ConnectedAccounts | undefined; + options?: Management.EventStreamCloudEventConnectionCreatedObject0Options | undefined; + /** Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`. */ + show_as_button?: boolean | undefined; + strategy: Management.EventStreamCloudEventConnectionCreatedObject0StrategyEnum; +} + +/** + * Configure the purpose of a connection to be used for authentication during login. + */ +export interface EventStreamCloudEventConnectionCreatedObject0Authentication { + active: boolean; +} + +/** + * Configure the purpose of a connection to be used for connected accounts and Token Vault. + */ +export interface EventStreamCloudEventConnectionCreatedObject0ConnectedAccounts { + active: boolean; + cross_app_access?: boolean | undefined; +} + +/** + * Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed. + */ +export interface EventStreamCloudEventConnectionCreatedObject0Metadata {} + +/** + * Options for the 'oidc' connection + */ +export interface EventStreamCloudEventConnectionCreatedObject0Options { + /** URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow. */ + authorization_endpoint?: string | undefined; + /** OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider. */ + client_id: string; + connection_settings?: Management.EventStreamCloudEventConnectionCreatedObject0OptionsConnectionSettings | undefined; + /** Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication. */ + domain_aliases?: string[] | undefined; + dpop_signing_alg?: Management.EventStreamCloudEventConnectionCreatedObject0OptionsDpopSigningAlgEnum | undefined; + federated_connections_access_tokens?: + | Management.EventStreamCloudEventConnectionCreatedObject0OptionsFederatedConnectionsAccessTokens + | undefined; + /** https url of the icon to be shown */ + icon_url?: string | undefined; + /** Indicates whether the identity provider supports session expiry via the id_token. If true, the system will use the session_expiry claim in the id_token to determine session expiry. */ + id_token_session_expiry_supported?: boolean | undefined; + /** List of algorithms allowed to verify the ID tokens. Applicable when strategy=oidc or okta. */ + id_token_signed_response_algs?: + | Management.EventStreamCloudEventConnectionCreatedObject0OptionsIdTokenSignedResponseAlgsItemEnum[] + | undefined; + /** The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider. */ + issuer?: string | undefined; + /** URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures. */ + jwks_uri?: string | undefined; + /** An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist) */ + non_persistent_attrs?: string[] | undefined; + oidc_metadata?: Management.EventStreamCloudEventConnectionCreatedObject0OptionsOidcMetadata | undefined; + schema_version?: Management.EventStreamCloudEventConnectionCreatedObject0OptionsSchemaVersionEnum | undefined; + /** Space-separated list of OAuth 2.0 scopes requested during authorization. Must include 'openid' (required by OIDC spec). Common values: 'openid profile email'. Additional scopes depend on the identity provider. */ + scope?: string | undefined; + /** When true and type is 'back_channel', includes a cryptographic nonce in authorization requests to prevent replay attacks. The identity provider must include this nonce in the ID token for validation. */ + send_back_channel_nonce?: boolean | undefined; + set_user_root_attributes?: + | Management.EventStreamCloudEventConnectionCreatedObject0OptionsSetUserRootAttributesEnum + | undefined; + /** Tenant domain */ + tenant_domain?: string | undefined; + /** URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow. */ + token_endpoint?: string | undefined; + token_endpoint_auth_method?: + | Management.EventStreamCloudEventConnectionCreatedObject0OptionsTokenEndpointAuthMethodEnum + | undefined; + token_endpoint_auth_signing_alg?: + | Management.EventStreamCloudEventConnectionCreatedObject0OptionsTokenEndpointAuthSigningAlgEnum + | undefined; + token_endpoint_jwtca_aud_format?: + | Management.EventStreamCloudEventConnectionCreatedObject0OptionsTokenEndpointJwtcaAudFormatEnum + | undefined; + upstream_params?: Management.EventStreamCloudEventConnectionCreatedObject0OptionsUpstreamParams | undefined; + /** Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token. */ + userinfo_endpoint?: string | undefined; + attribute_map?: Management.EventStreamCloudEventConnectionCreatedObject0OptionsAttributeMap | undefined; + /** URL of the identity provider's OIDC Discovery endpoint (/.well-known/openid-configuration). When provided and oidc_metadata is empty, Auth0 automatically retrieves the provider's configuration including endpoints and supported features. */ + discovery_url?: string | undefined; + type?: Management.EventStreamCloudEventConnectionCreatedObject0OptionsTypeEnum | undefined; +} + +/** + * Configuration for mapping claims from the identity provider to Auth0 user profile attributes. Allows customizing which IdP claims populate user fields and how they are transformed. + */ +export interface EventStreamCloudEventConnectionCreatedObject0OptionsAttributeMap { + attributes?: Management.EventStreamCloudEventConnectionCreatedObject0OptionsAttributeMapAttributes | undefined; + /** Scopes to send to the IdP's Userinfo endpoint */ + userinfo_scope?: string | undefined; + mapping_mode?: + | Management.EventStreamCloudEventConnectionCreatedObject0OptionsAttributeMapMappingModeEnum + | undefined; +} + +/** + * Object containing mapping details for incoming claims + */ +export type EventStreamCloudEventConnectionCreatedObject0OptionsAttributeMapAttributes = Record; + +/** Method used to map incoming claims when strategy=oidc. */ +export const EventStreamCloudEventConnectionCreatedObject0OptionsAttributeMapMappingModeEnum = { + BindAll: "bind_all", + UseMap: "use_map", +} as const; +export type EventStreamCloudEventConnectionCreatedObject0OptionsAttributeMapMappingModeEnum = + (typeof EventStreamCloudEventConnectionCreatedObject0OptionsAttributeMapMappingModeEnum)[keyof typeof EventStreamCloudEventConnectionCreatedObject0OptionsAttributeMapMappingModeEnum]; + +/** + * OAuth 2.0 PKCE (Proof Key for Code Exchange) settings. PKCE enhances security for public clients by preventing authorization code interception attacks. 'auto' (recommended) uses the strongest method supported by the IdP. + */ +export interface EventStreamCloudEventConnectionCreatedObject0OptionsConnectionSettings { + pkce?: Management.EventStreamCloudEventConnectionCreatedObject0OptionsConnectionSettingsPkceEnum | undefined; +} + +/** PKCE configuration. */ +export const EventStreamCloudEventConnectionCreatedObject0OptionsConnectionSettingsPkceEnum = { + Auto: "auto", + S256: "S256", + Plain: "plain", + Disabled: "disabled", +} as const; +export type EventStreamCloudEventConnectionCreatedObject0OptionsConnectionSettingsPkceEnum = + (typeof EventStreamCloudEventConnectionCreatedObject0OptionsConnectionSettingsPkceEnum)[keyof typeof EventStreamCloudEventConnectionCreatedObject0OptionsConnectionSettingsPkceEnum]; + +/** Algorithm used for DPoP proof JWT signing. Applicable when strategy=oidc or okta. */ +export const EventStreamCloudEventConnectionCreatedObject0OptionsDpopSigningAlgEnum = { + Es256: "ES256", + Es384: "ES384", + Es512: "ES512", + Ed25519: "Ed25519", +} as const; +export type EventStreamCloudEventConnectionCreatedObject0OptionsDpopSigningAlgEnum = + (typeof EventStreamCloudEventConnectionCreatedObject0OptionsDpopSigningAlgEnum)[keyof typeof EventStreamCloudEventConnectionCreatedObject0OptionsDpopSigningAlgEnum]; + +/** + * Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users. + */ +export interface EventStreamCloudEventConnectionCreatedObject0OptionsFederatedConnectionsAccessTokens { + /** Enables refresh tokens and access tokens collection for federated connections */ + active: boolean; +} + +/** Algorithm allowed to verify the ID tokens. */ +export const EventStreamCloudEventConnectionCreatedObject0OptionsIdTokenSignedResponseAlgsItemEnum = { + Es256: "ES256", + Es384: "ES384", + Ps256: "PS256", + Ps384: "PS384", + Rs256: "RS256", + Rs384: "RS384", + Rs512: "RS512", +} as const; +export type EventStreamCloudEventConnectionCreatedObject0OptionsIdTokenSignedResponseAlgsItemEnum = + (typeof EventStreamCloudEventConnectionCreatedObject0OptionsIdTokenSignedResponseAlgsItemEnum)[keyof typeof EventStreamCloudEventConnectionCreatedObject0OptionsIdTokenSignedResponseAlgsItemEnum]; + +/** + * OpenID Connect Provider Metadata as per https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata + */ +export interface EventStreamCloudEventConnectionCreatedObject0OptionsOidcMetadata { + /** A list of the Authentication Context Class References that this OP supports */ + acr_values_supported?: string[] | undefined; + /** URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow. */ + authorization_endpoint: string; + /** JSON array containing a list of the Claim Types that the OpenID Provider supports. These Claim Types are described in Section 5.6 of OpenID Connect Core 1.0 [OpenID.Core]. If omitted, the implementation supports only normal Claims. */ + claim_types_supported?: string[] | undefined; + /** Languages and scripts supported for values in Claims being returned, represented as a JSON array of BCP47 [RFC5646] language tag values. Not all languages and scripts are necessarily supported for all Claim values. */ + claims_locales_supported?: string[] | undefined; + /** Boolean value specifying whether the OP supports use of the claims parameter, with true indicating support. If omitted, the default value is false. */ + claims_parameter_supported?: boolean | undefined; + /** JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply values for. Note that for privacy or other reasons, this might not be an exhaustive list. */ + claims_supported?: string[] | undefined; + /** JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used. */ + display_values_supported?: string[] | undefined; + /** JSON array containing a list of the JWS signing algorithms (alg values) supported for DPoP proof JWT signing. */ + dpop_signing_alg_values_supported?: string[] | undefined; + /** URL of the identity provider's logout/end session endpoint. When configured as a static URL, users are redirected here after logging out from Auth0. Must use HTTPS scheme. */ + end_session_endpoint?: string | undefined; + /** A list of the OAuth 2.0 Grant Type values that this OP supports. Dynamic OpenID Providers MUST support the authorization_code and implicit Grant Type values and MAY support other Grant Types. If omitted, the default value is ["authorization_code", "implicit"]. */ + grant_types_supported?: string[] | undefined; + /** JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT */ + id_token_encryption_alg_values_supported?: string[] | undefined; + /** JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for the ID Token to encode the Claims in a JWT [JWT]. */ + id_token_encryption_enc_values_supported?: string[] | undefined; + /** A list of the JWS signing algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT. The algorithm RS256 MUST be included. The value none MAY be supported, but MUST NOT be used unless the Response Type used returns no ID Token from the Authorization Endpoint (such as when using the Authorization Code Flow). https://datatracker.ietf.org/doc/html/rfc7518 */ + id_token_signing_alg_values_supported: string[]; + /** The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider. */ + issuer: string; + /** URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures. */ + jwks_uri: string; + /** URL that the OpenID Provider provides to the person registering the Client to read about the OPs requirements on how the Relying Party can use the data provided by the OP. The registration process SHOULD display this URL to the person registering the Client if it is given. */ + op_policy_uri?: string | undefined; + /** URL that the OpenID Provider provides to the person registering the Client to read about OpenID Providers terms of service. The registration process SHOULD display this URL to the person registering the Client if it is given. */ + op_tos_uri?: string | undefined; + /** URL of the OPs Dynamic Client Registration Endpoint. RECOMMENDED but not REQUIRED. https://openid.net/specs/openid-connect-discovery-1_0.html#OpenID.Registration */ + registration_endpoint?: string | undefined; + /** JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference. */ + request_object_encryption_alg_values_supported?: string[] | undefined; + /** JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference. */ + request_object_encryption_enc_values_supported?: string[] | undefined; + /** JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for Request Objects, which are described in Section 6.1 of OpenID Connect Core 1.0 [OpenID.Core]. These algorithms are used both when the Request Object is passed by value (using the request parameter) and when it is passed by reference (using the request_uri parameter). Servers SHOULD support none and RS256. */ + request_object_signing_alg_values_supported?: string[] | undefined; + /** Boolean value specifying whether the OP supports use of the request parameter, with true indicating support. If omitted, the default value is false. */ + request_parameter_supported?: boolean | undefined; + /** Boolean value specifying whether the OP supports use of the request_uri parameter, with true indicating support. If omitted, the default value is false. */ + request_uri_parameter_supported?: boolean | undefined; + /** Boolean value specifying whether the OP requires use of the request_uri parameter. If omitted, the default value is false. */ + require_request_uri_registration?: boolean | undefined; + /** A list of the OAuth 2.0 response_mode values that this OP supports. If omitted, the default for Dynamic OpenID Providers is ["query", "fragment"] */ + response_modes_supported?: string[] | undefined; + /** A list of the OAuth 2.0 response_type values that this OP supports. Dynamic OpenID Providers MUST support the code, id_token, and the token id_token Response Type values */ + response_types_supported?: string[] | undefined; + /** A list of the OAuth 2.0 [RFC6749] scope values that this server supports. The server MUST support the openid scope value. Servers MAY choose not to advertise some supported scope values even when this parameter is used, although those defined in [OpenID.Core] SHOULD be listed, if supported. RECOMMENDED but not REQUIRED */ + scopes_supported?: string[] | undefined; + /** URL of a page containing human-readable information that developers might want or need to know when using the OpenID Provider. In particular, if the OpenID Provider does not support Dynamic Client Registration, then information on how to register Clients needs to be provided in this documentation. */ + service_documentation?: string | undefined; + /** A list of the Subject Identifier types that this OP supports. Valid types include pairwise and public */ + subject_types_supported?: string[] | undefined; + /** URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow. */ + token_endpoint?: string | undefined; + /** JSON array containing a list of Client Authentication methods supported by this Token Endpoint. The options are client_secret_post, client_secret_basic, client_secret_jwt, and private_key_jwt, as described in Section 9 of OpenID Connect Core 1.0 [OpenID.Core]. Other authentication methods MAY be defined by extensions. If omitted, the default is client_secret_basic -- the HTTP Basic Authentication Scheme specified in Section 2.3.1 of OAuth 2.0 [RFC6749]. */ + token_endpoint_auth_methods_supported?: string[] | undefined; + /** JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used. */ + token_endpoint_auth_signing_alg_values_supported?: string[] | undefined; + /** Languages and scripts supported for the user interface, represented as a JSON array of BCP47 [RFC5646] language tag values. */ + ui_locales_supported?: string[] | undefined; + /** JSON array containing a list of the JWE [JWE] encryption algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. */ + userinfo_encryption_alg_values_supported?: string[] | undefined; + /** JSON array containing a list of the JWE encryption algorithms (enc values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. */ + userinfo_encryption_enc_values_supported?: string[] | undefined; + /** Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token. */ + userinfo_endpoint?: string | undefined; + /** JSON array containing a list of the JWS [JWS] signing algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. The value none MAY be included. */ + userinfo_signing_alg_values_supported?: string[] | undefined; +} + +/** The internal schema version of the connection options. */ +export const EventStreamCloudEventConnectionCreatedObject0OptionsSchemaVersionEnum = { + Openid100: "openid-1.0.0", + OidcV4: "oidc-v4", +} as const; +export type EventStreamCloudEventConnectionCreatedObject0OptionsSchemaVersionEnum = + (typeof EventStreamCloudEventConnectionCreatedObject0OptionsSchemaVersionEnum)[keyof typeof EventStreamCloudEventConnectionCreatedObject0OptionsSchemaVersionEnum]; + +/** Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values. */ +export const EventStreamCloudEventConnectionCreatedObject0OptionsSetUserRootAttributesEnum = { + OnEachLogin: "on_each_login", + OnFirstLogin: "on_first_login", + NeverOnLogin: "never_on_login", +} as const; +export type EventStreamCloudEventConnectionCreatedObject0OptionsSetUserRootAttributesEnum = + (typeof EventStreamCloudEventConnectionCreatedObject0OptionsSetUserRootAttributesEnum)[keyof typeof EventStreamCloudEventConnectionCreatedObject0OptionsSetUserRootAttributesEnum]; + +/** Authentication method used at the identity provider's token endpoint. 'client_secret_post' sends credentials in the request body; 'private_key_jwt' uses a signed JWT assertion for enhanced security. Applicable when strategy=oidc or okta. */ +export const EventStreamCloudEventConnectionCreatedObject0OptionsTokenEndpointAuthMethodEnum = { + ClientSecretPost: "client_secret_post", + PrivateKeyJwt: "private_key_jwt", +} as const; +export type EventStreamCloudEventConnectionCreatedObject0OptionsTokenEndpointAuthMethodEnum = + (typeof EventStreamCloudEventConnectionCreatedObject0OptionsTokenEndpointAuthMethodEnum)[keyof typeof EventStreamCloudEventConnectionCreatedObject0OptionsTokenEndpointAuthMethodEnum]; + +/** Algorithm used to sign client_assertions. Applicable when strategy=oidc or okta. */ +export const EventStreamCloudEventConnectionCreatedObject0OptionsTokenEndpointAuthSigningAlgEnum = { + Es256: "ES256", + Es384: "ES384", + Ps256: "PS256", + Ps384: "PS384", + Rs256: "RS256", + Rs384: "RS384", + Rs512: "RS512", +} as const; +export type EventStreamCloudEventConnectionCreatedObject0OptionsTokenEndpointAuthSigningAlgEnum = + (typeof EventStreamCloudEventConnectionCreatedObject0OptionsTokenEndpointAuthSigningAlgEnum)[keyof typeof EventStreamCloudEventConnectionCreatedObject0OptionsTokenEndpointAuthSigningAlgEnum]; + +/** Specifies the format of the aud (audience) claim included in the JWT used for client authentication at the token endpoint. Accepted values are: 'issuer' (the aud claim is set to the OIDC issuer URL) or 'token_endpoint' (the aud claim is set to the token endpoint URL). */ +export const EventStreamCloudEventConnectionCreatedObject0OptionsTokenEndpointJwtcaAudFormatEnum = { + Issuer: "issuer", + TokenEndpoint: "token_endpoint", +} as const; +export type EventStreamCloudEventConnectionCreatedObject0OptionsTokenEndpointJwtcaAudFormatEnum = + (typeof EventStreamCloudEventConnectionCreatedObject0OptionsTokenEndpointJwtcaAudFormatEnum)[keyof typeof EventStreamCloudEventConnectionCreatedObject0OptionsTokenEndpointJwtcaAudFormatEnum]; + +/** OIDC communication channel type. 'back_channel' (confidential client) exchanges tokens server-side for stronger security; 'front_channel' handles responses in the browser. */ +export const EventStreamCloudEventConnectionCreatedObject0OptionsTypeEnum = { + BackChannel: "back_channel", + FrontChannel: "front_channel", +} as const; +export type EventStreamCloudEventConnectionCreatedObject0OptionsTypeEnum = + (typeof EventStreamCloudEventConnectionCreatedObject0OptionsTypeEnum)[keyof typeof EventStreamCloudEventConnectionCreatedObject0OptionsTypeEnum]; + +/** + * Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps + */ +export type EventStreamCloudEventConnectionCreatedObject0OptionsUpstreamParams = Record; + +/** The connection strategy. */ +export const EventStreamCloudEventConnectionCreatedObject0StrategyEnum = { + Oidc: "oidc", +} as const; +export type EventStreamCloudEventConnectionCreatedObject0StrategyEnum = + (typeof EventStreamCloudEventConnectionCreatedObject0StrategyEnum)[keyof typeof EventStreamCloudEventConnectionCreatedObject0StrategyEnum]; + +export interface EventStreamCloudEventConnectionCreatedObject1 { + authentication?: Management.EventStreamCloudEventConnectionCreatedObject1Authentication | undefined; + connected_accounts?: Management.EventStreamCloudEventConnectionCreatedObject1ConnectedAccounts | undefined; + /** Connection name used in the new universal login experience */ + display_name?: string | undefined; + /** Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients. */ + enabled_clients?: string[] | undefined; + /** The connection's identifier */ + id: string; + /** true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.) */ + is_domain_connection?: boolean | undefined; + metadata?: Management.EventStreamCloudEventConnectionCreatedObject1Metadata | undefined; + /** The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128 */ + name: string; + /** Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm. */ + realms?: string[] | undefined; + options?: Management.EventStreamCloudEventConnectionCreatedObject1Options | undefined; + /** Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`. */ + show_as_button?: boolean | undefined; + strategy: Management.EventStreamCloudEventConnectionCreatedObject1StrategyEnum; +} + +/** + * Configure the purpose of a connection to be used for authentication during login. + */ +export interface EventStreamCloudEventConnectionCreatedObject1Authentication { + active: boolean; +} + +/** + * Configure the purpose of a connection to be used for connected accounts and Token Vault. + */ +export interface EventStreamCloudEventConnectionCreatedObject1ConnectedAccounts { + active: boolean; +} + +/** + * Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed. + */ +export interface EventStreamCloudEventConnectionCreatedObject1Metadata {} + +/** + * Options for the 'okta' connection + */ +export interface EventStreamCloudEventConnectionCreatedObject1Options { + /** URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow. */ + authorization_endpoint?: string | undefined; + /** OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider. */ + client_id: string; + connection_settings?: Management.EventStreamCloudEventConnectionCreatedObject1OptionsConnectionSettings | undefined; + /** Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication. */ + domain_aliases?: string[] | undefined; + dpop_signing_alg?: Management.EventStreamCloudEventConnectionCreatedObject1OptionsDpopSigningAlgEnum | undefined; + federated_connections_access_tokens?: + | Management.EventStreamCloudEventConnectionCreatedObject1OptionsFederatedConnectionsAccessTokens + | undefined; + /** https url of the icon to be shown */ + icon_url?: string | undefined; + /** Indicates whether the identity provider supports session expiry via the id_token. If true, the system will use the session_expiry claim in the id_token to determine session expiry. */ + id_token_session_expiry_supported?: boolean | undefined; + /** List of algorithms allowed to verify the ID tokens. Applicable when strategy=oidc or okta. */ + id_token_signed_response_algs?: + | Management.EventStreamCloudEventConnectionCreatedObject1OptionsIdTokenSignedResponseAlgsItemEnum[] + | undefined; + /** The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider. */ + issuer?: string | undefined; + /** URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures. */ + jwks_uri?: string | undefined; + /** An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist) */ + non_persistent_attrs?: string[] | undefined; + oidc_metadata?: Management.EventStreamCloudEventConnectionCreatedObject1OptionsOidcMetadata | undefined; + schema_version?: Management.EventStreamCloudEventConnectionCreatedObject1OptionsSchemaVersionEnum | undefined; + /** Space-separated list of OAuth 2.0 scopes requested during authorization. Must include 'openid' (required by OIDC spec). Common values: 'openid profile email'. Additional scopes depend on the identity provider. */ + scope?: string | undefined; + /** When true and type is 'back_channel', includes a cryptographic nonce in authorization requests to prevent replay attacks. The identity provider must include this nonce in the ID token for validation. */ + send_back_channel_nonce?: boolean | undefined; + set_user_root_attributes?: + | Management.EventStreamCloudEventConnectionCreatedObject1OptionsSetUserRootAttributesEnum + | undefined; + /** Tenant domain */ + tenant_domain?: string | undefined; + /** URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow. */ + token_endpoint?: string | undefined; + token_endpoint_auth_method?: + | Management.EventStreamCloudEventConnectionCreatedObject1OptionsTokenEndpointAuthMethodEnum + | undefined; + token_endpoint_auth_signing_alg?: + | Management.EventStreamCloudEventConnectionCreatedObject1OptionsTokenEndpointAuthSigningAlgEnum + | undefined; + token_endpoint_jwtca_aud_format?: + | Management.EventStreamCloudEventConnectionCreatedObject1OptionsTokenEndpointJwtcaAudFormatEnum + | undefined; + upstream_params?: Management.EventStreamCloudEventConnectionCreatedObject1OptionsUpstreamParams | undefined; + /** Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token. */ + userinfo_endpoint?: string | undefined; + attribute_map?: Management.EventStreamCloudEventConnectionCreatedObject1OptionsAttributeMap | undefined; + /** Domain of the Okta organization (e.g., dev-123456.okta.com). Should be just the domain of the okta server with no scheme or trailing backslash. Discovery runs only when connection.options.oidc_metadata is empty and a domain is provided */ + domain?: string | undefined; + type?: Management.EventStreamCloudEventConnectionCreatedObject1OptionsTypeEnum | undefined; +} + +/** + * Mapping of claims received from the identity provider (IdP) + */ +export interface EventStreamCloudEventConnectionCreatedObject1OptionsAttributeMap { + attributes?: Management.EventStreamCloudEventConnectionCreatedObject1OptionsAttributeMapAttributes | undefined; + /** Scopes to send to the IdP's Userinfo endpoint */ + userinfo_scope?: string | undefined; + mapping_mode?: + | Management.EventStreamCloudEventConnectionCreatedObject1OptionsAttributeMapMappingModeEnum + | undefined; +} + +/** + * Object containing mapping details for incoming claims + */ +export type EventStreamCloudEventConnectionCreatedObject1OptionsAttributeMapAttributes = Record; + +/** Method used to map incoming claims when strategy=okta. */ +export const EventStreamCloudEventConnectionCreatedObject1OptionsAttributeMapMappingModeEnum = { + BasicProfile: "basic_profile", + UseMap: "use_map", +} as const; +export type EventStreamCloudEventConnectionCreatedObject1OptionsAttributeMapMappingModeEnum = + (typeof EventStreamCloudEventConnectionCreatedObject1OptionsAttributeMapMappingModeEnum)[keyof typeof EventStreamCloudEventConnectionCreatedObject1OptionsAttributeMapMappingModeEnum]; + +/** + * OAuth 2.0 PKCE (Proof Key for Code Exchange) settings. PKCE enhances security for public clients by preventing authorization code interception attacks. 'auto' (recommended) uses the strongest method supported by the IdP. + */ +export interface EventStreamCloudEventConnectionCreatedObject1OptionsConnectionSettings { + pkce?: Management.EventStreamCloudEventConnectionCreatedObject1OptionsConnectionSettingsPkceEnum | undefined; +} + +/** PKCE configuration. */ +export const EventStreamCloudEventConnectionCreatedObject1OptionsConnectionSettingsPkceEnum = { + Auto: "auto", + S256: "S256", + Plain: "plain", + Disabled: "disabled", +} as const; +export type EventStreamCloudEventConnectionCreatedObject1OptionsConnectionSettingsPkceEnum = + (typeof EventStreamCloudEventConnectionCreatedObject1OptionsConnectionSettingsPkceEnum)[keyof typeof EventStreamCloudEventConnectionCreatedObject1OptionsConnectionSettingsPkceEnum]; + +/** Algorithm used for DPoP proof JWT signing. Applicable when strategy=oidc or okta. */ +export const EventStreamCloudEventConnectionCreatedObject1OptionsDpopSigningAlgEnum = { + Es256: "ES256", + Es384: "ES384", + Es512: "ES512", + Ed25519: "Ed25519", +} as const; +export type EventStreamCloudEventConnectionCreatedObject1OptionsDpopSigningAlgEnum = + (typeof EventStreamCloudEventConnectionCreatedObject1OptionsDpopSigningAlgEnum)[keyof typeof EventStreamCloudEventConnectionCreatedObject1OptionsDpopSigningAlgEnum]; + +/** + * Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users. + */ +export interface EventStreamCloudEventConnectionCreatedObject1OptionsFederatedConnectionsAccessTokens { + /** Enables refresh tokens and access tokens collection for federated connections */ + active: boolean; +} + +/** Algorithm allowed to verify the ID tokens. */ +export const EventStreamCloudEventConnectionCreatedObject1OptionsIdTokenSignedResponseAlgsItemEnum = { + Es256: "ES256", + Es384: "ES384", + Ps256: "PS256", + Ps384: "PS384", + Rs256: "RS256", + Rs384: "RS384", + Rs512: "RS512", +} as const; +export type EventStreamCloudEventConnectionCreatedObject1OptionsIdTokenSignedResponseAlgsItemEnum = + (typeof EventStreamCloudEventConnectionCreatedObject1OptionsIdTokenSignedResponseAlgsItemEnum)[keyof typeof EventStreamCloudEventConnectionCreatedObject1OptionsIdTokenSignedResponseAlgsItemEnum]; + +/** + * OpenID Connect Provider Metadata as per https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata + */ +export interface EventStreamCloudEventConnectionCreatedObject1OptionsOidcMetadata { + /** A list of the Authentication Context Class References that this OP supports */ + acr_values_supported?: string[] | undefined; + /** URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow. */ + authorization_endpoint: string; + /** JSON array containing a list of the Claim Types that the OpenID Provider supports. These Claim Types are described in Section 5.6 of OpenID Connect Core 1.0 [OpenID.Core]. If omitted, the implementation supports only normal Claims. */ + claim_types_supported?: string[] | undefined; + /** Languages and scripts supported for values in Claims being returned, represented as a JSON array of BCP47 [RFC5646] language tag values. Not all languages and scripts are necessarily supported for all Claim values. */ + claims_locales_supported?: string[] | undefined; + /** Boolean value specifying whether the OP supports use of the claims parameter, with true indicating support. If omitted, the default value is false. */ + claims_parameter_supported?: boolean | undefined; + /** JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply values for. Note that for privacy or other reasons, this might not be an exhaustive list. */ + claims_supported?: string[] | undefined; + /** JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used. */ + display_values_supported?: string[] | undefined; + /** JSON array containing a list of the JWS signing algorithms (alg values) supported for DPoP proof JWT signing. */ + dpop_signing_alg_values_supported?: string[] | undefined; + /** URL of the identity provider's logout/end session endpoint. When configured as a static URL, users are redirected here after logging out from Auth0. Must use HTTPS scheme. */ + end_session_endpoint?: string | undefined; + /** A list of the OAuth 2.0 Grant Type values that this OP supports. Dynamic OpenID Providers MUST support the authorization_code and implicit Grant Type values and MAY support other Grant Types. If omitted, the default value is ["authorization_code", "implicit"]. */ + grant_types_supported?: string[] | undefined; + /** JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT */ + id_token_encryption_alg_values_supported?: string[] | undefined; + /** JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for the ID Token to encode the Claims in a JWT [JWT]. */ + id_token_encryption_enc_values_supported?: string[] | undefined; + /** A list of the JWS signing algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT. The algorithm RS256 MUST be included. The value none MAY be supported, but MUST NOT be used unless the Response Type used returns no ID Token from the Authorization Endpoint (such as when using the Authorization Code Flow). https://datatracker.ietf.org/doc/html/rfc7518 */ + id_token_signing_alg_values_supported: string[]; + /** The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider. */ + issuer: string; + /** URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures. */ + jwks_uri: string; + /** URL that the OpenID Provider provides to the person registering the Client to read about the OPs requirements on how the Relying Party can use the data provided by the OP. The registration process SHOULD display this URL to the person registering the Client if it is given. */ + op_policy_uri?: string | undefined; + /** URL that the OpenID Provider provides to the person registering the Client to read about OpenID Providers terms of service. The registration process SHOULD display this URL to the person registering the Client if it is given. */ + op_tos_uri?: string | undefined; + /** URL of the OPs Dynamic Client Registration Endpoint. RECOMMENDED but not REQUIRED. https://openid.net/specs/openid-connect-discovery-1_0.html#OpenID.Registration */ + registration_endpoint?: string | undefined; + /** JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference. */ + request_object_encryption_alg_values_supported?: string[] | undefined; + /** JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference. */ + request_object_encryption_enc_values_supported?: string[] | undefined; + /** JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for Request Objects, which are described in Section 6.1 of OpenID Connect Core 1.0 [OpenID.Core]. These algorithms are used both when the Request Object is passed by value (using the request parameter) and when it is passed by reference (using the request_uri parameter). Servers SHOULD support none and RS256. */ + request_object_signing_alg_values_supported?: string[] | undefined; + /** Boolean value specifying whether the OP supports use of the request parameter, with true indicating support. If omitted, the default value is false. */ + request_parameter_supported?: boolean | undefined; + /** Boolean value specifying whether the OP supports use of the request_uri parameter, with true indicating support. If omitted, the default value is false. */ + request_uri_parameter_supported?: boolean | undefined; + /** Boolean value specifying whether the OP requires use of the request_uri parameter. If omitted, the default value is false. */ + require_request_uri_registration?: boolean | undefined; + /** A list of the OAuth 2.0 response_mode values that this OP supports. If omitted, the default for Dynamic OpenID Providers is ["query", "fragment"] */ + response_modes_supported?: string[] | undefined; + /** A list of the OAuth 2.0 response_type values that this OP supports. Dynamic OpenID Providers MUST support the code, id_token, and the token id_token Response Type values */ + response_types_supported?: string[] | undefined; + /** A list of the OAuth 2.0 [RFC6749] scope values that this server supports. The server MUST support the openid scope value. Servers MAY choose not to advertise some supported scope values even when this parameter is used, although those defined in [OpenID.Core] SHOULD be listed, if supported. RECOMMENDED but not REQUIRED */ + scopes_supported?: string[] | undefined; + /** URL of a page containing human-readable information that developers might want or need to know when using the OpenID Provider. In particular, if the OpenID Provider does not support Dynamic Client Registration, then information on how to register Clients needs to be provided in this documentation. */ + service_documentation?: string | undefined; + /** A list of the Subject Identifier types that this OP supports. Valid types include pairwise and public */ + subject_types_supported?: string[] | undefined; + /** URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow. */ + token_endpoint?: string | undefined; + /** JSON array containing a list of Client Authentication methods supported by this Token Endpoint. The options are client_secret_post, client_secret_basic, client_secret_jwt, and private_key_jwt, as described in Section 9 of OpenID Connect Core 1.0 [OpenID.Core]. Other authentication methods MAY be defined by extensions. If omitted, the default is client_secret_basic -- the HTTP Basic Authentication Scheme specified in Section 2.3.1 of OAuth 2.0 [RFC6749]. */ + token_endpoint_auth_methods_supported?: string[] | undefined; + /** JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used. */ + token_endpoint_auth_signing_alg_values_supported?: string[] | undefined; + /** Languages and scripts supported for the user interface, represented as a JSON array of BCP47 [RFC5646] language tag values. */ + ui_locales_supported?: string[] | undefined; + /** JSON array containing a list of the JWE [JWE] encryption algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. */ + userinfo_encryption_alg_values_supported?: string[] | undefined; + /** JSON array containing a list of the JWE encryption algorithms (enc values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. */ + userinfo_encryption_enc_values_supported?: string[] | undefined; + /** Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token. */ + userinfo_endpoint?: string | undefined; + /** JSON array containing a list of the JWS [JWS] signing algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. The value none MAY be included. */ + userinfo_signing_alg_values_supported?: string[] | undefined; +} + +/** The internal schema version of the connection options. */ +export const EventStreamCloudEventConnectionCreatedObject1OptionsSchemaVersionEnum = { + Openid100: "openid-1.0.0", + OidcV4: "oidc-v4", +} as const; +export type EventStreamCloudEventConnectionCreatedObject1OptionsSchemaVersionEnum = + (typeof EventStreamCloudEventConnectionCreatedObject1OptionsSchemaVersionEnum)[keyof typeof EventStreamCloudEventConnectionCreatedObject1OptionsSchemaVersionEnum]; + +/** Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values. */ +export const EventStreamCloudEventConnectionCreatedObject1OptionsSetUserRootAttributesEnum = { + OnEachLogin: "on_each_login", + OnFirstLogin: "on_first_login", + NeverOnLogin: "never_on_login", +} as const; +export type EventStreamCloudEventConnectionCreatedObject1OptionsSetUserRootAttributesEnum = + (typeof EventStreamCloudEventConnectionCreatedObject1OptionsSetUserRootAttributesEnum)[keyof typeof EventStreamCloudEventConnectionCreatedObject1OptionsSetUserRootAttributesEnum]; + +/** Authentication method used at the identity provider's token endpoint. 'client_secret_post' sends credentials in the request body; 'private_key_jwt' uses a signed JWT assertion for enhanced security. Applicable when strategy=oidc or okta. */ +export const EventStreamCloudEventConnectionCreatedObject1OptionsTokenEndpointAuthMethodEnum = { + ClientSecretPost: "client_secret_post", + PrivateKeyJwt: "private_key_jwt", +} as const; +export type EventStreamCloudEventConnectionCreatedObject1OptionsTokenEndpointAuthMethodEnum = + (typeof EventStreamCloudEventConnectionCreatedObject1OptionsTokenEndpointAuthMethodEnum)[keyof typeof EventStreamCloudEventConnectionCreatedObject1OptionsTokenEndpointAuthMethodEnum]; + +/** Algorithm used to sign client_assertions. Applicable when strategy=oidc or okta. */ +export const EventStreamCloudEventConnectionCreatedObject1OptionsTokenEndpointAuthSigningAlgEnum = { + Es256: "ES256", + Es384: "ES384", + Ps256: "PS256", + Ps384: "PS384", + Rs256: "RS256", + Rs384: "RS384", + Rs512: "RS512", +} as const; +export type EventStreamCloudEventConnectionCreatedObject1OptionsTokenEndpointAuthSigningAlgEnum = + (typeof EventStreamCloudEventConnectionCreatedObject1OptionsTokenEndpointAuthSigningAlgEnum)[keyof typeof EventStreamCloudEventConnectionCreatedObject1OptionsTokenEndpointAuthSigningAlgEnum]; + +/** Specifies the format of the aud (audience) claim included in the JWT used for client authentication at the token endpoint. Accepted values are: 'issuer' (the aud claim is set to the OIDC issuer URL) or 'token_endpoint' (the aud claim is set to the token endpoint URL). */ +export const EventStreamCloudEventConnectionCreatedObject1OptionsTokenEndpointJwtcaAudFormatEnum = { + Issuer: "issuer", + TokenEndpoint: "token_endpoint", +} as const; +export type EventStreamCloudEventConnectionCreatedObject1OptionsTokenEndpointJwtcaAudFormatEnum = + (typeof EventStreamCloudEventConnectionCreatedObject1OptionsTokenEndpointJwtcaAudFormatEnum)[keyof typeof EventStreamCloudEventConnectionCreatedObject1OptionsTokenEndpointJwtcaAudFormatEnum]; + +/** Connection type */ +export const EventStreamCloudEventConnectionCreatedObject1OptionsTypeEnum = { + BackChannel: "back_channel", +} as const; +export type EventStreamCloudEventConnectionCreatedObject1OptionsTypeEnum = + (typeof EventStreamCloudEventConnectionCreatedObject1OptionsTypeEnum)[keyof typeof EventStreamCloudEventConnectionCreatedObject1OptionsTypeEnum]; + +/** + * Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps + */ +export type EventStreamCloudEventConnectionCreatedObject1OptionsUpstreamParams = Record; + +/** The connection strategy. */ +export const EventStreamCloudEventConnectionCreatedObject1StrategyEnum = { + Okta: "okta", +} as const; +export type EventStreamCloudEventConnectionCreatedObject1StrategyEnum = + (typeof EventStreamCloudEventConnectionCreatedObject1StrategyEnum)[keyof typeof EventStreamCloudEventConnectionCreatedObject1StrategyEnum]; + +export interface EventStreamCloudEventConnectionCreatedObject2 { + authentication?: Management.EventStreamCloudEventConnectionCreatedObject2Authentication | undefined; + connected_accounts?: Management.EventStreamCloudEventConnectionCreatedObject2ConnectedAccounts | undefined; + /** Connection name used in the new universal login experience */ + display_name?: string | undefined; + /** Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients. */ + enabled_clients?: string[] | undefined; + /** The connection's identifier */ + id: string; + /** true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.) */ + is_domain_connection?: boolean | undefined; + metadata?: Management.EventStreamCloudEventConnectionCreatedObject2Metadata | undefined; + /** The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128 */ + name: string; + /** Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm. */ + realms?: string[] | undefined; + options?: Management.EventStreamCloudEventConnectionCreatedObject2Options | undefined; + /** Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`. */ + show_as_button?: boolean | undefined; + strategy: Management.EventStreamCloudEventConnectionCreatedObject2StrategyEnum; +} + +/** + * Configure the purpose of a connection to be used for authentication during login. + */ +export interface EventStreamCloudEventConnectionCreatedObject2Authentication { + active: boolean; +} + +/** + * Configure the purpose of a connection to be used for connected accounts and Token Vault. + */ +export interface EventStreamCloudEventConnectionCreatedObject2ConnectedAccounts { + active: boolean; +} + +/** + * Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed. + */ +export interface EventStreamCloudEventConnectionCreatedObject2Metadata {} + +/** + * Options for the 'samlp' connection + */ +export interface EventStreamCloudEventConnectionCreatedObject2Options { + assertion_decryption_settings?: + | Management.EventStreamCloudEventConnectionCreatedObject2OptionsAssertionDecryptionSettings + | undefined; + /** X.509 signing certificate from the identity provider in .der format. Used to validate signatures in SAML Responses and Assertions. This is an alternative to signingCert and is kept for backward compatibility. Prefer using signingCert instead. */ + cert?: string | undefined; + /** Timestamp of the last certificate expiring soon notification. */ + cert_rollover_notification?: string | undefined; + digestAlgorithm?: Management.EventStreamCloudEventConnectionCreatedObject2OptionsDigestAlgorithmEnum | undefined; + /** Domain aliases for the connection */ + domain_aliases?: string[] | undefined; + /** The entity identifier (Issuer) for the SAML Service Provider. When not provided, defaults to 'urn:auth0:{tenant}:{connection}'. This value is included in SAML AuthnRequest messages sent to the identity provider. */ + entityId?: string | undefined; + /** ISO 8601 formatted datetime indicating when the identity provider's signing certificate expires. */ + expires?: string | undefined; + /** URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows. */ + icon_url?: string | undefined; + idpinitiated?: Management.EventStreamCloudEventConnectionCreatedObject2OptionsIdpinitiated | undefined; + /** An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist) */ + non_persistent_attrs?: string[] | undefined; + protocolBinding?: Management.EventStreamCloudEventConnectionCreatedObject2OptionsProtocolBindingEnum | undefined; + set_user_root_attributes?: + | Management.EventStreamCloudEventConnectionCreatedObject2OptionsSetUserRootAttributesEnum + | undefined; + signatureAlgorithm?: + | Management.EventStreamCloudEventConnectionCreatedObject2OptionsSignatureAlgorithmEnum + | undefined; + /** Identity provider's SAML SingleSignOnService endpoint URL where Auth0 sends SAML authentication requests. This is the primary login URL for the SAML connection. Required unless using metadataUrl or metadataXml. */ + signInEndpoint?: string | undefined; + /** Base64-encoded X.509 certificate from the identity provider used to validate signatures in SAML responses and assertions. The certificate is decoded and used for cryptographic signature verification. */ + signingCert?: string | undefined; + /** When true, Auth0 signs SAML authentication requests using the connection's signing key. The signature includes the request's digest and is validated by the identity provider. Defaults to false (unsigned requests). */ + signSAMLRequest?: boolean | undefined; + subject?: Management.EventStreamCloudEventConnectionCreatedObject2OptionsSubject | undefined; + /** For SAML connections, the tenant domain used to construct the login endpoint URL. Can be a string for single-tenant or an array of strings for multi-tenant validation. */ + tenant_domain?: string | undefined; + /** SHA-1 thumbprints (fingerprints) of the identity provider's signing certificates. Automatically computed from signingCert during connection creation. Each thumbprint must be a 40-character hexadecimal string. */ + thumbprints?: string[] | undefined; + upstream_params?: Management.EventStreamCloudEventConnectionCreatedObject2OptionsUpstreamParams | undefined; + /** When true, enables detailed SAML debugging by issuing 'w' (warning) events in tenant logs containing SAML request/response details. WARNING: Potentially exposes sensitive user information (PII, credentials) and should only be enabled temporarily for debugging purposes. */ + debug?: boolean | undefined; + /** When true, enables DEFLATE compression for SAML requests sent via HTTP-Redirect binding. */ + deflate?: boolean | undefined; + /** The URL where Auth0 will send SAML authentication requests (the Identity Provider's SSO URL). Must be a valid HTTPS URL. */ + destinationUrl?: string | undefined; + /** When true, disables sending SAML logout requests (SingleLogoutService) to the identity provider during user sign-out. The user will be logged out of Auth0 but will remain logged into the identity provider. Defaults to false (federated logout enabled). */ + disableSignout?: boolean | undefined; + fieldsMap?: Management.EventStreamCloudEventConnectionCreatedObject2OptionsFieldsMap | undefined; + /** Expected 'iss' (Issuer) claim value for JWT tokens in Global Token Revocation requests from the identity provider. When configured, Auth0 validates the JWT issuer matches this value before processing token revocation. Must be used together with global_token_revocation_jwt_sub. */ + global_token_revocation_jwt_iss?: string | undefined; + /** Expected 'sub' (Subject) claim value for JWT tokens in Global Token Revocation requests from the identity provider. When configured, Auth0 validates the JWT subject matches this value before processing token revocation. Must be used together with global_token_revocation_jwt_iss. */ + global_token_revocation_jwt_sub?: string | undefined; + /** HTTPS URL to the identity provider's SAML metadata document. When provided, Auth0 automatically fetches and parses the metadata to extract signInEndpoint, signOutEndpoint, signingCert, signSAMLRequest, and protocolBinding. Use metadataUrl OR metadataXml, not both. */ + metadataUrl?: string | undefined; + /** The URL where Auth0 will send SAML authentication requests (the Identity Provider's SSO URL). Must be a valid HTTPS URL. */ + recipientUrl?: string | undefined; + /** Custom XML template for SAML authentication requests. Supports variable substitution using @@variableName@@ syntax. When not provided, uses default SAML AuthnRequest template. See https://auth0.com/docs/authenticate/protocols/saml/saml-sso-integrations/configure-auth0-saml-service-provider#customize-the-request-template */ + requestTemplate?: string | undefined; + /** Identity provider's SAML SingleLogoutService endpoint URL where Auth0 sends logout requests for federated sign-out. When not provided, defaults to signInEndpoint. Only used if disableSignout is false. */ + signOutEndpoint?: string | undefined; + /** Custom SAML assertion attribute to use as the unique user identifier. When provided, this attribute is prepended to the default user_id mapping list with highest priority. Accepts a string (single SAML attribute name). */ + user_id_attribute?: string | undefined; +} + +/** + * Settings for SAML assertion decryption. + */ +export interface EventStreamCloudEventConnectionCreatedObject2OptionsAssertionDecryptionSettings { + /** A list of insecure algorithms to allow for SAML assertion decryption. */ + algorithm_exceptions?: string[] | undefined; + algorithm_profile: Management.EventStreamCloudEventConnectionCreatedObject2OptionsAssertionDecryptionSettingsAlgorithmProfileEnum; +} + +/** The algorithm profile to use for decrypting SAML assertions. */ +export const EventStreamCloudEventConnectionCreatedObject2OptionsAssertionDecryptionSettingsAlgorithmProfileEnum = { + V20261: "v2026-1", +} as const; +export type EventStreamCloudEventConnectionCreatedObject2OptionsAssertionDecryptionSettingsAlgorithmProfileEnum = + (typeof EventStreamCloudEventConnectionCreatedObject2OptionsAssertionDecryptionSettingsAlgorithmProfileEnum)[keyof typeof EventStreamCloudEventConnectionCreatedObject2OptionsAssertionDecryptionSettingsAlgorithmProfileEnum]; + +/** Algorithm used for computing digest values when signing SAML requests and logout requests. Defaults to 'sha256'. */ +export const EventStreamCloudEventConnectionCreatedObject2OptionsDigestAlgorithmEnum = { + Sha1: "sha1", + Sha256: "sha256", +} as const; +export type EventStreamCloudEventConnectionCreatedObject2OptionsDigestAlgorithmEnum = + (typeof EventStreamCloudEventConnectionCreatedObject2OptionsDigestAlgorithmEnum)[keyof typeof EventStreamCloudEventConnectionCreatedObject2OptionsDigestAlgorithmEnum]; + +/** + * Maps SAML assertion attributes from the identity provider to Auth0 user profile attributes. Format: { 'auth0_field': 'saml_attribute' } or { 'auth0_field': ['saml_attr1', 'saml_attr2'] } for fallback options. Merged with default mappings for email, name, given_name, family_name, and groups. + */ +export type EventStreamCloudEventConnectionCreatedObject2OptionsFieldsMap = Record; + +/** + * Configuration for IdP-Initiated SAML Single Sign-On. When enabled, allows users to initiate login directly from their SAML identity provider without first visiting Auth0. The IdP must include the connection parameter in the post-back URL (Assertion Consumer Service URL). + */ +export interface EventStreamCloudEventConnectionCreatedObject2OptionsIdpinitiated { + /** The query string sent to the default application */ + client_authorizequery?: string | undefined; + /** The client ID to use for IdP-initiated login requests. */ + client_id?: string | undefined; + client_protocol?: + | Management.EventStreamCloudEventConnectionCreatedObject2OptionsIdpinitiatedClientProtocolEnum + | undefined; + /** When true, enables IdP-initiated login support for this SAML connection. Allows users to log in directly from the identity provider without first visiting Auth0. */ + enabled?: boolean | undefined; +} + +/** The response protocol used to communicate with the default application. */ +export const EventStreamCloudEventConnectionCreatedObject2OptionsIdpinitiatedClientProtocolEnum = { + Oidc: "oidc", + Samlp: "samlp", + Wsfed: "wsfed", +} as const; +export type EventStreamCloudEventConnectionCreatedObject2OptionsIdpinitiatedClientProtocolEnum = + (typeof EventStreamCloudEventConnectionCreatedObject2OptionsIdpinitiatedClientProtocolEnum)[keyof typeof EventStreamCloudEventConnectionCreatedObject2OptionsIdpinitiatedClientProtocolEnum]; + +/** SAML protocol binding mechanism for sending authentication requests to the identity provider. */ +export const EventStreamCloudEventConnectionCreatedObject2OptionsProtocolBindingEnum = { + UrnOasisNamesTcSaml20BindingsHttpPost: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST", + UrnOasisNamesTcSaml20BindingsHttpRedirect: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect", +} as const; +export type EventStreamCloudEventConnectionCreatedObject2OptionsProtocolBindingEnum = + (typeof EventStreamCloudEventConnectionCreatedObject2OptionsProtocolBindingEnum)[keyof typeof EventStreamCloudEventConnectionCreatedObject2OptionsProtocolBindingEnum]; + +/** Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values. */ +export const EventStreamCloudEventConnectionCreatedObject2OptionsSetUserRootAttributesEnum = { + OnEachLogin: "on_each_login", + OnFirstLogin: "on_first_login", + NeverOnLogin: "never_on_login", +} as const; +export type EventStreamCloudEventConnectionCreatedObject2OptionsSetUserRootAttributesEnum = + (typeof EventStreamCloudEventConnectionCreatedObject2OptionsSetUserRootAttributesEnum)[keyof typeof EventStreamCloudEventConnectionCreatedObject2OptionsSetUserRootAttributesEnum]; + +/** Algorithm used to sign SAML authentication requests and logout requests using the connection's signing key. Common values: 'rsa-sha256' (RSA signature with SHA-256 digest) or 'rsa-sha1'. Defaults to 'rsa-sha256'. */ +export const EventStreamCloudEventConnectionCreatedObject2OptionsSignatureAlgorithmEnum = { + RsaSha1: "rsa-sha1", + RsaSha256: "rsa-sha256", +} as const; +export type EventStreamCloudEventConnectionCreatedObject2OptionsSignatureAlgorithmEnum = + (typeof EventStreamCloudEventConnectionCreatedObject2OptionsSignatureAlgorithmEnum)[keyof typeof EventStreamCloudEventConnectionCreatedObject2OptionsSignatureAlgorithmEnum]; + +/** + * Certificate Subject Distinguished Name (DN) extracted from the identity provider's signing certificate. + */ +export interface EventStreamCloudEventConnectionCreatedObject2OptionsSubject {} + +/** + * Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps + */ +export type EventStreamCloudEventConnectionCreatedObject2OptionsUpstreamParams = Record; + +/** The connection strategy. */ +export const EventStreamCloudEventConnectionCreatedObject2StrategyEnum = { + Samlp: "samlp", +} as const; +export type EventStreamCloudEventConnectionCreatedObject2StrategyEnum = + (typeof EventStreamCloudEventConnectionCreatedObject2StrategyEnum)[keyof typeof EventStreamCloudEventConnectionCreatedObject2StrategyEnum]; + +export interface EventStreamCloudEventConnectionCreatedObject3 { + authentication?: Management.EventStreamCloudEventConnectionCreatedObject3Authentication | undefined; + connected_accounts?: Management.EventStreamCloudEventConnectionCreatedObject3ConnectedAccounts | undefined; + /** Connection name used in the new universal login experience */ + display_name?: string | undefined; + /** Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients. */ + enabled_clients?: string[] | undefined; + /** The connection's identifier */ + id: string; + /** true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.) */ + is_domain_connection?: boolean | undefined; + metadata?: Management.EventStreamCloudEventConnectionCreatedObject3Metadata | undefined; + /** The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128 */ + name: string; + /** Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm. */ + realms?: string[] | undefined; + options?: Management.EventStreamCloudEventConnectionCreatedObject3Options | undefined; + /** Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`. */ + show_as_button?: boolean | undefined; + strategy: Management.EventStreamCloudEventConnectionCreatedObject3StrategyEnum; +} + +/** + * Configure the purpose of a connection to be used for authentication during login. + */ +export interface EventStreamCloudEventConnectionCreatedObject3Authentication { + active: boolean; +} + +/** + * Configure the purpose of a connection to be used for connected accounts and Token Vault. + */ +export interface EventStreamCloudEventConnectionCreatedObject3ConnectedAccounts { + active: boolean; +} + +/** + * Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed. + */ +export interface EventStreamCloudEventConnectionCreatedObject3Metadata {} + +/** + * Options for the 'pingfederate' connection + */ +export interface EventStreamCloudEventConnectionCreatedObject3Options { + assertion_decryption_settings?: + | Management.EventStreamCloudEventConnectionCreatedObject3OptionsAssertionDecryptionSettings + | undefined; + /** X.509 signing certificate from the identity provider in .der format. Used to validate signatures in SAML Responses and Assertions. This is an alternative to signingCert and is kept for backward compatibility. Prefer using signingCert instead. */ + cert?: string | undefined; + /** Timestamp of the last certificate expiring soon notification. */ + cert_rollover_notification?: string | undefined; + digestAlgorithm?: Management.EventStreamCloudEventConnectionCreatedObject3OptionsDigestAlgorithmEnum | undefined; + /** Domain aliases for the connection */ + domain_aliases?: string[] | undefined; + /** The entity identifier (Issuer) for the SAML Service Provider. When not provided, defaults to 'urn:auth0:{tenant}:{connection}'. This value is included in SAML AuthnRequest messages sent to the identity provider. */ + entityId?: string | undefined; + /** ISO 8601 formatted datetime indicating when the identity provider's signing certificate expires. */ + expires?: string | undefined; + /** URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows. */ + icon_url?: string | undefined; + idpinitiated?: Management.EventStreamCloudEventConnectionCreatedObject3OptionsIdpinitiated | undefined; + /** An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist) */ + non_persistent_attrs?: string[] | undefined; + protocolBinding?: Management.EventStreamCloudEventConnectionCreatedObject3OptionsProtocolBindingEnum | undefined; + set_user_root_attributes?: + | Management.EventStreamCloudEventConnectionCreatedObject3OptionsSetUserRootAttributesEnum + | undefined; + signatureAlgorithm?: + | Management.EventStreamCloudEventConnectionCreatedObject3OptionsSignatureAlgorithmEnum + | undefined; + /** Identity provider's SAML SingleSignOnService endpoint URL where Auth0 sends SAML authentication requests. This is the primary login URL for the SAML connection. Required unless using metadataUrl or metadataXml. */ + signInEndpoint?: string | undefined; + /** Base64-encoded X.509 certificate from the identity provider used to validate signatures in SAML responses and assertions. The certificate is decoded and used for cryptographic signature verification. */ + signingCert?: string | undefined; + /** When true, Auth0 signs SAML authentication requests using the connection's signing key. The signature includes the request's digest and is validated by the identity provider. Defaults to false (unsigned requests). */ + signSAMLRequest?: boolean | undefined; + subject?: Management.EventStreamCloudEventConnectionCreatedObject3OptionsSubject | undefined; + /** For SAML connections, the tenant domain used to construct the login endpoint URL. Can be a string for single-tenant or an array of strings for multi-tenant validation. */ + tenant_domain?: string | undefined; + /** SHA-1 thumbprints (fingerprints) of the identity provider's signing certificates. Automatically computed from signingCert during connection creation. Each thumbprint must be a 40-character hexadecimal string. */ + thumbprints?: string[] | undefined; + upstream_params?: Management.EventStreamCloudEventConnectionCreatedObject3OptionsUpstreamParams | undefined; + /** URL provided by PingFederate which returns information used for creating the connection */ + pingFederateBaseUrl: string; +} + +/** + * Settings for SAML assertion decryption. + */ +export interface EventStreamCloudEventConnectionCreatedObject3OptionsAssertionDecryptionSettings { + /** A list of insecure algorithms to allow for SAML assertion decryption. */ + algorithm_exceptions?: string[] | undefined; + algorithm_profile: Management.EventStreamCloudEventConnectionCreatedObject3OptionsAssertionDecryptionSettingsAlgorithmProfileEnum; +} + +/** The algorithm profile to use for decrypting SAML assertions. */ +export const EventStreamCloudEventConnectionCreatedObject3OptionsAssertionDecryptionSettingsAlgorithmProfileEnum = { + V20261: "v2026-1", +} as const; +export type EventStreamCloudEventConnectionCreatedObject3OptionsAssertionDecryptionSettingsAlgorithmProfileEnum = + (typeof EventStreamCloudEventConnectionCreatedObject3OptionsAssertionDecryptionSettingsAlgorithmProfileEnum)[keyof typeof EventStreamCloudEventConnectionCreatedObject3OptionsAssertionDecryptionSettingsAlgorithmProfileEnum]; + +/** Algorithm used for computing digest values when signing SAML requests and logout requests. Defaults to 'sha256'. */ +export const EventStreamCloudEventConnectionCreatedObject3OptionsDigestAlgorithmEnum = { + Sha1: "sha1", + Sha256: "sha256", +} as const; +export type EventStreamCloudEventConnectionCreatedObject3OptionsDigestAlgorithmEnum = + (typeof EventStreamCloudEventConnectionCreatedObject3OptionsDigestAlgorithmEnum)[keyof typeof EventStreamCloudEventConnectionCreatedObject3OptionsDigestAlgorithmEnum]; + +/** + * Configuration for IdP-Initiated SAML Single Sign-On. When enabled, allows users to initiate login directly from their SAML identity provider without first visiting Auth0. The IdP must include the connection parameter in the post-back URL (Assertion Consumer Service URL). + */ +export interface EventStreamCloudEventConnectionCreatedObject3OptionsIdpinitiated { + /** The query string sent to the default application */ + client_authorizequery?: string | undefined; + /** The client ID to use for IdP-initiated login requests. */ + client_id?: string | undefined; + client_protocol?: + | Management.EventStreamCloudEventConnectionCreatedObject3OptionsIdpinitiatedClientProtocolEnum + | undefined; + /** When true, enables IdP-initiated login support for this SAML connection. Allows users to log in directly from the identity provider without first visiting Auth0. */ + enabled?: boolean | undefined; +} + +/** The response protocol used to communicate with the default application. */ +export const EventStreamCloudEventConnectionCreatedObject3OptionsIdpinitiatedClientProtocolEnum = { + Oidc: "oidc", + Samlp: "samlp", + Wsfed: "wsfed", +} as const; +export type EventStreamCloudEventConnectionCreatedObject3OptionsIdpinitiatedClientProtocolEnum = + (typeof EventStreamCloudEventConnectionCreatedObject3OptionsIdpinitiatedClientProtocolEnum)[keyof typeof EventStreamCloudEventConnectionCreatedObject3OptionsIdpinitiatedClientProtocolEnum]; + +/** SAML protocol binding mechanism for sending authentication requests to the identity provider. */ +export const EventStreamCloudEventConnectionCreatedObject3OptionsProtocolBindingEnum = { + UrnOasisNamesTcSaml20BindingsHttpPost: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST", + UrnOasisNamesTcSaml20BindingsHttpRedirect: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect", +} as const; +export type EventStreamCloudEventConnectionCreatedObject3OptionsProtocolBindingEnum = + (typeof EventStreamCloudEventConnectionCreatedObject3OptionsProtocolBindingEnum)[keyof typeof EventStreamCloudEventConnectionCreatedObject3OptionsProtocolBindingEnum]; + +/** Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values. */ +export const EventStreamCloudEventConnectionCreatedObject3OptionsSetUserRootAttributesEnum = { + OnEachLogin: "on_each_login", + OnFirstLogin: "on_first_login", + NeverOnLogin: "never_on_login", +} as const; +export type EventStreamCloudEventConnectionCreatedObject3OptionsSetUserRootAttributesEnum = + (typeof EventStreamCloudEventConnectionCreatedObject3OptionsSetUserRootAttributesEnum)[keyof typeof EventStreamCloudEventConnectionCreatedObject3OptionsSetUserRootAttributesEnum]; + +/** Algorithm used to sign SAML authentication requests and logout requests using the connection's signing key. Common values: 'rsa-sha256' (RSA signature with SHA-256 digest) or 'rsa-sha1'. Defaults to 'rsa-sha256'. */ +export const EventStreamCloudEventConnectionCreatedObject3OptionsSignatureAlgorithmEnum = { + RsaSha1: "rsa-sha1", + RsaSha256: "rsa-sha256", +} as const; +export type EventStreamCloudEventConnectionCreatedObject3OptionsSignatureAlgorithmEnum = + (typeof EventStreamCloudEventConnectionCreatedObject3OptionsSignatureAlgorithmEnum)[keyof typeof EventStreamCloudEventConnectionCreatedObject3OptionsSignatureAlgorithmEnum]; + +/** + * Certificate Subject Distinguished Name (DN) extracted from the identity provider's signing certificate. + */ +export interface EventStreamCloudEventConnectionCreatedObject3OptionsSubject {} + +/** + * Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps + */ +export type EventStreamCloudEventConnectionCreatedObject3OptionsUpstreamParams = Record; + +/** The connection strategy. */ +export const EventStreamCloudEventConnectionCreatedObject3StrategyEnum = { + Pingfederate: "pingfederate", +} as const; +export type EventStreamCloudEventConnectionCreatedObject3StrategyEnum = + (typeof EventStreamCloudEventConnectionCreatedObject3StrategyEnum)[keyof typeof EventStreamCloudEventConnectionCreatedObject3StrategyEnum]; + +export interface EventStreamCloudEventConnectionCreatedObject4 { + authentication?: Management.EventStreamCloudEventConnectionCreatedObject4Authentication | undefined; + connected_accounts?: Management.EventStreamCloudEventConnectionCreatedObject4ConnectedAccounts | undefined; + /** Connection name used in the new universal login experience */ + display_name?: string | undefined; + /** Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients. */ + enabled_clients?: string[] | undefined; + /** The connection's identifier */ + id: string; + /** true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.) */ + is_domain_connection?: boolean | undefined; + metadata?: Management.EventStreamCloudEventConnectionCreatedObject4Metadata | undefined; + /** The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128 */ + name: string; + /** Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm. */ + realms?: string[] | undefined; + options?: Management.EventStreamCloudEventConnectionCreatedObject4Options | undefined; + /** Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`. */ + show_as_button?: boolean | undefined; + strategy: Management.EventStreamCloudEventConnectionCreatedObject4StrategyEnum; +} + +/** + * Configure the purpose of a connection to be used for authentication during login. + */ +export interface EventStreamCloudEventConnectionCreatedObject4Authentication { + active: boolean; +} + +/** + * Configure the purpose of a connection to be used for connected accounts and Token Vault. + */ +export interface EventStreamCloudEventConnectionCreatedObject4ConnectedAccounts { + active: boolean; +} + +/** + * Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed. + */ +export interface EventStreamCloudEventConnectionCreatedObject4Metadata {} + +/** + * Options for the 'adfs' connection + */ +export interface EventStreamCloudEventConnectionCreatedObject4Options { + /** ADFS federation metadata host or XML URL used to discover WS-Fed endpoints and certificates. Errors if adfs_server and fedMetadataXml are both absent. */ + adfs_server?: string | undefined; + /** Timestamp of the last certificate expiring soon notification. */ + cert_rollover_notification?: string | undefined; + /** Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication. */ + domain_aliases?: string[] | undefined; + /** The entity identifier (Issuer) for the ADFS Service Provider. When not provided, defaults to 'urn:auth0:{tenant}:{connection}'. */ + entityId?: string | undefined; + /** Inline XML alternative to 'adfs_server'. Cannot be set together with 'adfs_server'. */ + fedMetadataXml?: string | undefined; + /** URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows. */ + icon_url?: string | undefined; + /** An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist) */ + non_persistent_attrs?: string[] | undefined; + /** Array of certificate thumbprints (SHA-128/SHA-256/SHA-512 hex hashes) for validating SAML signatures. Used with WS-Federation protocol. Maximum 20 thumbprints. Each thumbprint must be a hexadecimal string. */ + prev_thumbprints?: string[] | undefined; + set_user_root_attributes?: + | Management.EventStreamCloudEventConnectionCreatedObject4OptionsSetUserRootAttributesEnum + | undefined; + should_trust_email_verified_connection?: + | Management.EventStreamCloudEventConnectionCreatedObject4OptionsShouldTrustEmailVerifiedConnectionEnum + | undefined; + /** Passive Requestor (WS-Fed) sign-in endpoint discovered from metadata or provided explicitly. */ + signInEndpoint?: string | undefined; + /** Tenant domain */ + tenant_domain?: string | undefined; + /** Array of certificate thumbprints (SHA-128/SHA-256/SHA-512 hex hashes) for validating SAML signatures. Used with WS-Federation protocol. Maximum 20 thumbprints. Each thumbprint must be a hexadecimal string. */ + thumbprints?: string[] | undefined; + upstream_params?: Management.EventStreamCloudEventConnectionCreatedObject4OptionsUpstreamParams | undefined; + /** Custom ADFS claim to use as the unique user identifier. When provided, this attribute is prepended to the default user_id mapping list with highest priority. Accepts a string (single ADFS claim name). */ + user_id_attribute?: string | undefined; +} + +/** Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values. */ +export const EventStreamCloudEventConnectionCreatedObject4OptionsSetUserRootAttributesEnum = { + OnEachLogin: "on_each_login", + OnFirstLogin: "on_first_login", + NeverOnLogin: "never_on_login", +} as const; +export type EventStreamCloudEventConnectionCreatedObject4OptionsSetUserRootAttributesEnum = + (typeof EventStreamCloudEventConnectionCreatedObject4OptionsSetUserRootAttributesEnum)[keyof typeof EventStreamCloudEventConnectionCreatedObject4OptionsSetUserRootAttributesEnum]; + +/** Choose how Auth0 sets the email_verified field in the user profile. */ +export const EventStreamCloudEventConnectionCreatedObject4OptionsShouldTrustEmailVerifiedConnectionEnum = { + NeverSetEmailsAsVerified: "never_set_emails_as_verified", + AlwaysSetEmailsAsVerified: "always_set_emails_as_verified", +} as const; +export type EventStreamCloudEventConnectionCreatedObject4OptionsShouldTrustEmailVerifiedConnectionEnum = + (typeof EventStreamCloudEventConnectionCreatedObject4OptionsShouldTrustEmailVerifiedConnectionEnum)[keyof typeof EventStreamCloudEventConnectionCreatedObject4OptionsShouldTrustEmailVerifiedConnectionEnum]; + +/** + * Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps + */ +export type EventStreamCloudEventConnectionCreatedObject4OptionsUpstreamParams = Record; + +/** The connection strategy. */ +export const EventStreamCloudEventConnectionCreatedObject4StrategyEnum = { + Adfs: "adfs", +} as const; +export type EventStreamCloudEventConnectionCreatedObject4StrategyEnum = + (typeof EventStreamCloudEventConnectionCreatedObject4StrategyEnum)[keyof typeof EventStreamCloudEventConnectionCreatedObject4StrategyEnum]; + +export interface EventStreamCloudEventConnectionCreatedObject5 { + authentication?: Management.EventStreamCloudEventConnectionCreatedObject5Authentication | undefined; + connected_accounts?: Management.EventStreamCloudEventConnectionCreatedObject5ConnectedAccounts | undefined; + /** Connection name used in the new universal login experience */ + display_name?: string | undefined; + /** Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients. */ + enabled_clients?: string[] | undefined; + /** The connection's identifier */ + id: string; + /** true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.) */ + is_domain_connection?: boolean | undefined; + metadata?: Management.EventStreamCloudEventConnectionCreatedObject5Metadata | undefined; + /** The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128 */ + name: string; + /** Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm. */ + realms?: string[] | undefined; + options?: Management.EventStreamCloudEventConnectionCreatedObject5Options | undefined; + strategy: Management.EventStreamCloudEventConnectionCreatedObject5StrategyEnum; +} + +/** + * Configure the purpose of a connection to be used for authentication during login. + */ +export interface EventStreamCloudEventConnectionCreatedObject5Authentication { + active: boolean; +} + +/** + * Configure the purpose of a connection to be used for connected accounts and Token Vault. + */ +export interface EventStreamCloudEventConnectionCreatedObject5ConnectedAccounts { + active: boolean; +} + +/** + * Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed. + */ +export interface EventStreamCloudEventConnectionCreatedObject5Metadata {} + +/** + * Options for the 'ad' connection + */ +export interface EventStreamCloudEventConnectionCreatedObject5Options { + /** IP address of the AD connector agent used to validate that authentication requests originate from the corporate network for Kerberos authentication (managed by the AD Connector agent). */ + agentIP?: string | undefined; + /** When enabled, allows direct username/password authentication through the AD connector agent instead of WS-Federation protocol (managed by the AD Connector agent). */ + agentMode?: boolean | undefined; + /** Version identifier of the installed AD connector agent software (managed by the AD Connector agent). */ + agentVersion?: string | undefined; + /** Enables Auth0's brute force protection to prevent credential stuffing attacks. When enabled, blocks suspicious login attempts from specific IP addresses after repeated failures. */ + brute_force_protection?: boolean | undefined; + /** Enables client SSL certificate authentication for the AD connector, requiring HTTPS on the sign-in endpoint */ + certAuth?: boolean | undefined; + /** Array of X.509 certificates in PEM format used for validating SAML signatures from the AD identity provider (managed by the AD Connector agent). */ + certs?: string[] | undefined; + /** When enabled, disables caching of AD connector authentication results to ensure real-time validation against the directory */ + disable_cache?: boolean | undefined; + /** When enabled, hides the 'Forgot Password' link on login pages to prevent users from initiating self-service password resets */ + disable_self_service_change_password?: boolean | undefined; + /** List of domain names that can be used with identifier-first authentication flow to route users to this AD connection; each domain must be a valid DNS name up to 256 characters */ + domain_aliases?: string[] | undefined; + /** https url of the icon to be shown */ + icon_url?: string | undefined; + /** Array of IP address ranges in CIDR notation used to determine if authentication requests originate from the corporate network for Kerberos or certificate authentication. */ + ips?: string[] | undefined; + /** Enables Windows Integrated Authentication (Kerberos) for seamless SSO when users authenticate from within the corporate network IP ranges */ + kerberos?: boolean | undefined; + /** An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist) */ + non_persistent_attrs?: string[] | undefined; + set_user_root_attributes?: + | Management.EventStreamCloudEventConnectionCreatedObject5OptionsSetUserRootAttributesEnum + | undefined; + /** The sign-in endpoint type for the AD-LDAP connector agent (managed by the AD Connector agent). */ + signInEndpoint?: string | undefined; + /** Primary AD domain hint used for HRD and discovery. */ + tenant_domain?: string | undefined; + /** Array of certificate SHA-1 thumbprints for validating signatures. Managed by Auth0 when using the AD Connector agent. */ + thumbprints?: string[] | undefined; + upstream_params?: Management.EventStreamCloudEventConnectionCreatedObject5OptionsUpstreamParams | undefined; +} + +/** Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values. */ +export const EventStreamCloudEventConnectionCreatedObject5OptionsSetUserRootAttributesEnum = { + OnEachLogin: "on_each_login", + OnFirstLogin: "on_first_login", + NeverOnLogin: "never_on_login", +} as const; +export type EventStreamCloudEventConnectionCreatedObject5OptionsSetUserRootAttributesEnum = + (typeof EventStreamCloudEventConnectionCreatedObject5OptionsSetUserRootAttributesEnum)[keyof typeof EventStreamCloudEventConnectionCreatedObject5OptionsSetUserRootAttributesEnum]; + +/** + * Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps + */ +export type EventStreamCloudEventConnectionCreatedObject5OptionsUpstreamParams = Record; + +/** The connection strategy. */ +export const EventStreamCloudEventConnectionCreatedObject5StrategyEnum = { + Ad: "ad", +} as const; +export type EventStreamCloudEventConnectionCreatedObject5StrategyEnum = + (typeof EventStreamCloudEventConnectionCreatedObject5StrategyEnum)[keyof typeof EventStreamCloudEventConnectionCreatedObject5StrategyEnum]; + +export interface EventStreamCloudEventConnectionCreatedObject6 { + authentication?: Management.EventStreamCloudEventConnectionCreatedObject6Authentication | undefined; + connected_accounts?: Management.EventStreamCloudEventConnectionCreatedObject6ConnectedAccounts | undefined; + /** Connection name used in the new universal login experience */ + display_name?: string | undefined; + /** Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients. */ + enabled_clients?: string[] | undefined; + /** The connection's identifier */ + id: string; + /** true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.) */ + is_domain_connection?: boolean | undefined; + metadata?: Management.EventStreamCloudEventConnectionCreatedObject6Metadata | undefined; + /** The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128 */ + name: string; + /** Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm. */ + realms?: string[] | undefined; + options?: Management.EventStreamCloudEventConnectionCreatedObject6Options | undefined; + /** Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`. */ + show_as_button?: boolean | undefined; + strategy: Management.EventStreamCloudEventConnectionCreatedObject6StrategyEnum; +} + +/** + * Configure the purpose of a connection to be used for authentication during login. + */ +export interface EventStreamCloudEventConnectionCreatedObject6Authentication { + active: boolean; +} + +/** + * Configure the purpose of a connection to be used for connected accounts and Token Vault. + */ +export interface EventStreamCloudEventConnectionCreatedObject6ConnectedAccounts { + active: boolean; +} + +/** + * Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed. + */ +export interface EventStreamCloudEventConnectionCreatedObject6Metadata {} + +/** + * Options for the 'google-apps' connection + */ +export interface EventStreamCloudEventConnectionCreatedObject6Options { + /** Expiration timestamp for the `admin_access_token` in ISO 8601 format. Auth0 uses this value to determine when to refresh the token. */ + admin_access_token_expiresin?: string | undefined; + /** When true, allows customization of OAuth scopes requested during user login. Custom scopes are appended to the mandatory email and profile scopes. When false or omitted, only the default email and profile scopes are used. This property is automatically enabled when Token Vault or Connected Accounts features are activated. */ + allow_setting_login_scopes?: boolean | undefined; + /** Enables integration with the Google Workspace Admin SDK Directory API for groups. When true, Auth0 can synchronize groups & group memberships and supports inbound directory provisioning for groups. Defaults to false. */ + api_enable_groups?: boolean | undefined; + /** Enables integration with the Google Workspace Admin SDK Directory API. When true, Auth0 can retrieve extended user attributes (admin status, suspension status, group memberships) and supports inbound directory provisioning (SCIM). Defaults to true. */ + api_enable_users?: boolean | undefined; + /** Your Google OAuth 2.0 client ID. You can find this in your [Google Cloud Console](https://console.cloud.google.com/apis/credentials) under the OAuth 2.0 Client IDs section. */ + client_id: string; + /** Primary Google Workspace domain name that users must belong to. */ + domain?: string | undefined; + /** Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication. */ + domain_aliases?: string[] | undefined; + /** Whether the OAuth flow requests the `email` scope. */ + email?: boolean | undefined; + /** Fetches the `agreedToTerms` flag from the Google Directory profile. */ + ext_agreed_terms?: boolean | undefined; + /** Enables enrichment with Google group memberships (required for `ext_groups_extended`). */ + ext_groups?: boolean | undefined; + /** Controls whether enriched group entries include `id`, `email`, `name` (true) or only the group name (false); can only be set when `ext_groups` is true. */ + ext_groups_extended?: boolean | undefined; + /** Fetches the Google Directory admin flag for the signing-in user. */ + ext_is_admin?: boolean | undefined; + /** Fetches the Google Directory suspended flag for the signing-in user. */ + ext_is_suspended?: boolean | undefined; + federated_connections_access_tokens?: + | Management.EventStreamCloudEventConnectionCreatedObject6OptionsFederatedConnectionsAccessTokens + | undefined; + /** When enabled, users who sign in with their Google account through a social login will be automatically routed to this Google Workspace connection if their email domain matches the configured tenant_domain or domain_aliases. This ensures enterprise users authenticate through their organization's Google Workspace identity provider rather than through a generic Google social login, enabling access to directory-based attributes and enforcing organizational security policies. Defaults to true for new connections. */ + handle_login_from_social?: boolean | undefined; + /** URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows. */ + icon_url?: string | undefined; + /** Determines how Auth0 generates the user_id for Google Workspace users. When false (default), the user's email address is used. When true, Google's stable numeric user ID is used instead, which persists even if the user's email changes. This setting can only be configured when creating the connection and cannot be changed afterward. */ + map_user_id_to_id?: boolean | undefined; + /** An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist) */ + non_persistent_attrs?: string[] | undefined; + /** Whether the OAuth flow requests the `profile` scope. */ + profile?: boolean | undefined; + /** Additional OAuth scopes requested beyond the default `email profile` scopes; ignored unless `allow_setting_login_scopes` is true. */ + scope?: string[] | undefined; + set_user_root_attributes?: + | Management.EventStreamCloudEventConnectionCreatedObject6OptionsSetUserRootAttributesEnum + | undefined; + /** The Google Workspace primary domain used to identify the organization during authentication. */ + tenant_domain?: string | undefined; + upstream_params?: Management.EventStreamCloudEventConnectionCreatedObject6OptionsUpstreamParams | undefined; +} + +/** + * Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users. + */ +export interface EventStreamCloudEventConnectionCreatedObject6OptionsFederatedConnectionsAccessTokens { + /** Enables refresh tokens and access tokens collection for federated connections */ + active: boolean; +} + +/** Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values. */ +export const EventStreamCloudEventConnectionCreatedObject6OptionsSetUserRootAttributesEnum = { + OnEachLogin: "on_each_login", + OnFirstLogin: "on_first_login", + NeverOnLogin: "never_on_login", +} as const; +export type EventStreamCloudEventConnectionCreatedObject6OptionsSetUserRootAttributesEnum = + (typeof EventStreamCloudEventConnectionCreatedObject6OptionsSetUserRootAttributesEnum)[keyof typeof EventStreamCloudEventConnectionCreatedObject6OptionsSetUserRootAttributesEnum]; + +/** + * Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps + */ +export type EventStreamCloudEventConnectionCreatedObject6OptionsUpstreamParams = Record; + +/** The connection strategy. */ +export const EventStreamCloudEventConnectionCreatedObject6StrategyEnum = { + GoogleApps: "google-apps", +} as const; +export type EventStreamCloudEventConnectionCreatedObject6StrategyEnum = + (typeof EventStreamCloudEventConnectionCreatedObject6StrategyEnum)[keyof typeof EventStreamCloudEventConnectionCreatedObject6StrategyEnum]; + +export interface EventStreamCloudEventConnectionCreatedObject7 { + authentication?: Management.EventStreamCloudEventConnectionCreatedObject7Authentication | undefined; + connected_accounts?: Management.EventStreamCloudEventConnectionCreatedObject7ConnectedAccounts | undefined; + /** Connection name used in the new universal login experience */ + display_name?: string | undefined; + /** Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients. */ + enabled_clients?: string[] | undefined; + /** The connection's identifier */ + id: string; + /** true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.) */ + is_domain_connection?: boolean | undefined; + metadata?: Management.EventStreamCloudEventConnectionCreatedObject7Metadata | undefined; + /** The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128 */ + name: string; + /** Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm. */ + realms?: string[] | undefined; + options?: Management.EventStreamCloudEventConnectionCreatedObject7Options | undefined; + /** Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`. */ + show_as_button?: boolean | undefined; + strategy: Management.EventStreamCloudEventConnectionCreatedObject7StrategyEnum; +} + +/** + * Configure the purpose of a connection to be used for authentication during login. + */ +export interface EventStreamCloudEventConnectionCreatedObject7Authentication { + active: boolean; +} + +/** + * Configure the purpose of a connection to be used for connected accounts and Token Vault. + */ +export interface EventStreamCloudEventConnectionCreatedObject7ConnectedAccounts { + active: boolean; +} + +/** + * Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed. + */ +export interface EventStreamCloudEventConnectionCreatedObject7Metadata {} + +/** + * Options for the 'waad' connection + */ +export interface EventStreamCloudEventConnectionCreatedObject7Options { + /** Enable users API */ + api_enable_users?: boolean | undefined; + /** The Azure AD application domain (e.g., 'contoso.onmicrosoft.com'). Used primarily with WS-Federation protocol and Azure AD v1 endpoints. */ + app_domain?: string | undefined; + /** The Application ID URI (App ID URI) for the Azure AD application. Required when using Azure AD v1 with the Resource Owner Password flow. Used to identify the resource being requested in OAuth token requests. */ + app_id?: string | undefined; + /** Includes basic user profile information from Azure AD (name, email, given_name, family_name). Always enabled and required - represents the minimum profile data retrieved during authentication. */ + basic_profile?: boolean | undefined; + /** Timestamp of the last certificate expiring soon notification. */ + cert_rollover_notification?: string | undefined; + /** OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider. */ + client_id: string; + /** The primary Azure AD tenant domain (e.g., 'contoso.onmicrosoft.com' or 'contoso.com'). */ + domain?: string | undefined; + /** Alternative domain names associated with this Azure AD tenant. Allows users from multiple verified domains to authenticate through this connection. Can be an array of domain strings. */ + domain_aliases?: string[] | undefined; + /** When enabled (true), retrieves and stores Azure AD security group memberships for the user. Requires Microsoft Graph API permissions (Directory.Read.All). Allows configuring max_groups_to_retrieve. */ + ext_groups?: boolean | undefined; + /** When true, stores all groups the user is member of, including transitive group memberships (groups within groups). When false (default), only direct group memberships are included. */ + ext_nested_groups?: boolean | undefined; + /** When enabled (true), retrieves extended profile attributes from Azure AD via Microsoft Graph API (job title, department, office location, etc.). Requires Graph API permissions. Only available with Azure AD v1 or when explicitly enabled for v2. */ + ext_profile?: boolean | undefined; + federated_connections_access_tokens?: + | Management.EventStreamCloudEventConnectionCreatedObject7OptionsFederatedConnectionsAccessTokens + | undefined; + /** Indicates whether admin consent has been granted for the required Azure AD permissions. Read-only status field managed by Auth0 during the OAuth authorization flow. */ + granted?: boolean | undefined; + /** URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows. */ + icon_url?: string | undefined; + identity_api?: Management.EventStreamCloudEventConnectionCreatedObject7OptionsIdentityApiEnum | undefined; + /** Maximum number of Azure AD groups to retrieve per user during authentication. Helps prevent performance issues for users in many groups. Only applies when ext_groups is enabled. Leave empty to use platform default. */ + max_groups_to_retrieve?: string | undefined; + /** An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist) */ + non_persistent_attrs?: string[] | undefined; + /** OAuth 2.0 scopes to request from Azure AD during authentication. Each scope represents a permission (e.g., 'User.Read', 'Group.Read.All'). Only applies with Microsoft Identity Platform v2.0. See Microsoft Graph permissions reference for available scopes. */ + scope?: string[] | undefined; + set_user_root_attributes?: + | Management.EventStreamCloudEventConnectionCreatedObject7OptionsSetUserRootAttributesEnum + | undefined; + should_trust_email_verified_connection?: + | Management.EventStreamCloudEventConnectionCreatedObject7OptionsShouldTrustEmailVerifiedConnectionEnum + | undefined; + tenant_domain?: Management.EventStreamCloudEventConnectionCreatedObject7OptionsTenantDomainOne | undefined; + /** The Azure AD tenant ID as a UUID. The unique identifier for your Azure AD organization. Must be a valid 36-character UUID. */ + tenantId?: string | undefined; + /** Array of certificate thumbprints (SHA-128/SHA-256/SHA-512 hex hashes) for validating SAML signatures. Used with WS-Federation protocol. Maximum 20 thumbprints. Each thumbprint must be a hexadecimal string. */ + thumbprints?: string[] | undefined; + upstream_params?: Management.EventStreamCloudEventConnectionCreatedObject7OptionsUpstreamParams | undefined; + /** Indicates WS-Federation protocol usage. When true, uses WS-Federation; when false, uses OpenID Connect. */ + use_wsfed?: boolean | undefined; + /** When enabled (true), uses the Azure AD common endpoint for multi-tenant authentication. Allows users from any Azure AD organization to sign in. Requires userid_attribute set to 'sub' (not 'oid'). Cannot be used with SCIM provisioning. Defaults to false. */ + useCommonEndpoint?: boolean | undefined; + userid_attribute?: Management.EventStreamCloudEventConnectionCreatedObject7OptionsUseridAttributeEnum | undefined; + waad_protocol?: Management.EventStreamCloudEventConnectionCreatedObject7OptionsWaadProtocolEnum | undefined; +} + +/** + * Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users. + */ +export interface EventStreamCloudEventConnectionCreatedObject7OptionsFederatedConnectionsAccessTokens { + /** Enables refresh tokens and access tokens collection for federated connections */ + active: boolean; +} + +/** The Azure AD endpoint version for authentication. 