autogen: regenerate OpenAPI client for v1.22.60

Version: v1.22.60

Author: aeneasr

api/openapi.yaml

@@ -39,7 +39,7 @@ info:
     url: https://www.apache.org/licenses/LICENSE-2.0.html
   termsOfService: /tos
   title: Ory APIs
-  version: v1.22.59
+  version: v1.22.60
 servers:
 - url: "https://{project_slug}.projects.oryapis.com/"
   variables:
@@ -11314,6 +11314,14 @@ components:
           example: 30m
           pattern: "^([0-9]+([.][0-9]+)?(ns|us|µs|ms|s|m|h))+$"
           type: string
+        hydra_oauth2_grant_jwt_omit_assertion_audience:
+          description: |-
+            Configures whether the audience (`aud`) claim from the assertion JSON Web Token (JWT) in the JWT Profile for OAuth 2.0 Client Authentication and Authorization Grants (RFC7523) is omitted from the resulting access token.
+
+            When set to `true` (the default for new projects), the audience values from the inbound assertion JWT are not granted in the access token. Set to `false` to copy the assertion audience into the access token (the legacy behavior).
+
+            This governs the "oauth2.grant.jwt.omit_assertion_audience" setting.
+          type: boolean
         hydra_oauth2_grant_refresh_token_rotation_grace_period:
           description: |-
             Configures the OAuth2 Grant Refresh Token Rotation Grace Period
@@ -12079,6 +12087,14 @@ components:
 
             This governs the "feature_flags.password_profile_registration_node_group" setting.
           type: boolean
+        kratos_feature_flags_refresh_login_choose_address:
+          description: |-
+            Render an address picker on the code refresh login screen
+
+            If true, a code-strategy refresh (privileged re-authentication) login renders a "Send code to <address>" button per available code address instead of re-asking for the identifier. The identity is already fixed by the active session, so re-entering the identifier is unnecessary. It is safe to toggle this back and forth.
+
+            This governs the "feature_flags.refresh_login_choose_address" setting.
+          type: boolean
         kratos_feature_flags_use_continue_with_transitions:
           description: |-
             Configures the Ory Kratos Session use_continue_with_transitions flag
@@ -12604,6 +12620,14 @@ components:
 
             This governs the "selfservice.methods.code.passwordless_login_fallback_enabled" setting.
           type: boolean
+        kratos_selfservice_methods_deviceauthn_config_android_app_ids:
+          description: |-
+            Configures the allow-list of Android app signing-certificate digests that a device key may be bound to.
+
+            This governs the "selfservice.methods.deviceauthn.config.android_app_ids" setting.
+          items:
+            type: string
+          type: array
         kratos_selfservice_methods_deviceauthn_config_insecure_allow_relaxed_attestation:
           description: |-
             Configures whether Ory Kratos Device authentication accepts relaxed attestations for testing
@@ -12613,6 +12637,14 @@ components:
 
