pffff

packages/client-ts/src/apis/AdminApi.ts

@@ -0,0 +1,900 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import type {
+    App,
+    FileList,
+    PatchedSettingsRequest,
+    Settings,
+    SettingsRequest,
+    SystemInfo,
+    UsageEnum,
+    UsedBy,
+    Version,
+    VersionHistory,
+} from "../models/index";
+import {
+    AppFromJSON,
+    FileListFromJSON,
+    PatchedSettingsRequestToJSON,
+    SettingsFromJSON,
+    SettingsRequestToJSON,
+    SystemInfoFromJSON,
+    UsedByFromJSON,
+    VersionFromJSON,
+    VersionHistoryFromJSON,
+} from "../models/index";
+import * as runtime from "../runtime";
+
+export interface AdminFileCreateRequest {
+    file: Blob;
+    name?: string;
+    usage?: string;
+}
+
+export interface AdminFileDestroyRequest {
+    name?: string;
+    usage?: UsageEnum;
+}
+
+export interface AdminFileListRequest {
+    manageableOnly?: boolean;
+    search?: string;
+    usage?: UsageEnum;
+}
+
+export interface AdminFileUsedByListRequest {
+    name?: string;
+}
+
+export interface AdminSettingsPartialUpdateRequest {
+    patchedSettingsRequest?: PatchedSettingsRequest;
+}
+
+export interface AdminSettingsUpdateRequest {
+    settingsRequest: SettingsRequest;
+}
+
+export interface AdminVersionHistoryListRequest {
+    build?: string;
+    ordering?: string;
+    search?: string;
+    version?: string;
+}
+
+export interface AdminVersionHistoryRetrieveRequest {
+    id: number;
+}
+
+/**
+ *
+ */
+export class AdminApi extends runtime.BaseAPI {
+    /**
+     * Creates request options for adminAppsList without sending the request
+     */
+    async adminAppsListRequestOpts(): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/admin/apps/`;
+
+        return {
+            path: urlPath,
+            method: "GET",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Read-only view list all installed apps
+     */
+    async adminAppsListRaw(
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<Array<App>>> {
+        const requestOptions = await this.adminAppsListRequestOpts();
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => jsonValue.map(AppFromJSON));
+    }
+
+    /**
+     * Read-only view list all installed apps
+     */
+    async adminAppsList(
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<Array<App>> {
+        const response = await this.adminAppsListRaw(initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for adminFileCreate without sending the request
+     */
+    async adminFileCreateRequestOpts(
+        requestParameters: AdminFileCreateRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["file"] == null) {
+            throw new runtime.RequiredError(
+                "file",
+                'Required parameter "file" was null or undefined when calling adminFileCreate().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+        const consumes: runtime.Consume[] = [{ contentType: "multipart/form-data" }];
+        // @ts-ignore: canConsumeForm may be unused
+        const canConsumeForm = runtime.canConsumeForm(consumes);
+
+        let formParams: { append(param: string, value: any): any };
+        let useForm = false;
+        // use FormData to transmit files using content-type "multipart/form-data"
+        useForm = canConsumeForm;
+        if (useForm) {
+            formParams = new FormData();
+        } else {
+            formParams = new URLSearchParams();
+        }
+
+        if (requestParameters["file"] != null) {
+            formParams.append("file", requestParameters["file"] as any);
+        }
+
+        if (requestParameters["name"] != null) {
+            formParams.append("name", requestParameters["name"] as any);
+        }
+
+        if (requestParameters["usage"] != null) {
+            formParams.append("usage", requestParameters["usage"] as any);
+        }
+
+        let urlPath = `/admin/file/`;
+
+        return {
+            path: urlPath,
+            method: "POST",
+            headers: headerParameters,
+            query: queryParameters,
+            body: formParams,
+        };
+    }
+
+    /**
+     * Upload file to storage backend.
+     */
+    async adminFileCreateRaw(
+        requestParameters: AdminFileCreateRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<void>> {
+        const requestOptions = await this.adminFileCreateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.VoidApiResponse(response);
+    }
+
+    /**
+     * Upload file to storage backend.