'microsoft-identity-platform-v2.0' (recommended, default) supports modern OAuth 2.0 features. 'azure-active-directory-v1.0' is the legacy endpoint with protocol limitations. Selection affects available features. */ +export const EventStreamCloudEventConnectionCreatedObject7OptionsIdentityApiEnum = { + MicrosoftIdentityPlatformV20: "microsoft-identity-platform-v2.0", + AzureActiveDirectoryV10: "azure-active-directory-v1.0", +} as const; +export type EventStreamCloudEventConnectionCreatedObject7OptionsIdentityApiEnum = + (typeof EventStreamCloudEventConnectionCreatedObject7OptionsIdentityApiEnum)[keyof typeof EventStreamCloudEventConnectionCreatedObject7OptionsIdentityApiEnum]; + +/** Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values. */ +export const EventStreamCloudEventConnectionCreatedObject7OptionsSetUserRootAttributesEnum = { + OnEachLogin: "on_each_login", + OnFirstLogin: "on_first_login", + NeverOnLogin: "never_on_login", +} as const; +export type EventStreamCloudEventConnectionCreatedObject7OptionsSetUserRootAttributesEnum = + (typeof EventStreamCloudEventConnectionCreatedObject7OptionsSetUserRootAttributesEnum)[keyof typeof EventStreamCloudEventConnectionCreatedObject7OptionsSetUserRootAttributesEnum]; + +/** Choose how Auth0 sets the email_verified field in the user profile. */ +export const EventStreamCloudEventConnectionCreatedObject7OptionsShouldTrustEmailVerifiedConnectionEnum = { + NeverSetEmailsAsVerified: "never_set_emails_as_verified", + AlwaysSetEmailsAsVerified: "always_set_emails_as_verified", +} as const; +export type EventStreamCloudEventConnectionCreatedObject7OptionsShouldTrustEmailVerifiedConnectionEnum = + (typeof EventStreamCloudEventConnectionCreatedObject7OptionsShouldTrustEmailVerifiedConnectionEnum)[keyof typeof EventStreamCloudEventConnectionCreatedObject7OptionsShouldTrustEmailVerifiedConnectionEnum]; + +/** + * Azure AD tenant domain as a UUID tenant ID. + */ +export type EventStreamCloudEventConnectionCreatedObject7OptionsTenantDomainOne = string; + +/** + * Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps + */ +export type EventStreamCloudEventConnectionCreatedObject7OptionsUpstreamParams = Record; + +/** The Azure AD claim to use as the unique user identifier. 'oid' (Object ID) is recommended for single-tenant connections and required for SCIM. 'sub' (Subject) is required for multi-tenant/common endpoint. Only applies with OpenID Connect protocol. */ +export const EventStreamCloudEventConnectionCreatedObject7OptionsUseridAttributeEnum = { + Oid: "oid", + Sub: "sub", +} as const; +export type EventStreamCloudEventConnectionCreatedObject7OptionsUseridAttributeEnum = + (typeof EventStreamCloudEventConnectionCreatedObject7OptionsUseridAttributeEnum)[keyof typeof EventStreamCloudEventConnectionCreatedObject7OptionsUseridAttributeEnum]; + +/** The authentication protocol for Azure AD v1 endpoints. 'openid-connect' (default, recommended) uses modern OAuth 2.0/OIDC. 'ws-federation' is a legacy SAML-based protocol for older integrations. Only available with Azure AD v1 API. */ +export const EventStreamCloudEventConnectionCreatedObject7OptionsWaadProtocolEnum = { + WsFederation: "ws-federation", + OpenidConnect: "openid-connect", +} as const; +export type EventStreamCloudEventConnectionCreatedObject7OptionsWaadProtocolEnum = + (typeof EventStreamCloudEventConnectionCreatedObject7OptionsWaadProtocolEnum)[keyof typeof EventStreamCloudEventConnectionCreatedObject7OptionsWaadProtocolEnum]; + +/** The connection strategy. */ +export const EventStreamCloudEventConnectionCreatedObject7StrategyEnum = { + Waad: "waad", +} as const; +export type EventStreamCloudEventConnectionCreatedObject7StrategyEnum = + (typeof EventStreamCloudEventConnectionCreatedObject7StrategyEnum)[keyof typeof EventStreamCloudEventConnectionCreatedObject7StrategyEnum]; + +/** The event type (injected from the SSE event field). */ +export const EventStreamCloudEventConnectionCreatedTypeEnum = { + ConnectionCreated: "connection.created", +} as const; +export type EventStreamCloudEventConnectionCreatedTypeEnum = + (typeof EventStreamCloudEventConnectionCreatedTypeEnum)[keyof typeof EventStreamCloudEventConnectionCreatedTypeEnum]; + +/** + * SSE message for connection.deleted. + */ +export interface EventStreamCloudEventConnectionDeleted { + /** Opaque cursor representing position in the stream. Pass as the `from` query parameter to resume. */ + offset: string; + event: Management.EventStreamCloudEventConnectionDeletedCloudEvent; +} + +/** + * Represents an event that occurs when a connection is deleted. + */ +export interface EventStreamCloudEventConnectionDeletedCloudEvent { + specversion: Management.EventStreamCloudEventSpecVersionEnum; + type: Management.EventStreamCloudEventConnectionDeletedCloudEventTypeEnum; + /** The source of the event. This will take the form 'urn:auth0:.'. */ + source: string; + /** A unique identifier for the event. */ + id: string; + /** An ISO-8601 timestamp indicating when the event physically occurred. */ + time: string; + data: Management.EventStreamCloudEventConnectionDeletedData; + /** The auth0 tenant ID to which the event is associated. */ + a0tenant: string; + /** The auth0 event stream ID of the stream the event was delivered on. */ + a0stream: string; + a0purpose?: Management.EventStreamCloudEventA0PurposeEnum | undefined; +} + +/** The type of the event which has happened. */ +export const EventStreamCloudEventConnectionDeletedCloudEventTypeEnum = { + ConnectionDeleted: "connection.deleted", +} as const; +export type EventStreamCloudEventConnectionDeletedCloudEventTypeEnum = + (typeof EventStreamCloudEventConnectionDeletedCloudEventTypeEnum)[keyof typeof EventStreamCloudEventConnectionDeletedCloudEventTypeEnum]; + +/** + * The event payload. + */ +export interface EventStreamCloudEventConnectionDeletedData { + object: Management.EventStreamCloudEventConnectionDeletedObject; + context?: Management.EventStreamCloudEventContext | undefined; +} + +/** + * The event content. + */ +export type EventStreamCloudEventConnectionDeletedObject = + | Management.EventStreamCloudEventConnectionDeletedObject0 + | Management.EventStreamCloudEventConnectionDeletedObject1 + | Management.EventStreamCloudEventConnectionDeletedObject2 + | Management.EventStreamCloudEventConnectionDeletedObject3 + | Management.EventStreamCloudEventConnectionDeletedObject4 + | Management.EventStreamCloudEventConnectionDeletedObject5 + | Management.EventStreamCloudEventConnectionDeletedObject6 + | Management.EventStreamCloudEventConnectionDeletedObject7; + +export interface EventStreamCloudEventConnectionDeletedObject0 { + authentication?: Management.EventStreamCloudEventConnectionDeletedObject0Authentication | undefined; + /** Connection name used in the new universal login experience */ + display_name?: string | undefined; + /** Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients. */ + enabled_clients?: string[] | undefined; + /** The connection's identifier */ + id: string; + /** true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.) */ + is_domain_connection?: boolean | undefined; + metadata?: Management.EventStreamCloudEventConnectionDeletedObject0Metadata | undefined; + /** The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128 */ + name: string; + /** Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm. */ + realms?: string[] | undefined; + connected_accounts?: Management.EventStreamCloudEventConnectionDeletedObject0ConnectedAccounts | undefined; + options?: Management.EventStreamCloudEventConnectionDeletedObject0Options | undefined; + /** Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`. */ + show_as_button?: boolean | undefined; + strategy: Management.EventStreamCloudEventConnectionDeletedObject0StrategyEnum; +} + +/** + * Configure the purpose of a connection to be used for authentication during login. + */ +export interface EventStreamCloudEventConnectionDeletedObject0Authentication { + active: boolean; +} + +/** + * Configure the purpose of a connection to be used for connected accounts and Token Vault. + */ +export interface EventStreamCloudEventConnectionDeletedObject0ConnectedAccounts { + active: boolean; + cross_app_access?: boolean | undefined; +} + +/** + * Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed. + */ +export interface EventStreamCloudEventConnectionDeletedObject0Metadata {} + +/** + * Options for the 'oidc' connection + */ +export interface EventStreamCloudEventConnectionDeletedObject0Options { + /** URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow. */ + authorization_endpoint?: string | undefined; + /** OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider. */ + client_id: string; + connection_settings?: Management.EventStreamCloudEventConnectionDeletedObject0OptionsConnectionSettings | undefined; + /** Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication. */ + domain_aliases?: string[] | undefined; + dpop_signing_alg?: Management.EventStreamCloudEventConnectionDeletedObject0OptionsDpopSigningAlgEnum | undefined; + federated_connections_access_tokens?: + | Management.EventStreamCloudEventConnectionDeletedObject0OptionsFederatedConnectionsAccessTokens + | undefined; + /** https url of the icon to be shown */ + icon_url?: string | undefined; + /** Indicates whether the identity provider supports session expiry via the id_token. If true, the system will use the session_expiry claim in the id_token to determine session expiry. */ + id_token_session_expiry_supported?: boolean | undefined; + /** List of algorithms allowed to verify the ID tokens. Applicable when strategy=oidc or okta. */ + id_token_signed_response_algs?: + | Management.EventStreamCloudEventConnectionDeletedObject0OptionsIdTokenSignedResponseAlgsItemEnum[] + | undefined; + /** The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider. */ + issuer?: string | undefined; + /** URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures. */ + jwks_uri?: string | undefined; + /** An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist) */ + non_persistent_attrs?: string[] | undefined; + oidc_metadata?: Management.EventStreamCloudEventConnectionDeletedObject0OptionsOidcMetadata | undefined; + schema_version?: Management.EventStreamCloudEventConnectionDeletedObject0OptionsSchemaVersionEnum | undefined; + /** Space-separated list of OAuth 2.0 scopes requested during authorization. Must include 'openid' (required by OIDC spec). Common values: 'openid profile email'. Additional scopes depend on the identity provider. */ + scope?: string | undefined; + /** When true and type is 'back_channel', includes a cryptographic nonce in authorization requests to prevent replay attacks. The identity provider must include this nonce in the ID token for validation. */ + send_back_channel_nonce?: boolean | undefined; + set_user_root_attributes?: + | Management.EventStreamCloudEventConnectionDeletedObject0OptionsSetUserRootAttributesEnum + | undefined; + /** Tenant domain */ + tenant_domain?: string | undefined; + /** URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow. */ + token_endpoint?: string | undefined; + token_endpoint_auth_method?: + | Management.EventStreamCloudEventConnectionDeletedObject0OptionsTokenEndpointAuthMethodEnum + | undefined; + token_endpoint_auth_signing_alg?: + | Management.EventStreamCloudEventConnectionDeletedObject0OptionsTokenEndpointAuthSigningAlgEnum + | undefined; + token_endpoint_jwtca_aud_format?: + | Management.EventStreamCloudEventConnectionDeletedObject0OptionsTokenEndpointJwtcaAudFormatEnum + | undefined; + upstream_params?: Management.EventStreamCloudEventConnectionDeletedObject0OptionsUpstreamParams | undefined; + /** Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token. */ + userinfo_endpoint?: string | undefined; + attribute_map?: Management.EventStreamCloudEventConnectionDeletedObject0OptionsAttributeMap | undefined; + /** URL of the identity provider's OIDC Discovery endpoint (/.well-known/openid-configuration). When provided and oidc_metadata is empty, Auth0 automatically retrieves the provider's configuration including endpoints and supported features. */ + discovery_url?: string | undefined; + type?: Management.EventStreamCloudEventConnectionDeletedObject0OptionsTypeEnum | undefined; +} + +/** + * Configuration for mapping claims from the identity provider to Auth0 user profile attributes. Allows customizing which IdP claims populate user fields and how they are transformed. + */ +export interface EventStreamCloudEventConnectionDeletedObject0OptionsAttributeMap { + attributes?: Management.EventStreamCloudEventConnectionDeletedObject0OptionsAttributeMapAttributes | undefined; + /** Scopes to send to the IdP's Userinfo endpoint */ + userinfo_scope?: string | undefined; + mapping_mode?: + | Management.EventStreamCloudEventConnectionDeletedObject0OptionsAttributeMapMappingModeEnum + | undefined; +} + +/** + * Object containing mapping details for incoming claims + */ +export type EventStreamCloudEventConnectionDeletedObject0OptionsAttributeMapAttributes = Record; + +/** Method used to map incoming claims when strategy=oidc. */ +export const EventStreamCloudEventConnectionDeletedObject0OptionsAttributeMapMappingModeEnum = { + BindAll: "bind_all", + UseMap: "use_map", +} as const; +export type EventStreamCloudEventConnectionDeletedObject0OptionsAttributeMapMappingModeEnum = + (typeof EventStreamCloudEventConnectionDeletedObject0OptionsAttributeMapMappingModeEnum)[keyof typeof EventStreamCloudEventConnectionDeletedObject0OptionsAttributeMapMappingModeEnum]; + +/** + * OAuth 2.0 PKCE (Proof Key for Code Exchange) settings. PKCE enhances security for public clients by preventing authorization code interception attacks. 'auto' (recommended) uses the strongest method supported by the IdP. + */ +export interface EventStreamCloudEventConnectionDeletedObject0OptionsConnectionSettings { + pkce?: Management.EventStreamCloudEventConnectionDeletedObject0OptionsConnectionSettingsPkceEnum | undefined; +} + +/** PKCE configuration. */ +export const EventStreamCloudEventConnectionDeletedObject0OptionsConnectionSettingsPkceEnum = { + Auto: "auto", + S256: "S256", + Plain: "plain", + Disabled: "disabled", +} as const; +export type EventStreamCloudEventConnectionDeletedObject0OptionsConnectionSettingsPkceEnum = + (typeof EventStreamCloudEventConnectionDeletedObject0OptionsConnectionSettingsPkceEnum)[keyof typeof EventStreamCloudEventConnectionDeletedObject0OptionsConnectionSettingsPkceEnum]; + +/** Algorithm used for DPoP proof JWT signing. Applicable when strategy=oidc or okta. */ +export const EventStreamCloudEventConnectionDeletedObject0OptionsDpopSigningAlgEnum = { + Es256: "ES256", + Es384: "ES384", + Es512: "ES512", + Ed25519: "Ed25519", +} as const; +export type EventStreamCloudEventConnectionDeletedObject0OptionsDpopSigningAlgEnum = + (typeof EventStreamCloudEventConnectionDeletedObject0OptionsDpopSigningAlgEnum)[keyof typeof EventStreamCloudEventConnectionDeletedObject0OptionsDpopSigningAlgEnum]; + +/** + * Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users. + */ +export interface EventStreamCloudEventConnectionDeletedObject0OptionsFederatedConnectionsAccessTokens { + /** Enables refresh tokens and access tokens collection for federated connections */ + active: boolean; +} + +/** Algorithm allowed to verify the ID tokens. */ +export const EventStreamCloudEventConnectionDeletedObject0OptionsIdTokenSignedResponseAlgsItemEnum = { + Es256: "ES256", + Es384: "ES384", + Ps256: "PS256", + Ps384: "PS384", + Rs256: "RS256", + Rs384: "RS384", + Rs512: "RS512", +} as const; +export type EventStreamCloudEventConnectionDeletedObject0OptionsIdTokenSignedResponseAlgsItemEnum = + (typeof EventStreamCloudEventConnectionDeletedObject0OptionsIdTokenSignedResponseAlgsItemEnum)[keyof typeof EventStreamCloudEventConnectionDeletedObject0OptionsIdTokenSignedResponseAlgsItemEnum]; + +/** + * OpenID Connect Provider Metadata as per https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata + */ +export interface EventStreamCloudEventConnectionDeletedObject0OptionsOidcMetadata { + /** A list of the Authentication Context Class References that this OP supports */ + acr_values_supported?: string[] | undefined; + /** URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow. */ + authorization_endpoint: string; + /** JSON array containing a list of the Claim Types that the OpenID Provider supports. These Claim Types are described in Section 5.6 of OpenID Connect Core 1.0 [OpenID.Core]. If omitted, the implementation supports only normal Claims. */ + claim_types_supported?: string[] | undefined; + /** Languages and scripts supported for values in Claims being returned, represented as a JSON array of BCP47 [RFC5646] language tag values. Not all languages and scripts are necessarily supported for all Claim values. */ + claims_locales_supported?: string[] | undefined; + /** Boolean value specifying whether the OP supports use of the claims parameter, with true indicating support. If omitted, the default value is false. */ + claims_parameter_supported?: boolean | undefined; + /** JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply values for. Note that for privacy or other reasons, this might not be an exhaustive list. */ + claims_supported?: string[] | undefined; + /** JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used. */ + display_values_supported?: string[] | undefined; + /** JSON array containing a list of the JWS signing algorithms (alg values) supported for DPoP proof JWT signing. */ + dpop_signing_alg_values_supported?: string[] | undefined; + /** URL of the identity provider's logout/end session endpoint. When configured as a static URL, users are redirected here after logging out from Auth0. Must use HTTPS scheme. */ + end_session_endpoint?: string | undefined; + /** A list of the OAuth 2.0 Grant Type values that this OP supports. Dynamic OpenID Providers MUST support the authorization_code and implicit Grant Type values and MAY support other Grant Types. If omitted, the default value is ["authorization_code", "implicit"]. */ + grant_types_supported?: string[] | undefined; + /** JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT */ + id_token_encryption_alg_values_supported?: string[] | undefined; + /** JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for the ID Token to encode the Claims in a JWT [JWT]. */ + id_token_encryption_enc_values_supported?: string[] | undefined; + /** A list of the JWS signing algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT. The algorithm RS256 MUST be included. The value none MAY be supported, but MUST NOT be used unless the Response Type used returns no ID Token from the Authorization Endpoint (such as when using the Authorization Code Flow). https://datatracker.ietf.org/doc/html/rfc7518 */ + id_token_signing_alg_values_supported: string[]; + /** The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider. */ + issuer: string; + /** URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures. */ + jwks_uri: string; + /** URL that the OpenID Provider provides to the person registering the Client to read about the OPs requirements on how the Relying Party can use the data provided by the OP. The registration process SHOULD display this URL to the person registering the Client if it is given. */ + op_policy_uri?: string | undefined; + /** URL that the OpenID Provider provides to the person registering the Client to read about OpenID Providers terms of service. The registration process SHOULD display this URL to the person registering the Client if it is given. */ + op_tos_uri?: string | undefined; + /** URL of the OPs Dynamic Client Registration Endpoint. RECOMMENDED but not REQUIRED. https://openid.net/specs/openid-connect-discovery-1_0.html#OpenID.Registration */ + registration_endpoint?: string | undefined; + /** JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference. */ + request_object_encryption_alg_values_supported?: string[] | undefined; + /** JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference. */ + request_object_encryption_enc_values_supported?: string[] | undefined; + /** JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for Request Objects, which are described in Section 6.1 of OpenID Connect Core 1.0 [OpenID.Core]. These algorithms are used both when the Request Object is passed by value (using the request parameter) and when it is passed by reference (using the request_uri parameter). Servers SHOULD support none and RS256. */ + request_object_signing_alg_values_supported?: string[] | undefined; + /** Boolean value specifying whether the OP supports use of the request parameter, with true indicating support. If omitted, the default value is false. */ + request_parameter_supported?: boolean | undefined; + /** Boolean value specifying whether the OP supports use of the request_uri parameter, with true indicating support. If omitted, the default value is false. */ + request_uri_parameter_supported?: boolean | undefined; + /** Boolean value specifying whether the OP requires use of the request_uri parameter. If omitted, the default value is false. */ + require_request_uri_registration?: boolean | undefined; + /** A list of the OAuth 2.0 response_mode values that this OP supports. If omitted, the default for Dynamic OpenID Providers is ["query", "fragment"] */ + response_modes_supported?: string[] | undefined; + /** A list of the OAuth 2.0 response_type values that this OP supports. Dynamic OpenID Providers MUST support the code, id_token, and the token id_token Response Type values */ + response_types_supported?: string[] | undefined; + /** A list of the OAuth 2.0 [RFC6749] scope values that this server supports. The server MUST support the openid scope value. Servers MAY choose not to advertise some supported scope values even when this parameter is used, although those defined in [OpenID.Core] SHOULD be listed, if supported. RECOMMENDED but not REQUIRED */ + scopes_supported?: string[] | undefined; + /** URL of a page containing human-readable information that developers might want or need to know when using the OpenID Provider. In particular, if the OpenID Provider does not support Dynamic Client Registration, then information on how to register Clients needs to be provided in this documentation. */ + service_documentation?: string | undefined; + /** A list of the Subject Identifier types that this OP supports. Valid types include pairwise and public */ + subject_types_supported?: string[] | undefined; + /** URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow. */ + token_endpoint?: string | undefined; + /** JSON array containing a list of Client Authentication methods supported by this Token Endpoint. The options are client_secret_post, client_secret_basic, client_secret_jwt, and private_key_jwt, as described in Section 9 of OpenID Connect Core 1.0 [OpenID.Core]. Other authentication methods MAY be defined by extensions. If omitted, the default is client_secret_basic -- the HTTP Basic Authentication Scheme specified in Section 2.3.1 of OAuth 2.0 [RFC6749]. */ + token_endpoint_auth_methods_supported?: string[] | undefined; + /** JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used. */ + token_endpoint_auth_signing_alg_values_supported?: string[] | undefined; + /** Languages and scripts supported for the user interface, represented as a JSON array of BCP47 [RFC5646] language tag values. */ + ui_locales_supported?: string[] | undefined; + /** JSON array containing a list of the JWE [JWE] encryption algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. */ + userinfo_encryption_alg_values_supported?: string[] | undefined; + /** JSON array containing a list of the JWE encryption algorithms (enc values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. */ + userinfo_encryption_enc_values_supported?: string[] | undefined; + /** Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token. */ + userinfo_endpoint?: string | undefined; + /** JSON array containing a list of the JWS [JWS] signing algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. The value none MAY be included. */ + userinfo_signing_alg_values_supported?: string[] | undefined; +} + +/** The internal schema version of the connection options. */ +export const EventStreamCloudEventConnectionDeletedObject0OptionsSchemaVersionEnum = { + Openid100: "openid-1.0.0", + OidcV4: "oidc-v4", +} as const; +export type EventStreamCloudEventConnectionDeletedObject0OptionsSchemaVersionEnum = + (typeof EventStreamCloudEventConnectionDeletedObject0OptionsSchemaVersionEnum)[keyof typeof EventStreamCloudEventConnectionDeletedObject0OptionsSchemaVersionEnum]; + +/** Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values. */ +export const EventStreamCloudEventConnectionDeletedObject0OptionsSetUserRootAttributesEnum = { + OnEachLogin: "on_each_login", + OnFirstLogin: "on_first_login", + NeverOnLogin: "never_on_login", +} as const; +export type EventStreamCloudEventConnectionDeletedObject0OptionsSetUserRootAttributesEnum = + (typeof EventStreamCloudEventConnectionDeletedObject0OptionsSetUserRootAttributesEnum)[keyof typeof EventStreamCloudEventConnectionDeletedObject0OptionsSetUserRootAttributesEnum]; + +/** Authentication method used at the identity provider's token endpoint. 'client_secret_post' sends credentials in the request body; 'private_key_jwt' uses a signed JWT assertion for enhanced security. Applicable when strategy=oidc or okta. */ +export const EventStreamCloudEventConnectionDeletedObject0OptionsTokenEndpointAuthMethodEnum = { + ClientSecretPost: "client_secret_post", + PrivateKeyJwt: "private_key_jwt", +} as const; +export type EventStreamCloudEventConnectionDeletedObject0OptionsTokenEndpointAuthMethodEnum = + (typeof EventStreamCloudEventConnectionDeletedObject0OptionsTokenEndpointAuthMethodEnum)[keyof typeof EventStreamCloudEventConnectionDeletedObject0OptionsTokenEndpointAuthMethodEnum]; + +/** Algorithm used to sign client_assertions. Applicable when strategy=oidc or okta. */ +export const EventStreamCloudEventConnectionDeletedObject0OptionsTokenEndpointAuthSigningAlgEnum = { + Es256: "ES256", + Es384: "ES384", + Ps256: "PS256", + Ps384: "PS384", + Rs256: "RS256", + Rs384: "RS384", + Rs512: "RS512", +} as const; +export type EventStreamCloudEventConnectionDeletedObject0OptionsTokenEndpointAuthSigningAlgEnum = + (typeof EventStreamCloudEventConnectionDeletedObject0OptionsTokenEndpointAuthSigningAlgEnum)[keyof typeof EventStreamCloudEventConnectionDeletedObject0OptionsTokenEndpointAuthSigningAlgEnum]; + +/** Specifies the format of the aud (audience) claim included in the JWT used for client authentication at the token endpoint. Accepted values are: 'issuer' (the aud claim is set to the OIDC issuer URL) or 'token_endpoint' (the aud claim is set to the token endpoint URL). */ +export const EventStreamCloudEventConnectionDeletedObject0OptionsTokenEndpointJwtcaAudFormatEnum = { + Issuer: "issuer", + TokenEndpoint: "token_endpoint", +} as const; +export type EventStreamCloudEventConnectionDeletedObject0OptionsTokenEndpointJwtcaAudFormatEnum = + (typeof EventStreamCloudEventConnectionDeletedObject0OptionsTokenEndpointJwtcaAudFormatEnum)[keyof typeof EventStreamCloudEventConnectionDeletedObject0OptionsTokenEndpointJwtcaAudFormatEnum]; + +/** OIDC communication channel type. 'back_channel' (confidential client) exchanges tokens server-side for stronger security; 'front_channel' handles responses in the browser. */ +export const EventStreamCloudEventConnectionDeletedObject0OptionsTypeEnum = { + BackChannel: "back_channel", + FrontChannel: "front_channel", +} as const; +export type EventStreamCloudEventConnectionDeletedObject0OptionsTypeEnum = + (typeof EventStreamCloudEventConnectionDeletedObject0OptionsTypeEnum)[keyof typeof EventStreamCloudEventConnectionDeletedObject0OptionsTypeEnum]; + +/** + * Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps + */ +export type EventStreamCloudEventConnectionDeletedObject0OptionsUpstreamParams = Record; + +/** The connection strategy. */ +export const EventStreamCloudEventConnectionDeletedObject0StrategyEnum = { + Oidc: "oidc", +} as const; +export type EventStreamCloudEventConnectionDeletedObject0StrategyEnum = + (typeof EventStreamCloudEventConnectionDeletedObject0StrategyEnum)[keyof typeof EventStreamCloudEventConnectionDeletedObject0StrategyEnum]; + +export interface EventStreamCloudEventConnectionDeletedObject1 { + authentication?: Management.EventStreamCloudEventConnectionDeletedObject1Authentication | undefined; + connected_accounts?: Management.EventStreamCloudEventConnectionDeletedObject1ConnectedAccounts | undefined; + /** Connection name used in the new universal login experience */ + display_name?: string | undefined; + /** Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients. */ + enabled_clients?: string[] | undefined; + /** The connection's identifier */ + id: string; + /** true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.) */ + is_domain_connection?: boolean | undefined; + metadata?: Management.EventStreamCloudEventConnectionDeletedObject1Metadata | undefined; + /** The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128 */ + name: string; + /** Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm. */ + realms?: string[] | undefined; + options?: Management.EventStreamCloudEventConnectionDeletedObject1Options | undefined; + /** Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`. */ + show_as_button?: boolean | undefined; + strategy: Management.EventStreamCloudEventConnectionDeletedObject1StrategyEnum; +} + +/** + * Configure the purpose of a connection to be used for authentication during login. + */ +export interface EventStreamCloudEventConnectionDeletedObject1Authentication { + active: boolean; +} + +/** + * Configure the purpose of a connection to be used for connected accounts and Token Vault. + */ +export interface EventStreamCloudEventConnectionDeletedObject1ConnectedAccounts { + active: boolean; +} + +/** + * Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed. + */ +export interface EventStreamCloudEventConnectionDeletedObject1Metadata {} + +/** + * Options for the 'okta' connection + */ +export interface EventStreamCloudEventConnectionDeletedObject1Options { + /** URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow. */ + authorization_endpoint?: string | undefined; + /** OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider. */ + client_id: string; + connection_settings?: Management.EventStreamCloudEventConnectionDeletedObject1OptionsConnectionSettings | undefined; + /** Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication. */ + domain_aliases?: string[] | undefined; + dpop_signing_alg?: Management.EventStreamCloudEventConnectionDeletedObject1OptionsDpopSigningAlgEnum | undefined; + federated_connections_access_tokens?: + | Management.EventStreamCloudEventConnectionDeletedObject1OptionsFederatedConnectionsAccessTokens + | undefined; + /** https url of the icon to be shown */ + icon_url?: string | undefined; + /** Indicates whether the identity provider supports session expiry via the id_token. If true, the system will use the session_expiry claim in the id_token to determine session expiry. */ + id_token_session_expiry_supported?: boolean | undefined; + /** List of algorithms allowed to verify the ID tokens. Applicable when strategy=oidc or okta. */ + id_token_signed_response_algs?: + | Management.EventStreamCloudEventConnectionDeletedObject1OptionsIdTokenSignedResponseAlgsItemEnum[] + | undefined; + /** The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider. */ + issuer?: string | undefined; + /** URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures. */ + jwks_uri?: string | undefined; + /** An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist) */ + non_persistent_attrs?: string[] | undefined; + oidc_metadata?: Management.EventStreamCloudEventConnectionDeletedObject1OptionsOidcMetadata | undefined; + schema_version?: Management.EventStreamCloudEventConnectionDeletedObject1OptionsSchemaVersionEnum | undefined; + /** Space-separated list of OAuth 2.0 scopes requested during authorization. Must include 'openid' (required by OIDC spec). Common values: 'openid profile email'. Additional scopes depend on the identity provider. */ + scope?: string | undefined; + /** When true and type is 'back_channel', includes a cryptographic nonce in authorization requests to prevent replay attacks. The identity provider must include this nonce in the ID token for validation. */ + send_back_channel_nonce?: boolean | undefined; + set_user_root_attributes?: + | Management.EventStreamCloudEventConnectionDeletedObject1OptionsSetUserRootAttributesEnum + | undefined; + /** Tenant domain */ + tenant_domain?: string | undefined; + /** URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow. */ + token_endpoint?: string | undefined; + token_endpoint_auth_method?: + | Management.EventStreamCloudEventConnectionDeletedObject1OptionsTokenEndpointAuthMethodEnum + | undefined; + token_endpoint_auth_signing_alg?: + | Management.EventStreamCloudEventConnectionDeletedObject1OptionsTokenEndpointAuthSigningAlgEnum + | undefined; + token_endpoint_jwtca_aud_format?: + | Management.EventStreamCloudEventConnectionDeletedObject1OptionsTokenEndpointJwtcaAudFormatEnum + | undefined; + upstream_params?: Management.EventStreamCloudEventConnectionDeletedObject1OptionsUpstreamParams | undefined; + /** Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token. */ + userinfo_endpoint?: string | undefined; + attribute_map?: Management.EventStreamCloudEventConnectionDeletedObject1OptionsAttributeMap | undefined; + /** Domain of the Okta organization (e.g., dev-123456.okta.com). Should be just the domain of the okta server with no scheme or trailing backslash. Discovery runs only when connection.options.oidc_metadata is empty and a domain is provided */ + domain?: string | undefined; + type?: Management.EventStreamCloudEventConnectionDeletedObject1OptionsTypeEnum | undefined; +} + +/** + * Mapping of claims received from the identity provider (IdP) + */ +export interface EventStreamCloudEventConnectionDeletedObject1OptionsAttributeMap { + attributes?: Management.EventStreamCloudEventConnectionDeletedObject1OptionsAttributeMapAttributes | undefined; + /** Scopes to send to the IdP's Userinfo endpoint */ + userinfo_scope?: string | undefined; + mapping_mode?: + | Management.EventStreamCloudEventConnectionDeletedObject1OptionsAttributeMapMappingModeEnum + | undefined; +} + +/** + * Object containing mapping details for incoming claims + */ +export type EventStreamCloudEventConnectionDeletedObject1OptionsAttributeMapAttributes = Record; + +/** Method used to map incoming claims when strategy=okta. */ +export const EventStreamCloudEventConnectionDeletedObject1OptionsAttributeMapMappingModeEnum = { + BasicProfile: "basic_profile", + UseMap: "use_map", +} as const; +export type EventStreamCloudEventConnectionDeletedObject1OptionsAttributeMapMappingModeEnum = + (typeof EventStreamCloudEventConnectionDeletedObject1OptionsAttributeMapMappingModeEnum)[keyof typeof EventStreamCloudEventConnectionDeletedObject1OptionsAttributeMapMappingModeEnum]; + +/** + * OAuth 2.0 PKCE (Proof Key for Code Exchange) settings. PKCE enhances security for public clients by preventing authorization code interception attacks. 'auto' (recommended) uses the strongest method supported by the IdP. + */ +export interface EventStreamCloudEventConnectionDeletedObject1OptionsConnectionSettings { + pkce?: Management.EventStreamCloudEventConnectionDeletedObject1OptionsConnectionSettingsPkceEnum | undefined; +} + +/** PKCE configuration. */ +export const EventStreamCloudEventConnectionDeletedObject1OptionsConnectionSettingsPkceEnum = { + Auto: "auto", + S256: "S256", + Plain: "plain", + Disabled: "disabled", +} as const; +export type EventStreamCloudEventConnectionDeletedObject1OptionsConnectionSettingsPkceEnum = + (typeof EventStreamCloudEventConnectionDeletedObject1OptionsConnectionSettingsPkceEnum)[keyof typeof EventStreamCloudEventConnectionDeletedObject1OptionsConnectionSettingsPkceEnum]; + +/** Algorithm used for DPoP proof JWT signing. Applicable when strategy=oidc or okta. */ +export const EventStreamCloudEventConnectionDeletedObject1OptionsDpopSigningAlgEnum = { + Es256: "ES256", + Es384: "ES384", + Es512: "ES512", + Ed25519: "Ed25519", +} as const; +export type EventStreamCloudEventConnectionDeletedObject1OptionsDpopSigningAlgEnum = + (typeof EventStreamCloudEventConnectionDeletedObject1OptionsDpopSigningAlgEnum)[keyof typeof EventStreamCloudEventConnectionDeletedObject1OptionsDpopSigningAlgEnum]; + +/** + * Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users. + */ +export interface EventStreamCloudEventConnectionDeletedObject1OptionsFederatedConnectionsAccessTokens { + /** Enables refresh tokens and access tokens collection for federated connections */ + active: boolean; +} + +/** Algorithm allowed to verify the ID tokens. */ +export const EventStreamCloudEventConnectionDeletedObject1OptionsIdTokenSignedResponseAlgsItemEnum = { + Es256: "ES256", + Es384: "ES384", + Ps256: "PS256", + Ps384: "PS384", + Rs256: "RS256", + Rs384: "RS384", + Rs512: "RS512", +} as const; +export type EventStreamCloudEventConnectionDeletedObject1OptionsIdTokenSignedResponseAlgsItemEnum = + (typeof EventStreamCloudEventConnectionDeletedObject1OptionsIdTokenSignedResponseAlgsItemEnum)[keyof typeof EventStreamCloudEventConnectionDeletedObject1OptionsIdTokenSignedResponseAlgsItemEnum]; + +/** + * OpenID Connect Provider Metadata as per https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata + */ +export interface EventStreamCloudEventConnectionDeletedObject1OptionsOidcMetadata { + /** A list of the Authentication Context Class References that this OP supports */ + acr_values_supported?: string[] | undefined; + /** URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow. */ + authorization_endpoint: string; + /** JSON array containing a list of the Claim Types that the OpenID Provider supports. These Claim Types are described in Section 5.6 of OpenID Connect Core 1.0 [OpenID.Core]. If omitted, the implementation supports only normal Claims. */ + claim_types_supported?: string[] | undefined; + /** Languages and scripts supported for values in Claims being returned, represented as a JSON array of BCP47 [RFC5646] language tag values. Not all languages and scripts are necessarily supported for all Claim values. */ + claims_locales_supported?: string[] | undefined; + /** Boolean value specifying whether the OP supports use of the claims parameter, with true indicating support. If omitted, the default value is false. */ + claims_parameter_supported?: boolean | undefined; + /** JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply values for. Note that for privacy or other reasons, this might not be an exhaustive list. */ + claims_supported?: string[] | undefined; + /** JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used. */ + display_values_supported?: string[] | undefined; + /** JSON array containing a list of the JWS signing algorithms (alg values) supported for DPoP proof JWT signing. */ + dpop_signing_alg_values_supported?: string[] | undefined; + /** URL of the identity provider's logout/end session endpoint. When configured as a static URL, users are redirected here after logging out from Auth0. Must use HTTPS scheme. */ + end_session_endpoint?: string | undefined; + /** A list of the OAuth 2.0 Grant Type values that this OP supports. Dynamic OpenID Providers MUST support the authorization_code and implicit Grant Type values and MAY support other Grant Types. If omitted, the default value is ["authorization_code", "implicit"]. */ + grant_types_supported?: string[] | undefined; + /** JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT */ + id_token_encryption_alg_values_supported?: string[] | undefined; + /** JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for the ID Token to encode the Claims in a JWT [JWT]. */ + id_token_encryption_enc_values_supported?: string[] | undefined; + /** A list of the JWS signing algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT. The algorithm RS256 MUST be included. The value none MAY be supported, but MUST NOT be used unless the Response Type used returns no ID Token from the Authorization Endpoint (such as when using the Authorization Code Flow). https://datatracker.ietf.org/doc/html/rfc7518 */ + id_token_signing_alg_values_supported: string[]; + /** The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider. */ + issuer: string; + /** URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures. */ + jwks_uri: string; + /** URL that the OpenID Provider provides to the person registering the Client to read about the OPs requirements on how the Relying Party can use the data provided by the OP. The registration process SHOULD display this URL to the person registering the Client if it is given. */ + op_policy_uri?: string | undefined; + /** URL that the OpenID Provider provides to the person registering the Client to read about OpenID Providers terms of service. The registration process SHOULD display this URL to the person registering the Client if it is given. */ + op_tos_uri?: string | undefined; + /** URL of the OPs Dynamic Client Registration Endpoint. RECOMMENDED but not REQUIRED. https://openid.net/specs/openid-connect-discovery-1_0.html#OpenID.Registration */ + registration_endpoint?: string | undefined; + /** JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference. */ + request_object_encryption_alg_values_supported?: string[] | undefined; + /** JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference. */ + request_object_encryption_enc_values_supported?: string[] | undefined; + /** JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for Request Objects, which are described in Section 6.1 of OpenID Connect Core 1.0 [OpenID.Core]. These algorithms are used both when the Request Object is passed by value (using the request parameter) and when it is passed by reference (using the request_uri parameter). Servers SHOULD support none and RS256. */ + request_object_signing_alg_values_supported?: string[] | undefined; + /** Boolean value specifying whether the OP supports use of the request parameter, with true indicating support. If omitted, the default value is false. */ + request_parameter_supported?: boolean | undefined; + /** Boolean value specifying whether the OP supports use of the request_uri parameter, with true indicating support. If omitted, the default value is false. */ + request_uri_parameter_supported?: boolean | undefined; + /** Boolean value specifying whether the OP requires use of the request_uri parameter. If omitted, the default value is false. */ + require_request_uri_registration?: boolean | undefined; + /** A list of the OAuth 2.0 response_mode values that this OP supports. If omitted, the default for Dynamic OpenID Providers is ["query", "fragment"] */ + response_modes_supported?: string[] | undefined; + /** A list of the OAuth 2.0 response_type values that this OP supports. Dynamic OpenID Providers MUST support the code, id_token, and the token id_token Response Type values */ + response_types_supported?: string[] | undefined; + /** A list of the OAuth 2.0 [RFC6749] scope values that this server supports. The server MUST support the openid scope value. Servers MAY choose not to advertise some supported scope values even when this parameter is used, although those defined in [OpenID.Core] SHOULD be listed, if supported. RECOMMENDED but not REQUIRED */ + scopes_supported?: string[] | undefined; + /** URL of a page containing human-readable information that developers might want or need to know when using the OpenID Provider. In particular, if the OpenID Provider does not support Dynamic Client Registration, then information on how to register Clients needs to be provided in this documentation. */ + service_documentation?: string | undefined; + /** A list of the Subject Identifier types that this OP supports. Valid types include pairwise and public */ + subject_types_supported?: string[] | undefined; + /** URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow. */ + token_endpoint?: string | undefined; + /** JSON array containing a list of Client Authentication methods supported by this Token Endpoint. The options are client_secret_post, client_secret_basic, client_secret_jwt, and private_key_jwt, as described in Section 9 of OpenID Connect Core 1.0 [OpenID.Core]. Other authentication methods MAY be defined by extensions. If omitted, the default is client_secret_basic -- the HTTP Basic Authentication Scheme specified in Section 2.3.1 of OAuth 2.0 [RFC6749]. */ + token_endpoint_auth_methods_supported?: string[] | undefined; + /** JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used. */ + token_endpoint_auth_signing_alg_values_supported?: string[] | undefined; + /** Languages and scripts supported for the user interface, represented as a JSON array of BCP47 [RFC5646] language tag values. */ + ui_locales_supported?: string[] | undefined; + /** JSON array containing a list of the JWE [JWE] encryption algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. */ + userinfo_encryption_alg_values_supported?: string[] | undefined; + /** JSON array containing a list of the JWE encryption algorithms (enc values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. */ + userinfo_encryption_enc_values_supported?: string[] | undefined; + /** Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token. */ + userinfo_endpoint?: string | undefined; + /** JSON array containing a list of the JWS [JWS] signing algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. The value none MAY be included. */ + userinfo_signing_alg_values_supported?: string[] | undefined; +} + +/** The internal schema version of the connection options. */ +export const EventStreamCloudEventConnectionDeletedObject1OptionsSchemaVersionEnum = { + Openid100: "openid-1.0.0", + OidcV4: "oidc-v4", +} as const; +export type EventStreamCloudEventConnectionDeletedObject1OptionsSchemaVersionEnum = + (typeof EventStreamCloudEventConnectionDeletedObject1OptionsSchemaVersionEnum)[keyof typeof EventStreamCloudEventConnectionDeletedObject1OptionsSchemaVersionEnum]; + +/** Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values. */ +export const EventStreamCloudEventConnectionDeletedObject1OptionsSetUserRootAttributesEnum = { + OnEachLogin: "on_each_login", + OnFirstLogin: "on_first_login", + NeverOnLogin: "never_on_login", +} as const; +export type EventStreamCloudEventConnectionDeletedObject1OptionsSetUserRootAttributesEnum = + (typeof EventStreamCloudEventConnectionDeletedObject1OptionsSetUserRootAttributesEnum)[keyof typeof EventStreamCloudEventConnectionDeletedObject1OptionsSetUserRootAttributesEnum]; + +/** Authentication method used at the identity provider's token endpoint. 