             This governs the "selfservice.methods.deviceauthn.config.insecure_allow_relaxed_attestation" setting.
           type: boolean
+        kratos_selfservice_methods_deviceauthn_config_ios_app_ids:
+          description: |-
+            Configures the allow-list of Apple App IDs that a device key may be bound to.
+
+            This governs the "selfservice.methods.deviceauthn.config.ios_app_ids" setting.
+          items:
+            type: string
+          type: array
         kratos_selfservice_methods_deviceauthn_enabled:
           description: |-
             Configures whether Ory Kratos Device authentication is enabled
@@ -13165,8 +13197,14 @@ components:
         attestation:
           $ref: '#/components/schemas/deviceAuthnAttestation'
         client_key_id:
-          description: ClientKeyID is a client-chosen id for the key and is unique
-            per identity.
+          description: |-
+            ClientKeyID is the key's stable, unique-per-identity id, computed as
+            hex(SHA-256(PublicKey)) — the lowercase-hex SHA-256 digest of the public
+            key's PKIX, ASN.1 DER (SubjectPublicKeyInfo) encoding, exactly the bytes
+            stored in PublicKey. It is a deterministic fingerprint of the enrolled
+            signing key, so the device recomputes the identical value locally instead
+            of receiving it from the server. Keys enrolled before the server derived
+            the id keep their original client-chosen value.
           type: string
         created_at:
           description: |-
@@ -13182,8 +13220,10 @@ components:
           type: string
         public_key:
           description: |-
-            PublicKey is an EC (in v1) public key, used to verify signatures, stored as uncompressed bytes.
-            The private key resides inside the device and does not exist on the server.
+            PublicKey is the device's public key (EC P-256 in v1), used to verify
+            signatures. It is stored in PKIX, ASN.1 DER form (the SubjectPublicKeyInfo
+            encoding produced by x509.MarshalPKIXPublicKey). The private key resides
+            inside the device and does not exist on the server.
           items:
             format: uint8
             type: integer
@@ -19553,6 +19593,14 @@ components:
           example: 30m
           pattern: "^([0-9]+([.][0-9]+)?(ns|us|µs|ms|s|m|h))+$"
           type: string
+        hydra_oauth2_grant_jwt_omit_assertion_audience:
+          description: |-
+            Configures whether the audience (`aud`) claim from the assertion JSON Web Token (JWT) in the JWT Profile for OAuth 2.0 Client Authentication and Authorization Grants (RFC7523) is omitted from the resulting access token.
+
+            When set to `true` (the default for new projects), the audience values from the inbound assertion JWT are not granted in the access token. Set to `false` to copy the assertion audience into the access token (the legacy behavior).
+
+            This governs the "oauth2.grant.jwt.omit_assertion_audience" setting.
+          type: boolean
         hydra_oauth2_grant_refresh_token_rotation_grace_period:
           description: |-
             Configures the OAuth2 Grant Refresh Token Rotation Grace Period
@@ -20318,6 +20366,14 @@ components:
 
             This governs the "feature_flags.password_profile_registration_node_group" setting.
           type: boolean
+        kratos_feature_flags_refresh_login_choose_address:
+          description: |-
+            Render an address picker on the code refresh login screen
+
+            If true, a code-strategy refresh (privileged re-authentication) login renders a "Send code to <address>" button per available code address instead of re-asking for the identifier. The identity is already fixed by the active session, so re-entering the identifier is unnecessary. It is safe to toggle this back and forth.
+
+            This governs the "feature_flags.refresh_login_choose_address" setting.
+          type: boolean
         kratos_feature_flags_use_continue_with_transitions:
           description: |-
             Configures the Ory Kratos Session use_continue_with_transitions flag
@@ -20843,6 +20899,14 @@ components:
 
             This governs the "selfservice.methods.code.passwordless_login_fallback_enabled" setting.
           type: boolean
+        kratos_selfservice_methods_deviceauthn_config_android_app_ids:
+          description: |-
+            Configures the allow-list of Android app signing-certificate digests that a device key may be bound to.
+
+            This governs the "selfservice.methods.deviceauthn.config.android_app_ids" setting.
+          items:
+            type: string
+          type: array
         kratos_selfservice_methods_deviceauthn_config_insecure_allow_relaxed_attestation:
           description: |-
             Configures whether Ory Kratos Device authentication accepts relaxed attestations for testing
@@ -20852,6 +20916,14 @@ components:
 
             This governs the "selfservice.methods.deviceauthn.config.insecure_allow_relaxed_attestation" setting.
           type: boolean
+        kratos_selfservice_methods_deviceauthn_config_ios_app_ids:
+          description: |-
+            Configures the allow-list of Apple App IDs that a device key may be bound to.
+
+            This governs the "selfservice.methods.deviceauthn.config.ios_app_ids" setting.
+          items:
+            type: string
+          type: array
         kratos_selfservice_methods_deviceauthn_enabled:
           description: |-
             Configures whether Ory Kratos Device authentication is enabled
@@ -21430,6 +21502,21 @@ components:
           x-go-enum-desc: |-
             enabled ThirdPartyProviderStateEnabled
             disabled ThirdPartyProviderStateDisabled
+        update_identity_on_login:
+          description: |-
+            UpdateIdentityOnLogin controls whether the identity is updated from SAML
+            claims on each login.
+
+            Possible values are "never" (default) and "automatic".
+            never UpdateIdentityOnLoginNever  UpdateIdentityOnLoginNever disables identity updates on login (default).
+            automatic UpdateIdentityOnLoginAutomatic  UpdateIdentityOnLoginAutomatic re-runs the Jsonnet claims mapper on every login and updates the identity's traits and metadata automatically.
+          enum:
+          - never
+          - automatic
+          type: string
+          x-go-enum-desc: |-
+            never UpdateIdentityOnLoginNever  UpdateIdentityOnLoginNever disables identity updates on login (default).
+            automatic UpdateIdentityOnLoginAutomatic  UpdateIdentityOnLoginAutomatic re-runs the Jsonnet claims mapper on every login and updates the identity's traits and metadata automatically.
         updated_at:
           description: Last Time Project's Revision was Updated
           format: date-time
@@ -21697,14 +21784,14 @@ components:
 