+     */
+    async adminFileCreate(
+        requestParameters: AdminFileCreateRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<void> {
+        await this.adminFileCreateRaw(requestParameters, initOverrides);
+    }
+
+    /**
+     * Creates request options for adminFileDestroy without sending the request
+     */
+    async adminFileDestroyRequestOpts(
+        requestParameters: AdminFileDestroyRequest,
+    ): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        if (requestParameters["name"] != null) {
+            queryParameters["name"] = requestParameters["name"];
+        }
+
+        if (requestParameters["usage"] != null) {
+            queryParameters["usage"] = requestParameters["usage"];
+        }
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/admin/file/`;
+
+        return {
+            path: urlPath,
+            method: "DELETE",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Delete file from storage backend.
+     */
+    async adminFileDestroyRaw(
+        requestParameters: AdminFileDestroyRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<void>> {
+        const requestOptions = await this.adminFileDestroyRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.VoidApiResponse(response);
+    }
+
+    /**
+     * Delete file from storage backend.
+     */
+    async adminFileDestroy(
+        requestParameters: AdminFileDestroyRequest = {},
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<void> {
+        await this.adminFileDestroyRaw(requestParameters, initOverrides);
+    }
+
+    /**
+     * Creates request options for adminFileList without sending the request
+     */
+    async adminFileListRequestOpts(
+        requestParameters: AdminFileListRequest,
+    ): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        if (requestParameters["manageableOnly"] != null) {
+            queryParameters["manageable_only"] = requestParameters["manageableOnly"];
+        }
+
+        if (requestParameters["search"] != null) {
+            queryParameters["search"] = requestParameters["search"];
+        }
+
+        if (requestParameters["usage"] != null) {
+            queryParameters["usage"] = requestParameters["usage"];
+        }
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/admin/file/`;
+
+        return {
+            path: urlPath,
+            method: "GET",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * List files from storage backend.
+     */
+    async adminFileListRaw(
+        requestParameters: AdminFileListRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<Array<FileList>>> {
+        const requestOptions = await this.adminFileListRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) =>
+            jsonValue.map(FileListFromJSON),
+        );
+    }
+
+    /**
+     * List files from storage backend.
+     */
+    async adminFileList(
+        requestParameters: AdminFileListRequest = {},
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<Array<FileList>> {
+        const response = await this.adminFileListRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for adminFileUsedByList without sending the request
+     */
+    async adminFileUsedByListRequestOpts(
+        requestParameters: AdminFileUsedByListRequest,
+    ): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        if (requestParameters["name"] != null) {
+            queryParameters["name"] = requestParameters["name"];
+        }
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/admin/file/used_by/`;
+
+        return {
+            path: urlPath,
+            method: "GET",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     */
+    async adminFileUsedByListRaw(
+        requestParameters: AdminFileUsedByListRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<Array<UsedBy>>> {
+        const requestOptions = await this.adminFileUsedByListRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => jsonValue.map(UsedByFromJSON));
+    }
+
+    /**
+     */
+    async adminFileUsedByList(
+        requestParameters: AdminFileUsedByListRequest = {},
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<Array<UsedBy>> {
+        const response = await this.adminFileUsedByListRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for adminModelsList without sending the request
+     */
+    async adminModelsListRequestOpts(): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/admin/models/`;
+
+        return {
+            path: urlPath,
+            method: "GET",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Read-only view list all installed models
+     */
+    async adminModelsListRaw(
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<Array<App>>> {
+        const requestOptions = await this.adminModelsListRequestOpts();
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => jsonValue.map(AppFromJSON));
+    }
+
+    /**
+     * Read-only view list all installed models
+     */
+    async adminModelsList(
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<Array<App>> {
+        const response = await this.adminModelsListRaw(initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for adminSettingsPartialUpdate without sending the request