'client_secret_post' sends credentials in the request body; 'private_key_jwt' uses a signed JWT assertion for enhanced security. Applicable when strategy=oidc or okta. */ +export const EventStreamCloudEventConnectionDeletedObject1OptionsTokenEndpointAuthMethodEnum = { + ClientSecretPost: "client_secret_post", + PrivateKeyJwt: "private_key_jwt", +} as const; +export type EventStreamCloudEventConnectionDeletedObject1OptionsTokenEndpointAuthMethodEnum = + (typeof EventStreamCloudEventConnectionDeletedObject1OptionsTokenEndpointAuthMethodEnum)[keyof typeof EventStreamCloudEventConnectionDeletedObject1OptionsTokenEndpointAuthMethodEnum]; + +/** Algorithm used to sign client_assertions. Applicable when strategy=oidc or okta. */ +export const EventStreamCloudEventConnectionDeletedObject1OptionsTokenEndpointAuthSigningAlgEnum = { + Es256: "ES256", + Es384: "ES384", + Ps256: "PS256", + Ps384: "PS384", + Rs256: "RS256", + Rs384: "RS384", + Rs512: "RS512", +} as const; +export type EventStreamCloudEventConnectionDeletedObject1OptionsTokenEndpointAuthSigningAlgEnum = + (typeof EventStreamCloudEventConnectionDeletedObject1OptionsTokenEndpointAuthSigningAlgEnum)[keyof typeof EventStreamCloudEventConnectionDeletedObject1OptionsTokenEndpointAuthSigningAlgEnum]; + +/** Specifies the format of the aud (audience) claim included in the JWT used for client authentication at the token endpoint. Accepted values are: 'issuer' (the aud claim is set to the OIDC issuer URL) or 'token_endpoint' (the aud claim is set to the token endpoint URL). */ +export const EventStreamCloudEventConnectionDeletedObject1OptionsTokenEndpointJwtcaAudFormatEnum = { + Issuer: "issuer", + TokenEndpoint: "token_endpoint", +} as const; +export type EventStreamCloudEventConnectionDeletedObject1OptionsTokenEndpointJwtcaAudFormatEnum = + (typeof EventStreamCloudEventConnectionDeletedObject1OptionsTokenEndpointJwtcaAudFormatEnum)[keyof typeof EventStreamCloudEventConnectionDeletedObject1OptionsTokenEndpointJwtcaAudFormatEnum]; + +/** Connection type */ +export const EventStreamCloudEventConnectionDeletedObject1OptionsTypeEnum = { + BackChannel: "back_channel", +} as const; +export type EventStreamCloudEventConnectionDeletedObject1OptionsTypeEnum = + (typeof EventStreamCloudEventConnectionDeletedObject1OptionsTypeEnum)[keyof typeof EventStreamCloudEventConnectionDeletedObject1OptionsTypeEnum]; + +/** + * Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps + */ +export type EventStreamCloudEventConnectionDeletedObject1OptionsUpstreamParams = Record; + +/** The connection strategy. */ +export const EventStreamCloudEventConnectionDeletedObject1StrategyEnum = { + Okta: "okta", +} as const; +export type EventStreamCloudEventConnectionDeletedObject1StrategyEnum = + (typeof EventStreamCloudEventConnectionDeletedObject1StrategyEnum)[keyof typeof EventStreamCloudEventConnectionDeletedObject1StrategyEnum]; + +export interface EventStreamCloudEventConnectionDeletedObject2 { + authentication?: Management.EventStreamCloudEventConnectionDeletedObject2Authentication | undefined; + connected_accounts?: Management.EventStreamCloudEventConnectionDeletedObject2ConnectedAccounts | undefined; + /** Connection name used in the new universal login experience */ + display_name?: string | undefined; + /** Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients. */ + enabled_clients?: string[] | undefined; + /** The connection's identifier */ + id: string; + /** true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.) */ + is_domain_connection?: boolean | undefined; + metadata?: Management.EventStreamCloudEventConnectionDeletedObject2Metadata | undefined; + /** The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128 */ + name: string; + /** Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm. */ + realms?: string[] | undefined; + options?: Management.EventStreamCloudEventConnectionDeletedObject2Options | undefined; + /** Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`. */ + show_as_button?: boolean | undefined; + strategy: Management.EventStreamCloudEventConnectionDeletedObject2StrategyEnum; +} + +/** + * Configure the purpose of a connection to be used for authentication during login. + */ +export interface EventStreamCloudEventConnectionDeletedObject2Authentication { + active: boolean; +} + +/** + * Configure the purpose of a connection to be used for connected accounts and Token Vault. + */ +export interface EventStreamCloudEventConnectionDeletedObject2ConnectedAccounts { + active: boolean; +} + +/** + * Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed. + */ +export interface EventStreamCloudEventConnectionDeletedObject2Metadata {} + +/** + * Options for the 'samlp' connection + */ +export interface EventStreamCloudEventConnectionDeletedObject2Options { + assertion_decryption_settings?: + | Management.EventStreamCloudEventConnectionDeletedObject2OptionsAssertionDecryptionSettings + | undefined; + /** X.509 signing certificate from the identity provider in .der format. Used to validate signatures in SAML Responses and Assertions. This is an alternative to signingCert and is kept for backward compatibility. Prefer using signingCert instead. */ + cert?: string | undefined; + /** Timestamp of the last certificate expiring soon notification. */ + cert_rollover_notification?: string | undefined; + digestAlgorithm?: Management.EventStreamCloudEventConnectionDeletedObject2OptionsDigestAlgorithmEnum | undefined; + /** Domain aliases for the connection */ + domain_aliases?: string[] | undefined; + /** The entity identifier (Issuer) for the SAML Service Provider. When not provided, defaults to 'urn:auth0:{tenant}:{connection}'. This value is included in SAML AuthnRequest messages sent to the identity provider. */ + entityId?: string | undefined; + /** ISO 8601 formatted datetime indicating when the identity provider's signing certificate expires. */ + expires?: string | undefined; + /** URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows. */ + icon_url?: string | undefined; + idpinitiated?: Management.EventStreamCloudEventConnectionDeletedObject2OptionsIdpinitiated | undefined; + /** An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist) */ + non_persistent_attrs?: string[] | undefined; + protocolBinding?: Management.EventStreamCloudEventConnectionDeletedObject2OptionsProtocolBindingEnum | undefined; + set_user_root_attributes?: + | Management.EventStreamCloudEventConnectionDeletedObject2OptionsSetUserRootAttributesEnum + | undefined; + signatureAlgorithm?: + | Management.EventStreamCloudEventConnectionDeletedObject2OptionsSignatureAlgorithmEnum + | undefined; + /** Identity provider's SAML SingleSignOnService endpoint URL where Auth0 sends SAML authentication requests. This is the primary login URL for the SAML connection. Required unless using metadataUrl or metadataXml. */ + signInEndpoint?: string | undefined; + /** Base64-encoded X.509 certificate from the identity provider used to validate signatures in SAML responses and assertions. The certificate is decoded and used for cryptographic signature verification. */ + signingCert?: string | undefined; + /** When true, Auth0 signs SAML authentication requests using the connection's signing key. The signature includes the request's digest and is validated by the identity provider. Defaults to false (unsigned requests). */ + signSAMLRequest?: boolean | undefined; + subject?: Management.EventStreamCloudEventConnectionDeletedObject2OptionsSubject | undefined; + /** For SAML connections, the tenant domain used to construct the login endpoint URL. Can be a string for single-tenant or an array of strings for multi-tenant validation. */ + tenant_domain?: string | undefined; + /** SHA-1 thumbprints (fingerprints) of the identity provider's signing certificates. Automatically computed from signingCert during connection creation. Each thumbprint must be a 40-character hexadecimal string. */ + thumbprints?: string[] | undefined; + upstream_params?: Management.EventStreamCloudEventConnectionDeletedObject2OptionsUpstreamParams | undefined; + /** When true, enables detailed SAML debugging by issuing 'w' (warning) events in tenant logs containing SAML request/response details. WARNING: Potentially exposes sensitive user information (PII, credentials) and should only be enabled temporarily for debugging purposes. */ + debug?: boolean | undefined; + /** When true, enables DEFLATE compression for SAML requests sent via HTTP-Redirect binding. */ + deflate?: boolean | undefined; + /** The URL where Auth0 will send SAML authentication requests (the Identity Provider's SSO URL). Must be a valid HTTPS URL. */ + destinationUrl?: string | undefined; + /** When true, disables sending SAML logout requests (SingleLogoutService) to the identity provider during user sign-out. The user will be logged out of Auth0 but will remain logged into the identity provider. Defaults to false (federated logout enabled). */ + disableSignout?: boolean | undefined; + fieldsMap?: Management.EventStreamCloudEventConnectionDeletedObject2OptionsFieldsMap | undefined; + /** Expected 'iss' (Issuer) claim value for JWT tokens in Global Token Revocation requests from the identity provider. When configured, Auth0 validates the JWT issuer matches this value before processing token revocation. Must be used together with global_token_revocation_jwt_sub. */ + global_token_revocation_jwt_iss?: string | undefined; + /** Expected 'sub' (Subject) claim value for JWT tokens in Global Token Revocation requests from the identity provider. When configured, Auth0 validates the JWT subject matches this value before processing token revocation. Must be used together with global_token_revocation_jwt_iss. */ + global_token_revocation_jwt_sub?: string | undefined; + /** HTTPS URL to the identity provider's SAML metadata document. When provided, Auth0 automatically fetches and parses the metadata to extract signInEndpoint, signOutEndpoint, signingCert, signSAMLRequest, and protocolBinding. Use metadataUrl OR metadataXml, not both. */ + metadataUrl?: string | undefined; + /** The URL where Auth0 will send SAML authentication requests (the Identity Provider's SSO URL). Must be a valid HTTPS URL. */ + recipientUrl?: string | undefined; + /** Custom XML template for SAML authentication requests. Supports variable substitution using @@variableName@@ syntax. When not provided, uses default SAML AuthnRequest template. See https://auth0.com/docs/authenticate/protocols/saml/saml-sso-integrations/configure-auth0-saml-service-provider#customize-the-request-template */ + requestTemplate?: string | undefined; + /** Identity provider's SAML SingleLogoutService endpoint URL where Auth0 sends logout requests for federated sign-out. When not provided, defaults to signInEndpoint. Only used if disableSignout is false. */ + signOutEndpoint?: string | undefined; + /** Custom SAML assertion attribute to use as the unique user identifier. When provided, this attribute is prepended to the default user_id mapping list with highest priority. Accepts a string (single SAML attribute name). */ + user_id_attribute?: string | undefined; +} + +/** + * Settings for SAML assertion decryption. + */ +export interface EventStreamCloudEventConnectionDeletedObject2OptionsAssertionDecryptionSettings { + /** A list of insecure algorithms to allow for SAML assertion decryption. */ + algorithm_exceptions?: string[] | undefined; + algorithm_profile: Management.EventStreamCloudEventConnectionDeletedObject2OptionsAssertionDecryptionSettingsAlgorithmProfileEnum; +} + +/** The algorithm profile to use for decrypting SAML assertions. */ +export const EventStreamCloudEventConnectionDeletedObject2OptionsAssertionDecryptionSettingsAlgorithmProfileEnum = { + V20261: "v2026-1", +} as const; +export type EventStreamCloudEventConnectionDeletedObject2OptionsAssertionDecryptionSettingsAlgorithmProfileEnum = + (typeof EventStreamCloudEventConnectionDeletedObject2OptionsAssertionDecryptionSettingsAlgorithmProfileEnum)[keyof typeof EventStreamCloudEventConnectionDeletedObject2OptionsAssertionDecryptionSettingsAlgorithmProfileEnum]; + +/** Algorithm used for computing digest values when signing SAML requests and logout requests. Defaults to 'sha256'. */ +export const EventStreamCloudEventConnectionDeletedObject2OptionsDigestAlgorithmEnum = { + Sha1: "sha1", + Sha256: "sha256", +} as const; +export type EventStreamCloudEventConnectionDeletedObject2OptionsDigestAlgorithmEnum = + (typeof EventStreamCloudEventConnectionDeletedObject2OptionsDigestAlgorithmEnum)[keyof typeof EventStreamCloudEventConnectionDeletedObject2OptionsDigestAlgorithmEnum]; + +/** + * Maps SAML assertion attributes from the identity provider to Auth0 user profile attributes. Format: { 'auth0_field': 'saml_attribute' } or { 'auth0_field': ['saml_attr1', 'saml_attr2'] } for fallback options. Merged with default mappings for email, name, given_name, family_name, and groups. + */ +export type EventStreamCloudEventConnectionDeletedObject2OptionsFieldsMap = Record; + +/** + * Configuration for IdP-Initiated SAML Single Sign-On. When enabled, allows users to initiate login directly from their SAML identity provider without first visiting Auth0. The IdP must include the connection parameter in the post-back URL (Assertion Consumer Service URL). + */ +export interface EventStreamCloudEventConnectionDeletedObject2OptionsIdpinitiated { + /** The query string sent to the default application */ + client_authorizequery?: string | undefined; + /** The client ID to use for IdP-initiated login requests. */ + client_id?: string | undefined; + client_protocol?: + | Management.EventStreamCloudEventConnectionDeletedObject2OptionsIdpinitiatedClientProtocolEnum + | undefined; + /** When true, enables IdP-initiated login support for this SAML connection. Allows users to log in directly from the identity provider without first visiting Auth0. */ + enabled?: boolean | undefined; +} + +/** The response protocol used to communicate with the default application. */ +export const EventStreamCloudEventConnectionDeletedObject2OptionsIdpinitiatedClientProtocolEnum = { + Oidc: "oidc", + Samlp: "samlp", + Wsfed: "wsfed", +} as const; +export type EventStreamCloudEventConnectionDeletedObject2OptionsIdpinitiatedClientProtocolEnum = + (typeof EventStreamCloudEventConnectionDeletedObject2OptionsIdpinitiatedClientProtocolEnum)[keyof typeof EventStreamCloudEventConnectionDeletedObject2OptionsIdpinitiatedClientProtocolEnum]; + +/** SAML protocol binding mechanism for sending authentication requests to the identity provider. */ +export const EventStreamCloudEventConnectionDeletedObject2OptionsProtocolBindingEnum = { + UrnOasisNamesTcSaml20BindingsHttpPost: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST", + UrnOasisNamesTcSaml20BindingsHttpRedirect: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect", +} as const; +export type EventStreamCloudEventConnectionDeletedObject2OptionsProtocolBindingEnum = + (typeof EventStreamCloudEventConnectionDeletedObject2OptionsProtocolBindingEnum)[keyof typeof EventStreamCloudEventConnectionDeletedObject2OptionsProtocolBindingEnum]; + +/** Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values. */ +export const EventStreamCloudEventConnectionDeletedObject2OptionsSetUserRootAttributesEnum = { + OnEachLogin: "on_each_login", + OnFirstLogin: "on_first_login", + NeverOnLogin: "never_on_login", +} as const; +export type EventStreamCloudEventConnectionDeletedObject2OptionsSetUserRootAttributesEnum = + (typeof EventStreamCloudEventConnectionDeletedObject2OptionsSetUserRootAttributesEnum)[keyof typeof EventStreamCloudEventConnectionDeletedObject2OptionsSetUserRootAttributesEnum]; + +/** Algorithm used to sign SAML authentication requests and logout requests using the connection's signing key. Common values: 'rsa-sha256' (RSA signature with SHA-256 digest) or 'rsa-sha1'. Defaults to 'rsa-sha256'. */ +export const EventStreamCloudEventConnectionDeletedObject2OptionsSignatureAlgorithmEnum = { + RsaSha1: "rsa-sha1", + RsaSha256: "rsa-sha256", +} as const; +export type EventStreamCloudEventConnectionDeletedObject2OptionsSignatureAlgorithmEnum = + (typeof EventStreamCloudEventConnectionDeletedObject2OptionsSignatureAlgorithmEnum)[keyof typeof EventStreamCloudEventConnectionDeletedObject2OptionsSignatureAlgorithmEnum]; + +/** + * Certificate Subject Distinguished Name (DN) extracted from the identity provider's signing certificate. + */ +export interface EventStreamCloudEventConnectionDeletedObject2OptionsSubject {} + +/** + * Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps + */ +export type EventStreamCloudEventConnectionDeletedObject2OptionsUpstreamParams = Record; + +/** The connection strategy. */ +export const EventStreamCloudEventConnectionDeletedObject2StrategyEnum = { + Samlp: "samlp", +} as const; +export type EventStreamCloudEventConnectionDeletedObject2StrategyEnum = + (typeof EventStreamCloudEventConnectionDeletedObject2StrategyEnum)[keyof typeof EventStreamCloudEventConnectionDeletedObject2StrategyEnum]; + +export interface EventStreamCloudEventConnectionDeletedObject3 { + authentication?: Management.EventStreamCloudEventConnectionDeletedObject3Authentication | undefined; + connected_accounts?: Management.EventStreamCloudEventConnectionDeletedObject3ConnectedAccounts | undefined; + /** Connection name used in the new universal login experience */ + display_name?: string | undefined; + /** Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients. */ + enabled_clients?: string[] | undefined; + /** The connection's identifier */ + id: string; + /** true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.) */ + is_domain_connection?: boolean | undefined; + metadata?: Management.EventStreamCloudEventConnectionDeletedObject3Metadata | undefined; + /** The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128 */ + name: string; + /** Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm. */ + realms?: string[] | undefined; + options?: Management.EventStreamCloudEventConnectionDeletedObject3Options | undefined; + /** Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`. */ + show_as_button?: boolean | undefined; + strategy: Management.EventStreamCloudEventConnectionDeletedObject3StrategyEnum; +} + +/** + * Configure the purpose of a connection to be used for authentication during login. + */ +export interface EventStreamCloudEventConnectionDeletedObject3Authentication { + active: boolean; +} + +/** + * Configure the purpose of a connection to be used for connected accounts and Token Vault. + */ +export interface EventStreamCloudEventConnectionDeletedObject3ConnectedAccounts { + active: boolean; +} + +/** + * Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed. + */ +export interface EventStreamCloudEventConnectionDeletedObject3Metadata {} + +/** + * Options for the 'pingfederate' connection + */ +export interface EventStreamCloudEventConnectionDeletedObject3Options { + assertion_decryption_settings?: + | Management.EventStreamCloudEventConnectionDeletedObject3OptionsAssertionDecryptionSettings + | undefined; + /** X.509 signing certificate from the identity provider in .der format. Used to validate signatures in SAML Responses and Assertions. This is an alternative to signingCert and is kept for backward compatibility. Prefer using signingCert instead. */ + cert?: string | undefined; + /** Timestamp of the last certificate expiring soon notification. */ + cert_rollover_notification?: string | undefined; + digestAlgorithm?: Management.EventStreamCloudEventConnectionDeletedObject3OptionsDigestAlgorithmEnum | undefined; + /** Domain aliases for the connection */ + domain_aliases?: string[] | undefined; + /** The entity identifier (Issuer) for the SAML Service Provider. When not provided, defaults to 'urn:auth0:{tenant}:{connection}'. This value is included in SAML AuthnRequest messages sent to the identity provider. */ + entityId?: string | undefined; + /** ISO 8601 formatted datetime indicating when the identity provider's signing certificate expires. */ + expires?: string | undefined; + /** URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows. */ + icon_url?: string | undefined; + idpinitiated?: Management.EventStreamCloudEventConnectionDeletedObject3OptionsIdpinitiated | undefined; + /** An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist) */ + non_persistent_attrs?: string[] | undefined; + protocolBinding?: Management.EventStreamCloudEventConnectionDeletedObject3OptionsProtocolBindingEnum | undefined; + set_user_root_attributes?: + | Management.EventStreamCloudEventConnectionDeletedObject3OptionsSetUserRootAttributesEnum + | undefined; + signatureAlgorithm?: + | Management.EventStreamCloudEventConnectionDeletedObject3OptionsSignatureAlgorithmEnum + | undefined; + /** Identity provider's SAML SingleSignOnService endpoint URL where Auth0 sends SAML authentication requests. This is the primary login URL for the SAML connection. Required unless using metadataUrl or metadataXml. */ + signInEndpoint?: string | undefined; + /** Base64-encoded X.509 certificate from the identity provider used to validate signatures in SAML responses and assertions. The certificate is decoded and used for cryptographic signature verification. */ + signingCert?: string | undefined; + /** When true, Auth0 signs SAML authentication requests using the connection's signing key. The signature includes the request's digest and is validated by the identity provider. Defaults to false (unsigned requests). */ + signSAMLRequest?: boolean | undefined; + subject?: Management.EventStreamCloudEventConnectionDeletedObject3OptionsSubject | undefined; + /** For SAML connections, the tenant domain used to construct the login endpoint URL. Can be a string for single-tenant or an array of strings for multi-tenant validation. */ + tenant_domain?: string | undefined; + /** SHA-1 thumbprints (fingerprints) of the identity provider's signing certificates. Automatically computed from signingCert during connection creation. Each thumbprint must be a 40-character hexadecimal string. */ + thumbprints?: string[] | undefined; + upstream_params?: Management.EventStreamCloudEventConnectionDeletedObject3OptionsUpstreamParams | undefined; + /** URL provided by PingFederate which returns information used for creating the connection */ + pingFederateBaseUrl: string; +} + +/** + * Settings for SAML assertion decryption. + */ +export interface EventStreamCloudEventConnectionDeletedObject3OptionsAssertionDecryptionSettings { + /** A list of insecure algorithms to allow for SAML assertion decryption. */ + algorithm_exceptions?: string[] | undefined; + algorithm_profile: Management.EventStreamCloudEventConnectionDeletedObject3OptionsAssertionDecryptionSettingsAlgorithmProfileEnum; +} + +/** The algorithm profile to use for decrypting SAML assertions. */ +export const EventStreamCloudEventConnectionDeletedObject3OptionsAssertionDecryptionSettingsAlgorithmProfileEnum = { + V20261: "v2026-1", +} as const; +export type EventStreamCloudEventConnectionDeletedObject3OptionsAssertionDecryptionSettingsAlgorithmProfileEnum = + (typeof EventStreamCloudEventConnectionDeletedObject3OptionsAssertionDecryptionSettingsAlgorithmProfileEnum)[keyof typeof EventStreamCloudEventConnectionDeletedObject3OptionsAssertionDecryptionSettingsAlgorithmProfileEnum]; + +/** Algorithm used for computing digest values when signing SAML requests and logout requests. Defaults to 'sha256'. */ +export const EventStreamCloudEventConnectionDeletedObject3OptionsDigestAlgorithmEnum = { + Sha1: "sha1", + Sha256: "sha256", +} as const; +export type EventStreamCloudEventConnectionDeletedObject3OptionsDigestAlgorithmEnum = + (typeof EventStreamCloudEventConnectionDeletedObject3OptionsDigestAlgorithmEnum)[keyof typeof EventStreamCloudEventConnectionDeletedObject3OptionsDigestAlgorithmEnum]; + +/** + * Configuration for IdP-Initiated SAML Single Sign-On. When enabled, allows users to initiate login directly from their SAML identity provider without first visiting Auth0. The IdP must include the connection parameter in the post-back URL (Assertion Consumer Service URL). + */ +export interface EventStreamCloudEventConnectionDeletedObject3OptionsIdpinitiated { + /** The query string sent to the default application */ + client_authorizequery?: string | undefined; + /** The client ID to use for IdP-initiated login requests. */ + client_id?: string | undefined; + client_protocol?: + | Management.EventStreamCloudEventConnectionDeletedObject3OptionsIdpinitiatedClientProtocolEnum + | undefined; + /** When true, enables IdP-initiated login support for this SAML connection. Allows users to log in directly from the identity provider without first visiting Auth0. */ + enabled?: boolean | undefined; +} + +/** The response protocol used to communicate with the default application. */ +export const EventStreamCloudEventConnectionDeletedObject3OptionsIdpinitiatedClientProtocolEnum = { + Oidc: "oidc", + Samlp: "samlp", + Wsfed: "wsfed", +} as const; +export type EventStreamCloudEventConnectionDeletedObject3OptionsIdpinitiatedClientProtocolEnum = + (typeof EventStreamCloudEventConnectionDeletedObject3OptionsIdpinitiatedClientProtocolEnum)[keyof typeof EventStreamCloudEventConnectionDeletedObject3OptionsIdpinitiatedClientProtocolEnum]; + +/** SAML protocol binding mechanism for sending authentication requests to the identity provider. */ +export const EventStreamCloudEventConnectionDeletedObject3OptionsProtocolBindingEnum = { + UrnOasisNamesTcSaml20BindingsHttpPost: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST", + UrnOasisNamesTcSaml20BindingsHttpRedirect: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect", +} as const; +export type EventStreamCloudEventConnectionDeletedObject3OptionsProtocolBindingEnum = + (typeof EventStreamCloudEventConnectionDeletedObject3OptionsProtocolBindingEnum)[keyof typeof EventStreamCloudEventConnectionDeletedObject3OptionsProtocolBindingEnum]; + +/** Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values. */ +export const EventStreamCloudEventConnectionDeletedObject3OptionsSetUserRootAttributesEnum = { + OnEachLogin: "on_each_login", + OnFirstLogin: "on_first_login", + NeverOnLogin: "never_on_login", +} as const; +export type EventStreamCloudEventConnectionDeletedObject3OptionsSetUserRootAttributesEnum = + (typeof EventStreamCloudEventConnectionDeletedObject3OptionsSetUserRootAttributesEnum)[keyof typeof EventStreamCloudEventConnectionDeletedObject3OptionsSetUserRootAttributesEnum]; + +/** Algorithm used to sign SAML authentication requests and logout requests using the connection's signing key. Common values: 'rsa-sha256' (RSA signature with SHA-256 digest) or 'rsa-sha1'. Defaults to 'rsa-sha256'. */ +export const EventStreamCloudEventConnectionDeletedObject3OptionsSignatureAlgorithmEnum = { + RsaSha1: "rsa-sha1", + RsaSha256: "rsa-sha256", +} as const; +export type EventStreamCloudEventConnectionDeletedObject3OptionsSignatureAlgorithmEnum = + (typeof EventStreamCloudEventConnectionDeletedObject3OptionsSignatureAlgorithmEnum)[keyof typeof EventStreamCloudEventConnectionDeletedObject3OptionsSignatureAlgorithmEnum]; + +/** + * Certificate Subject Distinguished Name (DN) extracted from the identity provider's signing certificate. + */ +export interface EventStreamCloudEventConnectionDeletedObject3OptionsSubject {} + +/** + * Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps + */ +export type EventStreamCloudEventConnectionDeletedObject3OptionsUpstreamParams = Record; + +/** The connection strategy. */ +export const EventStreamCloudEventConnectionDeletedObject3StrategyEnum = { + Pingfederate: "pingfederate", +} as const; +export type EventStreamCloudEventConnectionDeletedObject3StrategyEnum = + (typeof EventStreamCloudEventConnectionDeletedObject3StrategyEnum)[keyof typeof EventStreamCloudEventConnectionDeletedObject3StrategyEnum]; + +export interface EventStreamCloudEventConnectionDeletedObject4 { + authentication?: Management.EventStreamCloudEventConnectionDeletedObject4Authentication | undefined; + connected_accounts?: Management.EventStreamCloudEventConnectionDeletedObject4ConnectedAccounts | undefined; + /** Connection name used in the new universal login experience */ + display_name?: string | undefined; + /** Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients. */ + enabled_clients?: string[] | undefined; + /** The connection's identifier */ + id: string; + /** true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.) */ + is_domain_connection?: boolean | undefined; + metadata?: Management.EventStreamCloudEventConnectionDeletedObject4Metadata | undefined; + /** The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128 */ + name: string; + /** Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm. */ + realms?: string[] | undefined; + options?: Management.EventStreamCloudEventConnectionDeletedObject4Options | undefined; + /** Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`. */ + show_as_button?: boolean | undefined; + strategy: Management.EventStreamCloudEventConnectionDeletedObject4StrategyEnum; +} + +/** + * Configure the purpose of a connection to be used for authentication during login. + */ +export interface EventStreamCloudEventConnectionDeletedObject4Authentication { + active: boolean; +} + +/** + * Configure the purpose of a connection to be used for connected accounts and Token Vault. + */ +export interface EventStreamCloudEventConnectionDeletedObject4ConnectedAccounts { + active: boolean; +} + +/** + * Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed. + */ +export interface EventStreamCloudEventConnectionDeletedObject4Metadata {} + +/** + * Options for the 'adfs' connection + */ +export interface EventStreamCloudEventConnectionDeletedObject4Options { + /** ADFS federation metadata host or XML URL used to discover WS-Fed endpoints and certificates. Errors if adfs_server and fedMetadataXml are both absent. */ + adfs_server?: string | undefined; + /** Timestamp of the last certificate expiring soon notification. */ + cert_rollover_notification?: string | undefined; + /** Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication. */ + domain_aliases?: string[] | undefined; + /** The entity identifier (Issuer) for the ADFS Service Provider. When not provided, defaults to 'urn:auth0:{tenant}:{connection}'. */ + entityId?: string | undefined; + /** Inline XML alternative to 'adfs_server'. Cannot be set together with 'adfs_server'. */ + fedMetadataXml?: string | undefined; + /** URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows. */ + icon_url?: string | undefined; + /** An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist) */ + non_persistent_attrs?: string[] | undefined; + /** Array of certificate thumbprints (SHA-128/SHA-256/SHA-512 hex hashes) for validating SAML signatures. Used with WS-Federation protocol. Maximum 20 thumbprints. Each thumbprint must be a hexadecimal string. */ + prev_thumbprints?: string[] | undefined; + set_user_root_attributes?: + | Management.EventStreamCloudEventConnectionDeletedObject4OptionsSetUserRootAttributesEnum + | undefined; + should_trust_email_verified_connection?: + | Management.EventStreamCloudEventConnectionDeletedObject4OptionsShouldTrustEmailVerifiedConnectionEnum + | undefined; + /** Passive Requestor (WS-Fed) sign-in endpoint discovered from metadata or provided explicitly. */ + signInEndpoint?: string | undefined; + /** Tenant domain */ + tenant_domain?: string | undefined; + /** Array of certificate thumbprints (SHA-128/SHA-256/SHA-512 hex hashes) for validating SAML signatures. Used with WS-Federation protocol. Maximum 20 thumbprints. Each thumbprint must be a hexadecimal string. */ + thumbprints?: string[] | undefined; + upstream_params?: Management.EventStreamCloudEventConnectionDeletedObject4OptionsUpstreamParams | undefined; + /** Custom ADFS claim to use as the unique user identifier. When provided, this attribute is prepended to the default user_id mapping list with highest priority. Accepts a string (single ADFS claim name). */ + user_id_attribute?: string | undefined; +} + +/** Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values. */ +export const EventStreamCloudEventConnectionDeletedObject4OptionsSetUserRootAttributesEnum = { + OnEachLogin: "on_each_login", + OnFirstLogin: "on_first_login", + NeverOnLogin: "never_on_login", +} as const; +export type EventStreamCloudEventConnectionDeletedObject4OptionsSetUserRootAttributesEnum = + (typeof EventStreamCloudEventConnectionDeletedObject4OptionsSetUserRootAttributesEnum)[keyof typeof EventStreamCloudEventConnectionDeletedObject4OptionsSetUserRootAttributesEnum]; + +/** Choose how Auth0 sets the email_verified field in the user profile. */ +export const EventStreamCloudEventConnectionDeletedObject4OptionsShouldTrustEmailVerifiedConnectionEnum = { + NeverSetEmailsAsVerified: "never_set_emails_as_verified", + AlwaysSetEmailsAsVerified: "always_set_emails_as_verified", +} as const; +export type EventStreamCloudEventConnectionDeletedObject4OptionsShouldTrustEmailVerifiedConnectionEnum = + (typeof EventStreamCloudEventConnectionDeletedObject4OptionsShouldTrustEmailVerifiedConnectionEnum)[keyof typeof EventStreamCloudEventConnectionDeletedObject4OptionsShouldTrustEmailVerifiedConnectionEnum]; + +/** + * Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps + */ +export type EventStreamCloudEventConnectionDeletedObject4OptionsUpstreamParams = Record; + +/** The connection strategy. */ +export const EventStreamCloudEventConnectionDeletedObject4StrategyEnum = { + Adfs: "adfs", +} as const; +export type EventStreamCloudEventConnectionDeletedObject4StrategyEnum = + (typeof EventStreamCloudEventConnectionDeletedObject4StrategyEnum)[keyof typeof EventStreamCloudEventConnectionDeletedObject4StrategyEnum]; + +export interface EventStreamCloudEventConnectionDeletedObject5 { + authentication?: Management.EventStreamCloudEventConnectionDeletedObject5Authentication | undefined; + connected_accounts?: Management.EventStreamCloudEventConnectionDeletedObject5ConnectedAccounts | undefined; + /** Connection name used in the new universal login experience */ + display_name?: string | undefined; + /** Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients. */ + enabled_clients?: string[] | undefined; + /** The connection's identifier */ + id: string; + /** true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.) */ + is_domain_connection?: boolean | undefined; + metadata?: Management.EventStreamCloudEventConnectionDeletedObject5Metadata | undefined; + /** The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128 */ + name: string; + /** Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm. */ + realms?: string[] | undefined; + options?: Management.EventStreamCloudEventConnectionDeletedObject5Options | undefined; + strategy: Management.EventStreamCloudEventConnectionDeletedObject5StrategyEnum; +} + +/** + * Configure the purpose of a connection to be used for authentication during login. + */ +export interface EventStreamCloudEventConnectionDeletedObject5Authentication { + active: boolean; +} + +/** + * Configure the purpose of a connection to be used for connected accounts and Token Vault. + */ +export interface EventStreamCloudEventConnectionDeletedObject5ConnectedAccounts { + active: boolean; +} + +/** + * Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed. + */ +export interface EventStreamCloudEventConnectionDeletedObject5Metadata {} + +/** + * Options for the 'ad' connection + */ +export interface EventStreamCloudEventConnectionDeletedObject5Options { + /** IP address of the AD connector agent used to validate that authentication requests originate from the corporate network for Kerberos authentication (managed by the AD Connector agent). */ + agentIP?: string | undefined; + /** When enabled, allows direct username/password authentication through the AD connector agent instead of WS-Federation protocol (managed by the AD Connector agent). */ + agentMode?: boolean | undefined; + /** Version identifier of the installed AD connector agent software (managed by the AD Connector agent). */ + agentVersion?: string | undefined; + /** Enables Auth0's brute force protection to prevent credential stuffing attacks. When enabled, blocks suspicious login attempts from specific IP addresses after repeated failures. */ + brute_force_protection?: boolean | undefined; + /** Enables client SSL certificate authentication for the AD connector, requiring HTTPS on the sign-in endpoint */ + certAuth?: boolean | undefined; + /** Array of X.509 certificates in PEM format used for validating SAML signatures from the AD identity provider (managed by the AD Connector agent). */ + certs?: string[] | undefined; + /** When enabled, disables caching of AD connector authentication results to ensure real-time validation against the directory */ + disable_cache?: boolean | undefined; + /** When enabled, hides the 'Forgot Password' link on login pages to prevent users from initiating self-service password resets */ + disable_self_service_change_password?: boolean | undefined; + /** List of domain names that can be used with identifier-first authentication flow to route users to this AD connection; each domain must be a valid DNS name up to 256 characters */ + domain_aliases?: string[] | undefined; + /** https url of the icon to be shown */ + icon_url?: string | undefined; + /** Array of IP address ranges in CIDR notation used to determine if authentication requests originate from the corporate network for Kerberos or certificate authentication. */ + ips?: string[] | undefined; + /** Enables Windows Integrated Authentication (Kerberos) for seamless SSO when users authenticate from within the corporate network IP ranges */ + kerberos?: boolean | undefined; + /** An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist) */ + non_persistent_attrs?: string[] | undefined; + set_user_root_attributes?: + | Management.EventStreamCloudEventConnectionDeletedObject5OptionsSetUserRootAttributesEnum + | undefined; + /** The sign-in endpoint type for the AD-LDAP connector agent (managed by the AD Connector agent). */ + signInEndpoint?: string | undefined; + /** Primary AD domain hint used for HRD and discovery. */ + tenant_domain?: string | undefined; + /** Array of certificate SHA-1 thumbprints for validating signatures. Managed by Auth0 when using the AD Connector agent. */ + thumbprints?: string[] | undefined; + upstream_params?: Management.EventStreamCloudEventConnectionDeletedObject5OptionsUpstreamParams | undefined; +} + +/** Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values. */ +export const EventStreamCloudEventConnectionDeletedObject5OptionsSetUserRootAttributesEnum = { + OnEachLogin: "on_each_login", + OnFirstLogin: "on_first_login", + NeverOnLogin: "never_on_login", +} as const; +export type EventStreamCloudEventConnectionDeletedObject5OptionsSetUserRootAttributesEnum = + (typeof EventStreamCloudEventConnectionDeletedObject5OptionsSetUserRootAttributesEnum)[keyof typeof EventStreamCloudEventConnectionDeletedObject5OptionsSetUserRootAttributesEnum]; + +/** + * Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps + */ +export type EventStreamCloudEventConnectionDeletedObject5OptionsUpstreamParams = Record; + +/** The connection strategy. */ +export const EventStreamCloudEventConnectionDeletedObject5StrategyEnum = { + Ad: "ad", +} as const; +export type EventStreamCloudEventConnectionDeletedObject5StrategyEnum = + (typeof EventStreamCloudEventConnectionDeletedObject5StrategyEnum)[keyof typeof EventStreamCloudEventConnectionDeletedObject5StrategyEnum]; + +export interface EventStreamCloudEventConnectionDeletedObject6 { + authentication?: Management.EventStreamCloudEventConnectionDeletedObject6Authentication | undefined; + connected_accounts?: Management.EventStreamCloudEventConnectionDeletedObject6ConnectedAccounts | undefined; + /** Connection name used in the new universal login experience */ + display_name?: string | undefined; + /** Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients. */ + enabled_clients?: string[] | undefined; + /** The connection's identifier */ + id: string; + /** true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.) */ + is_domain_connection?: boolean | undefined; + metadata?: Management.EventStreamCloudEventConnectionDeletedObject6Metadata | undefined; + /** The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128 */ + name: string; + /** Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm. */ + realms?: string[] | undefined; + options?: Management.EventStreamCloudEventConnectionDeletedObject6Options | undefined; + /** Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`. */ + show_as_button?: boolean | undefined; + strategy: Management.EventStreamCloudEventConnectionDeletedObject6StrategyEnum; +} + +/** + * Configure the purpose of a connection to be used for authentication during login. + */ +export interface EventStreamCloudEventConnectionDeletedObject6Authentication { + active: boolean; +} + +/** + * Configure the purpose of a connection to be used for connected accounts and Token Vault. + */ +export interface EventStreamCloudEventConnectionDeletedObject6ConnectedAccounts { + active: boolean; +} + +/** + * Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed. + */ +export interface EventStreamCloudEventConnectionDeletedObject6Metadata {} + +/** + * Options for the 'google-apps' connection + */ +export interface EventStreamCloudEventConnectionDeletedObject6Options { + /** Expiration timestamp for the `admin_access_token` in ISO 8601 format. Auth0 uses this value to determine when to refresh the token. */ + admin_access_token_expiresin?: string | undefined; + /** When true, allows customization of OAuth scopes requested during user login. Custom scopes are appended to the mandatory email and profile scopes. When false or omitted, only the default email and profile scopes are used. This property is automatically enabled when Token Vault or Connected Accounts features are activated. */ + allow_setting_login_scopes?: boolean | undefined; + /** Enables integration with the Google Workspace Admin SDK Directory API for groups. When true, Auth0 can synchronize groups & group memberships and supports inbound directory provisioning for groups. Defaults to false. */ + api_enable_groups?: boolean | undefined; + /** Enables integration with the Google Workspace Admin SDK Directory API. When true, Auth0 can retrieve extended user attributes (admin status, suspension status, group memberships) and supports inbound directory provisioning (SCIM). Defaults to true. */ + api_enable_users?: boolean | undefined; + /** Your Google OAuth 2.0 client ID. You can find this in your [Google Cloud Console](https://console.cloud.google.com/apis/credentials) under the OAuth 2.0 Client IDs section. */ + client_id: string; + /** Primary Google Workspace domain name that users must belong to. */ + domain?: string | undefined; + /** Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication. */ + domain_aliases?: string[] | undefined; + /** Whether the OAuth flow requests the `email` scope. */ + email?: boolean | undefined; + /** Fetches the `agreedToTerms` flag from the Google Directory profile. */ + ext_agreed_terms?: boolean | undefined; + /** Enables enrichment with Google group memberships (required for `ext_groups_extended`). */ + ext_groups?: boolean | undefined; + /** Controls whether enriched group entries include `id`, `email`, `name` (true) or only the group name (false); can only be set when `ext_groups` is true. */ + ext_groups_extended?: boolean | undefined; + /** Fetches the Google Directory admin flag for the signing-in user. */ + ext_is_admin?: boolean | undefined; + /** Fetches the Google Directory suspended flag for the signing-in user. */ + ext_is_suspended?: boolean | undefined; + federated_connections_access_tokens?: + | Management.EventStreamCloudEventConnectionDeletedObject6OptionsFederatedConnectionsAccessTokens + | undefined; + /** When enabled, users who sign in with their Google account through a social login will be automatically routed to this Google Workspace connection if their email domain matches the configured tenant_domain or domain_aliases. This ensures enterprise users authenticate through their organization's Google Workspace identity provider rather than through a generic Google social login, enabling access to directory-based attributes and enforcing organizational security policies. Defaults to true for new connections. */ + handle_login_from_social?: boolean | undefined; + /** URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows. */ + icon_url?: string | undefined; + /** Determines how Auth0 generates the user_id for Google Workspace users. When false (default), the user's email address is used. When true, Google's stable numeric user ID is used instead, which persists even if the user's email changes. This setting can only be configured when creating the connection and cannot be changed afterward. */ + map_user_id_to_id?: boolean | undefined; + /** An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist) */ + non_persistent_attrs?: string[] | undefined; + /** Whether the OAuth flow requests the `profile` scope. */ + profile?: boolean | undefined; + /** Additional OAuth scopes requested beyond the default `email profile` scopes; ignored unless `allow_setting_login_scopes` is true. */ + scope?: string[] | undefined; + set_user_root_attributes?: + | Management.EventStreamCloudEventConnectionDeletedObject6OptionsSetUserRootAttributesEnum + | undefined; + /** The Google Workspace primary domain used to identify the organization during authentication. */ + tenant_domain?: string | undefined; + upstream_params?: Management.EventStreamCloudEventConnectionDeletedObject6OptionsUpstreamParams | undefined; +} + +/** + * Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users. + */ +export interface EventStreamCloudEventConnectionDeletedObject6OptionsFederatedConnectionsAccessTokens { + /** Enables refresh tokens and access tokens collection for federated connections */ + active: boolean; +} + +/** Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values. */ +export const EventStreamCloudEventConnectionDeletedObject6OptionsSetUserRootAttributesEnum = { + OnEachLogin: "on_each_login", + OnFirstLogin: "on_first_login", + NeverOnLogin: "never_on_login", +} as const; +export type EventStreamCloudEventConnectionDeletedObject6OptionsSetUserRootAttributesEnum = + (typeof EventStreamCloudEventConnectionDeletedObject6OptionsSetUserRootAttributesEnum)[keyof typeof