             Possible values are "never" (default) and "automatic".
             never UpdateIdentityOnLoginNever  UpdateIdentityOnLoginNever disables identity updates on login (default).
-            automatic UpdateIdentityOnLoginAutomatic  UpdateIdentityOnLoginAutomatic re-runs the Jsonnet claims mapper on every  OIDC login and updates the identity's traits and metadata automatically.
+            automatic UpdateIdentityOnLoginAutomatic  UpdateIdentityOnLoginAutomatic re-runs the Jsonnet claims mapper on every login and updates the identity's traits and metadata automatically.
           enum:
           - never
           - automatic
           type: string
           x-go-enum-desc: |-
             never UpdateIdentityOnLoginNever  UpdateIdentityOnLoginNever disables identity updates on login (default).
-            automatic UpdateIdentityOnLoginAutomatic  UpdateIdentityOnLoginAutomatic re-runs the Jsonnet claims mapper on every  OIDC login and updates the identity's traits and metadata automatically.
+            automatic UpdateIdentityOnLoginAutomatic  UpdateIdentityOnLoginAutomatic re-runs the Jsonnet claims mapper on every login and updates the identity's traits and metadata automatically.
         updated_at:
           description: Last Time Project's Revision was Updated
           format: date-time
@@ -28396,10 +28483,12 @@ components:
       properties:
         client_key_id:
           description: |-
-            Login with a DeviceAuthn Security Key.
+            ClientKeyID identifies the DeviceAuthn key to authenticate with.
 
-            This must contain the client ID of the DeviceAuthN key,
-            a.k.a 'key alias' on Android and 'key id' on iOS.
+            It is the key's deterministic fingerprint — the lowercase-hex SHA-256 of
+            the device public key in PKIX, ASN.1 DER (SubjectPublicKeyInfo) form —
+            which the device recomputes locally after enrollment. Keys enrolled before
+            the server derived the id use their original client-chosen value.
           type: string
         method:
           description: Method should be set to "deviceauthn" when logging in using
@@ -29090,9 +29179,6 @@ components:
             format: byte
             type: string
           type: array
-        client_key_id:
-          description: ClientKeyID is the key id/alias on the device.
-          type: string
         device_name:
           description: DeviceName is a human-readable name for the device e.g. 'My
             work phone'.
@@ -29104,13 +29190,16 @@ components:
           format: int64
           type: integer
       required:
-      - client_key_id
       - device_name
       type: object
     updateSettingsFlowWithDeviceAuthnMethodDelete:
       properties:
         client_key_id:
-          description: ClientKeyID is the key id/alias on the device.
+          description: |-
+            ClientKeyID is the deterministic fingerprint of the key to remove: the
+            lowercase-hex SHA-256 of the device public key in PKIX, ASN.1 DER
+            (SubjectPublicKeyInfo) form. Keys enrolled before the server derived the
+            id use their original client-chosen value.
           type: string
       required:
       - client_key_id

build.gradle

@@ -4,7 +4,7 @@ apply plugin: 'java'
 apply plugin: 'com.diffplug.spotless'
 
 group = 'sh.ory'
-version = 'v1.22.59'
+version = 'v1.22.60'
 
 buildscript {
     repositories {

build.sbt

@@ -2,7 +2,7 @@ lazy val root = (project in file(".")).
   settings(
     organization := "sh.ory",
     name := "client",
-    version := "v1.22.59",
+    version := "v1.22.60",
     scalaVersion := "2.11.4",
     scalacOptions ++= Seq("-feature"),
     javacOptions in compile ++= Seq("-Xlint:deprecation"),