+     */
+    async adminSettingsPartialUpdateRequestOpts(
+        requestParameters: AdminSettingsPartialUpdateRequest,
+    ): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters["Content-Type"] = "application/json";
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/admin/settings/`;
+
+        return {
+            path: urlPath,
+            method: "PATCH",
+            headers: headerParameters,
+            query: queryParameters,
+            body: PatchedSettingsRequestToJSON(requestParameters["patchedSettingsRequest"]),
+        };
+    }
+
+    /**
+     * Settings view
+     */
+    async adminSettingsPartialUpdateRaw(
+        requestParameters: AdminSettingsPartialUpdateRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<Settings>> {
+        const requestOptions = await this.adminSettingsPartialUpdateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => SettingsFromJSON(jsonValue));
+    }
+
+    /**
+     * Settings view
+     */
+    async adminSettingsPartialUpdate(
+        requestParameters: AdminSettingsPartialUpdateRequest = {},
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<Settings> {
+        const response = await this.adminSettingsPartialUpdateRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for adminSettingsRetrieve without sending the request
+     */
+    async adminSettingsRetrieveRequestOpts(): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/admin/settings/`;
+
+        return {
+            path: urlPath,
+            method: "GET",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Settings view
+     */
+    async adminSettingsRetrieveRaw(
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<Settings>> {
+        const requestOptions = await this.adminSettingsRetrieveRequestOpts();
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => SettingsFromJSON(jsonValue));
+    }
+
+    /**
+     * Settings view
+     */
+    async adminSettingsRetrieve(
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<Settings> {
+        const response = await this.adminSettingsRetrieveRaw(initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for adminSettingsUpdate without sending the request
+     */
+    async adminSettingsUpdateRequestOpts(
+        requestParameters: AdminSettingsUpdateRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["settingsRequest"] == null) {
+            throw new runtime.RequiredError(
+                "settingsRequest",
+                'Required parameter "settingsRequest" was null or undefined when calling adminSettingsUpdate().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters["Content-Type"] = "application/json";
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/admin/settings/`;
+
+        return {
+            path: urlPath,
+            method: "PUT",
+            headers: headerParameters,
+            query: queryParameters,
+            body: SettingsRequestToJSON(requestParameters["settingsRequest"]),
+        };
+    }
+
+    /**
+     * Settings view
+     */
+    async adminSettingsUpdateRaw(
+        requestParameters: AdminSettingsUpdateRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<Settings>> {
+        const requestOptions = await this.adminSettingsUpdateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => SettingsFromJSON(jsonValue));
+    }
+
+    /**
+     * Settings view
+     */
+    async adminSettingsUpdate(
+        requestParameters: AdminSettingsUpdateRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<Settings> {
+        const response = await this.adminSettingsUpdateRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for adminSystemCreate without sending the request
+     */
+    async adminSystemCreateRequestOpts(): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/admin/system/`;
+
+        return {
+            path: urlPath,
+            method: "POST",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Get system information.
+     */
+    async adminSystemCreateRaw(
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<SystemInfo>> {
+        const requestOptions = await this.adminSystemCreateRequestOpts();
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => SystemInfoFromJSON(jsonValue));
+    }
+
+    /**
+     * Get system information.
+     */
+    async adminSystemCreate(
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<SystemInfo> {
+        const response = await this.adminSystemCreateRaw(initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for adminSystemRetrieve without sending the request
+     */
+    async adminSystemRetrieveRequestOpts(): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/admin/system/`;
+
+        return {
+            path: urlPath,
+            method: "GET",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Get system information.
+     */
+    async adminSystemRetrieveRaw(
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<SystemInfo>> {
+        const requestOptions = await this.adminSystemRetrieveRequestOpts();
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => SystemInfoFromJSON(jsonValue));
+    }
+
+    /**
+     * Get system information.