EventStreamCloudEventConnectionDeletedObject6OptionsSetUserRootAttributesEnum]; + +/** + * Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps + */ +export type EventStreamCloudEventConnectionDeletedObject6OptionsUpstreamParams = Record; + +/** The connection strategy. */ +export const EventStreamCloudEventConnectionDeletedObject6StrategyEnum = { + GoogleApps: "google-apps", +} as const; +export type EventStreamCloudEventConnectionDeletedObject6StrategyEnum = + (typeof EventStreamCloudEventConnectionDeletedObject6StrategyEnum)[keyof typeof EventStreamCloudEventConnectionDeletedObject6StrategyEnum]; + +export interface EventStreamCloudEventConnectionDeletedObject7 { + authentication?: Management.EventStreamCloudEventConnectionDeletedObject7Authentication | undefined; + connected_accounts?: Management.EventStreamCloudEventConnectionDeletedObject7ConnectedAccounts | undefined; + /** Connection name used in the new universal login experience */ + display_name?: string | undefined; + /** Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients. */ + enabled_clients?: string[] | undefined; + /** The connection's identifier */ + id: string; + /** true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.) */ + is_domain_connection?: boolean | undefined; + metadata?: Management.EventStreamCloudEventConnectionDeletedObject7Metadata | undefined; + /** The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128 */ + name: string; + /** Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm. */ + realms?: string[] | undefined; + options?: Management.EventStreamCloudEventConnectionDeletedObject7Options | undefined; + /** Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`. */ + show_as_button?: boolean | undefined; + strategy: Management.EventStreamCloudEventConnectionDeletedObject7StrategyEnum; +} + +/** + * Configure the purpose of a connection to be used for authentication during login. + */ +export interface EventStreamCloudEventConnectionDeletedObject7Authentication { + active: boolean; +} + +/** + * Configure the purpose of a connection to be used for connected accounts and Token Vault. + */ +export interface EventStreamCloudEventConnectionDeletedObject7ConnectedAccounts { + active: boolean; +} + +/** + * Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed. + */ +export interface EventStreamCloudEventConnectionDeletedObject7Metadata {} + +/** + * Options for the 'waad' connection + */ +export interface EventStreamCloudEventConnectionDeletedObject7Options { + /** Enable users API */ + api_enable_users?: boolean | undefined; + /** The Azure AD application domain (e.g., 'contoso.onmicrosoft.com'). Used primarily with WS-Federation protocol and Azure AD v1 endpoints. */ + app_domain?: string | undefined; + /** The Application ID URI (App ID URI) for the Azure AD application. Required when using Azure AD v1 with the Resource Owner Password flow. Used to identify the resource being requested in OAuth token requests. */ + app_id?: string | undefined; + /** Includes basic user profile information from Azure AD (name, email, given_name, family_name). Always enabled and required - represents the minimum profile data retrieved during authentication. */ + basic_profile?: boolean | undefined; + /** Timestamp of the last certificate expiring soon notification. */ + cert_rollover_notification?: string | undefined; + /** OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider. */ + client_id: string; + /** The primary Azure AD tenant domain (e.g., 'contoso.onmicrosoft.com' or 'contoso.com'). */ + domain?: string | undefined; + /** Alternative domain names associated with this Azure AD tenant. Allows users from multiple verified domains to authenticate through this connection. Can be an array of domain strings. */ + domain_aliases?: string[] | undefined; + /** When enabled (true), retrieves and stores Azure AD security group memberships for the user. Requires Microsoft Graph API permissions (Directory.Read.All). Allows configuring max_groups_to_retrieve. */ + ext_groups?: boolean | undefined; + /** When true, stores all groups the user is member of, including transitive group memberships (groups within groups). When false (default), only direct group memberships are included. */ + ext_nested_groups?: boolean | undefined; + /** When enabled (true), retrieves extended profile attributes from Azure AD via Microsoft Graph API (job title, department, office location, etc.). Requires Graph API permissions. Only available with Azure AD v1 or when explicitly enabled for v2. */ + ext_profile?: boolean | undefined; + federated_connections_access_tokens?: + | Management.EventStreamCloudEventConnectionDeletedObject7OptionsFederatedConnectionsAccessTokens + | undefined; + /** Indicates whether admin consent has been granted for the required Azure AD permissions. Read-only status field managed by Auth0 during the OAuth authorization flow. */ + granted?: boolean | undefined; + /** URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows. */ + icon_url?: string | undefined; + identity_api?: Management.EventStreamCloudEventConnectionDeletedObject7OptionsIdentityApiEnum | undefined; + /** Maximum number of Azure AD groups to retrieve per user during authentication. Helps prevent performance issues for users in many groups. Only applies when ext_groups is enabled. Leave empty to use platform default. */ + max_groups_to_retrieve?: string | undefined; + /** An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist) */ + non_persistent_attrs?: string[] | undefined; + /** OAuth 2.0 scopes to request from Azure AD during authentication. Each scope represents a permission (e.g., 'User.Read', 'Group.Read.All'). Only applies with Microsoft Identity Platform v2.0. See Microsoft Graph permissions reference for available scopes. */ + scope?: string[] | undefined; + set_user_root_attributes?: + | Management.EventStreamCloudEventConnectionDeletedObject7OptionsSetUserRootAttributesEnum + | undefined; + should_trust_email_verified_connection?: + | Management.EventStreamCloudEventConnectionDeletedObject7OptionsShouldTrustEmailVerifiedConnectionEnum + | undefined; + tenant_domain?: Management.EventStreamCloudEventConnectionDeletedObject7OptionsTenantDomainOne | undefined; + /** The Azure AD tenant ID as a UUID. The unique identifier for your Azure AD organization. Must be a valid 36-character UUID. */ + tenantId?: string | undefined; + /** Array of certificate thumbprints (SHA-128/SHA-256/SHA-512 hex hashes) for validating SAML signatures. Used with WS-Federation protocol. Maximum 20 thumbprints. Each thumbprint must be a hexadecimal string. */ + thumbprints?: string[] | undefined; + upstream_params?: Management.EventStreamCloudEventConnectionDeletedObject7OptionsUpstreamParams | undefined; + /** Indicates WS-Federation protocol usage. When true, uses WS-Federation; when false, uses OpenID Connect. */ + use_wsfed?: boolean | undefined; + /** When enabled (true), uses the Azure AD common endpoint for multi-tenant authentication. Allows users from any Azure AD organization to sign in. Requires userid_attribute set to 'sub' (not 'oid'). Cannot be used with SCIM provisioning. Defaults to false. */ + useCommonEndpoint?: boolean | undefined; + userid_attribute?: Management.EventStreamCloudEventConnectionDeletedObject7OptionsUseridAttributeEnum | undefined; + waad_protocol?: Management.EventStreamCloudEventConnectionDeletedObject7OptionsWaadProtocolEnum | undefined; +} + +/** + * Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users. + */ +export interface EventStreamCloudEventConnectionDeletedObject7OptionsFederatedConnectionsAccessTokens { + /** Enables refresh tokens and access tokens collection for federated connections */ + active: boolean; +} + +/** The Azure AD endpoint version for authentication. 'microsoft-identity-platform-v2.0' (recommended, default) supports modern OAuth 2.0 features. 'azure-active-directory-v1.0' is the legacy endpoint with protocol limitations. Selection affects available features. */ +export const EventStreamCloudEventConnectionDeletedObject7OptionsIdentityApiEnum = { + MicrosoftIdentityPlatformV20: "microsoft-identity-platform-v2.0", + AzureActiveDirectoryV10: "azure-active-directory-v1.0", +} as const; +export type EventStreamCloudEventConnectionDeletedObject7OptionsIdentityApiEnum = + (typeof EventStreamCloudEventConnectionDeletedObject7OptionsIdentityApiEnum)[keyof typeof EventStreamCloudEventConnectionDeletedObject7OptionsIdentityApiEnum]; + +/** Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values. */ +export const EventStreamCloudEventConnectionDeletedObject7OptionsSetUserRootAttributesEnum = { + OnEachLogin: "on_each_login", + OnFirstLogin: "on_first_login", + NeverOnLogin: "never_on_login", +} as const; +export type EventStreamCloudEventConnectionDeletedObject7OptionsSetUserRootAttributesEnum = + (typeof EventStreamCloudEventConnectionDeletedObject7OptionsSetUserRootAttributesEnum)[keyof typeof EventStreamCloudEventConnectionDeletedObject7OptionsSetUserRootAttributesEnum]; + +/** Choose how Auth0 sets the email_verified field in the user profile. */ +export const EventStreamCloudEventConnectionDeletedObject7OptionsShouldTrustEmailVerifiedConnectionEnum = { + NeverSetEmailsAsVerified: "never_set_emails_as_verified", + AlwaysSetEmailsAsVerified: "always_set_emails_as_verified", +} as const; +export type EventStreamCloudEventConnectionDeletedObject7OptionsShouldTrustEmailVerifiedConnectionEnum = + (typeof EventStreamCloudEventConnectionDeletedObject7OptionsShouldTrustEmailVerifiedConnectionEnum)[keyof typeof EventStreamCloudEventConnectionDeletedObject7OptionsShouldTrustEmailVerifiedConnectionEnum]; + +/** + * Azure AD tenant domain as a UUID tenant ID. + */ +export type EventStreamCloudEventConnectionDeletedObject7OptionsTenantDomainOne = string; + +/** + * Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps + */ +export type EventStreamCloudEventConnectionDeletedObject7OptionsUpstreamParams = Record; + +/** The Azure AD claim to use as the unique user identifier. 'oid' (Object ID) is recommended for single-tenant connections and required for SCIM. 'sub' (Subject) is required for multi-tenant/common endpoint. Only applies with OpenID Connect protocol. */ +export const EventStreamCloudEventConnectionDeletedObject7OptionsUseridAttributeEnum = { + Oid: "oid", + Sub: "sub", +} as const; +export type EventStreamCloudEventConnectionDeletedObject7OptionsUseridAttributeEnum = + (typeof EventStreamCloudEventConnectionDeletedObject7OptionsUseridAttributeEnum)[keyof typeof EventStreamCloudEventConnectionDeletedObject7OptionsUseridAttributeEnum]; + +/** The authentication protocol for Azure AD v1 endpoints. 'openid-connect' (default, recommended) uses modern OAuth 2.0/OIDC. 'ws-federation' is a legacy SAML-based protocol for older integrations. Only available with Azure AD v1 API. */ +export const EventStreamCloudEventConnectionDeletedObject7OptionsWaadProtocolEnum = { + WsFederation: "ws-federation", + OpenidConnect: "openid-connect", +} as const; +export type EventStreamCloudEventConnectionDeletedObject7OptionsWaadProtocolEnum = + (typeof EventStreamCloudEventConnectionDeletedObject7OptionsWaadProtocolEnum)[keyof typeof EventStreamCloudEventConnectionDeletedObject7OptionsWaadProtocolEnum]; + +/** The connection strategy. */ +export const EventStreamCloudEventConnectionDeletedObject7StrategyEnum = { + Waad: "waad", +} as const; +export type EventStreamCloudEventConnectionDeletedObject7StrategyEnum = + (typeof EventStreamCloudEventConnectionDeletedObject7StrategyEnum)[keyof typeof EventStreamCloudEventConnectionDeletedObject7StrategyEnum]; + +/** The event type (injected from the SSE event field). */ +export const EventStreamCloudEventConnectionDeletedTypeEnum = { + ConnectionDeleted: "connection.deleted", +} as const; +export type EventStreamCloudEventConnectionDeletedTypeEnum = + (typeof EventStreamCloudEventConnectionDeletedTypeEnum)[keyof typeof EventStreamCloudEventConnectionDeletedTypeEnum]; + +/** + * SSE message for connection.updated. + */ +export interface EventStreamCloudEventConnectionUpdated { + /** Opaque cursor representing position in the stream. Pass as the `from` query parameter to resume. */ + offset: string; + event: Management.EventStreamCloudEventConnectionUpdatedCloudEvent; +} + +/** + * Represents an event that occurs when a connection is updated. + */ +export interface EventStreamCloudEventConnectionUpdatedCloudEvent { + specversion: Management.EventStreamCloudEventSpecVersionEnum; + type: Management.EventStreamCloudEventConnectionUpdatedCloudEventTypeEnum; + /** The source of the event. This will take the form 'urn:auth0:.'. */ + source: string; + /** A unique identifier for the event. */ + id: string; + /** An ISO-8601 timestamp indicating when the event physically occurred. */ + time: string; + data: Management.EventStreamCloudEventConnectionUpdatedData; + /** The auth0 tenant ID to which the event is associated. */ + a0tenant: string; + /** The auth0 event stream ID of the stream the event was delivered on. */ + a0stream: string; + a0purpose?: Management.EventStreamCloudEventA0PurposeEnum | undefined; +} + +/** The type of the event which has happened. */ +export const EventStreamCloudEventConnectionUpdatedCloudEventTypeEnum = { + ConnectionUpdated: "connection.updated", +} as const; +export type EventStreamCloudEventConnectionUpdatedCloudEventTypeEnum = + (typeof EventStreamCloudEventConnectionUpdatedCloudEventTypeEnum)[keyof typeof EventStreamCloudEventConnectionUpdatedCloudEventTypeEnum]; + +/** + * The event payload. + */ +export interface EventStreamCloudEventConnectionUpdatedData { + object: Management.EventStreamCloudEventConnectionUpdatedObject; + context?: Management.EventStreamCloudEventContext | undefined; +} + +/** + * The event content. + */ +export type EventStreamCloudEventConnectionUpdatedObject = + | Management.EventStreamCloudEventConnectionUpdatedObject0 + | Management.EventStreamCloudEventConnectionUpdatedObject1 + | Management.EventStreamCloudEventConnectionUpdatedObject2 + | Management.EventStreamCloudEventConnectionUpdatedObject3 + | Management.EventStreamCloudEventConnectionUpdatedObject4 + | Management.EventStreamCloudEventConnectionUpdatedObject5 + | Management.EventStreamCloudEventConnectionUpdatedObject6 + | Management.EventStreamCloudEventConnectionUpdatedObject7; + +export interface EventStreamCloudEventConnectionUpdatedObject0 { + authentication?: Management.EventStreamCloudEventConnectionUpdatedObject0Authentication | undefined; + /** Connection name used in the new universal login experience */ + display_name?: string | undefined; + /** Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients. */ + enabled_clients?: string[] | undefined; + /** The connection's identifier */ + id: string; + /** true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.) */ + is_domain_connection?: boolean | undefined; + metadata?: Management.EventStreamCloudEventConnectionUpdatedObject0Metadata | undefined; + /** The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128 */ + name: string; + /** Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm. */ + realms?: string[] | undefined; + connected_accounts?: Management.EventStreamCloudEventConnectionUpdatedObject0ConnectedAccounts | undefined; + options?: Management.EventStreamCloudEventConnectionUpdatedObject0Options | undefined; + /** Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`. */ + show_as_button?: boolean | undefined; + strategy: Management.EventStreamCloudEventConnectionUpdatedObject0StrategyEnum; +} + +/** + * Configure the purpose of a connection to be used for authentication during login. + */ +export interface EventStreamCloudEventConnectionUpdatedObject0Authentication { + active: boolean; +} + +/** + * Configure the purpose of a connection to be used for connected accounts and Token Vault. + */ +export interface EventStreamCloudEventConnectionUpdatedObject0ConnectedAccounts { + active: boolean; + cross_app_access?: boolean | undefined; +} + +/** + * Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed. + */ +export interface EventStreamCloudEventConnectionUpdatedObject0Metadata {} + +/** + * Options for the 'oidc' connection + */ +export interface EventStreamCloudEventConnectionUpdatedObject0Options { + /** URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow. */ + authorization_endpoint?: string | undefined; + /** OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider. */ + client_id: string; + connection_settings?: Management.EventStreamCloudEventConnectionUpdatedObject0OptionsConnectionSettings | undefined; + /** Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication. */ + domain_aliases?: string[] | undefined; + dpop_signing_alg?: Management.EventStreamCloudEventConnectionUpdatedObject0OptionsDpopSigningAlgEnum | undefined; + federated_connections_access_tokens?: + | Management.EventStreamCloudEventConnectionUpdatedObject0OptionsFederatedConnectionsAccessTokens + | undefined; + /** https url of the icon to be shown */ + icon_url?: string | undefined; + /** Indicates whether the identity provider supports session expiry via the id_token. If true, the system will use the session_expiry claim in the id_token to determine session expiry. */ + id_token_session_expiry_supported?: boolean | undefined; + /** List of algorithms allowed to verify the ID tokens. Applicable when strategy=oidc or okta. */ + id_token_signed_response_algs?: + | Management.EventStreamCloudEventConnectionUpdatedObject0OptionsIdTokenSignedResponseAlgsItemEnum[] + | undefined; + /** The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider. */ + issuer?: string | undefined; + /** URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures. */ + jwks_uri?: string | undefined; + /** An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist) */ + non_persistent_attrs?: string[] | undefined; + oidc_metadata?: Management.EventStreamCloudEventConnectionUpdatedObject0OptionsOidcMetadata | undefined; + schema_version?: Management.EventStreamCloudEventConnectionUpdatedObject0OptionsSchemaVersionEnum | undefined; + /** Space-separated list of OAuth 2.0 scopes requested during authorization. Must include 'openid' (required by OIDC spec). Common values: 'openid profile email'. Additional scopes depend on the identity provider. */ + scope?: string | undefined; + /** When true and type is 'back_channel', includes a cryptographic nonce in authorization requests to prevent replay attacks. The identity provider must include this nonce in the ID token for validation. */ + send_back_channel_nonce?: boolean | undefined; + set_user_root_attributes?: + | Management.EventStreamCloudEventConnectionUpdatedObject0OptionsSetUserRootAttributesEnum + | undefined; + /** Tenant domain */ + tenant_domain?: string | undefined; + /** URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow. */ + token_endpoint?: string | undefined; + token_endpoint_auth_method?: + | Management.EventStreamCloudEventConnectionUpdatedObject0OptionsTokenEndpointAuthMethodEnum + | undefined; + token_endpoint_auth_signing_alg?: + | Management.EventStreamCloudEventConnectionUpdatedObject0OptionsTokenEndpointAuthSigningAlgEnum + | undefined; + token_endpoint_jwtca_aud_format?: + | Management.EventStreamCloudEventConnectionUpdatedObject0OptionsTokenEndpointJwtcaAudFormatEnum + | undefined; + upstream_params?: Management.EventStreamCloudEventConnectionUpdatedObject0OptionsUpstreamParams | undefined; + /** Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token. */ + userinfo_endpoint?: string | undefined; + attribute_map?: Management.EventStreamCloudEventConnectionUpdatedObject0OptionsAttributeMap | undefined; + /** URL of the identity provider's OIDC Discovery endpoint (/.well-known/openid-configuration). When provided and oidc_metadata is empty, Auth0 automatically retrieves the provider's configuration including endpoints and supported features. */ + discovery_url?: string | undefined; + type?: Management.EventStreamCloudEventConnectionUpdatedObject0OptionsTypeEnum | undefined; +} + +/** + * Configuration for mapping claims from the identity provider to Auth0 user profile attributes. Allows customizing which IdP claims populate user fields and how they are transformed. + */ +export interface EventStreamCloudEventConnectionUpdatedObject0OptionsAttributeMap { + attributes?: Management.EventStreamCloudEventConnectionUpdatedObject0OptionsAttributeMapAttributes | undefined; + /** Scopes to send to the IdP's Userinfo endpoint */ + userinfo_scope?: string | undefined; + mapping_mode?: + | Management.EventStreamCloudEventConnectionUpdatedObject0OptionsAttributeMapMappingModeEnum + | undefined; +} + +/** + * Object containing mapping details for incoming claims + */ +export type EventStreamCloudEventConnectionUpdatedObject0OptionsAttributeMapAttributes = Record; + +/** Method used to map incoming claims when strategy=oidc. */ +export const EventStreamCloudEventConnectionUpdatedObject0OptionsAttributeMapMappingModeEnum = { + BindAll: "bind_all", + UseMap: "use_map", +} as const; +export type EventStreamCloudEventConnectionUpdatedObject0OptionsAttributeMapMappingModeEnum = + (typeof EventStreamCloudEventConnectionUpdatedObject0OptionsAttributeMapMappingModeEnum)[keyof typeof EventStreamCloudEventConnectionUpdatedObject0OptionsAttributeMapMappingModeEnum]; + +/** + * OAuth 2.0 PKCE (Proof Key for Code Exchange) settings. PKCE enhances security for public clients by preventing authorization code interception attacks. 'auto' (recommended) uses the strongest method supported by the IdP. + */ +export interface EventStreamCloudEventConnectionUpdatedObject0OptionsConnectionSettings { + pkce?: Management.EventStreamCloudEventConnectionUpdatedObject0OptionsConnectionSettingsPkceEnum | undefined; +} + +/** PKCE configuration. */ +export const EventStreamCloudEventConnectionUpdatedObject0OptionsConnectionSettingsPkceEnum = { + Auto: "auto", + S256: "S256", + Plain: "plain", + Disabled: "disabled", +} as const; +export type EventStreamCloudEventConnectionUpdatedObject0OptionsConnectionSettingsPkceEnum = + (typeof EventStreamCloudEventConnectionUpdatedObject0OptionsConnectionSettingsPkceEnum)[keyof typeof EventStreamCloudEventConnectionUpdatedObject0OptionsConnectionSettingsPkceEnum]; + +/** Algorithm used for DPoP proof JWT signing. Applicable when strategy=oidc or okta. */ +export const EventStreamCloudEventConnectionUpdatedObject0OptionsDpopSigningAlgEnum = { + Es256: "ES256", + Es384: "ES384", + Es512: "ES512", + Ed25519: "Ed25519", +} as const; +export type EventStreamCloudEventConnectionUpdatedObject0OptionsDpopSigningAlgEnum = + (typeof EventStreamCloudEventConnectionUpdatedObject0OptionsDpopSigningAlgEnum)[keyof typeof EventStreamCloudEventConnectionUpdatedObject0OptionsDpopSigningAlgEnum]; + +/** + * Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users. + */ +export interface EventStreamCloudEventConnectionUpdatedObject0OptionsFederatedConnectionsAccessTokens { + /** Enables refresh tokens and access tokens collection for federated connections */ + active: boolean; +} + +/** Algorithm allowed to verify the ID tokens. */ +export const EventStreamCloudEventConnectionUpdatedObject0OptionsIdTokenSignedResponseAlgsItemEnum = { + Es256: "ES256", + Es384: "ES384", + Ps256: "PS256", + Ps384: "PS384", + Rs256: "RS256", + Rs384: "RS384", + Rs512: "RS512", +} as const; +export type EventStreamCloudEventConnectionUpdatedObject0OptionsIdTokenSignedResponseAlgsItemEnum = + (typeof EventStreamCloudEventConnectionUpdatedObject0OptionsIdTokenSignedResponseAlgsItemEnum)[keyof typeof EventStreamCloudEventConnectionUpdatedObject0OptionsIdTokenSignedResponseAlgsItemEnum]; + +/** + * OpenID Connect Provider Metadata as per https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata + */ +export interface EventStreamCloudEventConnectionUpdatedObject0OptionsOidcMetadata { + /** A list of the Authentication Context Class References that this OP supports */ + acr_values_supported?: string[] | undefined; + /** URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow. */ + authorization_endpoint: string; + /** JSON array containing a list of the Claim Types that the OpenID Provider supports. These Claim Types are described in Section 5.6 of OpenID Connect Core 1.0 [OpenID.Core]. If omitted, the implementation supports only normal Claims. */ + claim_types_supported?: string[] | undefined; + /** Languages and scripts supported for values in Claims being returned, represented as a JSON array of BCP47 [RFC5646] language tag values. Not all languages and scripts are necessarily supported for all Claim values. */ + claims_locales_supported?: string[] | undefined; + /** Boolean value specifying whether the OP supports use of the claims parameter, with true indicating support. If omitted, the default value is false. */ + claims_parameter_supported?: boolean | undefined; + /** JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply values for. Note that for privacy or other reasons, this might not be an exhaustive list. */ + claims_supported?: string[] | undefined; + /** JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used. */ + display_values_supported?: string[] | undefined; + /** JSON array containing a list of the JWS signing algorithms (alg values) supported for DPoP proof JWT signing. */ + dpop_signing_alg_values_supported?: string[] | undefined; + /** URL of the identity provider's logout/end session endpoint. When configured as a static URL, users are redirected here after logging out from Auth0. Must use HTTPS scheme. */ + end_session_endpoint?: string | undefined; + /** A list of the OAuth 2.0 Grant Type values that this OP supports. Dynamic OpenID Providers MUST support the authorization_code and implicit Grant Type values and MAY support other Grant Types. If omitted, the default value is ["authorization_code", "implicit"]. */ + grant_types_supported?: string[] | undefined; + /** JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT */ + id_token_encryption_alg_values_supported?: string[] | undefined; + /** JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for the ID Token to encode the Claims in a JWT [JWT]. */ + id_token_encryption_enc_values_supported?: string[] | undefined; + /** A list of the JWS signing algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT. The algorithm RS256 MUST be included. The value none MAY be supported, but MUST NOT be used unless the Response Type used returns no ID Token from the Authorization Endpoint (such as when using the Authorization Code Flow). https://datatracker.ietf.org/doc/html/rfc7518 */ + id_token_signing_alg_values_supported: string[]; + /** The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider. */ + issuer: string; + /** URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures. */ + jwks_uri: string; + /** URL that the OpenID Provider provides to the person registering the Client to read about the OPs requirements on how the Relying Party can use the data provided by the OP. The registration process SHOULD display this URL to the person registering the Client if it is given. */ + op_policy_uri?: string | undefined; + /** URL that the OpenID Provider provides to the person registering the Client to read about OpenID Providers terms of service. The registration process SHOULD display this URL to the person registering the Client if it is given. */ + op_tos_uri?: string | undefined; + /** URL of the OPs Dynamic Client Registration Endpoint. RECOMMENDED but not REQUIRED. https://openid.net/specs/openid-connect-discovery-1_0.html#OpenID.Registration */ + registration_endpoint?: string | undefined; + /** JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference. */ + request_object_encryption_alg_values_supported?: string[] | undefined; + /** JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference. */ + request_object_encryption_enc_values_supported?: string[] | undefined; + /** JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for Request Objects, which are described in Section 6.1 of OpenID Connect Core 1.0 [OpenID.Core]. These algorithms are used both when the Request Object is passed by value (using the request parameter) and when it is passed by reference (using the request_uri parameter). Servers SHOULD support none and RS256. */ + request_object_signing_alg_values_supported?: string[] | undefined; + /** Boolean value specifying whether the OP supports use of the request parameter, with true indicating support. If omitted, the default value is false. */ + request_parameter_supported?: boolean | undefined; + /** Boolean value specifying whether the OP supports use of the request_uri parameter, with true indicating support. If omitted, the default value is false. */ + request_uri_parameter_supported?: boolean | undefined; + /** Boolean value specifying whether the OP requires use of the request_uri parameter. If omitted, the default value is false. */ + require_request_uri_registration?: boolean | undefined; + /** A list of the OAuth 2.0 response_mode values that this OP supports. If omitted, the default for Dynamic OpenID Providers is ["query", "fragment"] */ + response_modes_supported?: string[] | undefined; + /** A list of the OAuth 2.0 response_type values that this OP supports. Dynamic OpenID Providers MUST support the code, id_token, and the token id_token Response Type values */ + response_types_supported?: string[] | undefined; + /** A list of the OAuth 2.0 [RFC6749] scope values that this server supports. The server MUST support the openid scope value. Servers MAY choose not to advertise some supported scope values even when this parameter is used, although those defined in [OpenID.Core] SHOULD be listed, if supported. RECOMMENDED but not REQUIRED */ + scopes_supported?: string[] | undefined; + /** URL of a page containing human-readable information that developers might want or need to know when using the OpenID Provider. In particular, if the OpenID Provider does not support Dynamic Client Registration, then information on how to register Clients needs to be provided in this documentation. */ + service_documentation?: string | undefined; + /** A list of the Subject Identifier types that this OP supports. Valid types include pairwise and public */ + subject_types_supported?: string[] | undefined; + /** URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow. */ + token_endpoint?: string | undefined; + /** JSON array containing a list of Client Authentication methods supported by this Token Endpoint. The options are client_secret_post, client_secret_basic, client_secret_jwt, and private_key_jwt, as described in Section 9 of OpenID Connect Core 1.0 [OpenID.Core]. Other authentication methods MAY be defined by extensions. If omitted, the default is client_secret_basic -- the HTTP Basic Authentication Scheme specified in Section 2.3.1 of OAuth 2.0 [RFC6749]. */ + token_endpoint_auth_methods_supported?: string[] | undefined; + /** JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used. */ + token_endpoint_auth_signing_alg_values_supported?: string[] | undefined; + /** Languages and scripts supported for the user interface, represented as a JSON array of BCP47 [RFC5646] language tag values. */ + ui_locales_supported?: string[] | undefined; + /** JSON array containing a list of the JWE [JWE] encryption algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. */ + userinfo_encryption_alg_values_supported?: string[] | undefined; + /** JSON array containing a list of the JWE encryption algorithms (enc values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. */ + userinfo_encryption_enc_values_supported?: string[] | undefined; + /** Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token. */ + userinfo_endpoint?: string | undefined; + /** JSON array containing a list of the JWS [JWS] signing algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. The value none MAY be included. */ + userinfo_signing_alg_values_supported?: string[] | undefined; +} + +/** The internal schema version of the connection options. */ +export const EventStreamCloudEventConnectionUpdatedObject0OptionsSchemaVersionEnum = { + Openid100: "openid-1.0.0", + OidcV4: "oidc-v4", +} as const; +export type EventStreamCloudEventConnectionUpdatedObject0OptionsSchemaVersionEnum = + (typeof EventStreamCloudEventConnectionUpdatedObject0OptionsSchemaVersionEnum)[keyof typeof EventStreamCloudEventConnectionUpdatedObject0OptionsSchemaVersionEnum]; + +/** Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values. */ +export const EventStreamCloudEventConnectionUpdatedObject0OptionsSetUserRootAttributesEnum = { + OnEachLogin: "on_each_login", + OnFirstLogin: "on_first_login", + NeverOnLogin: "never_on_login", +} as const; +export type EventStreamCloudEventConnectionUpdatedObject0OptionsSetUserRootAttributesEnum = + (typeof EventStreamCloudEventConnectionUpdatedObject0OptionsSetUserRootAttributesEnum)[keyof typeof EventStreamCloudEventConnectionUpdatedObject0OptionsSetUserRootAttributesEnum]; + +/** Authentication method used at the identity provider's token endpoint. 'client_secret_post' sends credentials in the request body; 'private_key_jwt' uses a signed JWT assertion for enhanced security. Applicable when strategy=oidc or okta. */ +export const EventStreamCloudEventConnectionUpdatedObject0OptionsTokenEndpointAuthMethodEnum = { + ClientSecretPost: "client_secret_post", + PrivateKeyJwt: "private_key_jwt", +} as const; +export type EventStreamCloudEventConnectionUpdatedObject0OptionsTokenEndpointAuthMethodEnum = + (typeof EventStreamCloudEventConnectionUpdatedObject0OptionsTokenEndpointAuthMethodEnum)[keyof typeof EventStreamCloudEventConnectionUpdatedObject0OptionsTokenEndpointAuthMethodEnum]; + +/** Algorithm used to sign client_assertions. Applicable when strategy=oidc or okta. */ +export const EventStreamCloudEventConnectionUpdatedObject0OptionsTokenEndpointAuthSigningAlgEnum = { + Es256: "ES256", + Es384: "ES384", + Ps256: "PS256", + Ps384: "PS384", + Rs256: "RS256", + Rs384: "RS384", + Rs512: "RS512", +} as const; +export type EventStreamCloudEventConnectionUpdatedObject0OptionsTokenEndpointAuthSigningAlgEnum = + (typeof EventStreamCloudEventConnectionUpdatedObject0OptionsTokenEndpointAuthSigningAlgEnum)[keyof typeof EventStreamCloudEventConnectionUpdatedObject0OptionsTokenEndpointAuthSigningAlgEnum]; + +/** Specifies the format of the aud (audience) claim included in the JWT used for client authentication at the token endpoint. Accepted values are: 'issuer' (the aud claim is set to the OIDC issuer URL) or 'token_endpoint' (the aud claim is set to the token endpoint URL). */ +export const EventStreamCloudEventConnectionUpdatedObject0OptionsTokenEndpointJwtcaAudFormatEnum = { + Issuer: "issuer", + TokenEndpoint: "token_endpoint", +} as const; +export type EventStreamCloudEventConnectionUpdatedObject0OptionsTokenEndpointJwtcaAudFormatEnum = + (typeof EventStreamCloudEventConnectionUpdatedObject0OptionsTokenEndpointJwtcaAudFormatEnum)[keyof typeof EventStreamCloudEventConnectionUpdatedObject0OptionsTokenEndpointJwtcaAudFormatEnum]; + +/** OIDC communication channel type. 'back_channel' (confidential client) exchanges tokens server-side for stronger security; 'front_channel' handles responses in the browser. */ +export const EventStreamCloudEventConnectionUpdatedObject0OptionsTypeEnum = { + BackChannel: "back_channel", + FrontChannel: "front_channel", +} as const; +export type EventStreamCloudEventConnectionUpdatedObject0OptionsTypeEnum = + (typeof EventStreamCloudEventConnectionUpdatedObject0OptionsTypeEnum)[keyof typeof EventStreamCloudEventConnectionUpdatedObject0OptionsTypeEnum]; + +/** + * Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps + */ +export type EventStreamCloudEventConnectionUpdatedObject0OptionsUpstreamParams = Record; + +/** The connection strategy. */ +export const EventStreamCloudEventConnectionUpdatedObject0StrategyEnum = { + Oidc: "oidc", +} as const; +export type EventStreamCloudEventConnectionUpdatedObject0StrategyEnum = + (typeof EventStreamCloudEventConnectionUpdatedObject0StrategyEnum)[keyof typeof EventStreamCloudEventConnectionUpdatedObject0StrategyEnum]; + +export interface EventStreamCloudEventConnectionUpdatedObject1 { + authentication?: Management.EventStreamCloudEventConnectionUpdatedObject1Authentication | undefined; + connected_accounts?: Management.EventStreamCloudEventConnectionUpdatedObject1ConnectedAccounts | undefined; + /** Connection name used in the new universal login experience */ + display_name?: string | undefined; + /** Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients. */ + enabled_clients?: string[] | undefined; + /** The connection's identifier */ + id: string; + /** true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.) */ + is_domain_connection?: boolean | undefined; + metadata?: Management.EventStreamCloudEventConnectionUpdatedObject1Metadata | undefined; + /** The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128 */ + name: string; + /** Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm. */ + realms?: string[] | undefined; + options?: Management.EventStreamCloudEventConnectionUpdatedObject1Options | undefined; + /** Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`. */ + show_as_button?: boolean | undefined; + strategy: Management.EventStreamCloudEventConnectionUpdatedObject1StrategyEnum; +} + +/** + * Configure the purpose of a connection to be used for authentication during login. + */ +export interface EventStreamCloudEventConnectionUpdatedObject1Authentication { + active: boolean; +} + +/** + * Configure the purpose of a connection to be used for connected accounts and Token Vault. + */ +export interface EventStreamCloudEventConnectionUpdatedObject1ConnectedAccounts { + active: boolean; +} + +/** + * Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed. + */ +export interface EventStreamCloudEventConnectionUpdatedObject1Metadata {} + +/** + * Options for the 'okta' connection + */ +export interface EventStreamCloudEventConnectionUpdatedObject1Options { + /** URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow. */ + authorization_endpoint?: string | undefined; + /** OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider. */ + client_id: string; + connection_settings?: Management.EventStreamCloudEventConnectionUpdatedObject1OptionsConnectionSettings | undefined; + /** Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication. */ + domain_aliases?: string[] | undefined; + dpop_signing_alg?: Management.EventStreamCloudEventConnectionUpdatedObject1OptionsDpopSigningAlgEnum | undefined; + federated_connections_access_tokens?: + | Management.EventStreamCloudEventConnectionUpdatedObject1OptionsFederatedConnectionsAccessTokens + | undefined; + /** https url of the icon to be shown */ + icon_url?: string | undefined; + /** Indicates whether the identity provider supports session expiry via the id_token. If true, the system will use the session_expiry claim in the id_token to determine session expiry. */ + id_token_session_expiry_supported?: boolean | undefined; + /** List of algorithms allowed to verify the ID tokens. Applicable when strategy=oidc or okta. */ + id_token_signed_response_algs?: + | Management.EventStreamCloudEventConnectionUpdatedObject1OptionsIdTokenSignedResponseAlgsItemEnum[] + | undefined; + /** The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider. */ + issuer?: string | undefined; + /** URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures. */ + jwks_uri?: string | undefined; + /** An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist) */ + non_persistent_attrs?: string[] | undefined; + oidc_metadata?: Management.EventStreamCloudEventConnectionUpdatedObject1OptionsOidcMetadata | undefined; + schema_version?: Management.EventStreamCloudEventConnectionUpdatedObject1OptionsSchemaVersionEnum | undefined; + /** Space-separated list of OAuth 2.0 scopes requested during authorization. Must include 'openid' (required by OIDC spec). Common values: 'openid profile email'. Additional scopes depend on the identity provider. */ + scope?: string | undefined; + /** When true and type is 'back_channel', includes a cryptographic nonce in authorization requests to prevent replay attacks. The identity provider must include this nonce in the ID token for validation. */ + send_back_channel_nonce?: boolean | undefined; + set_user_root_attributes?: + | Management.EventStreamCloudEventConnectionUpdatedObject1OptionsSetUserRootAttributesEnum + | undefined; + /** Tenant domain */ + tenant_domain?: string | undefined; + /** URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow. */ + token_endpoint?: string | undefined; + token_endpoint_auth_method?: + | Management.EventStreamCloudEventConnectionUpdatedObject1OptionsTokenEndpointAuthMethodEnum + | undefined; + token_endpoint_auth_signing_alg?: + | Management.EventStreamCloudEventConnectionUpdatedObject1OptionsTokenEndpointAuthSigningAlgEnum + | undefined; + token_endpoint_jwtca_aud_format?: + | Management.EventStreamCloudEventConnectionUpdatedObject1OptionsTokenEndpointJwtcaAudFormatEnum + | undefined; + upstream_params?: Management.EventStreamCloudEventConnectionUpdatedObject1OptionsUpstreamParams | undefined; + /** Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token. */ + userinfo_endpoint?: string | undefined; + attribute_map?: Management.EventStreamCloudEventConnectionUpdatedObject1OptionsAttributeMap | undefined; + /** Domain of the Okta organization (e.g., dev-123456.okta.com). Should be just the domain of the okta server with no scheme or trailing backslash. Discovery runs only when connection.options.oidc_metadata is empty and a domain is provided */ + domain?: string | undefined; + type?: Management.EventStreamCloudEventConnectionUpdatedObject1OptionsTypeEnum | undefined; +} + +/** + * Mapping of claims received from the identity provider (IdP) + */ +export interface EventStreamCloudEventConnectionUpdatedObject1OptionsAttributeMap { + attributes?: Management.EventStreamCloudEventConnectionUpdatedObject1OptionsAttributeMapAttributes | undefined; + /** Scopes to send to the IdP's Userinfo endpoint */ + userinfo_scope?: string | undefined; + mapping_mode?: + | Management.EventStreamCloudEventConnectionUpdatedObject1OptionsAttributeMapMappingModeEnum + | undefined; +} + +/** + * Object containing mapping details for incoming claims + */ +export type EventStreamCloudEventConnectionUpdatedObject1OptionsAttributeMapAttributes = Record; + +/** Method used to map incoming claims when strategy=okta. */ +export const EventStreamCloudEventConnectionUpdatedObject1OptionsAttributeMapMappingModeEnum = { + BasicProfile: "basic_profile", + UseMap: "use_map", +} as const; +export type EventStreamCloudEventConnectionUpdatedObject1OptionsAttributeMapMappingModeEnum = + (typeof EventStreamCloudEventConnectionUpdatedObject1OptionsAttributeMapMappingModeEnum)[keyof typeof EventStreamCloudEventConnectionUpdatedObject1OptionsAttributeMapMappingModeEnum]; + +/** + * OAuth 2.0 PKCE (Proof Key for Code Exchange) settings. PKCE enhances security for public clients by preventing authorization code interception attacks. 'auto' (recommended) uses the strongest method supported by the IdP. + */ +export interface EventStreamCloudEventConnectionUpdatedObject1OptionsConnectionSettings { + pkce?: Management.EventStreamCloudEventConnectionUpdatedObject1OptionsConnectionSettingsPkceEnum | undefined; +} + +/** PKCE configuration. */ +export const EventStreamCloudEventConnectionUpdatedObject1OptionsConnectionSettingsPkceEnum = { + Auto: "auto", + S256: "S256", + Plain: "plain", + Disabled: "disabled", +} as const; +export type EventStreamCloudEventConnectionUpdatedObject1OptionsConnectionSettingsPkceEnum = + (typeof EventStreamCloudEventConnectionUpdatedObject1OptionsConnectionSettingsPkceEnum)[keyof typeof EventStreamCloudEventConnectionUpdatedObject1OptionsConnectionSettingsPkceEnum]; + +/** Algorithm used for DPoP proof JWT signing. Applicable when strategy=oidc or okta. */ +export const EventStreamCloudEventConnectionUpdatedObject1OptionsDpopSigningAlgEnum = { + Es256: "ES256", + Es384: "ES384", + Es512: "ES512", + Ed25519: "Ed25519", +} as const; +export type EventStreamCloudEventConnectionUpdatedObject1OptionsDpopSigningAlgEnum = + (typeof EventStreamCloudEventConnectionUpdatedObject1OptionsDpopSigningAlgEnum)[keyof typeof EventStreamCloudEventConnectionUpdatedObject1OptionsDpopSigningAlgEnum]; + +/** + * Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users. + */ +export interface EventStreamCloudEventConnectionUpdatedObject1OptionsFederatedConnectionsAccessTokens { + /** Enables refresh tokens and access tokens collection for federated connections */ + active: boolean; +} + +/** Algorithm allowed to verify the ID tokens. */ +export const EventStreamCloudEventConnectionUpdatedObject1OptionsIdTokenSignedResponseAlgsItemEnum = { + Es256: "ES256", + Es384: "ES384", + Ps256: "PS256", + Ps384: "PS384", + Rs256: "RS256", + Rs384: "RS384", + Rs512: "RS512", +} as const; +export type EventStreamCloudEventConnectionUpdatedObject1OptionsIdTokenSignedResponseAlgsItemEnum = + (typeof EventStreamCloudEventConnectionUpdatedObject1OptionsIdTokenSignedResponseAlgsItemEnum)[keyof typeof EventStreamCloudEventConnectionUpdatedObject1OptionsIdTokenSignedResponseAlgsItemEnum]; + +/** + * OpenID Connect Provider Metadata as per https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata + */ +export interface EventStreamCloudEventConnectionUpdatedObject1OptionsOidcMetadata { + /** A list of the Authentication Context Class References that this OP supports */ + acr_values_supported?: string[] | undefined; + /** URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow. */ + authorization_endpoint: string; + /** JSON array containing a list of the Claim Types that the OpenID Provider supports. These Claim Types are described in Section 5.6 of OpenID Connect Core 1.0 [OpenID.Core]. If omitted, the implementation supports only normal Claims. */ + claim_types_supported?: string[] | undefined; + /** Languages and scripts supported for values in Claims being returned, represented as a JSON array of BCP47 [RFC5646] language tag values. Not all languages and scripts are necessarily supported for all Claim values. */ + claims_locales_supported?: string[] | undefined; + /** Boolean value specifying whether the OP supports use of the claims parameter, with true indicating support. If omitted, the default value is false. */ + claims_parameter_supported?: boolean | undefined; + /** JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply values for. Note that for privacy or other reasons, this might not be an exhaustive list. */ + claims_supported?: string[] | undefined; + /** JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used. */ + display_values_supported?: string[] | undefined; + /** JSON array containing a list of the JWS signing algorithms (alg values) supported for DPoP proof JWT signing. */ + dpop_signing_alg_values_supported?: string[] | undefined; + /** URL of the identity provider's logout/end session endpoint. When configured as a static URL, users are redirected here after logging out from Auth0. Must use HTTPS scheme. */ + end_session_endpoint?: string | undefined; + /** A list of the OAuth 2.0 Grant Type values that this OP supports. Dynamic OpenID Providers MUST support the authorization_code and implicit Grant Type values and MAY support other Grant Types. If omitted, the default value is ["authorization_code", "implicit"]. */ + grant_types_supported?: string[] | undefined; + /** JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT */ + id_token_encryption_alg_values_supported?: string[] | undefined; + /** JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for the ID Token to encode the Claims in a JWT [JWT]. */ + id_token_encryption_enc_values_supported?: string[] | undefined; + /** A list of the JWS signing algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT. The algorithm RS256 MUST be included. The value none MAY be supported, but MUST NOT be used unless the Response Type used returns no ID Token from the Authorization Endpoint (such as when using the Authorization Code Flow). https://datatracker.ietf.org/doc/html/rfc7518 */ + id_token_signing_alg_values_supported: string[]; + /** The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider. */ + issuer: string; + /** URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures. */ + jwks_uri: string; + /** URL that the OpenID Provider provides to the person registering the Client to read about the OPs requirements on how the Relying Party can use the data provided by the OP. The registration process SHOULD display this URL to the person registering the Client if it is given. */ + op_policy_uri?: string | undefined; + /** URL that the OpenID Provider provides to the person registering the Client to read about OpenID Providers terms of service. The registration process SHOULD display this URL to the person registering the Client if it is given. */ + op_tos_uri?: string | undefined; + /** URL of the OPs Dynamic Client Registration Endpoint. RECOMMENDED but not REQUIRED. https://openid.net/specs/openid-connect-discovery-1_0.html#OpenID.Registration */ + registration_endpoint?: string | undefined; + /** JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference. */ + request_object_encryption_alg_values_supported?: string[] | undefined; + /** JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference. */ + request_object_encryption_enc_values_supported?: string[] | undefined; + /** JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for Request Objects, which are described in Section 6.1 of OpenID Connect Core 1.0 [OpenID.Core]. These algorithms are used both when the Request Object is passed by value (using the request parameter) and when it is passed by reference (using the request_uri parameter). Servers SHOULD support none and RS256. */ + request_object_signing_alg_values_supported?: string[] | undefined; + /** Boolean value specifying whether the OP supports use of the request parameter, with true indicating support. If omitted, the default value is false. */ + request_parameter_supported?: boolean | undefined; + /** Boolean value specifying whether the OP supports use of the request_uri parameter, with true indicating support. If omitted, the default value is false. */ + request_uri_parameter_supported?: boolean | undefined; + /** Boolean value specifying whether the OP requires use of the request_uri parameter. If omitted, the default value is false. */ + require_request_uri_registration?: boolean | undefined; + /** A list of the OAuth 2.0 response_mode values that this OP supports. If omitted, the default for Dynamic OpenID Providers is ["query", "fragment"] */ + response_modes_supported?: string[] | undefined; + /** A list of the OAuth 2.0 response_type values that this OP supports. Dynamic OpenID Providers MUST support the code, id_token, and the token id_token Response Type values */ + response_types_supported?: string[] | undefined; + /** A list of the OAuth 2.0 [RFC6749] scope values that this server supports. The server MUST support the openid scope value. Servers MAY choose not to advertise some supported scope values even when this parameter is used, although those defined in [OpenID.Core] SHOULD be listed, if supported. RECOMMENDED but not REQUIRED */ + scopes_supported?: string[] | undefined; + /** URL of a page containing human-readable information that developers might want or need to know when using the OpenID Provider. In particular, if the OpenID Provider does not support Dynamic Client Registration, then information on how to register Clients needs to be provided in this documentation. */ + service_documentation?: string | undefined; + /** A list of the Subject Identifier types that this OP supports. Valid types include pairwise and public */ + subject_types_supported?: string[] | undefined; + /** URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow. */ + token_endpoint?: string | undefined; + /** JSON array containing a list of Client Authentication methods supported by this Token Endpoint. The options are client_secret_post, client_secret_basic, client_secret_jwt, and private_key_jwt, as described in Section 9 of OpenID Connect Core 1.0 [OpenID.Core]. Other authentication methods MAY be defined by extensions. If omitted, the default is client_secret_basic -- the HTTP Basic Authentication Scheme specified in Section 2.3.1 of OAuth 2.0 [RFC6749]. */ + token_endpoint_auth_methods_supported?: string[] | undefined; + /** JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used. */ + token_endpoint_auth_signing_alg_values_supported?: string[] | undefined; + /** Languages and scripts supported for the user interface, represented as a JSON array of BCP47 [RFC5646] language tag values. */ + ui_locales_supported?: string[] | undefined; + /** JSON array containing a list of the JWE [JWE] encryption algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. */ + userinfo_encryption_alg_values_supported?: string[] | undefined; + /** JSON array containing a list of the JWE encryption algorithms (enc values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. */ + userinfo_encryption_enc_values_supported?: string[] | undefined; + /** Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token. */ + userinfo_endpoint?: string | undefined; + /** JSON array containing a list of the JWS [JWS] signing algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. The value none MAY be included. */ + userinfo_signing_alg_values_supported?: string[] | undefined; +} + +/** The internal schema version of the connection options. */ +export const EventStreamCloudEventConnectionUpdatedObject1OptionsSchemaVersionEnum = { + Openid100: "openid-1.0.0", + OidcV4: "oidc-v4", +} as const; +export type EventStreamCloudEventConnectionUpdatedObject1OptionsSchemaVersionEnum = + (typeof EventStreamCloudEventConnectionUpdatedObject1OptionsSchemaVersionEnum)[keyof typeof EventStreamCloudEventConnectionUpdatedObject1OptionsSchemaVersionEnum]; + +/** Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values. */ +export const EventStreamCloudEventConnectionUpdatedObject1OptionsSetUserRootAttributesEnum = { + OnEachLogin: "on_each_login", + OnFirstLogin: "on_first_login", + NeverOnLogin: "never_on_login", +} as const; +export type EventStreamCloudEventConnectionUpdatedObject1OptionsSetUserRootAttributesEnum = + (typeof EventStreamCloudEventConnectionUpdatedObject1OptionsSetUserRootAttributesEnum)[keyof typeof EventStreamCloudEventConnectionUpdatedObject1OptionsSetUserRootAttributesEnum]; + +/** Authentication method used at the identity provider's token endpoint. 'client_secret_post' sends credentials in the request body; 'private_key_jwt' uses a signed JWT assertion for enhanced security. Applicable when strategy=oidc or okta. */ +export const EventStreamCloudEventConnectionUpdatedObject1OptionsTokenEndpointAuthMethodEnum = { + ClientSecretPost: "client_secret_post", + PrivateKeyJwt: "private_key_jwt", +} as const; +export type EventStreamCloudEventConnectionUpdatedObject1OptionsTokenEndpointAuthMethodEnum = + (typeof EventStreamCloudEventConnectionUpdatedObject1OptionsTokenEndpointAuthMethodEnum)[keyof typeof EventStreamCloudEventConnectionUpdatedObject1OptionsTokenEndpointAuthMethodEnum]; + +/** Algorithm used to sign client_assertions. Applicable when strategy=oidc or okta. */ +export const EventStreamCloudEventConnectionUpdatedObject1OptionsTokenEndpointAuthSigningAlgEnum = { + Es256: "ES256", + Es384: "ES384", + Ps256: "PS256", + Ps384: "PS384", + Rs256: "RS256", + Rs384: "RS384", + Rs512: "RS512", +} as const; +export type EventStreamCloudEventConnectionUpdatedObject1OptionsTokenEndpointAuthSigningAlgEnum = + (typeof EventStreamCloudEventConnectionUpdatedObject1OptionsTokenEndpointAuthSigningAlgEnum)[keyof typeof EventStreamCloudEventConnectionUpdatedObject1OptionsTokenEndpointAuthSigningAlgEnum]; + +/** Specifies the format of the aud (audience) claim included in the JWT used for client authentication at the token endpoint. Accepted values are: 'issuer' (the aud claim is set to the OIDC issuer URL) or 'token_endpoint' (the aud claim is set to the token endpoint URL). */ +export const EventStreamCloudEventConnectionUpdatedObject1OptionsTokenEndpointJwtcaAudFormatEnum = { + Issuer: "issuer", + TokenEndpoint: "token_endpoint", +} as const; +export type EventStreamCloudEventConnectionUpdatedObject1OptionsTokenEndpointJwtcaAudFormatEnum = + (typeof EventStreamCloudEventConnectionUpdatedObject1OptionsTokenEndpointJwtcaAudFormatEnum)[keyof typeof EventStreamCloudEventConnectionUpdatedObject1OptionsTokenEndpointJwtcaAudFormatEnum]; + +/** Connection type */ +export const EventStreamCloudEventConnectionUpdatedObject1OptionsTypeEnum = { + BackChannel: "back_channel", +} as const; +export type EventStreamCloudEventConnectionUpdatedObject1OptionsTypeEnum = + (typeof EventStreamCloudEventConnectionUpdatedObject1OptionsTypeEnum)[keyof typeof EventStreamCloudEventConnectionUpdatedObject1OptionsTypeEnum]; + +/** + * Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps + */ +export type EventStreamCloudEventConnectionUpdatedObject1OptionsUpstreamParams = Record; + +/** The connection strategy. */ +export const EventStreamCloudEventConnectionUpdatedObject1StrategyEnum = { + Okta: "okta", +} as const; +export type EventStreamCloudEventConnectionUpdatedObject1StrategyEnum = + (typeof EventStreamCloudEventConnectionUpdatedObject1StrategyEnum)[keyof typeof EventStreamCloudEventConnectionUpdatedObject1StrategyEnum]; + +export interface EventStreamCloudEventConnectionUpdatedObject2 { + authentication?: Management.EventStreamCloudEventConnectionUpdatedObject2Authentication | undefined; + connected_accounts?: Management.EventStreamCloudEventConnectionUpdatedObject2ConnectedAccounts | undefined; + /** Connection name used in the new universal login experience */ + display_name?: string | undefined; + /** Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients. */ + enabled_clients?: string[] | undefined; + /** The connection's identifier */ + id: string; + /** true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.) */ + is_domain_connection?: boolean | undefined; + metadata?: Management.EventStreamCloudEventConnectionUpdatedObject2Metadata | undefined; + /** The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128 */ + name: string; + /** Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm. */ + realms?: string[] | undefined; + options?: Management.EventStreamCloudEventConnectionUpdatedObject2Options | undefined; + /** Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`. */ + show_as_button?: boolean | undefined; + strategy: Management.EventStreamCloudEventConnectionUpdatedObject2StrategyEnum; +} + +/** + * Configure the purpose of a connection to be used for authentication during login. + */ +export interface EventStreamCloudEventConnectionUpdatedObject2Authentication { + active: boolean; +} + +/** + * Configure the purpose of a connection to be used for connected accounts and Token Vault. + */ +export interface EventStreamCloudEventConnectionUpdatedObject2ConnectedAccounts { + active: boolean; +} + +/** + * Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed. + */ +export interface EventStreamCloudEventConnectionUpdatedObject2Metadata {} + +/** + * Options for the 'samlp' connection + */ +export interface EventStreamCloudEventConnectionUpdatedObject2Options { + assertion_decryption_settings?: + | Management.EventStreamCloudEventConnectionUpdatedObject2OptionsAssertionDecryptionSettings + | undefined; + /** X.509 signing certificate from the identity provider in .der format. Used to validate signatures in SAML Responses and Assertions. This is an alternative to signingCert and is kept for backward compatibility. Prefer using signingCert instead. */ + cert?: string | undefined; + /** Timestamp of the last certificate expiring soon notification. */ + cert_rollover_notification?: string | undefined; + digestAlgorithm?: Management.EventStreamCloudEventConnectionUpdatedObject2OptionsDigestAlgorithmEnum | undefined; + /** Domain aliases for the connection */ + domain_aliases?: string[] | undefined; + /** The entity identifier (Issuer) for the SAML Service Provider. When not provided, defaults to 'urn:auth0:{tenant}:{connection}'. This value is included in SAML AuthnRequest messages sent to the identity provider. */ + entityId?: string | undefined; + /** ISO 8601 formatted datetime indicating when the identity provider's signing certificate expires. */ + expires?: string | undefined; + /** URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows. */ + icon_url?: string | undefined; + idpinitiated?: Management.EventStreamCloudEventConnectionUpdatedObject2OptionsIdpinitiated | undefined; + /** An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist) */ + non_persistent_attrs?: string[] | undefined; + protocolBinding?: Management.EventStreamCloudEventConnectionUpdatedObject2OptionsProtocolBindingEnum | undefined; + set_user_root_attributes?: + | Management.EventStreamCloudEventConnectionUpdatedObject2OptionsSetUserRootAttributesEnum + | undefined; + signatureAlgorithm?: + | Management.EventStreamCloudEventConnectionUpdatedObject2OptionsSignatureAlgorithmEnum + | undefined; + /** Identity provider's SAML SingleSignOnService endpoint URL where Auth0 sends SAML authentication requests. This is the primary login URL for the SAML connection. Required unless using metadataUrl or metadataXml. */ + signInEndpoint?: string | undefined; + /** Base64-encoded X.509 certificate from the identity provider used to validate signatures in SAML responses and assertions. The certificate is decoded and used for cryptographic signature verification. */ + signingCert?: string | undefined; + /** When true, Auth0 signs SAML authentication requests using the connection's signing key. The signature includes the request's digest and is validated by the identity provider. Defaults to false (unsigned requests). */ + signSAMLRequest?: boolean | undefined; + subject?: Management.EventStreamCloudEventConnectionUpdatedObject2OptionsSubject | undefined; + /** For SAML connections, the tenant domain used to construct the login endpoint URL. Can be a string for single-tenant or an array of strings for multi-tenant validation. */ + tenant_domain?: string | undefined; + /** SHA-1 thumbprints (fingerprints) of the identity provider's signing certificates. Automatically computed from signingCert during connection creation. Each thumbprint must be a 40-character hexadecimal string. */ + thumbprints?: string[] | undefined; + upstream_params?: Management.EventStreamCloudEventConnectionUpdatedObject2OptionsUpstreamParams | undefined; + /** When true, enables detailed SAML debugging by issuing 'w' (warning) events in tenant logs containing SAML request/response details. WARNING: Potentially exposes sensitive user information (PII, credentials) and should only be enabled temporarily for debugging purposes. */ + debug?: boolean | undefined; + /** When true, enables DEFLATE compression for SAML requests sent via HTTP-Redirect binding. */ + deflate?: boolean | undefined; + /** The URL where Auth0 will send SAML authentication requests (the Identity Provider's SSO URL). Must be a valid HTTPS URL. */ + destinationUrl?: string | undefined; + /** When true, disables sending SAML logout requests (SingleLogoutService) to the identity provider during user sign-out. The user will be logged out of Auth0 but will remain logged into the identity provider. Defaults to false (federated logout enabled). */ + disableSignout?: boolean | undefined; + fieldsMap?: Management.EventStreamCloudEventConnectionUpdatedObject2OptionsFieldsMap | undefined; + /** Expected 'iss' (Issuer) claim value for JWT tokens in Global Token Revocation requests from the identity provider. When configured, Auth0 validates the JWT issuer matches this value before processing token revocation. Must be used together with global_token_revocation_jwt_sub. */ + global_token_revocation_jwt_iss?: string | undefined; + /** Expected 'sub' (Subject) claim value for JWT tokens in Global Token Revocation requests from the identity provider. When configured, Auth0 validates the JWT subject matches this value before processing token revocation. Must be used together with global_token_revocation_jwt_iss. */ + global_token_revocation_jwt_sub?: string | undefined; + /** HTTPS URL to the identity provider's SAML metadata document. When provided, Auth0 automatically fetches and parses the metadata to extract signInEndpoint, signOutEndpoint, signingCert, signSAMLRequest, and protocolBinding. Use metadataUrl OR metadataXml, not both. */ + metadataUrl?: string | undefined; + /** The URL where Auth0 will send SAML authentication requests (the Identity Provider's SSO URL). Must be a valid HTTPS URL. */ + recipientUrl?: string | undefined; + /** Custom XML template for SAML authentication requests. Supports variable substitution using @@variableName@@ syntax. When not provided, uses default SAML AuthnRequest template. See https://auth0.com/docs/authenticate/protocols/saml/saml-sso-integrations/configure-auth0-saml-service-provider#customize-the-request-template */ + requestTemplate?: string | undefined; + /** Identity provider's SAML SingleLogoutService endpoint URL where Auth0 sends logout requests for federated sign-out. When not provided, defaults to signInEndpoint. Only used if disableSignout is false. */ + signOutEndpoint?: string | undefined; + /** Custom SAML assertion attribute to use as the unique user identifier. When provided, this attribute is prepended to the default user_id mapping list with highest priority. Accepts a string (single SAML attribute name). */ + user_id_attribute?: string | undefined; +} + +/** + * Settings for SAML assertion decryption. + */ +export interface EventStreamCloudEventConnectionUpdatedObject2OptionsAssertionDecryptionSettings { + /** A list of insecure algorithms to allow for SAML assertion decryption. */ + algorithm_exceptions?: string[] | undefined; + algorithm_profile: Management.EventStreamCloudEventConnectionUpdatedObject2OptionsAssertionDecryptionSettingsAlgorithmProfileEnum; +} + +/** The algorithm profile to use for decrypting SAML assertions. */ +export const EventStreamCloudEventConnectionUpdatedObject2OptionsAssertionDecryptionSettingsAlgorithmProfileEnum = { + V20261: "v2026-1", +} as const; +export type EventStreamCloudEventConnectionUpdatedObject2OptionsAssertionDecryptionSettingsAlgorithmProfileEnum = + (typeof EventStreamCloudEventConnectionUpdatedObject2OptionsAssertionDecryptionSettingsAlgorithmProfileEnum)[keyof typeof EventStreamCloudEventConnectionUpdatedObject2OptionsAssertionDecryptionSettingsAlgorithmProfileEnum]; + +/** Algorithm used for computing digest values when signing SAML requests and logout requests. Defaults to 'sha256'. */ +export const EventStreamCloudEventConnectionUpdatedObject2OptionsDigestAlgorithmEnum = { + Sha1: "sha1", + Sha256: "sha256", +} as const; +export type EventStreamCloudEventConnectionUpdatedObject2OptionsDigestAlgorithmEnum = + (typeof EventStreamCloudEventConnectionUpdatedObject2OptionsDigestAlgorithmEnum)[keyof typeof EventStreamCloudEventConnectionUpdatedObject2OptionsDigestAlgorithmEnum]; + +/** + * Maps SAML assertion attributes from the identity provider to Auth0 user profile attributes. Format: { 'auth0_field': 'saml_attribute' } or { 'auth0_field': ['saml_attr1', 'saml_attr2'] } for fallback options. Merged with default mappings for email, name, given_name, family_name, and groups. + */ +export type EventStreamCloudEventConnectionUpdatedObject2OptionsFieldsMap = Record; + +/** + * Configuration for IdP-Initiated SAML Single Sign-On. When enabled, allows users to initiate login directly from their SAML identity provider without first visiting Auth0. The IdP must include the connection parameter in the post-back URL (Assertion Consumer Service URL). + */ +export interface EventStreamCloudEventConnectionUpdatedObject2OptionsIdpinitiated { + /** The query string sent to the default application */ + client_authorizequery?: string | undefined; + /** The client ID to use for IdP-initiated login requests. */ + client_id?: string | undefined; + client_protocol?: + | Management.EventStreamCloudEventConnectionUpdatedObject2OptionsIdpinitiatedClientProtocolEnum + | undefined; + /** When true, enables IdP-initiated login support for this SAML connection. Allows users to log in directly from the identity provider without first visiting Auth0. */ + enabled?: boolean | undefined; +} + +/** The response protocol used to communicate with the default application. */ +export const EventStreamCloudEventConnectionUpdatedObject2OptionsIdpinitiatedClientProtocolEnum = { + Oidc: "oidc", + Samlp: "samlp", + Wsfed: "wsfed", +} as const; +export type EventStreamCloudEventConnectionUpdatedObject2OptionsIdpinitiatedClientProtocolEnum = + (typeof EventStreamCloudEventConnectionUpdatedObject2OptionsIdpinitiatedClientProtocolEnum)[keyof typeof EventStreamCloudEventConnectionUpdatedObject2OptionsIdpinitiatedClientProtocolEnum]; + +/** SAML protocol binding mechanism for sending authentication requests to the identity provider. */ +export const EventStreamCloudEventConnectionUpdatedObject2OptionsProtocolBindingEnum = { + UrnOasisNamesTcSaml20BindingsHttpPost: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST", + UrnOasisNamesTcSaml20BindingsHttpRedirect: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect", +} as const; +export type EventStreamCloudEventConnectionUpdatedObject2OptionsProtocolBindingEnum = + (typeof EventStreamCloudEventConnectionUpdatedObject2OptionsProtocolBindingEnum)[keyof typeof EventStreamCloudEventConnectionUpdatedObject2OptionsProtocolBindingEnum]; + +/** Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values. */ +export const EventStreamCloudEventConnectionUpdatedObject2OptionsSetUserRootAttributesEnum = { + OnEachLogin: "on_each_login", + OnFirstLogin: "on_first_login", + NeverOnLogin: "never_on_login", +} as const; +export type EventStreamCloudEventConnectionUpdatedObject2OptionsSetUserRootAttributesEnum = + (typeof EventStreamCloudEventConnectionUpdatedObject2OptionsSetUserRootAttributesEnum)[keyof typeof EventStreamCloudEventConnectionUpdatedObject2OptionsSetUserRootAttributesEnum]; + +/** Algorithm used to sign SAML authentication requests and logout requests using the connection's signing key. Common values: 'rsa-sha256' (RSA signature with SHA-256 digest) or 'rsa-sha1'. Defaults to 'rsa-sha256'. */ +export const EventStreamCloudEventConnectionUpdatedObject2OptionsSignatureAlgorithmEnum = { + RsaSha1: "rsa-sha1", + RsaSha256: "rsa-sha256", +} as const; +export type EventStreamCloudEventConnectionUpdatedObject2OptionsSignatureAlgorithmEnum = + (typeof EventStreamCloudEventConnectionUpdatedObject2OptionsSignatureAlgorithmEnum)[keyof typeof EventStreamCloudEventConnectionUpdatedObject2OptionsSignatureAlgorithmEnum]; + +/** + * Certificate Subject Distinguished Name (DN) extracted from the identity provider's signing certificate. + */ +export interface EventStreamCloudEventConnectionUpdatedObject2OptionsSubject {} + +/** + * Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps + */ +export type EventStreamCloudEventConnectionUpdatedObject2OptionsUpstreamParams = Record; + +/** The connection strategy. */ +export const EventStreamCloudEventConnectionUpdatedObject2StrategyEnum = { + Samlp: "samlp", +} as const; +export type EventStreamCloudEventConnectionUpdatedObject2StrategyEnum = + (typeof EventStreamCloudEventConnectionUpdatedObject2StrategyEnum)[keyof typeof EventStreamCloudEventConnectionUpdatedObject2StrategyEnum]; + +export interface EventStreamCloudEventConnectionUpdatedObject3 { + authentication?: Management.EventStreamCloudEventConnectionUpdatedObject3Authentication | undefined; + connected_accounts?: Management.EventStreamCloudEventConnectionUpdatedObject3ConnectedAccounts | undefined; + /** Connection name used in the new universal login experience */ + display_name?: string | undefined; + /** Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients. */ + enabled_clients?: string[] | undefined; + /** The connection's identifier */ + id: string; + /** true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.) */ + is_domain_connection?: boolean | undefined; + metadata?: Management.EventStreamCloudEventConnectionUpdatedObject3Metadata | undefined; + /** The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128 */ + name: string; + /** Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm. */ + realms?: string[] | undefined; + options?: Management.EventStreamCloudEventConnectionUpdatedObject3Options | undefined; + /** Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`. */ + show_as_button?: boolean | undefined; + strategy: Management.EventStreamCloudEventConnectionUpdatedObject3StrategyEnum; +} + +/** + * Configure the purpose of a connection to be used for authentication during login. + */ +export interface EventStreamCloudEventConnectionUpdatedObject3Authentication { + active: boolean; +} + +/** + * Configure the purpose of a connection to be used for connected accounts and Token Vault. + */ +export interface EventStreamCloudEventConnectionUpdatedObject3ConnectedAccounts { + active: boolean; +} + +/** + * Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed. + */ +export interface EventStreamCloudEventConnectionUpdatedObject3Metadata {} + +/** + * Options for the 'pingfederate' connection + */ +export interface EventStreamCloudEventConnectionUpdatedObject3Options { + assertion_decryption_settings?: + | Management.EventStreamCloudEventConnectionUpdatedObject3OptionsAssertionDecryptionSettings + | undefined; + /** X.509 signing certificate from the identity provider in .der format. Used to validate signatures in SAML Responses and Assertions. This is an alternative to signingCert and is kept for backward compatibility. Prefer using signingCert instead. */ + cert?: string | undefined; + /** Timestamp of the last certificate expiring soon notification. */ + cert_rollover_notification?: string | undefined; + digestAlgorithm?: Management.EventStreamCloudEventConnectionUpdatedObject3OptionsDigestAlgorithmEnum | undefined; + /** Domain aliases for the connection */ + domain_aliases?: string[] | undefined; + /** The entity identifier (Issuer) for the SAML Service Provider. When not provided, defaults to 'urn:auth0:{tenant}:{connection}'. This value is included in SAML AuthnRequest messages sent to the identity provider. */ + entityId?: string | undefined; + /** ISO 8601 formatted datetime indicating when the identity provider's signing certificate expires. */ + expires?: string | undefined; + /** URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows. */ + icon_url?: string | undefined; + idpinitiated?: Management.EventStreamCloudEventConnectionUpdatedObject3OptionsIdpinitiated | undefined; + /** An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist) */ + non_persistent_attrs?: string[] | undefined; + protocolBinding?: Management.EventStreamCloudEventConnectionUpdatedObject3OptionsProtocolBindingEnum | undefined; + set_user_root_attributes?: + | Management.EventStreamCloudEventConnectionUpdatedObject3OptionsSetUserRootAttributesEnum + | undefined; + signatureAlgorithm?: + | Management.EventStreamCloudEventConnectionUpdatedObject3OptionsSignatureAlgorithmEnum + | undefined; + /** Identity provider's SAML SingleSignOnService endpoint URL where Auth0 sends SAML authentication requests. This is the primary login URL for the SAML connection. Required unless using metadataUrl or metadataXml. */ + signInEndpoint?: string | undefined; + /** Base64-encoded X.509 certificate from the identity provider used to validate signatures in SAML responses and assertions. The certificate is decoded and used for cryptographic signature verification. */ + signingCert?: string | undefined; + /** When true, Auth0 signs SAML authentication requests using the connection's signing key. The signature includes the request's digest and is validated by the identity provider. Defaults to false (unsigned requests). */ + signSAMLRequest?: boolean | undefined; + subject?: Management.EventStreamCloudEventConnectionUpdatedObject3OptionsSubject | undefined; + /** For SAML connections, the tenant domain used to construct the login endpoint URL. Can be a string for single-tenant or an array of strings for multi-tenant validation. */ + tenant_domain?: string | undefined; + /** SHA-1 thumbprints (fingerprints) of the identity provider's signing certificates. Automatically computed from signingCert during connection creation. Each thumbprint must be a 40-character hexadecimal string. */ + thumbprints?: string[] | undefined; + upstream_params?: Management.EventStreamCloudEventConnectionUpdatedObject3OptionsUpstreamParams | undefined; + /** URL provided by PingFederate which returns information used for creating the connection */ + pingFederateBaseUrl: string; +} + +/** + * Settings for SAML assertion decryption. + */ +export interface EventStreamCloudEventConnectionUpdatedObject3OptionsAssertionDecryptionSettings { + /** A list of insecure algorithms to allow for SAML assertion decryption. */ + algorithm_exceptions?: string[] | undefined; + algorithm_profile: Management.EventStreamCloudEventConnectionUpdatedObject3OptionsAssertionDecryptionSettingsAlgorithmProfileEnum; +} + +/** The algorithm profile to use for decrypting SAML assertions. */ +export const EventStreamCloudEventConnectionUpdatedObject3OptionsAssertionDecryptionSettingsAlgorithmProfileEnum = { + V20261: "v2026-1", +} as const; +export type EventStreamCloudEventConnectionUpdatedObject3OptionsAssertionDecryptionSettingsAlgorithmProfileEnum = + (typeof EventStreamCloudEventConnectionUpdatedObject3OptionsAssertionDecryptionSettingsAlgorithmProfileEnum)[keyof typeof EventStreamCloudEventConnectionUpdatedObject3OptionsAssertionDecryptionSettingsAlgorithmProfileEnum]; + +/** Algorithm used for computing digest values when signing SAML requests and logout requests. Defaults to 'sha256'. */ +export const EventStreamCloudEventConnectionUpdatedObject3OptionsDigestAlgorithmEnum = { + Sha1: "sha1", + Sha256: "sha256", +} as const; +export type EventStreamCloudEventConnectionUpdatedObject3OptionsDigestAlgorithmEnum = + (typeof EventStreamCloudEventConnectionUpdatedObject3OptionsDigestAlgorithmEnum)[keyof typeof EventStreamCloudEventConnectionUpdatedObject3OptionsDigestAlgorithmEnum]; + +/** + * Configuration for IdP-Initiated SAML Single Sign-On. When enabled, allows users to initiate login directly from their SAML identity provider without first visiting Auth0. The IdP must include the connection parameter in the post-back URL (Assertion Consumer Service URL). + */ +export interface EventStreamCloudEventConnectionUpdatedObject3OptionsIdpinitiated { + /** The query string sent to the default application */ + client_authorizequery?: string | undefined; + /** The client ID to use for IdP-initiated login requests. */ + client_id?: string | undefined; + client_protocol?: + | Management.EventStreamCloudEventConnectionUpdatedObject3OptionsIdpinitiatedClientProtocolEnum + | undefined; + /** When true, enables IdP-initiated login support for this SAML connection. Allows users to log in directly from the identity provider without first visiting Auth0. */ + enabled?: boolean | undefined; +} + +/** The response protocol used to communicate with the default application. */ +export const EventStreamCloudEventConnectionUpdatedObject3OptionsIdpinitiatedClientProtocolEnum = { + Oidc: "oidc", + Samlp: "samlp", + Wsfed: "wsfed", +} as const; +export type EventStreamCloudEventConnectionUpdatedObject3OptionsIdpinitiatedClientProtocolEnum = + (typeof EventStreamCloudEventConnectionUpdatedObject3OptionsIdpinitiatedClientProtocolEnum)[keyof typeof EventStreamCloudEventConnectionUpdatedObject3OptionsIdpinitiatedClientProtocolEnum]; + +/** SAML protocol binding mechanism for sending authentication requests to the identity provider. */ +export const EventStreamCloudEventConnectionUpdatedObject3OptionsProtocolBindingEnum = { + UrnOasisNamesTcSaml20BindingsHttpPost: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST", + UrnOasisNamesTcSaml20BindingsHttpRedirect: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect", +} as const; +export type EventStreamCloudEventConnectionUpdatedObject3OptionsProtocolBindingEnum = + (typeof EventStreamCloudEventConnectionUpdatedObject3OptionsProtocolBindingEnum)[keyof typeof EventStreamCloudEventConnectionUpdatedObject3OptionsProtocolBindingEnum]; + +/** Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values. */ +export const EventStreamCloudEventConnectionUpdatedObject3OptionsSetUserRootAttributesEnum = { + OnEachLogin: "on_each_login", + OnFirstLogin: "on_first_login", + NeverOnLogin: "never_on_login", +} as const; +export type EventStreamCloudEventConnectionUpdatedObject3OptionsSetUserRootAttributesEnum = + (typeof EventStreamCloudEventConnectionUpdatedObject3OptionsSetUserRootAttributesEnum)[keyof typeof EventStreamCloudEventConnectionUpdatedObject3OptionsSetUserRootAttributesEnum]; + +/** Algorithm used to sign SAML authentication requests and logout requests using the connection's signing key. Common values: 'rsa-sha256' (RSA signature with SHA-256 digest) or 'rsa-sha1'. Defaults to 'rsa-sha256'. */ +export const EventStreamCloudEventConnectionUpdatedObject3OptionsSignatureAlgorithmEnum = { + RsaSha1: "rsa-sha1", + RsaSha256: "rsa-sha256", +} as const; +export type EventStreamCloudEventConnectionUpdatedObject3OptionsSignatureAlgorithmEnum = + (typeof EventStreamCloudEventConnectionUpdatedObject3OptionsSignatureAlgorithmEnum)[keyof typeof EventStreamCloudEventConnectionUpdatedObject3OptionsSignatureAlgorithmEnum]; + +/** + * Certificate Subject Distinguished Name (DN) extracted from the identity provider's signing certificate. + */ +export interface EventStreamCloudEventConnectionUpdatedObject3OptionsSubject {} + +/** + * Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps + */ +export type EventStreamCloudEventConnectionUpdatedObject3OptionsUpstreamParams = Record; + +/** The connection strategy. */ +export const EventStreamCloudEventConnectionUpdatedObject3StrategyEnum = { + Pingfederate: "pingfederate", +} as const; +export type EventStreamCloudEventConnectionUpdatedObject3StrategyEnum = + (typeof EventStreamCloudEventConnectionUpdatedObject3StrategyEnum)[keyof typeof EventStreamCloudEventConnectionUpdatedObject3StrategyEnum]; + +export interface EventStreamCloudEventConnectionUpdatedObject4 { + authentication?: Management.EventStreamCloudEventConnectionUpdatedObject4Authentication | undefined; + connected_accounts?: Management.EventStreamCloudEventConnectionUpdatedObject4ConnectedAccounts | undefined; + /** Connection name used in the new universal login experience */ + display_name?: string | undefined; + /** Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients. */ + enabled_clients?: string[] | undefined; + /** The connection's identifier */ + id: string; + /** true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.) */ + is_domain_connection?: boolean | undefined; + metadata?: Management.EventStreamCloudEventConnectionUpdatedObject4Metadata | undefined; + /** The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128 */ + name: string; + /** Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm. */ + realms?: string[] | undefined; + options?: Management.EventStreamCloudEventConnectionUpdatedObject4Options | undefined; + /** Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`. */ + show_as_button?: boolean | undefined; + strategy: Management.EventStreamCloudEventConnectionUpdatedObject4StrategyEnum; +} + +/** + * Configure the purpose of a connection to be used for authentication during login. + */ +export interface EventStreamCloudEventConnectionUpdatedObject4Authentication { + active: boolean; +} + +/** + * Configure the purpose of a connection to be used for connected accounts and Token Vault. + */ +export interface EventStreamCloudEventConnectionUpdatedObject4ConnectedAccounts { + active: boolean; +} + +/** + * Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed. + */ +export interface EventStreamCloudEventConnectionUpdatedObject4Metadata {} + +/** + * Options for the 'adfs' connection + */ +export interface EventStreamCloudEventConnectionUpdatedObject4Options { + /** ADFS federation metadata host or XML URL used to discover WS-Fed endpoints and certificates. Errors if adfs_server and fedMetadataXml are both absent. */ + adfs_server?: string | undefined; + /** Timestamp of the last certificate expiring soon notification. */ + cert_rollover_notification?: string | undefined; + /** Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication. */ + domain_aliases?: string[] | undefined; + /** The entity identifier (Issuer) for the ADFS Service Provider. When not provided, defaults to 'urn:auth0:{tenant}:{connection}'. */ + entityId?: string | undefined; + /** Inline XML alternative to 'adfs_server'. Cannot be set together with 'adfs_server'. */ + fedMetadataXml?: string | undefined; + /** URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows. */ + icon_url?: string | undefined; + /** An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist) */ + non_persistent_attrs?: string[] | undefined; + /** Array of certificate thumbprints (SHA-128/SHA-256/SHA-512 hex hashes) for validating SAML signatures. Used with WS-Federation protocol. Maximum 20 thumbprints. Each thumbprint must be a hexadecimal string. */ + prev_thumbprints?: string[] | undefined; + set_user_root_attributes?: + | Management.EventStreamCloudEventConnectionUpdatedObject4OptionsSetUserRootAttributesEnum + | undefined; + should_trust_email_verified_connection?: + | Management.EventStreamCloudEventConnectionUpdatedObject4OptionsShouldTrustEmailVerifiedConnectionEnum + | undefined; + /** Passive Requestor (WS-Fed) sign-in endpoint discovered from metadata or provided explicitly. */ + signInEndpoint?: string | undefined; + /** Tenant domain */ + tenant_domain?: string | undefined; + /** Array of certificate thumbprints (SHA-128/SHA-256/SHA-512 hex hashes) for validating SAML signatures. Used with WS-Federation protocol. Maximum 20 thumbprints. Each thumbprint must be a hexadecimal string. */ + thumbprints?: string[] | undefined; + upstream_params?: Management.EventStreamCloudEventConnectionUpdatedObject4OptionsUpstreamParams | undefined; + /** Custom ADFS claim to use as the unique user identifier. When provided, this attribute is prepended to the default user_id mapping list with highest priority. Accepts a string (single ADFS claim name). */ + user_id_attribute?: string | undefined; +} + +/** Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values. */ +export const EventStreamCloudEventConnectionUpdatedObject4OptionsSetUserRootAttributesEnum = { + OnEachLogin: "on_each_login", + OnFirstLogin: "on_first_login", + NeverOnLogin: "never_on_login", +} as const; +export type EventStreamCloudEventConnectionUpdatedObject4OptionsSetUserRootAttributesEnum = + (typeof EventStreamCloudEventConnectionUpdatedObject4OptionsSetUserRootAttributesEnum)[keyof typeof EventStreamCloudEventConnectionUpdatedObject4OptionsSetUserRootAttributesEnum]; + +/** Choose how Auth0 sets the email_verified field in the user profile. */ +export const EventStreamCloudEventConnectionUpdatedObject4OptionsShouldTrustEmailVerifiedConnectionEnum = { + NeverSetEmailsAsVerified: "never_set_emails_as_verified", + AlwaysSetEmailsAsVerified: "always_set_emails_as_verified", +} as const; +export type EventStreamCloudEventConnectionUpdatedObject4OptionsShouldTrustEmailVerifiedConnectionEnum = + (typeof EventStreamCloudEventConnectionUpdatedObject4OptionsShouldTrustEmailVerifiedConnectionEnum)[keyof typeof EventStreamCloudEventConnectionUpdatedObject4OptionsShouldTrustEmailVerifiedConnectionEnum]; + +/** + * Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps + */ +export type EventStreamCloudEventConnectionUpdatedObject4OptionsUpstreamParams = Record; + +/** The connection strategy. */ +export const EventStreamCloudEventConnectionUpdatedObject4StrategyEnum = { + Adfs: "adfs", +} as const; +export type EventStreamCloudEventConnectionUpdatedObject4StrategyEnum = + (typeof EventStreamCloudEventConnectionUpdatedObject4StrategyEnum)[keyof typeof EventStreamCloudEventConnectionUpdatedObject4StrategyEnum]; + +export interface EventStreamCloudEventConnectionUpdatedObject5 { + authentication?: Management.EventStreamCloudEventConnectionUpdatedObject5Authentication | undefined; + connected_accounts?: Management.EventStreamCloudEventConnectionUpdatedObject5ConnectedAccounts | undefined; + /** Connection name used in the new universal login experience */ + display_name?: string | undefined; + /** Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients. */ + enabled_clients?: string[] | undefined; + /** The connection's identifier */ + id: string; + /** true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.) */ + is_domain_connection?: boolean | undefined; + metadata?: Management.EventStreamCloudEventConnectionUpdatedObject5Metadata | undefined; + /** The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128 */ + name: string; + /** Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm. */ + realms?: string[] | undefined; + options?: Management.EventStreamCloudEventConnectionUpdatedObject5Options | undefined; + strategy: Management.EventStreamCloudEventConnectionUpdatedObject5StrategyEnum; +} + +/** + * Configure the purpose of a connection to be used for authentication during login. + */ +export interface EventStreamCloudEventConnectionUpdatedObject5Authentication { + active: boolean; +} + +/** + * Configure the purpose of a connection to be used for connected accounts and Token Vault. + */ +export interface EventStreamCloudEventConnectionUpdatedObject5ConnectedAccounts { + active: boolean; +} + +/** + * Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed. + */ +export interface EventStreamCloudEventConnectionUpdatedObject5Metadata {} + +/** + * Options for the 'ad' connection + */ +export interface EventStreamCloudEventConnectionUpdatedObject5Options { + /** IP address of the AD connector agent used to validate that authentication requests originate from the corporate network for Kerberos authentication (managed by the AD Connector agent). */ + agentIP?: string | undefined; + /** When enabled, allows direct username/password authentication through the AD connector agent instead of WS-Federation protocol (managed by the AD Connector agent). */ + agentMode?: boolean | undefined; + /** Version identifier of the installed AD connector agent software (managed by the AD Connector agent). */ + agentVersion?: string | undefined; + /** Enables Auth0's brute force protection to prevent credential stuffing attacks. When enabled, blocks suspicious login attempts from specific IP addresses after repeated failures. */ + brute_force_protection?: boolean | undefined; + /** Enables client SSL certificate authentication for the AD connector, requiring HTTPS on the sign-in endpoint */ + certAuth?: boolean | undefined; + /** Array of X.509 certificates in PEM format used for validating SAML signatures from the AD identity provider (managed by the AD Connector agent). */ + certs?: string[] | undefined; + /** When enabled, disables caching of AD connector authentication results to ensure real-time validation against the directory */ + disable_cache?: boolean | undefined; + /** When enabled, hides the 'Forgot Password' link on login pages to prevent users from initiating self-service password resets */ + disable_self_service_change_password?: boolean | undefined; + /** List of domain names that can be used with identifier-first authentication flow to route users to this AD connection; each domain must be a valid DNS name up to 256 characters */ + domain_aliases?: string[] | undefined; + /** https url of the icon to be shown */ + icon_url?: string | undefined; + /** Array of IP address ranges in CIDR notation used to determine if authentication requests originate from the corporate network for Kerberos or certificate authentication. */ + ips?: string[] | undefined; + /** Enables Windows Integrated Authentication (Kerberos) for seamless SSO when users authenticate from within the corporate network IP ranges */ + kerberos?: boolean | undefined; + /** An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist) */ + non_persistent_attrs?: string[] | undefined; + set_user_root_attributes?: + | Management.EventStreamCloudEventConnectionUpdatedObject5OptionsSetUserRootAttributesEnum + | undefined; + /** The sign-in endpoint type for the AD-LDAP connector agent (managed by the AD Connector agent). */ + signInEndpoint?: string | undefined; + /** Primary AD domain hint used for HRD and discovery. */ + tenant_domain?: string | undefined; + /** Array of certificate SHA-1 thumbprints for validating signatures. Managed by Auth0 when using the AD Connector agent. */ + thumbprints?: string[] | undefined; + upstream_params?: Management.EventStreamCloudEventConnectionUpdatedObject5OptionsUpstreamParams | undefined; +} + +/** Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values. */ +export const EventStreamCloudEventConnectionUpdatedObject5OptionsSetUserRootAttributesEnum = { + OnEachLogin: "on_each_login", + OnFirstLogin: "on_first_login", + NeverOnLogin: "never_on_login", +} as const; +export type EventStreamCloudEventConnectionUpdatedObject5OptionsSetUserRootAttributesEnum = + (typeof EventStreamCloudEventConnectionUpdatedObject5OptionsSetUserRootAttributesEnum)[keyof