+     */
+    async adminSystemRetrieve(
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<SystemInfo> {
+        const response = await this.adminSystemRetrieveRaw(initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for adminVersionHistoryList without sending the request
+     */
+    async adminVersionHistoryListRequestOpts(
+        requestParameters: AdminVersionHistoryListRequest,
+    ): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        if (requestParameters["build"] != null) {
+            queryParameters["build"] = requestParameters["build"];
+        }
+
+        if (requestParameters["ordering"] != null) {
+            queryParameters["ordering"] = requestParameters["ordering"];
+        }
+
+        if (requestParameters["search"] != null) {
+            queryParameters["search"] = requestParameters["search"];
+        }
+
+        if (requestParameters["version"] != null) {
+            queryParameters["version"] = requestParameters["version"];
+        }
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/admin/version/history/`;
+
+        return {
+            path: urlPath,
+            method: "GET",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * VersionHistory Viewset
+     */
+    async adminVersionHistoryListRaw(
+        requestParameters: AdminVersionHistoryListRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<Array<VersionHistory>>> {
+        const requestOptions = await this.adminVersionHistoryListRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) =>
+            jsonValue.map(VersionHistoryFromJSON),
+        );
+    }
+
+    /**
+     * VersionHistory Viewset
+     */
+    async adminVersionHistoryList(
+        requestParameters: AdminVersionHistoryListRequest = {},
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<Array<VersionHistory>> {
+        const response = await this.adminVersionHistoryListRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for adminVersionHistoryRetrieve without sending the request
+     */
+    async adminVersionHistoryRetrieveRequestOpts(
+        requestParameters: AdminVersionHistoryRetrieveRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["id"] == null) {
+            throw new runtime.RequiredError(
+                "id",
+                'Required parameter "id" was null or undefined when calling adminVersionHistoryRetrieve().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/admin/version/history/{id}/`;
+        urlPath = urlPath.replace(`{${"id"}}`, encodeURIComponent(String(requestParameters["id"])));
+
+        return {
+            path: urlPath,
+            method: "GET",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * VersionHistory Viewset
+     */
+    async adminVersionHistoryRetrieveRaw(
+        requestParameters: AdminVersionHistoryRetrieveRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<VersionHistory>> {
+        const requestOptions = await this.adminVersionHistoryRetrieveRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) =>
+            VersionHistoryFromJSON(jsonValue),
+        );
+    }
+
+    /**
+     * VersionHistory Viewset
+     */
+    async adminVersionHistoryRetrieve(
+        requestParameters: AdminVersionHistoryRetrieveRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<VersionHistory> {
+        const response = await this.adminVersionHistoryRetrieveRaw(
+            requestParameters,
+            initOverrides,
+        );
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for adminVersionRetrieve without sending the request
+     */
+    async adminVersionRetrieveRequestOpts(): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/admin/version/`;
+
+        return {
+            path: urlPath,
+            method: "GET",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Get running and latest version.
+     */
+    async adminVersionRetrieveRaw(
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<Version>> {
+        const requestOptions = await this.adminVersionRetrieveRequestOpts();
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => VersionFromJSON(jsonValue));
+    }
+
+    /**
+     * Get running and latest version.
+     */
+    async adminVersionRetrieve(
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<Version> {
+        const response = await this.adminVersionRetrieveRaw(initOverrides);
+        return await response.value();
+    }
+}

packages/client-ts/src/apis/CryptoApi.ts

@@ -0,0 +1,830 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import type {
+    CertificateData,
+    CertificateGenerationRequest,
+    CertificateKeyPair,
+    CertificateKeyPairRequest,
+    KeyTypeEnum,
+    PaginatedCertificateKeyPairList,
+    PatchedCertificateKeyPairRequest,
+    UsedBy,
+} from "../models/index";
+import {
+    CertificateDataFromJSON,
+    CertificateGenerationRequestToJSON,
+    CertificateKeyPairFromJSON,
+    CertificateKeyPairRequestToJSON,
+    PaginatedCertificateKeyPairListFromJSON,
+    PatchedCertificateKeyPairRequestToJSON,
+    UsedByFromJSON,
+} from "../models/index";
+import * as runtime from "../runtime";
+
+export interface CryptoCertificatekeypairsCreateRequest {
+    certificateKeyPairRequest: CertificateKeyPairRequest;
+}
+
+export interface CryptoCertificatekeypairsDestroyRequest {
+    kpUuid: string;
+}
+
+export interface CryptoCertificatekeypairsGenerateCreateRequest {
+    certificateGenerationRequest: CertificateGenerationRequest;
+}
+
+export interface CryptoCertificatekeypairsListRequest {
+    hasKey?: boolean;
+    keyType?: Array<KeyTypeEnum>;
+    managed?: string;
+    name?: string;
+    ordering?: string;
+    page?: number;
+    pageSize?: number;
+    search?: string;
+}
+
+export interface CryptoCertificatekeypairsPartialUpdateRequest {
+    kpUuid: string;
+    patchedCertificateKeyPairRequest?: PatchedCertificateKeyPairRequest;
+}
+
+export interface CryptoCertificatekeypairsRetrieveRequest {
+    kpUuid: string;
+}
+
+export interface CryptoCertificatekeypairsUpdateRequest {
+    kpUuid: string;
+    certificateKeyPairRequest: CertificateKeyPairRequest;
+}
+
+export interface CryptoCertificatekeypairsUsedByListRequest {
+    kpUuid: string;
+}
+
+export interface CryptoCertificatekeypairsViewCertificateRetrieveRequest {
+    kpUuid: string;
+    download?: boolean;
+}
+
+export interface CryptoCertificatekeypairsViewPrivateKeyRetrieveRequest {
+    kpUuid: string;
+    download?: boolean;
+}
+
+/**
+ *
+ */
+export class CryptoApi extends runtime.BaseAPI {
+    /**
+     * Creates request options for cryptoCertificatekeypairsCreate without sending the request
+     */
+    async cryptoCertificatekeypairsCreateRequestOpts(
+        requestParameters: CryptoCertificatekeypairsCreateRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["certificateKeyPairRequest"] == null) {
+            throw new runtime.RequiredError(
+                "certificateKeyPairRequest",
+                'Required parameter "certificateKeyPairRequest" was null or undefined when calling cryptoCertificatekeypairsCreate().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters["Content-Type"] = "application/json";
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/crypto/certificatekeypairs/`;
+
+        return {
+            path: urlPath,
+            method: "POST",
+            headers: headerParameters,
+            query: queryParameters,
+            body: CertificateKeyPairRequestToJSON(requestParameters["certificateKeyPairRequest"]),
+        };
+    }
+
+    /**
+     * CertificateKeyPair Viewset
+     */
+    async cryptoCertificatekeypairsCreateRaw(
+        requestParameters: CryptoCertificatekeypairsCreateRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<CertificateKeyPair>> {
+        const requestOptions =
+            await this.cryptoCertificatekeypairsCreateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) =>
+            CertificateKeyPairFromJSON(jsonValue),
+        );
+    }
+
+    /**
+     * CertificateKeyPair Viewset
+     */
+    async cryptoCertificatekeypairsCreate(
+        requestParameters: CryptoCertificatekeypairsCreateRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<CertificateKeyPair> {
+        const response = await this.cryptoCertificatekeypairsCreateRaw(
+            requestParameters,
+            initOverrides,
+        );
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for cryptoCertificatekeypairsDestroy without sending the request
+     */
+    async cryptoCertificatekeypairsDestroyRequestOpts(
+        requestParameters: CryptoCertificatekeypairsDestroyRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["kpUuid"] == null) {
+            throw new runtime.RequiredError(
+                "kpUuid",
+                'Required parameter "kpUuid" was null or undefined when calling cryptoCertificatekeypairsDestroy().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/crypto/certificatekeypairs/{kp_uuid}/`;
+        urlPath = urlPath.replace(
+            `{${"kp_uuid"}}`,
+            encodeURIComponent(String(requestParameters["kpUuid"])),
+        );
+
+        return {
+            path: urlPath,
+            method: "DELETE",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * CertificateKeyPair Viewset
+     */
+    async cryptoCertificatekeypairsDestroyRaw(
+        requestParameters: CryptoCertificatekeypairsDestroyRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<void>> {
+        const requestOptions =
+            await this.cryptoCertificatekeypairsDestroyRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.VoidApiResponse(response);
+    }
+
+    /**
+     * CertificateKeyPair Viewset
+     */
+    async cryptoCertificatekeypairsDestroy(