typeof EventStreamCloudEventConnectionUpdatedObject5OptionsSetUserRootAttributesEnum]; + +/** + * Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps + */ +export type EventStreamCloudEventConnectionUpdatedObject5OptionsUpstreamParams = Record; + +/** The connection strategy. */ +export const EventStreamCloudEventConnectionUpdatedObject5StrategyEnum = { + Ad: "ad", +} as const; +export type EventStreamCloudEventConnectionUpdatedObject5StrategyEnum = + (typeof EventStreamCloudEventConnectionUpdatedObject5StrategyEnum)[keyof typeof EventStreamCloudEventConnectionUpdatedObject5StrategyEnum]; + +export interface EventStreamCloudEventConnectionUpdatedObject6 { + authentication?: Management.EventStreamCloudEventConnectionUpdatedObject6Authentication | undefined; + connected_accounts?: Management.EventStreamCloudEventConnectionUpdatedObject6ConnectedAccounts | undefined; + /** Connection name used in the new universal login experience */ + display_name?: string | undefined; + /** Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients. */ + enabled_clients?: string[] | undefined; + /** The connection's identifier */ + id: string; + /** true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.) */ + is_domain_connection?: boolean | undefined; + metadata?: Management.EventStreamCloudEventConnectionUpdatedObject6Metadata | undefined; + /** The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128 */ + name: string; + /** Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm. */ + realms?: string[] | undefined; + options?: Management.EventStreamCloudEventConnectionUpdatedObject6Options | undefined; + /** Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`. */ + show_as_button?: boolean | undefined; + strategy: Management.EventStreamCloudEventConnectionUpdatedObject6StrategyEnum; +} + +/** + * Configure the purpose of a connection to be used for authentication during login. + */ +export interface EventStreamCloudEventConnectionUpdatedObject6Authentication { + active: boolean; +} + +/** + * Configure the purpose of a connection to be used for connected accounts and Token Vault. + */ +export interface EventStreamCloudEventConnectionUpdatedObject6ConnectedAccounts { + active: boolean; +} + +/** + * Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed. + */ +export interface EventStreamCloudEventConnectionUpdatedObject6Metadata {} + +/** + * Options for the 'google-apps' connection + */ +export interface EventStreamCloudEventConnectionUpdatedObject6Options { + /** Expiration timestamp for the `admin_access_token` in ISO 8601 format. Auth0 uses this value to determine when to refresh the token. */ + admin_access_token_expiresin?: string | undefined; + /** When true, allows customization of OAuth scopes requested during user login. Custom scopes are appended to the mandatory email and profile scopes. When false or omitted, only the default email and profile scopes are used. This property is automatically enabled when Token Vault or Connected Accounts features are activated. */ + allow_setting_login_scopes?: boolean | undefined; + /** Enables integration with the Google Workspace Admin SDK Directory API for groups. When true, Auth0 can synchronize groups & group memberships and supports inbound directory provisioning for groups. Defaults to false. */ + api_enable_groups?: boolean | undefined; + /** Enables integration with the Google Workspace Admin SDK Directory API. When true, Auth0 can retrieve extended user attributes (admin status, suspension status, group memberships) and supports inbound directory provisioning (SCIM). Defaults to true. */ + api_enable_users?: boolean | undefined; + /** Your Google OAuth 2.0 client ID. You can find this in your [Google Cloud Console](https://console.cloud.google.com/apis/credentials) under the OAuth 2.0 Client IDs section. */ + client_id: string; + /** Primary Google Workspace domain name that users must belong to. */ + domain?: string | undefined; + /** Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication. */ + domain_aliases?: string[] | undefined; + /** Whether the OAuth flow requests the `email` scope. */ + email?: boolean | undefined; + /** Fetches the `agreedToTerms` flag from the Google Directory profile. */ + ext_agreed_terms?: boolean | undefined; + /** Enables enrichment with Google group memberships (required for `ext_groups_extended`). */ + ext_groups?: boolean | undefined; + /** Controls whether enriched group entries include `id`, `email`, `name` (true) or only the group name (false); can only be set when `ext_groups` is true. */ + ext_groups_extended?: boolean | undefined; + /** Fetches the Google Directory admin flag for the signing-in user. */ + ext_is_admin?: boolean | undefined; + /** Fetches the Google Directory suspended flag for the signing-in user. */ + ext_is_suspended?: boolean | undefined; + federated_connections_access_tokens?: + | Management.EventStreamCloudEventConnectionUpdatedObject6OptionsFederatedConnectionsAccessTokens + | undefined; + /** When enabled, users who sign in with their Google account through a social login will be automatically routed to this Google Workspace connection if their email domain matches the configured tenant_domain or domain_aliases. This ensures enterprise users authenticate through their organization's Google Workspace identity provider rather than through a generic Google social login, enabling access to directory-based attributes and enforcing organizational security policies. Defaults to true for new connections. */ + handle_login_from_social?: boolean | undefined; + /** URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows. */ + icon_url?: string | undefined; + /** Determines how Auth0 generates the user_id for Google Workspace users. When false (default), the user's email address is used. When true, Google's stable numeric user ID is used instead, which persists even if the user's email changes. This setting can only be configured when creating the connection and cannot be changed afterward. */ + map_user_id_to_id?: boolean | undefined; + /** An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist) */ + non_persistent_attrs?: string[] | undefined; + /** Whether the OAuth flow requests the `profile` scope. */ + profile?: boolean | undefined; + /** Additional OAuth scopes requested beyond the default `email profile` scopes; ignored unless `allow_setting_login_scopes` is true. */ + scope?: string[] | undefined; + set_user_root_attributes?: + | Management.EventStreamCloudEventConnectionUpdatedObject6OptionsSetUserRootAttributesEnum + | undefined; + /** The Google Workspace primary domain used to identify the organization during authentication. */ + tenant_domain?: string | undefined; + upstream_params?: Management.EventStreamCloudEventConnectionUpdatedObject6OptionsUpstreamParams | undefined; +} + +/** + * Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users. */ -export type EmailSmtpHost = string; +export interface EventStreamCloudEventConnectionUpdatedObject6OptionsFederatedConnectionsAccessTokens { + /** Enables refresh tokens and access tokens collection for federated connections */ + active: boolean; +} -/** Set to eu to use SparkPost service hosted in Western Europe. To use SparkPost hosted in North America, set it to null. */ -export const EmailSparkPostRegionEnum = { - Eu: "eu", +/** Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values. */ +export const EventStreamCloudEventConnectionUpdatedObject6OptionsSetUserRootAttributesEnum = { + OnEachLogin: "on_each_login", + OnFirstLogin: "on_first_login", + NeverOnLogin: "never_on_login", } as const; -export type EmailSparkPostRegionEnum = (typeof EmailSparkPostRegionEnum)[keyof typeof EmailSparkPostRegionEnum]; +export type EventStreamCloudEventConnectionUpdatedObject6OptionsSetUserRootAttributesEnum = + (typeof EventStreamCloudEventConnectionUpdatedObject6OptionsSetUserRootAttributesEnum)[keyof typeof EventStreamCloudEventConnectionUpdatedObject6OptionsSetUserRootAttributesEnum]; /** - * Specific provider setting + * Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps */ -export type EmailSpecificProviderSettingsWithAdditionalProperties = (Record | null) | undefined; +export type EventStreamCloudEventConnectionUpdatedObject6OptionsUpstreamParams = Record; -/** Template name. Can be `verify_email`, `verify_email_by_code`, `auth_email_by_code`, `reset_email`, `reset_email_by_code`, `welcome_email`, `blocked_account`, `stolen_credentials`, `enrollment_email`, `mfa_oob_code`, `user_invitation`, `async_approval`, `change_password` (legacy), or `password_reset` (legacy). */ -export const EmailTemplateNameEnum = { - VerifyEmail: "verify_email", - VerifyEmailByCode: "verify_email_by_code", - AuthEmailByCode: "auth_email_by_code", - ResetEmail: "reset_email", - ResetEmailByCode: "reset_email_by_code", - WelcomeEmail: "welcome_email", - BlockedAccount: "blocked_account", - StolenCredentials: "stolen_credentials", - EnrollmentEmail: "enrollment_email", - MfaOobCode: "mfa_oob_code", - UserInvitation: "user_invitation", - ChangePassword: "change_password", - PasswordReset: "password_reset", - AsyncApproval: "async_approval", +/** The connection strategy. */ +export const EventStreamCloudEventConnectionUpdatedObject6StrategyEnum = { + GoogleApps: "google-apps", } as const; -export type EmailTemplateNameEnum = (typeof EmailTemplateNameEnum)[keyof typeof EmailTemplateNameEnum]; +export type EventStreamCloudEventConnectionUpdatedObject6StrategyEnum = + (typeof EventStreamCloudEventConnectionUpdatedObject6StrategyEnum)[keyof typeof EventStreamCloudEventConnectionUpdatedObject6StrategyEnum]; -/** Enum for enabled features. */ -export const EnabledFeaturesEnum = { - Scim: "scim", - UniversalLogout: "universal_logout", -} as const; -export type EnabledFeaturesEnum = (typeof EnabledFeaturesEnum)[keyof typeof EnabledFeaturesEnum]; +export interface EventStreamCloudEventConnectionUpdatedObject7 { + authentication?: Management.EventStreamCloudEventConnectionUpdatedObject7Authentication | undefined; + connected_accounts?: Management.EventStreamCloudEventConnectionUpdatedObject7ConnectedAccounts | undefined; + /** Connection name used in the new universal login experience */ + display_name?: string | undefined; + /** Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients. */ + enabled_clients?: string[] | undefined; + /** The connection's identifier */ + id: string; + /** true promotes to a domain-level connection so that third-party applications can use it. false does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to false.) */ + is_domain_connection?: boolean | undefined; + metadata?: Management.EventStreamCloudEventConnectionUpdatedObject7Metadata | undefined; + /** The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128 */ + name: string; + /** Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm. */ + realms?: string[] | undefined; + options?: Management.EventStreamCloudEventConnectionUpdatedObject7Options | undefined; + /** Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`. */ + show_as_button?: boolean | undefined; + strategy: Management.EventStreamCloudEventConnectionUpdatedObject7StrategyEnum; +} /** - * Encryption key + * Configure the purpose of a connection to be used for authentication during login. */ -export interface EncryptionKey { - /** Key ID */ - kid: string; - type: Management.EncryptionKeyType; - state: Management.EncryptionKeyState; - /** Key creation timestamp */ - created_at: string; - /** Key update timestamp */ - updated_at: string; - /** ID of parent wrapping key */ - parent_kid?: (string | null) | undefined; - /** Public key in PEM format */ - public_key?: (string | null) | undefined; +export interface EventStreamCloudEventConnectionUpdatedObject7Authentication { + active: boolean; } -/** Encryption algorithm that shall be used to wrap your key material */ -export const EncryptionKeyPublicWrappingAlgorithm = { - CkmRsaAesKeyWrap: "CKM_RSA_AES_KEY_WRAP", -} as const; -export type EncryptionKeyPublicWrappingAlgorithm = - (typeof EncryptionKeyPublicWrappingAlgorithm)[keyof typeof EncryptionKeyPublicWrappingAlgorithm]; - -/** Key state */ -export const EncryptionKeyState = { - PreActivation: "pre-activation", - Active: "active", - Deactivated: "deactivated", - Destroyed: "destroyed", -} as const; -export type EncryptionKeyState = (typeof EncryptionKeyState)[keyof typeof EncryptionKeyState]; +/** + * Configure the purpose of a connection to be used for connected accounts and Token Vault. + */ +export interface EventStreamCloudEventConnectionUpdatedObject7ConnectedAccounts { + active: boolean; +} -/** Key type */ -export const EncryptionKeyType = { - CustomerProvidedRootKey: "customer-provided-root-key", - EnvironmentRootKey: "environment-root-key", - TenantMasterKey: "tenant-master-key", - TenantEncryptionKey: "tenant-encryption-key", -} as const; -export type EncryptionKeyType = (typeof EncryptionKeyType)[keyof typeof EncryptionKeyType]; +/** + * Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed. + */ +export interface EventStreamCloudEventConnectionUpdatedObject7Metadata {} /** - * Configuration specific to an action destination. + * Options for the 'waad' connection */ -export interface EventStreamActionConfiguration { - /** Action ID for the action destination. */ - action_id: string; +export interface EventStreamCloudEventConnectionUpdatedObject7Options { + /** Enable users API */ + api_enable_users?: boolean | undefined; + /** The Azure AD application domain (e.g., 'contoso.onmicrosoft.com'). Used primarily with WS-Federation protocol and Azure AD v1 endpoints. */ + app_domain?: string | undefined; + /** The Application ID URI (App ID URI) for the Azure AD application. Required when using Azure AD v1 with the Resource Owner Password flow. Used to identify the resource being requested in OAuth token requests. */ + app_id?: string | undefined; + /** Includes basic user profile information from Azure AD (name, email, given_name, family_name). Always enabled and required - represents the minimum profile data retrieved during authentication. */ + basic_profile?: boolean | undefined; + /** Timestamp of the last certificate expiring soon notification. */ + cert_rollover_notification?: string | undefined; + /** OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider. */ + client_id: string; + /** The primary Azure AD tenant domain (e.g., 'contoso.onmicrosoft.com' or 'contoso.com'). */ + domain?: string | undefined; + /** Alternative domain names associated with this Azure AD tenant. Allows users from multiple verified domains to authenticate through this connection. Can be an array of domain strings. */ + domain_aliases?: string[] | undefined; + /** When enabled (true), retrieves and stores Azure AD security group memberships for the user. Requires Microsoft Graph API permissions (Directory.Read.All). Allows configuring max_groups_to_retrieve. */ + ext_groups?: boolean | undefined; + /** When true, stores all groups the user is member of, including transitive group memberships (groups within groups). When false (default), only direct group memberships are included. */ + ext_nested_groups?: boolean | undefined; + /** When enabled (true), retrieves extended profile attributes from Azure AD via Microsoft Graph API (job title, department, office location, etc.). Requires Graph API permissions. Only available with Azure AD v1 or when explicitly enabled for v2. */ + ext_profile?: boolean | undefined; + federated_connections_access_tokens?: + | Management.EventStreamCloudEventConnectionUpdatedObject7OptionsFederatedConnectionsAccessTokens + | undefined; + /** Indicates whether admin consent has been granted for the required Azure AD permissions. Read-only status field managed by Auth0 during the OAuth authorization flow. */ + granted?: boolean | undefined; + /** URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows. */ + icon_url?: string | undefined; + identity_api?: Management.EventStreamCloudEventConnectionUpdatedObject7OptionsIdentityApiEnum | undefined; + /** Maximum number of Azure AD groups to retrieve per user during authentication. Helps prevent performance issues for users in many groups. Only applies when ext_groups is enabled. Leave empty to use platform default. */ + max_groups_to_retrieve?: string | undefined; + /** An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist) */ + non_persistent_attrs?: string[] | undefined; + /** OAuth 2.0 scopes to request from Azure AD during authentication. Each scope represents a permission (e.g., 'User.Read', 'Group.Read.All'). Only applies with Microsoft Identity Platform v2.0. See Microsoft Graph permissions reference for available scopes. */ + scope?: string[] | undefined; + set_user_root_attributes?: + | Management.EventStreamCloudEventConnectionUpdatedObject7OptionsSetUserRootAttributesEnum + | undefined; + should_trust_email_verified_connection?: + | Management.EventStreamCloudEventConnectionUpdatedObject7OptionsShouldTrustEmailVerifiedConnectionEnum + | undefined; + tenant_domain?: Management.EventStreamCloudEventConnectionUpdatedObject7OptionsTenantDomainOne | undefined; + /** The Azure AD tenant ID as a UUID. The unique identifier for your Azure AD organization. Must be a valid 36-character UUID. */ + tenantId?: string | undefined; + /** Array of certificate thumbprints (SHA-128/SHA-256/SHA-512 hex hashes) for validating SAML signatures. Used with WS-Federation protocol. Maximum 20 thumbprints. Each thumbprint must be a hexadecimal string. */ + thumbprints?: string[] | undefined; + upstream_params?: Management.EventStreamCloudEventConnectionUpdatedObject7OptionsUpstreamParams | undefined; + /** Indicates WS-Federation protocol usage. When true, uses WS-Federation; when false, uses OpenID Connect. */ + use_wsfed?: boolean | undefined; + /** When enabled (true), uses the Azure AD common endpoint for multi-tenant authentication. Allows users from any Azure AD organization to sign in. Requires userid_attribute set to 'sub' (not 'oid'). Cannot be used with SCIM provisioning. Defaults to false. */ + useCommonEndpoint?: boolean | undefined; + userid_attribute?: Management.EventStreamCloudEventConnectionUpdatedObject7OptionsUseridAttributeEnum | undefined; + waad_protocol?: Management.EventStreamCloudEventConnectionUpdatedObject7OptionsWaadProtocolEnum | undefined; } -export interface EventStreamActionDestination { - type: Management.EventStreamActionDestinationTypeEnum; - configuration: Management.EventStreamActionConfiguration; +/** + * Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users. + */ +export interface EventStreamCloudEventConnectionUpdatedObject7OptionsFederatedConnectionsAccessTokens { + /** Enables refresh tokens and access tokens collection for federated connections */ + active: boolean; } -export const EventStreamActionDestinationTypeEnum = { - Action: "action", +/** The Azure AD endpoint version for authentication. 'microsoft-identity-platform-v2.0' (recommended, default) supports modern OAuth 2.0 features. 'azure-active-directory-v1.0' is the legacy endpoint with protocol limitations. Selection affects available features. */ +export const EventStreamCloudEventConnectionUpdatedObject7OptionsIdentityApiEnum = { + MicrosoftIdentityPlatformV20: "microsoft-identity-platform-v2.0", + AzureActiveDirectoryV10: "azure-active-directory-v1.0", } as const; -export type EventStreamActionDestinationTypeEnum = - (typeof EventStreamActionDestinationTypeEnum)[keyof typeof EventStreamActionDestinationTypeEnum]; +export type EventStreamCloudEventConnectionUpdatedObject7OptionsIdentityApiEnum = + (typeof EventStreamCloudEventConnectionUpdatedObject7OptionsIdentityApiEnum)[keyof typeof EventStreamCloudEventConnectionUpdatedObject7OptionsIdentityApiEnum]; -export interface EventStreamActionResponseContent { - /** Unique identifier for the event stream. */ - id?: string | undefined; - /** Name of the event stream. */ - name?: string | undefined; - /** List of event types subscribed to in this stream. */ - subscriptions?: Management.EventStreamSubscription[] | undefined; - destination?: Management.EventStreamActionDestination | undefined; - status?: Management.EventStreamStatusEnum | undefined; - /** Timestamp when the event stream was created. */ - created_at?: string | undefined; - /** Timestamp when the event stream was last updated. */ - updated_at?: string | undefined; -} +/** Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values. */ +export const EventStreamCloudEventConnectionUpdatedObject7OptionsSetUserRootAttributesEnum = { + OnEachLogin: "on_each_login", + OnFirstLogin: "on_first_login", + NeverOnLogin: "never_on_login", +} as const; +export type EventStreamCloudEventConnectionUpdatedObject7OptionsSetUserRootAttributesEnum = + (typeof EventStreamCloudEventConnectionUpdatedObject7OptionsSetUserRootAttributesEnum)[keyof typeof EventStreamCloudEventConnectionUpdatedObject7OptionsSetUserRootAttributesEnum]; + +/** Choose how Auth0 sets the email_verified field in the user profile. */ +export const EventStreamCloudEventConnectionUpdatedObject7OptionsShouldTrustEmailVerifiedConnectionEnum = { + NeverSetEmailsAsVerified: "never_set_emails_as_verified", + AlwaysSetEmailsAsVerified: "always_set_emails_as_verified", +} as const; +export type EventStreamCloudEventConnectionUpdatedObject7OptionsShouldTrustEmailVerifiedConnectionEnum = + (typeof EventStreamCloudEventConnectionUpdatedObject7OptionsShouldTrustEmailVerifiedConnectionEnum)[keyof typeof EventStreamCloudEventConnectionUpdatedObject7OptionsShouldTrustEmailVerifiedConnectionEnum]; /** - * Event content. This will only be set if delivery failed. + * Azure AD tenant domain as a UUID tenant ID. */ -export interface EventStreamCloudEvent { - /** Unique identifier for the event */ - id?: string | undefined; - /** Where the event originated */ - source?: string | undefined; - /** Version of CloudEvents spec */ - specversion?: string | undefined; - /** Type of the event (e.g., user.created) */ - type?: string | undefined; - /** Timestamp at which the event was generated */ - time?: string | undefined; - /** Event contents encoded as a string. */ - data?: string | undefined; -} +export type EventStreamCloudEventConnectionUpdatedObject7OptionsTenantDomainOne = string; /** - * The purpose of this event. This field will typically appear only in special cases - * such as sending a test event. For normal events, this field will be omitted. + * Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps */ -export const EventStreamCloudEventA0PurposeEnum = { - Test: "test", +export type EventStreamCloudEventConnectionUpdatedObject7OptionsUpstreamParams = Record; + +/** The Azure AD claim to use as the unique user identifier. 'oid' (Object ID) is recommended for single-tenant connections and required for SCIM. 'sub' (Subject) is required for multi-tenant/common endpoint. Only applies with OpenID Connect protocol. */ +export const EventStreamCloudEventConnectionUpdatedObject7OptionsUseridAttributeEnum = { + Oid: "oid", + Sub: "sub", } as const; -export type EventStreamCloudEventA0PurposeEnum = - (typeof EventStreamCloudEventA0PurposeEnum)[keyof typeof EventStreamCloudEventA0PurposeEnum]; +export type EventStreamCloudEventConnectionUpdatedObject7OptionsUseridAttributeEnum = + (typeof EventStreamCloudEventConnectionUpdatedObject7OptionsUseridAttributeEnum)[keyof typeof EventStreamCloudEventConnectionUpdatedObject7OptionsUseridAttributeEnum]; + +/** The authentication protocol for Azure AD v1 endpoints. 'openid-connect' (default, recommended) uses modern OAuth 2.0/OIDC. 'ws-federation' is a legacy SAML-based protocol for older integrations. Only available with Azure AD v1 API. */ +export const EventStreamCloudEventConnectionUpdatedObject7OptionsWaadProtocolEnum = { + WsFederation: "ws-federation", + OpenidConnect: "openid-connect", +} as const; +export type EventStreamCloudEventConnectionUpdatedObject7OptionsWaadProtocolEnum = + (typeof EventStreamCloudEventConnectionUpdatedObject7OptionsWaadProtocolEnum)[keyof typeof EventStreamCloudEventConnectionUpdatedObject7OptionsWaadProtocolEnum]; + +/** The connection strategy. */ +export const EventStreamCloudEventConnectionUpdatedObject7StrategyEnum = { + Waad: "waad", +} as const; +export type EventStreamCloudEventConnectionUpdatedObject7StrategyEnum = + (typeof EventStreamCloudEventConnectionUpdatedObject7StrategyEnum)[keyof typeof EventStreamCloudEventConnectionUpdatedObject7StrategyEnum]; + +/** The event type (injected from the SSE event field). */ +export const EventStreamCloudEventConnectionUpdatedTypeEnum = { + ConnectionUpdated: "connection.updated", +} as const; +export type EventStreamCloudEventConnectionUpdatedTypeEnum = + (typeof EventStreamCloudEventConnectionUpdatedTypeEnum)[keyof typeof EventStreamCloudEventConnectionUpdatedTypeEnum]; /** * Information about the context in which the event was produced. This may include things like @@ -11066,8 +15941,7 @@ export interface EventStreamCloudEventGroupCreated { * Represents an event that occurs when a group is created. */ export interface EventStreamCloudEventGroupCreatedCloudEvent { - /** The version of the CloudEvents specification which the event uses. */ - specversion: string; + specversion: Management.EventStreamCloudEventSpecVersionEnum; type: Management.EventStreamCloudEventGroupCreatedCloudEventTypeEnum; /** The source of the event. This will take the form 'urn:auth0:.'. */ source: string; @@ -11196,8 +16070,7 @@ export interface EventStreamCloudEventGroupDeleted { * Represents an event that occurs when a group is deleted. */ export interface EventStreamCloudEventGroupDeletedCloudEvent { - /** The version of the CloudEvents specification which the event uses. */ - specversion: string; + specversion: Management.EventStreamCloudEventSpecVersionEnum; type: Management.EventStreamCloudEventGroupDeletedCloudEventTypeEnum; /** The source of the event. This will take the form 'urn:auth0:.'. */ source: string; @@ -11332,8 +16205,7 @@ export interface EventStreamCloudEventGroupMemberAdded { * Represents an event that occurs when a member is added to a group. */ export interface EventStreamCloudEventGroupMemberAddedCloudEvent { - /** The version of the CloudEvents specification which the event uses. */ - specversion: string; + specversion: Management.EventStreamCloudEventSpecVersionEnum; type: Management.EventStreamCloudEventGroupMemberAddedCloudEventTypeEnum; /** The source of the event. This will take the form 'urn:auth0:.'. */ source: string; @@ -11501,8 +16373,7 @@ export interface EventStreamCloudEventGroupMemberDeleted { * Represents an event that occurs when a member is removed from a group. */ export interface EventStreamCloudEventGroupMemberDeletedCloudEvent { - /** The version of the CloudEvents specification which the event uses. */ - specversion: string; + specversion: Management.EventStreamCloudEventSpecVersionEnum; type: Management.EventStreamCloudEventGroupMemberDeletedCloudEventTypeEnum; /** The source of the event. This will take the form 'urn:auth0:.'. */ source: string; @@ -11670,8 +16541,7 @@ export interface EventStreamCloudEventGroupRoleAssigned { * Represents an event that occurs when a role is assigned to a group. */ export interface EventStreamCloudEventGroupRoleAssignedCloudEvent { - /** The version of the CloudEvents specification which the event uses. */ - specversion: string; + specversion: Management.EventStreamCloudEventSpecVersionEnum; type: Management.EventStreamCloudEventGroupRoleAssignedCloudEventTypeEnum; /** The source of the event. This will take the form 'urn:auth0:.'. */ source: string; @@ -11808,8 +16678,7 @@ export interface EventStreamCloudEventGroupRoleDeleted { * Represents an event that occurs when a role is removed from a group. */ export interface EventStreamCloudEventGroupRoleDeletedCloudEvent { - /** The version of the CloudEvents specification which the event uses. */ - specversion: string; + specversion: Management.EventStreamCloudEventSpecVersionEnum; type: Management.EventStreamCloudEventGroupRoleDeletedCloudEventTypeEnum; /** The source of the event. This will take the form 'urn:auth0:.'. */ source: string; @@ -11944,8 +16813,7 @@ export interface EventStreamCloudEventGroupUpdated { * Represents an event that occurs when a group is updated. */ export interface EventStreamCloudEventGroupUpdatedCloudEvent { - /** The version of the CloudEvents specification which the event uses. */ - specversion: string; + specversion: Management.EventStreamCloudEventSpecVersionEnum; type: Management.EventStreamCloudEventGroupUpdatedCloudEventTypeEnum; /** The source of the event. This will take the form 'urn:auth0:.'. */ source: string; @@ -12095,8 +16963,7 @@ export interface EventStreamCloudEventOrgConnectionAdded { * Represents an event that occurs when a connection is added to an organization. */ export interface EventStreamCloudEventOrgConnectionAddedCloudEvent { - /** The version of the CloudEvents specification which the event uses. */ - specversion: string; + specversion: Management.EventStreamCloudEventSpecVersionEnum; type: Management.EventStreamCloudEventOrgConnectionAddedCloudEventTypeEnum; /** The source of the event. This will take the form 'urn:auth0:.'. */ source: string; @@ -12186,8 +17053,7 @@ export interface EventStreamCloudEventOrgConnectionRemoved { * Represents an event that occurs when a connection is removed from an organization. */ export interface EventStreamCloudEventOrgConnectionRemovedCloudEvent { - /** The version of the CloudEvents specification which the event uses. */ - specversion: string; + specversion: Management.EventStreamCloudEventSpecVersionEnum; type: Management.EventStreamCloudEventOrgConnectionRemovedCloudEventTypeEnum; /** The source of the event. This will take the form 'urn:auth0:.'. */ source: string; @@ -12261,8 +17127,7 @@ export interface EventStreamCloudEventOrgConnectionUpdated { * Represents an event that occurs when a organization connection is updated. */ export interface EventStreamCloudEventOrgConnectionUpdatedCloudEvent { - /** The version of the CloudEvents specification which the event uses. */ - specversion: string; + specversion: Management.EventStreamCloudEventSpecVersionEnum; type: Management.EventStreamCloudEventOrgConnectionUpdatedCloudEventTypeEnum; /** The source of the event. This will take the form 'urn:auth0:.'. */ source: string; @@ -12352,8 +17217,7 @@ export interface EventStreamCloudEventOrgCreated { * Represents an event that occurs when an organization is created. */ export interface EventStreamCloudEventOrgCreatedCloudEvent { - /** The version of the CloudEvents specification which the event uses. */ - specversion: string; + specversion: Management.EventStreamCloudEventSpecVersionEnum; type: Management.EventStreamCloudEventOrgCreatedCloudEventTypeEnum; /** The source of the event. This will take the form 'urn:auth0:.'. */ source: string; @@ -12442,8 +17306,7 @@ export interface EventStreamCloudEventOrgDeleted { * Represents an event that occurs when an organization is deleted. */ export interface EventStreamCloudEventOrgDeletedCloudEvent { - /** The version of the CloudEvents specification which the event uses. */ - specversion: string; + specversion: Management.EventStreamCloudEventSpecVersionEnum; type: Management.EventStreamCloudEventOrgDeletedCloudEventTypeEnum; /** The source of the event. This will take the form 'urn:auth0:.'. */ source: string; @@ -12512,8 +17375,7 @@ export interface EventStreamCloudEventOrgGroupRoleAssigned { * Represents an event that occurs when a role is assigned to an organization group. */ export interface EventStreamCloudEventOrgGroupRoleAssignedCloudEvent { - /** The version of the CloudEvents specification which the event uses. */ - specversion: string; + specversion: Management.EventStreamCloudEventSpecVersionEnum; type: Management.EventStreamCloudEventOrgGroupRoleAssignedCloudEventTypeEnum; /** The source of the event. This will take the form 'urn:auth0:.'. */ source: string; @@ -12659,8 +17521,7 @@ export interface EventStreamCloudEventOrgGroupRoleDeleted { * Represents an event that occurs when a role is removed from an organization group. */ export interface EventStreamCloudEventOrgGroupRoleDeletedCloudEvent { - /** The version of the CloudEvents specification which the event uses. */ - specversion: string; + specversion: Management.EventStreamCloudEventSpecVersionEnum; type: Management.EventStreamCloudEventOrgGroupRoleDeletedCloudEventTypeEnum; /** The source of the event. This will take the form 'urn:auth0:.'. */ source: string; @@ -12804,8 +17665,7 @@ export interface EventStreamCloudEventOrgMemberAdded { * Represents an event that occurs when a member is added to an organization. */ export interface EventStreamCloudEventOrgMemberAddedCloudEvent { - /** The version of the CloudEvents specification which the event uses. */ - specversion: string; + specversion: Management.EventStreamCloudEventSpecVersionEnum; type: Management.EventStreamCloudEventOrgMemberAddedCloudEventTypeEnum; /** The source of the event. This will take the form 'urn:auth0:.'. */ source: string; @@ -12884,8 +17744,7 @@ export interface EventStreamCloudEventOrgMemberDeleted { * Represents an event that occurs when a member is removed from an organization. */ export interface EventStreamCloudEventOrgMemberDeletedCloudEvent { - /** The version of the CloudEvents specification which the event uses. */ - specversion: string; + specversion: Management.EventStreamCloudEventSpecVersionEnum; type: Management.EventStreamCloudEventOrgMemberDeletedCloudEventTypeEnum; /** The source of the event. This will take the form 'urn:auth0:.'. */ source: string; @@ -12964,8 +17823,7 @@ export interface EventStreamCloudEventOrgMemberRoleAssigned { * Represents an event that occurs when a member is added to an organization. */ export interface EventStreamCloudEventOrgMemberRoleAssignedCloudEvent { - /** The version of the CloudEvents specification which the event uses. */ - specversion: string; + specversion: Management.EventStreamCloudEventSpecVersionEnum; type: Management.EventStreamCloudEventOrgMemberRoleAssignedCloudEventTypeEnum; /** The source of the event. This will take the form 'urn:auth0:.'. */ source: string; @@ -13053,8 +17911,7 @@ export interface EventStreamCloudEventOrgMemberRoleDeleted { * Represents an event that occurs when a member is removed from an organization. */ export interface EventStreamCloudEventOrgMemberRoleDeletedCloudEvent { - /** The version of the CloudEvents specification which the event uses. */ - specversion: string; + specversion: Management.EventStreamCloudEventSpecVersionEnum; type: Management.EventStreamCloudEventOrgMemberRoleDeletedCloudEventTypeEnum; /** The source of the event. This will take the form 'urn:auth0:.'. */ source: string; @@ -13142,8 +17999,7 @@ export interface EventStreamCloudEventOrgUpdated { * Represents an event that occurs when an organization is updated. */ export interface EventStreamCloudEventOrgUpdatedCloudEvent { - /** The version of the CloudEvents specification which the event uses. */ - specversion: string; + specversion: Management.EventStreamCloudEventSpecVersionEnum; type: Management.EventStreamCloudEventOrgUpdatedCloudEventTypeEnum; /** The source of the event. This will take the form 'urn:auth0:.'. */ source: string; @@ -13219,6 +18075,13 @@ export const EventStreamCloudEventOrgUpdatedTypeEnum = { export type EventStreamCloudEventOrgUpdatedTypeEnum = (typeof EventStreamCloudEventOrgUpdatedTypeEnum)[keyof typeof EventStreamCloudEventOrgUpdatedTypeEnum]; +/** The version of the CloudEvents specification which the event uses. */ +export const EventStreamCloudEventSpecVersionEnum = { + One0: "1.0", +} as const; +export type EventStreamCloudEventSpecVersionEnum = + (typeof EventStreamCloudEventSpecVersionEnum)[keyof typeof EventStreamCloudEventSpecVersionEnum]; + /** * SSE message for user.created. */ @@ -13232,8 +18095,7 @@ export interface EventStreamCloudEventUserCreated { * Represents an event that occurs when a user is created. */ export interface EventStreamCloudEventUserCreatedCloudEvent { - /** The version of the CloudEvents specification which the event uses. */ - specversion: string; + specversion: Management.EventStreamCloudEventSpecVersionEnum; type: Management.EventStreamCloudEventUserCreatedCloudEventTypeEnum; /** The source of the event. This will take the form 'urn:auth0:.'. */ source: string; @@ -13651,8 +18513,7 @@ export interface EventStreamCloudEventUserDeleted { * Represents an event that occurs when a user is deleted. */ export interface EventStreamCloudEventUserDeletedCloudEvent { - /** The version of the CloudEvents specification which the event uses. */ - specversion: string; + specversion: Management.EventStreamCloudEventSpecVersionEnum; type: Management.EventStreamCloudEventUserDeletedCloudEventTypeEnum; /** The source of the event. This will take the form 'urn:auth0:.'. */ source: string; @@ -14072,8 +18933,7 @@ export interface EventStreamCloudEventUserUpdated { * Represents an event that occurs when a user is updated. */ export interface EventStreamCloudEventUserUpdatedCloudEvent { - /** The version of the CloudEvents specification which the event uses. */ - specversion: string; + specversion: Management.EventStreamCloudEventSpecVersionEnum; type: Management.EventStreamCloudEventUserUpdatedCloudEventTypeEnum; /** The source of the event. This will take the form 'urn:auth0:.'. */ source: string; @@ -14503,6 +19363,9 @@ export interface EventStreamDeliveryAttempt { /** Type of event */ export const EventStreamDeliveryEventTypeEnum = { + ConnectionCreated: "connection.created", + ConnectionDeleted: "connection.deleted", + ConnectionUpdated: "connection.updated", GroupCreated: "group.created", GroupDeleted: "group.deleted", GroupMemberAdded: "group.member.added", @@ -14620,6 +19483,9 @@ export interface EventStreamEventBridgeResponseContent { } export const EventStreamEventTypeEnum = { + ConnectionCreated: "connection.created", + ConnectionDeleted: "connection.deleted", + ConnectionUpdated: "connection.updated", GroupCreated: "group.created", GroupDeleted: "group.deleted", GroupMemberAdded: "group.member.added", @@ -14658,6 +19524,9 @@ export const EventStreamStatusEnum = { export type EventStreamStatusEnum = (typeof EventStreamStatusEnum)[keyof typeof EventStreamStatusEnum]; export const EventStreamSubscribeEventsEventTypeEnum = { + ConnectionCreated: "connection.created", + ConnectionDeleted: "connection.deleted", + ConnectionUpdated: "connection.updated", GroupCreated: "group.created", GroupDeleted: "group.deleted", GroupMemberAdded: "group.member.added", @@ -14693,6 +19562,9 @@ export type EventStreamSubscribeEventsEventTypeParam = Management.EventStreamSub * The JSON payload delivered in each SSE data line. The type field is injected from the SSE event field by the SDK. Discriminated by type: an event type name for events, "error" for errors, and "offset-only" for cursor-only heartbeats. */ export type EventStreamSubscribeEventsResponseContent = + | Management.EventStreamSubscribeEventsResponseContent.ConnectionCreated + | Management.EventStreamSubscribeEventsResponseContent.ConnectionDeleted + | Management.EventStreamSubscribeEventsResponseContent.ConnectionUpdated | Management.EventStreamSubscribeEventsResponseContent.GroupCreated | Management.EventStreamSubscribeEventsResponseContent.GroupDeleted | Management.EventStreamSubscribeEventsResponseContent.GroupMemberAdded @@ -14719,6 +19591,18 @@ export type EventStreamSubscribeEventsResponseContent = | Management.EventStreamSubscribeEventsResponseContent.OffsetOnly; export namespace EventStreamSubscribeEventsResponseContent { + export interface ConnectionCreated extends Management.EventStreamCloudEventConnectionCreated { + type: "connection.created"; + } + + export interface ConnectionDeleted extends Management.EventStreamCloudEventConnectionDeleted { + type: "connection.deleted"; + } + + export interface ConnectionUpdated extends Management.EventStreamCloudEventConnectionUpdated { + type: "connection.updated"; + } + export interface GroupCreated extends Management.EventStreamCloudEventGroupCreated { type: "group.created"; } @@ -14825,6 +19709,9 @@ export interface EventStreamSubscription { /** The type of event this test event represents. */ export const EventStreamTestEventTypeEnum = { + ConnectionCreated: "connection.created", + ConnectionDeleted: "connection.deleted", + ConnectionUpdated: "connection.updated", GroupCreated: "group.created", GroupDeleted: "group.deleted", GroupMemberAdded: "group.member.added", @@ -19511,6 +24398,7 @@ export interface GetOrganizationByNameResponseContent { branding?: Management.OrganizationBranding | undefined; metadata?: Management.OrganizationMetadata | undefined; token_quota?: Management.TokenQuota | undefined; + third_party_client_access?: Management.OrganizationThirdPartyClientAccessEnum | undefined; /** Accepts any additional properties */ [key: string]: any; } @@ -19590,6 +24478,7 @@ export interface GetOrganizationResponseContent { branding?: Management.OrganizationBranding | undefined; metadata?: Management.OrganizationMetadata | undefined; token_quota?: Management.TokenQuota | undefined; + third_party_client_access?: Management.OrganizationThirdPartyClientAccessEnum | undefined; /** Accepts any additional properties */ [key: string]: any; } @@ -20783,6 +25672,13 @@ export interface ListOrganizationMembersPaginatedResponseContent { [key: string]: any; } +export interface ListOrganizationRoleMembersResponseContent { + /** List of members assigned to the role within the organization. */ + members: Management.RoleMember[]; + /** Cursor for the next page of results. Absent when there are no more results. */ + next?: string | undefined; +} + export interface ListOrganizationsPaginatedResponseContent { next?: string | undefined; organizations?: Management.Organization[] | undefined; @@ -20832,9 +25728,9 @@ export interface ListRoleUsersPaginatedResponseContent { } export interface ListRolesOffsetPaginatedResponseContent { - start?: number | undefined; - limit?: number | undefined; - total?: number | undefined; + start: number; + limit: number; + total: number; roles?: Management.Role[] | undefined; } @@ -21764,6 +26660,7 @@ export interface Organization { branding?: Management.OrganizationBranding | undefined; metadata?: Management.OrganizationMetadata | undefined; token_quota?: Management.TokenQuota | undefined; + third_party_client_access?: Management.OrganizationThirdPartyClientAccessEnum | undefined; /** Accepts any additional properties */ [key: string]: any; } @@ -21972,6 +26869,14 @@ export interface OrganizationMemberRole { */ export type OrganizationMetadata = Record; +/** Controls whether this organization can be used in user flows with third-party clients. Defaults to `block`. */ +export const OrganizationThirdPartyClientAccessEnum = { + Block: "block", + Allow: "allow", +} as const; +export type OrganizationThirdPartyClientAccessEnum = + (typeof OrganizationThirdPartyClientAccessEnum)[keyof typeof OrganizationThirdPartyClientAccessEnum]; + /** Defines whether organizations can be used with client credentials exchanges for this grant. */ export const OrganizationUsageEnum = { Deny: "deny", @@ -22120,12 +27025,18 @@ export interface PermissionsResponsePayload { * Configuration for the phone number attribute for users. */ export interface PhoneAttribute { - identifier?: Management.ConnectionAttributeIdentifier | undefined; + identifier?: Management.PhoneAttributeIdentifier | undefined; /** Determines if property should be required for users */ profile_required?: boolean | undefined; signup?: Management.SignupVerified | undefined; } +export interface PhoneAttributeIdentifier { + /** Determines if the attribute is used for identification */ + active?: boolean | undefined; + default_method?: Management.DefaultMethodPhoneNumberIdentifierEnum | undefined; +} + /** This depicts the type of notifications this provider can receive. */ export const PhoneProviderChannelEnum = { Phone: "phone", @@ -22159,7 +27070,7 @@ export type PhoneProviderNameEnum = (typeof PhoneProviderNameEnum)[keyof typeof /** The type of backoff strategy to use. */ export const PhoneProviderProtectionBackoffStrategyEnum = { Exponential: "exponential", - None: "none", + Default: "default", } as const; export type PhoneProviderProtectionBackoffStrategyEnum = (typeof PhoneProviderProtectionBackoffStrategyEnum)[keyof typeof PhoneProviderProtectionBackoffStrategyEnum]; @@ -22829,6 +27740,17 @@ export interface Role { description?: string | undefined; } +export interface RoleMember { + /** ID of this user. */ + user_id?: string | undefined; + /** URL to a picture for this user. */ + picture?: string | undefined; + /** Name of this user. */ + name?: string | undefined; + /** Email address of this user. */ + email?: string | undefined; +} + export interface RoleUser { /** ID of this user. */ user_id?: string | undefined; @@ -24271,6 +29193,11 @@ export interface TokenQuotaConfiguration { [key: string]: any; } +export interface TokenVaultPrivilegedAccessGrant { + connection: string; + scopes: string[]; +} + export type TokenVaultPrivilegedAccessIpAllowlistEntry = string; /** @@ -24713,6 +29640,8 @@ export interface UpdateConnectionOptions { token_endpoint_auth_signing_alg?: (Management.ConnectionTokenEndpointAuthSigningAlgEnum | null) | undefined; token_endpoint_jwtca_aud_format?: Management.ConnectionTokenEndpointJwtcaAudFormatEnumOidc | undefined; id_token_session_expiry_supported?: Management.ConnectionIdTokenSessionExpirySupported | undefined; + discovery_url?: ((Management.ConnectionsDiscoveryUrl | undefined) | null) | undefined; + oidc_metadata?: (Management.ConnectionsOidcMetadata | null) | undefined; /** Accepts any additional properties */ [key: string]: any; } @@ -25475,6 +30404,7 @@ export interface UpdateOrganizationResponseContent { branding?: Management.OrganizationBranding | undefined; metadata?: Management.OrganizationMetadata | undefined; token_quota?: Management.TokenQuota | undefined; + third_party_client_access?: Management.OrganizationThirdPartyClientAccessEnum | undefined; /** Accepts any additional properties */ [key: string]: any; } @@ -26188,6 +31118,8 @@ export interface UserGrant { audience?: string | undefined; /** Scopes included in this grant. */ scope?: string[] | undefined; + /** ID of the organization associated with the grant. */ + organization_id?: string | undefined; } export interface UserGroupsResponseSchema extends Management.Group { @@ -26410,13 +31342,18 @@ export interface UsernameAllowedTypes { * Configuration for the username attribute for users. */ export interface UsernameAttribute { - identifier?: Management.ConnectionAttributeIdentifier | undefined; + identifier?: Management.UsernameAttributeIdentifier | undefined; /** Determines if property should be required for users */ profile_required?: boolean | undefined; signup?: Management.SignupSchema | undefined; validation?: Management.UsernameValidation | undefined; } +export interface UsernameAttributeIdentifier { + /** Determines if the attribute is used for identification */ + active?: boolean | undefined; +} + export interface UsernameValidation { /** Minimum allowed length */ min_length?: number | undefined; diff --git a/src/management/tests/wire/clientGrants/organizations.test.ts b/src/management/tests/wire/clientGrants/organizations.test.ts index c5455ae008..18377992cd 100644 --- a/src/management/tests/wire/clientGrants/organizations.test.ts +++ b/src/management/tests/wire/clientGrants/organizations.test.ts @@ -12,7 +12,13 @@ describe("OrganizationsClient", () => { const rawResponseBody = { next: "next", organizations: [ - { id: "id", name: "name", display_name: "display_name", token_quota: { client_credentials: {} } }, + { + id: "id", + name: "name", + display_name: "display_name", + token_quota: { client_credentials: {} }, + third_party_client_access: "block", + }, ], }; diff --git a/src/management/tests/wire/clients.test.ts b/src/management/tests/wire/clients.test.ts index 31e455476b..72df34cdb7 100644 --- a/src/management/tests/wire/clients.test.ts +++ b/src/management/tests/wire/clients.test.ts @@ -365,7 +365,11 @@ describe("ClientsClient", () => { require_pushed_authorization_requests: true, require_proof_of_possession: true, signed_request_object: { required: true, credentials: [{ id: "id" }] }, - token_vault_privileged_access: { credentials: [{ id: "id" }], ip_allowlist: ["ip_allowlist"] }, + token_vault_privileged_access: { + credentials: [{ id: "id" }], + ip_allowlist: ["ip_allowlist"], + grants: [{ connection: "connection", scopes: ["scopes"] }], + }, compliance_level: "none", skip_non_verifiable_callback_uri_confirmation_prompt: true, token_exchange: { allow_any_profile_of_type: ["custom_authentication"] }, @@ -1022,7 +1026,11 @@ describe("ClientsClient", () => { require_pushed_authorization_requests: true, require_proof_of_possession: true, signed_request_object: { required: true, credentials: [{ id: "id" }] }, - token_vault_privileged_access: { credentials: [{ id: "id" }], ip_allowlist: ["ip_allowlist"] }, + token_vault_privileged_access: { + credentials: [{ id: "id" }], + ip_allowlist: ["ip_allowlist"], + grants: [{ connection: "connection", scopes: ["scopes"] }], + }, compliance_level: "none", skip_non_verifiable_callback_uri_confirmation_prompt: true, token_exchange: { allow_any_profile_of_type: ["custom_authentication"] }, @@ -1371,7 +1379,11 @@ describe("ClientsClient", () => { require_pushed_authorization_requests: true, require_proof_of_possession: true, signed_request_object: { required: true, credentials: [{ id: "id" }] }, - token_vault_privileged_access: { credentials: [{ id: "id" }], ip_allowlist: ["ip_allowlist"] }, + token_vault_privileged_access: { + credentials: [{ id: "id" }], + ip_allowlist: ["ip_allowlist"], + grants: [{ connection: "connection", scopes: ["scopes"] }], + }, compliance_level: "none", skip_non_verifiable_callback_uri_confirmation_prompt: true, token_exchange: { allow_any_profile_of_type: ["custom_authentication"] }, @@ -1697,7 +1709,11 @@ describe("ClientsClient", () => { require_pushed_authorization_requests: true, require_proof_of_possession: true, signed_request_object: { required: true, credentials: [{ id: "id" }] }, - token_vault_privileged_access: { credentials: [{ id: "id" }], ip_allowlist: ["ip_allowlist"] }, + token_vault_privileged_access: { + credentials: [{ id: "id" }], + ip_allowlist: ["ip_allowlist"], + grants: [{ connection: "connection", scopes: ["scopes"] }], + }, compliance_level: "none", skip_non_verifiable_callback_uri_confirmation_prompt: true, token_exchange: { allow_any_profile_of_type: ["custom_authentication"] }, diff --git a/src/management/tests/wire/eventStreams.test.ts b/src/management/tests/wire/eventStreams.test.ts index 1749eb1464..19eb30da98 100644 --- a/src/management/tests/wire/eventStreams.test.ts +++ b/src/management/tests/wire/eventStreams.test.ts @@ -629,12 +629,12 @@ describe("EventStreamsClient", () => { test("test (1)", async () => { const server = mockServerPool.createServer(); const client = new ManagementClient({ maxRetries: 0, token: "test", environment: server.baseUrl }); - const rawRequestBody = { event_type: "group.created" }; + const rawRequestBody = { event_type: "connection.created" }; const rawResponseBody = { id: "id", event_stream_id: "event_stream_id", status: "failed", - event_type: "group.created", + event_type: "connection.created", attempts: [{ status: "failed", timestamp: "2024-01-15T09:30:00Z", error_message: "error_message" }], event: { id: "id", @@ -656,7 +656,7 @@ describe("EventStreamsClient", () => { .build(); const response = await client.eventStreams.test("id", { - event_type: "group.created", + event_type: "connection.created", }); expect(response).toEqual(rawResponseBody); }); @@ -664,7 +664,7 @@ describe("EventStreamsClient", () => { test("test (2)", async () => { const server = mockServerPool.createServer(); const client = new ManagementClient({ maxRetries: 0, token: "test", environment: server.baseUrl }); - const rawRequestBody = { event_type: "group.created" }; + const rawRequestBody = { event_type: "connection.created" }; const rawResponseBody = { key: "value" }; server @@ -678,7 +678,7 @@ describe("EventStreamsClient", () => { await expect(async () => { return await client.eventStreams.test("id", { - event_type: "group.created", + event_type: "connection.created", }); }).rejects.toThrow(Management.UnauthorizedError); }); @@ -686,7 +686,7 @@ describe("EventStreamsClient", () => { test("test (3)", async () => { const server = mockServerPool.createServer(); const client = new ManagementClient({ maxRetries: 0, token: "test", environment: server.baseUrl }); - const rawRequestBody = { event_type: "group.created" }; + const rawRequestBody = { event_type: "connection.created" }; const rawResponseBody = { key: "value" }; server @@ -700,7 +700,7 @@ describe("EventStreamsClient", () => { await expect(async () => { return await client.eventStreams.test("id", { - event_type: "group.created", + event_type: "connection.created", }); }).rejects.toThrow(Management.ForbiddenError); }); @@ -708,7 +708,7 @@ describe("EventStreamsClient", () => { test("test (4)", async () => { const server = mockServerPool.createServer(); const client = new ManagementClient({ maxRetries: 0, token: "test", environment: server.baseUrl }); - const rawRequestBody = { event_type: "group.created" }; + const rawRequestBody = { event_type: "connection.created" }; const rawResponseBody = { key: "value" }; server @@ -722,7 +722,7 @@ describe("EventStreamsClient", () => { await expect(async () => { return await client.eventStreams.test("id", { - event_type: "group.created", + event_type: "connection.created", }); }).rejects.toThrow(Management.TooManyRequestsError); }); diff --git a/src/management/tests/wire/eventStreams/deliveries.test.ts b/src/management/tests/wire/eventStreams/deliveries.test.ts index 18192f09fe..157d8d8de6 100644 --- a/src/management/tests/wire/eventStreams/deliveries.test.ts +++ b/src/management/tests/wire/eventStreams/deliveries.test.ts @@ -14,7 +14,7 @@ describe("DeliveriesClient", () => { id: "id", event_stream_id: "event_stream_id", status: "failed", - event_type: "group.created", + event_type: "connection.created", attempts: [{ status: "failed", timestamp: "2024-01-15T09:30:00Z" }], event: { id: "id", @@ -149,7 +149,7 @@ describe("DeliveriesClient", () => { id: "id", event_stream_id: "event_stream_id", status: "failed", - event_type: "group.created", + event_type: "connection.created", attempts: [{ status: "failed", timestamp: "2024-01-15T09:30:00Z", error_message: "error_message" }], event: { id: "id", diff --git a/src/management/tests/wire/eventStreams/redeliveries.test.ts b/src/management/tests/wire/eventStreams/redeliveries.test.ts index 7beac42c10..db646f0118 100644 --- a/src/management/tests/wire/eventStreams/redeliveries.test.ts +++ b/src/management/tests/wire/eventStreams/redeliveries.test.ts @@ -13,7 +13,7 @@ describe("RedeliveriesClient", () => { date_from: "2024-01-15T09:30:00Z", date_to: "2024-01-15T09:30:00Z", statuses: ["failed"], - event_types: ["group.created"], + event_types: ["connection.created"], }; server diff --git a/src/management/tests/wire/events.test.ts b/src/management/tests/wire/events.test.ts index d7f0a1112c..5f157b174f 100644 --- a/src/management/tests/wire/events.test.ts +++ b/src/management/tests/wire/events.test.ts @@ -10,14 +10,14 @@ describe("EventsClient", () => { const client = new ManagementClient({ maxRetries: 0, token: "test", environment: server.baseUrl }); const rawResponseBody = - 'event: group.created\ndata: {"offset":"offset","event":{"specversion":"specversion","type":"group.created","source":"source","id":"id","time":"2024-01-15T09:30:00Z","data":{"object":{"id":"id","name":"name","created_at":"2024-01-15T09:30:00Z","type":"connection","connection_id":"connection_id"},"context":{"tenant":{"tenant_id":"tenant_id"}}},"a0tenant":"a0tenant","a0stream":"a0stream","a0purpose":"test"}}\n\n'; + 'event: connection.created\ndata: {"offset":"offset","event":{"specversion":"1.0","type":"connection.created","source":"source","id":"id","time":"2024-01-15T09:30:00Z","data":{"object":{"id":"id","name":"name","strategy":"oidc"},"context":{"tenant":{"tenant_id":"tenant_id"}}},"a0tenant":"a0tenant","a0stream":"a0stream","a0purpose":"test"}}\n\n'; server.mockEndpoint().get("/events").respondWith().statusCode(200).sseBody(rawResponseBody).build(); const response = await client.events.subscribe({ from: "from", from_timestamp: "from_timestamp", - event_type: ["group.created"], + event_type: ["connection.created"], }); const events: unknown[] = []; for await (const event of response) { @@ -25,11 +25,11 @@ describe("EventsClient", () => { } expect(events).toEqual([ { - type: "group.created", + type: "connection.created", offset: "offset", event: { - specversion: "specversion", - type: "group.created", + specversion: "1.0", + type: "connection.created", source: "source", id: "id", time: "2024-01-15T09:30:00Z", @@ -37,9 +37,7 @@ describe("EventsClient", () => { object: { id: "id", name: "name", - created_at: "2024-01-15T09:30:00Z", - type: "connection", - connection_id: "connection_id", + strategy: "oidc", }, context: { tenant: { diff --git a/src/management/tests/wire/organizations.test.ts b/src/management/tests/wire/organizations.test.ts index d9842dc149..a84327cce2 100644 --- a/src/management/tests/wire/organizations.test.ts +++ b/src/management/tests/wire/organizations.test.ts @@ -12,7 +12,13 @@ describe("OrganizationsClient", () => { const rawResponseBody = { next: "next", organizations: [ - { id: "id", name: "name", display_name: "display_name", token_quota: { client_credentials: {} } }, + { + id: "id", + name: "name", + display_name: "display_name", + token_quota: { client_credentials: {} }, + third_party_client_access: "block", + }, ], }; @@ -100,6 +106,7 @@ describe("OrganizationsClient", () => { branding: { logo_url: "logo_url", colors: { primary: "primary", page_background: "page_background" } }, metadata: { key: "value" }, token_quota: { client_credentials: { enforce: true, per_day: 1, per_hour: 1 } }, + third_party_client_access: "block", enabled_connections: [ { connection_id: "connection_id", @@ -246,6 +253,7 @@ describe("OrganizationsClient", () => { branding: { logo_url: "logo_url", colors: { primary: "primary", page_background: "page_background" } }, metadata: { key: "value" }, token_quota: { client_credentials: { enforce: true, per_day: 1, per_hour: 1 } }, + third_party_client_access: "block", }; server @@ -366,6 +374,7 @@ describe("OrganizationsClient", () => { branding: { logo_url: "logo_url", colors: { primary: "primary", page_background: "page_background" } }, metadata: { key: "value" }, token_quota: { client_credentials: { enforce: true, per_day: 1, per_hour: 1 } }, + third_party_client_access: "block", }; server.mockEndpoint().get("/organizations/id").respondWith().statusCode(200).jsonBody(rawResponseBody).build(); @@ -555,6 +564,7 @@ describe("OrganizationsClient", () => { branding: { logo_url: "logo_url", colors: { primary: "primary", page_background: "page_background" } }, metadata: { key: "value" }, token_quota: { client_credentials: { enforce: true, per_day: 1, per_hour: 1 } }, + third_party_client_access: "block", }; server diff --git a/src/management/tests/wire/organizations/roles/members.test.ts b/src/management/tests/wire/organizations/roles/members.test.ts new file mode 100644 index 0000000000..6556b407ed --- /dev/null +++ b/src/management/tests/wire/organizations/roles/members.test.ts @@ -0,0 +1,133 @@ +// This file was auto-generated by Fern from our API Definition. + +import * as Management from "../../../../api/index"; +import { ManagementClient } from "../../../../Client"; +import { mockServerPool } from "../../../mock-server/MockServerPool"; + +describe("MembersClient", () => { + test("list (1)", async () => { + const server = mockServerPool.createServer(); + const client = new ManagementClient({ maxRetries: 0, token: "test", environment: server.baseUrl }); + + const rawResponseBody = { + members: [{ user_id: "user_id", picture: "picture", name: "name", email: "email" }], + next: "next", + }; + + server + .mockEndpoint({ once: false }) + .get("/organizations/id/roles/role_id/members") + .respondWith() + .statusCode(200) + .jsonBody(rawResponseBody) + .build(); + + const expected = rawResponseBody; + const page = await client.organizations.roles.members.list("id", "role_id", { + from: "from", + take: 1, + fields: "fields", + include_fields: true, + }); + + expect(expected.members).toEqual(page.data); + expect(page.hasNextPage()).toBe(true); + const nextPage = await page.getNextPage(); + expect(expected.members).toEqual(nextPage.data); + }); + + test("list (2)", async () => { + const server = mockServerPool.createServer(); + const client = new ManagementClient({ maxRetries: 0, token: "test", environment: server.baseUrl }); + + const rawResponseBody = { key: "value" }; + + server + .mockEndpoint() + .get("/organizations/id/roles/role_id/members") + .respondWith() + .statusCode(400) + .jsonBody(rawResponseBody) + .build(); + + await expect(async () => { + return await client.organizations.roles.members.list("id", "role_id"); + }).rejects.toThrow(Management.BadRequestError); + }); + + test("list (3)", async () => { + const server = mockServerPool.createServer(); + const client = new ManagementClient({ maxRetries: 0, token: "test", environment: server.baseUrl }); + + const rawResponseBody = { key: "value" }; + + server + .mockEndpoint() + .get("/organizations/id/roles/role_id/members") + .respondWith() + .statusCode(401) + .jsonBody(rawResponseBody) + .build(); + + await expect(async () => { + return await client.organizations.roles.members.list("id", "role_id"); + }).rejects.toThrow(Management.UnauthorizedError); + }); + + test("list (4)", async () => { + const server = mockServerPool.createServer(); + const client = new ManagementClient({ maxRetries: 0, token: "test", environment: server.baseUrl }); + + const rawResponseBody = { key: "value" }; + + server + .mockEndpoint() + .get("/organizations/id/roles/role_id/members") + .respondWith() + .statusCode(403) + .jsonBody(rawResponseBody) + .build(); + + await expect(async () => { + return await client.organizations.roles.members.list("id", "role_id"); + }).rejects.toThrow(Management.ForbiddenError); + }); + + test("list (5)", async () => { + const server = mockServerPool.createServer(); + const client = new ManagementClient({ maxRetries: 0, token: "test", environment: server.baseUrl }); + + const rawResponseBody = { key: "value" }; + + server + .mockEndpoint() + .get("/organizations/id/roles/role_id/members") + .respondWith() + .statusCode(404) + .jsonBody(rawResponseBody) + .build(); + + await expect(async () => { + return await client.organizations.roles.members.list("id", "role_id"); + }).rejects.toThrow(Management.NotFoundError); + }); + + test("list (6)", async () => { + const server = mockServerPool.createServer(); + const client = new ManagementClient({ maxRetries: 0, token: "test", environment: server.baseUrl }); + + const rawResponseBody = { key: "value" }; + + server + .mockEndpoint() + .get("/organizations/id/roles/role_id/members") + .respondWith() + .statusCode(429) + .jsonBody(rawResponseBody) + .build(); + + await expect(async () => { + return await client.organizations.roles.members.list("id", "role_id"); + }).rejects.toThrow(Management.TooManyRequestsError); + }); +}); diff --git a/src/management/tests/wire/userGrants.test.ts b/src/management/tests/wire/userGrants.test.ts index 18b9a28f9b..379dc4cf80 100644 --- a/src/management/tests/wire/userGrants.test.ts +++ b/src/management/tests/wire/userGrants.test.ts @@ -13,7 +13,16 @@ describe("UserGrantsClient", () => { start: 1.1, limit: 1.1, total: 1.1, - grants: [{ id: "id", clientID: "clientID", user_id: "user_id", audience: "audience", scope: ["scope"] }], + grants: [ + { + id: "id", + clientID: "clientID", + user_id: "user_id", + audience: "audience", + scope: ["scope"], + organization_id: "organization_id", + }, + ], }; server diff --git a/src/management/tests/wire/users/organizations.test.ts b/src/management/tests/wire/users/organizations.test.ts index 58bd232769..0812f11151 100644 --- a/src/management/tests/wire/users/organizations.test.ts +++ b/src/management/tests/wire/users/organizations.test.ts @@ -14,7 +14,13 @@ describe("OrganizationsClient", () => { limit: 1.1, total: 1.1, organizations: [ - { id: "id", name: "name", display_name: "display_name", token_quota: { client_credentials: {} } }, + { + id: "id", + name: "name", + display_name: "display_name", + token_quota: { client_credentials: {} }, + third_party_client_access: "block", + }, ], }; diff --git a/yarn.lock b/yarn.lock index a6ca2b4044..743c474a8b 100644 --- a/yarn.lock +++ b/yarn.lock @@ -893,9 +893,9 @@ integrity sha512-5+fP8P8MFNC+AyZCDxrB2pkZFPGzqQWUzpSeuuVLvm8VMcorNYavBqoFcxK8bQz4Qsbn4oUEEem4wDLfcysGHA== "@types/node@*": - version "26.0.0" - resolved "https://registry.yarnpkg.com/@types/node/-/node-26.0.0.tgz#d4aece9e9412e9f2008d59bc2d74f5279316b665" - integrity sha512-vf2YFi1iY9lHGwNJMs01biZFbKJkrZR1T6/MlzjhJLPdntOHLhTrDSnSVcdtvjihi4VQNlrFRIxLsDBlQpAipA== + version "26.1.0" + resolved "https://registry.yarnpkg.com/@types/node/-/node-26.1.0.tgz#aa85f0727fc5611347091c478341c63650903439" + integrity sha512-O0A1G3xPGy4w7AgQdAQYUlQ+BKk2Oovw8eRpofyp5KdBZULnbe+WqaOVNrm705SHphCiG4XHsACrSmPu1f+Kgw== dependencies: undici-types "~8.3.0" @@ -939,99 +939,99 @@ "@types/yargs-parser" "*" "@typescript-eslint/eslint-plugin@^8.38.0": - version "8.62.0" - resolved "https://registry.yarnpkg.com/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.62.0.tgz#ef482aab65b9b2c0abf92d36d670a0d270bcef4c" - integrity sha512-o+mpz7EYiMzXoySXiKmzlabIvTVqUuK5yLrAedRPRDA0IpPFMUV1IXt6OqljIxX/kumN6EjUYp41Hqelh6p/Dw== + version "8.63.0" + resolved "https://registry.yarnpkg.com/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.63.0.tgz#0d85d0ec1a28b0e35f484cc8220a8bf084019e71" + integrity sha512-rvwSgqT+DHpWdzfSzPatRLm02a0GlESt++9iy3hLCDY4BgkaLcl8LBi9Yh7XGFBpwcBE/K3024QuXWTpbz4FfQ== dependencies: "@eslint-community/regexpp" "^4.12.2" - "@typescript-eslint/scope-manager" "8.62.0" - "@typescript-eslint/type-utils" "8.62.0" - "@typescript-eslint/utils" "8.62.0" - "@typescript-eslint/visitor-keys" "8.62.0" + "@typescript-eslint/scope-manager" "8.63.0" + "@typescript-eslint/type-utils" "8.63.0" + "@typescript-eslint/utils" "8.63.0" + "@typescript-eslint/visitor-keys" "8.63.0" ignore "^7.0.5" natural-compare "^1.4.0" ts-api-utils "^2.5.0" "@typescript-eslint/parser@^8.38.0": - version "8.62.0" - resolved "https://registry.yarnpkg.com/@typescript-eslint/parser/-/parser-8.62.0.tgz#8533094fb44427f50b82813c6d3876782f20dc3e" - integrity sha512-dzHeT2gySzZtLDsuqxU9AkYgIsQoHAHtRBpOqM+Ofzx1Bwrd2RcCjQJ+6iQbsHOIR6NS33bF2W1k3blN1zLDrA== - dependencies: - "@typescript-eslint/scope-manager" "8.62.0" - "@typescript-eslint/types" "8.62.0" - "@typescript-eslint/typescript-estree" "8.62.0" - "@typescript-eslint/visitor-keys" "8.62.0" + version "8.63.0" + resolved "https://registry.yarnpkg.com/@typescript-eslint/parser/-/parser-8.63.0.tgz#2993338c379903e6afc72c3532ae6e15b97334d4" + integrity sha512-gwh4gvvlaVDKKxyfxMG+Gnu1u9X0OQBwyGLkbwB65dIzBKnxeRiJlNFqlI3zwVhNXJIs6qV7mlFCn/BIajlVig== + dependencies: + "@typescript-eslint/scope-manager" "8.63.0" + "@typescript-eslint/types" "8.63.0" + "@typescript-eslint/typescript-estree" "8.63.0" + "@typescript-eslint/visitor-keys" "8.63.0" debug "^4.4.3" -"@typescript-eslint/project-service@8.62.0": - version "8.62.0" - resolved "https://registry.yarnpkg.com/@typescript-eslint/project-service/-/project-service-8.62.0.tgz#ab74c1abb4959fb4c3ba7d7edc6554ee245db990" - integrity sha512-wexnCqiTg7BOGtbLDftYpRWlmLq4xfoMd7BKFR6Y75sZS3QmRKLdN3yWLhmIYgqMmP/OXWpj3H8odkb5nGURCQ== +"@typescript-eslint/project-service@8.63.0": + version "8.63.0" + resolved "https://registry.yarnpkg.com/@typescript-eslint/project-service/-/project-service-8.63.0.tgz#01a3d0550a860127444a9939749ab434591cd71a" + integrity sha512-e5dh0/UI0ok53AlZ5wRkXCB32z/f2jUZqPR/ygAw5WYaSw8j9EoJWlS7wQjr/dmOaqWjnPIn2m+HhVPCMWGZVQ== dependencies: - "@typescript-eslint/tsconfig-utils" "^8.62.0" - "@typescript-eslint/types" "^8.62.0" + "@typescript-eslint/tsconfig-utils" "^8.63.0" + "@typescript-eslint/types" "^8.63.0" debug "^4.4.3" -"@typescript-eslint/scope-manager@8.62.0": - version "8.62.0" - resolved "https://registry.yarnpkg.com/@typescript-eslint/scope-manager/-/scope-manager-8.62.0.tgz#a7a7b428d32444bc9a4fe16f24a78fc124283fd4" - integrity sha512-1lX38kNxXIRb8mEc3lbq5mdHq1Pf2+U0nFU65KfT18mtPxxl0fvjuEE92mHuXPuCtElJhOrddOpyMlM3Z0umEA== +"@typescript-eslint/scope-manager@8.63.0": + version "8.63.0" + resolved "https://registry.yarnpkg.com/@typescript-eslint/scope-manager/-/scope-manager-8.63.0.tgz#c9cf7ecd234f7ec346f62e5c7d28dfaf4d507b4d" + integrity sha512-uUyfMWCnDSN8bCpcrY8nGP2BLkQ9Xn0GsipcONcpIDWhwhO4ZSyHvyS14U3X75mzxWxL3I2UZIrenTzdzcJO8A== dependencies: - "@typescript-eslint/types" "8.62.0" - "@typescript-eslint/visitor-keys" "8.62.0" + "@typescript-eslint/types" "8.63.0" + "@typescript-eslint/visitor-keys" "8.63.0" -"@typescript-eslint/tsconfig-utils@8.62.0", "@typescript-eslint/tsconfig-utils@^8.62.0": - version "8.62.0" - resolved "https://registry.yarnpkg.com/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.62.0.tgz#9440a673581c6d9de308c4d5803dd52ed5d71729" - integrity sha512-y2GAdB6ykaXUvuspbYnizQc4oDDz0Tz/Yc7iWrXf9mx8vm/L/0vLHCe0tS2boG96Zy+DivnVDQ9ZUEWoHqqx1g== +"@typescript-eslint/tsconfig-utils@8.63.0", "@typescript-eslint/tsconfig-utils@^8.63.0": + version "8.63.0" + resolved "https://registry.yarnpkg.com/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.63.0.tgz#f7e1cf9a029bb71f4027ffa4194ba82afb564cd3" + integrity sha512-sUAbkulqBAsncKnbRP3+7CtQFRKicexnj7ZwNC6ddCR7EmrXvjvdCYMJbUIqMd6lwoEriZjwLo08aS5tSjVMHg== -"@typescript-eslint/type-utils@8.62.0": - version "8.62.0" - resolved "https://registry.yarnpkg.com/@typescript-eslint/type-utils/-/type-utils-8.62.0.tgz#6f64d813ed9f340d796baed40cdab86b8e9a491a" - integrity sha512-+g5O3j0w2ldzC86Pv6fvbO/xhAonbJFIdf/MKQ1d30gndlsVzUOE83ldfSE15Qrl9fhFjK6AovHs5Wpp6vx86w== +"@typescript-eslint/type-utils@8.63.0": + version "8.63.0" + resolved "https://registry.yarnpkg.com/@typescript-eslint/type-utils/-/type-utils-8.63.0.tgz#9c00f362140186c588da86b3e10c212800b64b85" + integrity sha512-Nzzh/OGxVCOjObjaj1CQF2RUasyYy2Jfuh+zZ3PjLzG2fYRriAiZLib9UKtO+CpQAS3YHiAS+ckZDclwqI1TPA== dependencies: - "@typescript-eslint/types" "8.62.0" - "@typescript-eslint/typescript-estree" "8.62.0" - "@typescript-eslint/utils" "8.62.0" + "@typescript-eslint/types" "8.63.0" + "@typescript-eslint/typescript-estree" "8.63.0" + "@typescript-eslint/utils" "8.63.0" debug "^4.4.3" ts-api-utils "^2.5.0" -"@typescript-eslint/types@8.62.0", "@typescript-eslint/types@^8.62.0": - version "8.62.0" - resolved "https://registry.yarnpkg.com/@typescript-eslint/types/-/types-8.62.0.tgz#601427c10203d9f0f34f0b3e474df735eb12b593" - integrity sha512-KvAclkktORPvM54TgLgA4z9HIV1M8zOgw9ZVNXl9f/8dLYfXYX1wkMXP7qmabpijQRV5bHJLOmoyGQbLMaUYeg== +"@typescript-eslint/types@8.63.0", "@typescript-eslint/types@^8.63.0": + version "8.63.0" + resolved "https://registry.yarnpkg.com/@typescript-eslint/types/-/types-8.63.0.tgz#6b32b0a5913520554d81a986acfffba2d32b6963" + integrity sha512-xyLtl9DUBBFrcJS4x2pIqGLH68/tC2uOa4Z7pUteW09D3bXnnXUom4dyPikzWgB7llmIc1zoeI3aoUdC4rPK/Q== -"@typescript-eslint/typescript-estree@8.62.0": - version "8.62.0" - resolved "https://registry.yarnpkg.com/@typescript-eslint/typescript-estree/-/typescript-estree-8.62.0.tgz#b96b55d02e26aa09434421c3fa678e525ca09a4c" - integrity sha512-+hVbNxtW64pIcZWDPGbyaKF7vp2IBTVY5ma1blwwksrjdsbdqqEKvJWMGbBofei4F6Dovx1M0RJgoFeNu2279A== +"@typescript-eslint/typescript-estree@8.63.0": + version "8.63.0" + resolved "https://registry.yarnpkg.com/@typescript-eslint/typescript-estree/-/typescript-estree-8.63.0.tgz#a6f9c9cd290e98203ad29850b0d72529dc83be73" + integrity sha512-ygBkU+B7ex5UI/gKhaqexWev79uISfIv7XQCRNYO/jmD8rGLPyWLAb3KMRT6nd8Gt9bmUBi9+iX6tBdYfOY81Q== dependencies: - "@typescript-eslint/project-service" "8.62.0" - "@typescript-eslint/tsconfig-utils" "8.62.0" - "@typescript-eslint/types" "8.62.0" - "@typescript-eslint/visitor-keys" "8.62.0" + "@typescript-eslint/project-service" "8.63.0" + "@typescript-eslint/tsconfig-utils" "8.63.0" + "@typescript-eslint/types" "8.63.0" + "@typescript-eslint/visitor-keys" "8.63.0" debug "^4.4.3" minimatch "^10.2.2" semver "^7.7.3" tinyglobby "^0.2.15" ts-api-utils "^2.5.0" -"@typescript-eslint/utils@8.62.0": - version "8.62.0" - resolved "https://registry.yarnpkg.com/@typescript-eslint/utils/-/utils-8.62.0.tgz#b5228524ca1ee51af40e156c82d425dec3e01cfe" - integrity sha512-82r66fi9zYwZ+mTq3vKgwjbZ1PVk/DJzrXFLpG6RnBbdvH8TEGVHIs9H4d2drhkOzf0syZuD/OZvvlu6GDbP4g== +"@typescript-eslint/utils@8.63.0": + version "8.63.0" + resolved "https://registry.yarnpkg.com/@typescript-eslint/utils/-/utils-8.63.0.tgz#b6a6c8aff1cebd1de4410b3a42b7ec9ba6703f23" + integrity sha512-fUKaeAvrTuQg/Tgt3nliAUSZHJM6DlCcfyEmxCvlX8kieWSStBX+5O5Fnidtc3i2JrH+9c/GL4RY2iasd/GPTA== dependencies: "@eslint-community/eslint-utils" "^4.9.1" - "@typescript-eslint/scope-manager" "8.62.0" - "@typescript-eslint/types" "8.62.0" - "@typescript-eslint/typescript-estree" "8.62.0" + "@typescript-eslint/scope-manager" "8.63.0" + "@typescript-eslint/types" "8.63.0" + "@typescript-eslint/typescript-estree" "8.63.0" -"@typescript-eslint/visitor-keys@8.62.0": - version "8.62.0" - resolved "https://registry.yarnpkg.com/@typescript-eslint/visitor-keys/-/visitor-keys-8.62.0.tgz#b6daab190bf8f18612f5b86323469a12288c6b31" - integrity sha512-CY3uyFSRbcQv3nnSv8S0+lDftMVz6P963PoRlxrV7ew/Md564g9ut60PYzdLM5qW4jFn93GBF+Soi90ISAN+GQ== +"@typescript-eslint/visitor-keys@8.63.0": + version "8.63.0" + resolved "https://registry.yarnpkg.com/@typescript-eslint/visitor-keys/-/visitor-keys-8.63.0.tgz#2853a8e33b52f23570338f96cc89cb223daabd44" + integrity sha512-UexrHGnGTpbuQHct2ExOc2ZcFbGUS9FOesCxxqdBGcpI1BxYu/LZ6U8Aq6/72XtF/qRBk9nhuGHFJIXXMhPMdw== dependencies: - "@typescript-eslint/types" "8.62.0" + "@typescript-eslint/types" "8.63.0" eslint-visitor-keys "^5.0.0" "@webassemblyjs/ast@1.14.1", "@webassemblyjs/ast@^1.14.1": @@ -1389,10 +1389,10 @@ balanced-match@^4.0.2: resolved "https://registry.yarnpkg.com/balanced-match/-/balanced-match-4.0.4.tgz#bfb10662feed8196a2c62e7c68e17720c274179a" integrity sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA== -baseline-browser-mapping@^2.10.38: - version "2.10.38" - resolved "https://registry.yarnpkg.com/baseline-browser-mapping/-/baseline-browser-mapping-2.10.38.tgz#c84d093c4bf7325c5053c279d90f153c66526042" - integrity sha512-31/02mVB4yuQU6adKk5SlY6m+mxDwUq5KZkyYgnLrrKl7TEm1+3PyDtDBz2kOv/wxZz41GHsvV1A/u6RmiyBvw== +baseline-browser-mapping@^2.10.42: + version "2.10.42" + resolved "https://registry.yarnpkg.com/baseline-browser-mapping/-/baseline-browser-mapping-2.10.42.tgz#195dcc76baa269a497f0b07decace169fee9ac58" + integrity sha512-c/jurFrDLyui7o1J86yLkRu4LMsTYcBohveus7/I2Hzdn9KIP2bdJPTue/lR1KH46enoPbD77GKeSYNdyPoD3Q== brace-expansion@^1.1.7: version "1.1.15" @@ -1403,9 +1403,9 @@ brace-expansion@^1.1.7: concat-map "0.0.1" brace-expansion@^5.0.5: - version "5.0.6" - resolved "https://registry.yarnpkg.com/brace-expansion/-/brace-expansion-5.0.6.tgz#ec68fe0a641a29d8711579caf641d05bae1f2285" - integrity sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g== + version "5.0.7" + resolved "https://registry.yarnpkg.com/brace-expansion/-/brace-expansion-5.0.7.tgz#1b0e46965b479dad65af737b4a02790a05498337" + integrity sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA== dependencies: balanced-match "^4.0.2" @@ -1417,14 +1417,14 @@ braces@^3.0.3: fill-range "^7.1.1" browserslist@^4.24.0, browserslist@^4.28.1: - version "4.28.4" - resolved "https://registry.yarnpkg.com/browserslist/-/browserslist-4.28.4.tgz#dd8b8167a32845ff5f8cd6ce13f5abba16cd04c9" - integrity sha512-MTc8i/x9jBQd1iMw2CFGS+rwMa07eYjLR0CCTLDACl9xhxy+nIs3KeML/biicXtk9JrZ6dnnTatmc7ErPXIxqw== - dependencies: - baseline-browser-mapping "^2.10.38" - caniuse-lite "^1.0.30001799" - electron-to-chromium "^1.5.376" - node-releases "^2.0.48" + version "4.28.5" + resolved "https://registry.yarnpkg.com/browserslist/-/browserslist-4.28.5.tgz#438b7d38c0d4b47740bbb36778d5bdca01b37838" + integrity sha512-Cu2E6QejHWzuDMTkuwgpABFgDfZrXLQq5V13YOACZx4mFAG4IwGTbTfHPMr4WtxlHoXSM8FIuRwYYCz5XiabaQ== + dependencies: + baseline-browser-mapping "^2.10.42" + caniuse-lite "^1.0.30001800" + electron-to-chromium "^1.5.387" + node-releases "^2.0.50" update-browserslist-db "^1.2.3" bs-logger@^0.2.6: @@ -1469,10 +1469,10 @@ camelcase@^6.2.0: resolved "https://registry.yarnpkg.com/camelcase/-/camelcase-6.3.0.tgz#5685b95eb209ac9c0c177467778c9c84df58ba9a" integrity sha512-Gmy6FhYlCY7uOElZUSbxo2UCDH8owEk996gkbrpsgGtrJLM3J7jGxl9Ic7Qwwj4ivOE5AWZWRMecDdF7hqGjFA== -caniuse-lite@^1.0.30001799: - version "1.0.30001799" - resolved "https://registry.yarnpkg.com/caniuse-lite/-/caniuse-lite-1.0.30001799.tgz#5c909138c27f1a61219d3e092071c1cc7d32dc55" - integrity sha512-hG1bReV+OUU+MOqK4t/ZWI0tZOyz3rqS9XuhOUz1cIcbwBKjOyJEJuw9ER5JuNyqxNk8u/JUVbGibBOL1yrjFw== +caniuse-lite@^1.0.30001800: + version "1.0.30001803" + resolved "https://registry.yarnpkg.com/caniuse-lite/-/caniuse-lite-1.0.30001803.tgz#b2a5d696e042bc8304dcd4942c39fe330fbbcb24" + integrity sha512-g/uHREV2ZpK9qMalCsWaxmA6ol+DX8GYhuf3T40RKoP+oL7vhRJh8LNt73PCjpnR6l14FzfPrB5Yux4PKm2meg== chalk@^4.0.0, chalk@^4.1.0: version "4.1.2" @@ -1696,10 +1696,10 @@ dunder-proto@^1.0.1: es-errors "^1.3.0" gopd "^1.2.0" -electron-to-chromium@^1.5.376: - version "1.5.377" - resolved "https://registry.yarnpkg.com/electron-to-chromium/-/electron-to-chromium-1.5.377.tgz#69c8fed266cdd088aa6b7ede7f06cff283bb492c" - integrity sha512-cH1jZgJHoezfTnKfKwnScpHywTFVnJUNITDPREFdhNjiuD502+QFpG0Qk7G8jhsV/f+CEAFlIrzP1fT+IMb92g== +electron-to-chromium@^1.5.387: + version "1.5.388" + resolved "https://registry.yarnpkg.com/electron-to-chromium/-/electron-to-chromium-1.5.388.tgz#002666dfda32e087c44fd01b7ce1719b6ec89c57" + integrity sha512-Pl/aJaqOOxYxda3vcx1IKSJimwYXHDkEnGn0F+kG2EE68dDtx2uCinaS+Vih8Z91B9t8CSAbiF/HKyWcnXjhzw== emittery@^0.13.1: version "0.13.1" @@ -1716,15 +1716,15 @@ emoji-regex@^8.0.0: resolved "https://registry.yarnpkg.com/emoji-regex/-/emoji-regex-8.0.0.tgz#e818fd69ce5ccfcb404594f842963bf53164cc37" integrity sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A== -enhanced-resolve@^5.22.0: - version "5.24.0" - resolved "https://registry.yarnpkg.com/enhanced-resolve/-/enhanced-resolve-5.24.0.tgz#cf14b9768a774cb6a5087220c0dc6e55df6ec35a" - integrity sha512-SkE2t82KlkkxQRVMVLAGKxLfORGQfrkx5dkj+vlgXRVNEdPc4eZcR+J/Fvj8C+yKSFH5L0q3NFlyufOVQnCcYQ== +enhanced-resolve@^5.22.2: + version "5.24.2" + resolved "https://registry.yarnpkg.com/enhanced-resolve/-/enhanced-resolve-5.24.2.tgz#f25d703a24431cb1e02f944adb74aefa4fcb8d7e" + integrity sha512-rpsZEGT1jFuve6QlpyRp9ckQ+kN61hvF9BzCPyMdaKTm8UJce96KBn3sorXOFXlzjPrs3Vc4T1NsSroZ3PxlFw== dependencies: graceful-fs "^4.2.4" tapable "^2.3.3" -entities@^4.4.0: +entities@^4.5.0: version "4.5.0" resolved "https://registry.yarnpkg.com/entities/-/entities-4.5.0.tgz#5d268ea5e7113ec74c4d033b79ea5a35a488fb48" integrity sha512-V0hjH4dGPh9Ao5p0MoRY6BVqtwCjhz6vI5LT8AJ55H+4g9/4vbHx1I54fS0XuclLhDHArPQCiMjDxjaL8fPxhw== @@ -1757,9 +1757,9 @@ es-errors@^1.3.0: integrity sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw== es-module-lexer@^2.1.0: - version "2.1.0" - resolved "https://registry.yarnpkg.com/es-module-lexer/-/es-module-lexer-2.1.0.tgz#1dfcbb5ea3bbfb63f28e1fc3676c3676d1c9624c" - integrity sha512-n27zTYMjYu1aj4MjCWzSP7G9r75utsaoc8m61weK+W8JMBGGQybd43GstCXZ3WNmSFtGT9wi59qQTW6mhTR5LQ== + version "2.3.0" + resolved "https://registry.yarnpkg.com/es-module-lexer/-/es-module-lexer-2.3.0.tgz#fda770234c345064c122eb905e1c4200ffa4ce7e" + integrity sha512-KLdwQm2NvGLDkQDCGvmiQrhkd0JbMzXthwQAUgWjQuQdBLFa3eiBP5arXZyA+f8x+x7OXgud6bq2rxjGtHV2tw== es-object-atoms@^1.0.0, es-object-atoms@^1.1.1: version "1.1.2" @@ -1993,9 +1993,9 @@ fast-levenshtein@^2.0.6: integrity sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw== fast-uri@^3.0.1: - version "3.1.2" - resolved "https://registry.yarnpkg.com/fast-uri/-/fast-uri-3.1.2.tgz#8af3d4fc9d3e71b11572cc2673b514a7d1a8c8ec" - integrity sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ== + version "3.1.3" + resolved "https://registry.yarnpkg.com/fast-uri/-/fast-uri-3.1.3.tgz#f695a40f006aba505631573a0021ddb21194ad11" + integrity sha512-i70LwGWUduXqzicKXWshooq+sWL1K3WUU5rKZNG/0i3a1OSoX3HqhH5WbWwTmqWfor4urUakGPiRQcleRZTwOg== fb-watchman@^2.0.0: version "2.0.2" @@ -2134,11 +2134,6 @@ glob-parent@^6.0.2: dependencies: is-glob "^4.0.3" -glob-to-regexp@^0.4.1: - version "0.4.1" - resolved "https://registry.yarnpkg.com/glob-to-regexp/-/glob-to-regexp-0.4.1.tgz#c75297087c851b9a578bd217dd59a92f59fe546e" - integrity sha512-lkX1HJXwyMcprw/5YUZc2s7DrpAiHB21/V+E1rHUrVNokkvB6bqMzT0VfV6/86ZNabt1k14YOIaT7nDvOX3Iiw== - glob@^7.1.3, glob@^7.1.4: version "7.2.3" resolved "https://registry.yarnpkg.com/glob/-/glob-7.2.3.tgz#b8df0fb802bbfa8e89bd1d938b4e16578ed44f2b" @@ -2813,17 +2808,17 @@ js-tokens@^4.0.0: integrity sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ== js-yaml@^3.13.1: - version "3.14.2" - resolved "https://registry.yarnpkg.com/js-yaml/-/js-yaml-3.14.2.tgz#77485ce1dd7f33c061fd1b16ecea23b55fcb04b0" - integrity sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg== + version "3.15.0" + resolved "https://registry.yarnpkg.com/js-yaml/-/js-yaml-3.15.0.tgz#586e5214eafe3e893756a41e979b50d89d3e4a67" + integrity sha512-ttBQIIQPDeLjpPOohtUdXuXUVoA2uIB6fEH9HyJ7234s5mBJ5wTx20njxplLZQgLaOfpmPQA7X2t5AX6tIPbog== dependencies: argparse "^1.0.7" esprima "^4.0.0" js-yaml@^4.1.1: - version "4.2.0" - resolved "https://registry.yarnpkg.com/js-yaml/-/js-yaml-4.2.0.tgz#2bd9e85682dd91bd469afb809d816043b3d49524" - integrity sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw== + version "4.3.0" + resolved "https://registry.yarnpkg.com/js-yaml/-/js-yaml-4.3.0.tgz#d1900572a7f7cf0b5f540c83673e60bad3436592" + integrity sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q== dependencies: argparse "^2.0.1" @@ -2929,10 +2924,10 @@ lines-and-columns@^1.1.6: resolved "https://registry.yarnpkg.com/lines-and-columns/-/lines-and-columns-1.2.4.tgz#eca284f75d2965079309dc0ad9255abb2ebc1632" integrity sha512-7ylylesZQ/PV29jhEDl3Ufjo6ZX7gCqJr5F7PKrqc93v7fzSymt1BpwEU8nAUXs8qzzvqhbjhK5QZg6Mt/HkBg== -linkify-it@^5.0.1: - version "5.0.1" - resolved "https://registry.yarnpkg.com/linkify-it/-/linkify-it-5.0.1.tgz#10c4cecbb5c6828eabf81d3c801adc4a542dfb55" - integrity sha512-wVoTjP4Q6R0NW5hiZkVJaFZPWgtXfoGF+6LucL3/FtiNjmcHhYjEr5f1Kqjirc1nBW07J/ZuRFumqr2oqccEWg== +linkify-it@^5.0.2: + version "5.0.2" + resolved "https://registry.yarnpkg.com/linkify-it/-/linkify-it-5.0.2.tgz#d3be0a693af3da9df3883f1e346a0e97461a8c19" + integrity sha512-ONTm2jCMAVZjgQa/Fy1kScXsuOoF5NPTsoFBdE1KVIZ2vAh/r9+Bqo+0jINCBYnavTPQZz38QzFTme79ENoN3Q== dependencies: uc.micro "^2.0.0" @@ -3031,14 +3026,14 @@ makeerror@1.0.12: dependencies: tmpl "1.0.5" -markdown-it@^14.1.1: - version "14.2.0" - resolved "https://registry.yarnpkg.com/markdown-it/-/markdown-it-14.2.0.tgz#06d48d9035e77d5b1c85adb315482fc8240289ef" - integrity sha512-1TGiQiJVRQ3NPmZH6sx5Cfnmg6GQm9jvC1ch4TK511NjSJvjzKLzn5pPfZRNZkRPZP0HqCioSndqH8v2nRaWVQ== +markdown-it@^14.3.0: + version "14.3.0" + resolved "https://registry.yarnpkg.com/markdown-it/-/markdown-it-14.3.0.tgz#8542fa5506e3530f7e2b08dc3885630135c5620e" + integrity sha512-RCEsPjR+sr0x+AuYp601tKTkgFG4YEPLCzHST3cQ/fhlJkqAkz1L2/Qbp1j9qw5SBwQHFBoW8+hoN5xssOF0Tw== dependencies: argparse "^2.0.1" - entities "^4.4.0" - linkify-it "^5.0.1" + entities "^4.5.0" + linkify-it "^5.0.2" mdurl "^2.0.0" punycode.js "^2.3.1" uc.micro "^2.1.0" @@ -3112,6 +3107,16 @@ minimist@^1.2.5: resolved "https://registry.yarnpkg.com/minimist/-/minimist-1.2.8.tgz#c1a464e7693302e082a075cee0c057741ac4772c" integrity sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA== +minimizer-webpack-plugin@^5.6.1: + version "5.6.1" + resolved "https://registry.yarnpkg.com/minimizer-webpack-plugin/-/minimizer-webpack-plugin-5.6.1.tgz#289922a4c96c4ed1ddb76b8a00bd8074e89a2f7f" + integrity sha512-DoeAZz8Q1C1znwsUzej1fdoi4jCf7/+Em27ouLqfK/+3m8G+D7yDhUwrc3CNhjSzGUN1kn7Iv4sWmjflQHenpw== + dependencies: + "@jridgewell/trace-mapping" "^0.3.25" + jest-worker "^27.4.5" + schema-utils "^4.3.0" + terser "^5.31.1" + mri@^1.1.0: version "1.2.0" resolved "https://registry.yarnpkg.com/mri/-/mri-1.2.0.tgz#6721480fec2a11a4889861115a48b6cbe7cc8f0b" @@ -3163,9 +3168,9 @@ neo-async@^2.6.2: integrity sha512-Yd3UES5mWCSqR+qNT93S3UoYUkqAZ9lLg8a7g9rimsWmYGK8cVToA4/sF3RrshdyV3sAGMXVUmpMYOw+dLpOuw== nock@^14.0.6: - version "14.0.15" - resolved "https://registry.yarnpkg.com/nock/-/nock-14.0.15.tgz#23f9978fb20d8b3607dc263f4978cb89648f550b" - integrity sha512-S0a47C9pLvcYx/Ugf0H30BVBEcUgMMBDk9VJIDlJ8XGrfH2QDUD4Tgdp45qDIiHttokBG+IbsOtsvIjGR/j3bg== + version "14.0.16" + resolved "https://registry.yarnpkg.com/nock/-/nock-14.0.16.tgz#d92dcc85ecf704791ef0bacb2447f81ea5ec52f4" + integrity sha512-8r4KEc6nT1D/fdLD/R1BO1CPaVEL8o40u/guFRJlXabN7vr3RmMqyjsY5Krt0nMwhsOAwXQ/mtN5vy5Jh3aErg== dependencies: "@mswjs/interceptors" "^0.41.0" json-stringify-safe "^5.0.1" @@ -3176,10 +3181,10 @@ node-int64@^0.4.0: resolved "https://registry.yarnpkg.com/node-int64/-/node-int64-0.4.0.tgz#87a9065cdb355d3182d8f94ce11188b825c68a3b" integrity sha512-O5lz91xSOeoXP6DulyHfllpq+Eg00MWitZIbtPfoSEvqIHdl5gfcY6hYzDWnj0qD5tz52PI08u9qUvSVeUBeHw== -node-releases@^2.0.48: - version "2.0.48" - resolved "https://registry.yarnpkg.com/node-releases/-/node-releases-2.0.48.tgz#4da73d040ada751fc9959d993f27de48792e3b7d" - integrity sha512-1uz8041X6LoI6ZSdZacM9lVY28vuzDlSKitnpbSNK0RfKoIJkX29NBPVEFXhnuSuEOA9Ww0xnPJ+ILWbGAv8DA== +node-releases@^2.0.50: + version "2.0.50" + resolved "https://registry.yarnpkg.com/node-releases/-/node-releases-2.0.50.tgz#597197a852071ce42fc2550e58e223242bcba969" + integrity sha512-J6l92tKHX6w8Jy5nO1Vuc01NoIiRGi/d6qBKVxh+IQ8Cr3b6HbVNfKiF8ZpFKufTwpwxMmce2W3iQZ861ZRyTg== normalize-path@^3.0.0: version "3.0.0" @@ -3270,9 +3275,9 @@ p-try@^2.0.0: integrity sha512-R4nPAVTAU0B9D35/Gk3uJf/7XYbQcyohSKdvAxIRSNghFl4e71hVoGnBNQz9cWaXxO2I10KTC+3jMdvvoKw6dQ== package-manager-detector@^1.6.0: - version "1.6.0" - resolved "https://registry.yarnpkg.com/package-manager-detector/-/package-manager-detector-1.6.0.tgz#70d0cf0aa02c877eeaf66c4d984ede0be9130734" - integrity sha512-61A5ThoTiDG/C8s8UMZwSorAGwMJ0ERVGj2OjoW5pAalsNOg15+iQiPzrLJ4jhZ1HJzmC2PIHT2oEiH3R5fzNA== + version "1.7.0" + resolved "https://registry.yarnpkg.com/package-manager-detector/-/package-manager-detector-1.7.0.tgz#0a6d6d3856627b8ac9331f95fc891ea81247aafd" + integrity sha512-xg1eHpwYL/D/HEdWw2goFZP6vV0FH7W+PZ5rFkGjdIDLtxq7EkzBUeT3m+lndYCt8wKbmofUu1MUdMCXkCk9ZQ== parent-module@^1.0.0: version "1.0.1" @@ -3334,9 +3339,9 @@ picomatch@^2.0.4, picomatch@^2.2.3, picomatch@^2.3.1: integrity sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA== picomatch@^4.0.0, picomatch@^4.0.3, picomatch@^4.0.4: - version "4.0.4" - resolved "https://registry.yarnpkg.com/picomatch/-/picomatch-4.0.4.tgz#fd6f5e00a143086e074dffe4c924b8fb293b0589" - integrity sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A== + version "4.0.5" + resolved "https://registry.yarnpkg.com/picomatch/-/picomatch-4.0.5.tgz#51ea57a17d86f605f81039595fbc40ed06a55fab" + integrity sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A== pirates@^4.0.4: version "4.0.7" @@ -3735,16 +3740,6 @@ tapable@^2.3.0, tapable@^2.3.3: resolved "https://registry.yarnpkg.com/tapable/-/tapable-2.3.3.tgz#5da7c9992c46038221267985ab28421a8879f160" integrity sha512-uxc/zpqFg6x7C8vOE7lh6Lbda8eEL9zmVm/PLeTPBRhh1xCgdWaQ+J1CUieGpIfm2HdtsUpRv+HshiasBMcc6A== -terser-webpack-plugin@^5.5.0: - version "5.6.1" - resolved "https://registry.yarnpkg.com/terser-webpack-plugin/-/terser-webpack-plugin-5.6.1.tgz#47bc41bd8b8fab8383b62ec763b7394829097e7b" - integrity sha512-201R5j+sJpK8nFWwKVyNfZot8FaJbLZDq5evriVzbV1wDtSXDjRUDRfJzHpAaxFDMEhsZL1QkeqM61wgsS3KaQ== - dependencies: - "@jridgewell/trace-mapping" "^0.3.25" - jest-worker "^27.4.5" - schema-utils "^4.3.0" - terser "^5.31.1" - terser@^5.31.1: version "5.48.0" resolved "https://registry.yarnpkg.com/terser/-/terser-5.48.0.tgz#8b391171cfbb7ac4a88f9f04ba1cfabc54f643db" @@ -3777,17 +3772,17 @@ tinyglobby@^0.2.15: fdir "^6.5.0" picomatch "^4.0.4" -tldts-core@^7.4.3: - version "7.4.3" - resolved "https://registry.yarnpkg.com/tldts-core/-/tldts-core-7.4.3.tgz#d43401c0499cd884eeaf1ccf073df841a1e4e2dd" - integrity sha512-27ep5H9PzdBrNd5OFM/j3WCU8F3kPwM9D0BOaOf7uYfxMJfyr0K5Tjj69Gri+sZlh2WXd5buIm47NuPF29CDiw== +tldts-core@^7.4.7: + version "7.4.7" + resolved "https://registry.yarnpkg.com/tldts-core/-/tldts-core-7.4.7.tgz#d58ba7b3f67b167ebc70c2a47fef1d96532d092d" + integrity sha512-rNlAI8fKn/JckBMUSbNL/ES2kmDiurWaE49l+ikwEc9A6lFR7gMx9AhgQMQKBK4H5w4pKLH64JzZfB99uRsGNQ== tldts@^7.0.5: - version "7.4.3" - resolved "https://registry.yarnpkg.com/tldts/-/tldts-7.4.3.tgz#536c93aecffc96d41ce5627a4b7e12f9c2cfceb5" - integrity sha512-A3BDQBeeukYPzB4QdQ1DtdlUmp4x2OCH8n5UVhEWbyANxNep8GavottKzd1xYKFJKjUgMyPT7EzOfnBO55s8Sg== + version "7.4.7" + resolved "https://registry.yarnpkg.com/tldts/-/tldts-7.4.7.tgz#5e48d9a31b9c538caa0179f2026f934246db2f7b" + integrity sha512-56L0/9HELHSsG1bFCzay8UoLxzRL7kpFf7Wl5q/kSYwiSJGACvro61xnKzPNM+SadxllzdtXsKDSXE7HPeqIAw== dependencies: - tldts-core "^7.4.3" + tldts-core "^7.4.7" tmpl@1.0.5: version "1.0.5" @@ -3877,20 +3872,20 @@ type-fest@^4.26.1, type-fest@^4.41.0: integrity sha512-TeTSQ6H5YHvpqVwBRcnLDCBnDOHWYu7IvGbHT6N8AOymcr9PJGjc1GTtiWZTYg0NCgYwvnYWEkVChQAr9bjfwA== typedoc-plugin-missing-exports@^4.0.0: - version "4.1.3" - resolved "https://registry.yarnpkg.com/typedoc-plugin-missing-exports/-/typedoc-plugin-missing-exports-4.1.3.tgz#36573af8021df7c82cd54edd42081c66a04be54f" - integrity sha512-tgrlnwzXbqMP2/3BaZk0atddPsD7UnpCoeQ0cUCtk624gODT1bLYOLBEJLXQyVmbnP8HZCMhHpRiR+rxSdZqhg== + version "4.1.4" + resolved "https://registry.yarnpkg.com/typedoc-plugin-missing-exports/-/typedoc-plugin-missing-exports-4.1.4.tgz#436e44a451df54fbe28bbf407ed2f2cb8bf70dbf" + integrity sha512-tIay6z6MRb/4+mfWgKNPR6qEM5rz9S8rTiz0JWmSb/66A6AlZIl9q+1lAFygj4n8GHH1fsqKYQNt9JbNcuE0Uw== typedoc@^0.28.7: - version "0.28.19" - resolved "https://registry.yarnpkg.com/typedoc/-/typedoc-0.28.19.tgz#0940c6b98eafae27cba71e57855d593f88a80649" - integrity sha512-wKh+lhdmMFivMlc6vRRcMGXeGEHGU2g8a2CkPTJjJlwRf1iXbimWIPcFolCqe4E0d/FRtGszpIrsp3WLpDB8Pw== + version "0.28.20" + resolved "https://registry.yarnpkg.com/typedoc/-/typedoc-0.28.20.tgz#23c9c841587c528b56cf9c0d017ca717745bb0d9" + integrity sha512-uSKqkh8Cr48vllnEy+jdaAgOeR6Y+QCBW7usgUsKj7gJEfR7stw9U/fE49LBnj2tPRKPY0c0EBJSWe9Appmplg== dependencies: "@gerrit0/mini-shiki" "^3.23.0" lunr "^2.3.9" - markdown-it "^14.1.1" + markdown-it "^14.3.0" minimatch "^10.2.5" - yaml "^2.8.3" + yaml "^2.9.0" typescript@~5.9.3: version "5.9.3" @@ -3983,7 +3978,7 @@ walker@^1.0.8: dependencies: makeerror "1.0.12" -watchpack@^2.5.1: +watchpack@^2.5.2: version "2.5.2" resolved "https://registry.yarnpkg.com/watchpack/-/watchpack-2.5.2.tgz#e12e82d84674266fc1c6dbfe38891b92ff0522ec" integrity sha512-6i/00NBjP4yGPs+caKSyRfpTF/8Torsu0MOW3mMzIbhgISFder8i7xbqgHlLMwJrdiN8ndBV3UA1/AfzPSr+jg== @@ -3996,14 +3991,14 @@ webidl-conversions@^7.0.0: integrity sha512-VwddBukDzu71offAQR975unBIGqfKZpM+8ZX6ySk8nYhVoo5CYaZyzt3YBvYtRtO+aoGlqxPg/B87NGVZ/fu6g== webpack-sources@^3.5.0: - version "3.5.0" - resolved "https://registry.yarnpkg.com/webpack-sources/-/webpack-sources-3.5.0.tgz#87bf7f5801a4e985b1f1c92b64b9620a02f76d08" - integrity sha512-HPuy+uuoTCaaoEoI1LQ3JN9+vrPBvEesnnX1jADHy728cHSMlq4wUc4afYqahq2B1mhQVZxCXOkNTnXltr+2vQ== + version "3.5.1" + resolved "https://registry.yarnpkg.com/webpack-sources/-/webpack-sources-3.5.1.tgz#76c2418486dcc02b2aa0694c104176c2858fe84a" + integrity sha512-jyuiGJdtvY434z5bUZrjz67v76/ePNvFZTp9Mdz29IlH4+GPsgyGjiv0fKI+M7BdkU6ADjulUcKAd3tUK3WlEw== webpack@^5.105.4: - version "5.107.2" - resolved "https://registry.yarnpkg.com/webpack/-/webpack-5.107.2.tgz#dea14dcb177b46b29de15f952f7303691ee2b596" - integrity sha512-v7RhXaJbpMlV0D7hC7lb2EbnxkoeUqf9qhKr6lozx3Q48pmFrqqNRmZFUEGmi7pSwm6fCQ2H1IjvCkHqdpVdjQ== + version "5.108.4" + resolved "https://registry.yarnpkg.com/webpack/-/webpack-5.108.4.tgz#141818a411662773a0bb32dc5536acc5409943b7" + integrity sha512-yur8LyJoeiWh47dErD+Ok7vlbmDsJ3UbbRPAoxbGJ54WpE2y5yVo5G/inUzujnYgw3tPmBRdn+G7PoxXaYC33w== dependencies: "@types/estree" "^1.0.8" "@types/json-schema" "^7.0.15" @@ -4014,19 +4009,18 @@ webpack@^5.105.4: acorn-import-phases "^1.0.3" browserslist "^4.28.1" chrome-trace-event "^1.0.2" - enhanced-resolve "^5.22.0" + enhanced-resolve "^5.22.2" es-module-lexer "^2.1.0" eslint-scope "5.1.1" events "^3.2.0" - glob-to-regexp "^0.4.1" graceful-fs "^4.2.11" loader-runner "^4.3.2" mime-db "^1.54.0" + minimizer-webpack-plugin "^5.6.1" neo-async "^2.6.2" schema-utils "^4.3.3" tapable "^2.3.0" - terser-webpack-plugin "^5.5.0" - watchpack "^2.5.1" + watchpack "^2.5.2" webpack-sources "^3.5.0" whatwg-encoding@^2.0.0: @@ -4131,7 +4125,7 @@ yallist@^3.0.2: resolved "https://registry.yarnpkg.com/yallist/-/yallist-3.1.1.tgz#dbb7daf9bfd8bac9ab45ebf602b8cbad0d5d08fd" integrity sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g== -yaml@^2.8.2, yaml@^2.8.3: +yaml@^2.8.2, yaml@^2.9.0: version "2.9.0" resolved "https://registry.yarnpkg.com/yaml/-/yaml-2.9.0.tgz#78274afd93598a1dfdd6130df6a566defcbf9aa4" integrity sha512-2AvhNX3mb8zd6Zy7INTtSpl1F15HW6Wnqj0srWlkKLcpYl/gMIMJiyuGq2KeI2YFxUPjdlB+3Lc10seMLtL4cA==