+        requestParameters: CryptoCertificatekeypairsDestroyRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<void> {
+        await this.cryptoCertificatekeypairsDestroyRaw(requestParameters, initOverrides);
+    }
+
+    /**
+     * Creates request options for cryptoCertificatekeypairsGenerateCreate without sending the request
+     */
+    async cryptoCertificatekeypairsGenerateCreateRequestOpts(
+        requestParameters: CryptoCertificatekeypairsGenerateCreateRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["certificateGenerationRequest"] == null) {
+            throw new runtime.RequiredError(
+                "certificateGenerationRequest",
+                'Required parameter "certificateGenerationRequest" was null or undefined when calling cryptoCertificatekeypairsGenerateCreate().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters["Content-Type"] = "application/json";
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/crypto/certificatekeypairs/generate/`;
+
+        return {
+            path: urlPath,
+            method: "POST",
+            headers: headerParameters,
+            query: queryParameters,
+            body: CertificateGenerationRequestToJSON(
+                requestParameters["certificateGenerationRequest"],
+            ),
+        };
+    }
+
+    /**
+     * Generate a new, self-signed certificate-key pair
+     */
+    async cryptoCertificatekeypairsGenerateCreateRaw(
+        requestParameters: CryptoCertificatekeypairsGenerateCreateRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<CertificateKeyPair>> {
+        const requestOptions =
+            await this.cryptoCertificatekeypairsGenerateCreateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) =>
+            CertificateKeyPairFromJSON(jsonValue),
+        );
+    }
+
+    /**
+     * Generate a new, self-signed certificate-key pair
+     */
+    async cryptoCertificatekeypairsGenerateCreate(
+        requestParameters: CryptoCertificatekeypairsGenerateCreateRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<CertificateKeyPair> {
+        const response = await this.cryptoCertificatekeypairsGenerateCreateRaw(
+            requestParameters,
+            initOverrides,
+        );
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for cryptoCertificatekeypairsList without sending the request
+     */
+    async cryptoCertificatekeypairsListRequestOpts(
+        requestParameters: CryptoCertificatekeypairsListRequest,
+    ): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        if (requestParameters["hasKey"] != null) {
+            queryParameters["has_key"] = requestParameters["hasKey"];
+        }
+
+        if (requestParameters["keyType"] != null) {
+            queryParameters["key_type"] = requestParameters["keyType"];
+        }
+
+        if (requestParameters["managed"] != null) {
+            queryParameters["managed"] = requestParameters["managed"];
+        }
+
+        if (requestParameters["name"] != null) {
+            queryParameters["name"] = requestParameters["name"];
+        }
+
+        if (requestParameters["ordering"] != null) {
+            queryParameters["ordering"] = requestParameters["ordering"];
+        }
+
+        if (requestParameters["page"] != null) {
+            queryParameters["page"] = requestParameters["page"];
+        }
+
+        if (requestParameters["pageSize"] != null) {
+            queryParameters["page_size"] = requestParameters["pageSize"];
+        }
+
+        if (requestParameters["search"] != null) {
+            queryParameters["search"] = requestParameters["search"];
+        }
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/crypto/certificatekeypairs/`;
+
+        return {
+            path: urlPath,
+            method: "GET",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * CertificateKeyPair Viewset
+     */
+    async cryptoCertificatekeypairsListRaw(
+        requestParameters: CryptoCertificatekeypairsListRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<PaginatedCertificateKeyPairList>> {
+        const requestOptions =
+            await this.cryptoCertificatekeypairsListRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) =>
+            PaginatedCertificateKeyPairListFromJSON(jsonValue),
+        );
+    }
+
+    /**
+     * CertificateKeyPair Viewset
+     */
+    async cryptoCertificatekeypairsList(
+        requestParameters: CryptoCertificatekeypairsListRequest = {},
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<PaginatedCertificateKeyPairList> {
+        const response = await this.cryptoCertificatekeypairsListRaw(
+            requestParameters,
+            initOverrides,
+        );
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for cryptoCertificatekeypairsPartialUpdate without sending the request
+     */
+    async cryptoCertificatekeypairsPartialUpdateRequestOpts(
+        requestParameters: CryptoCertificatekeypairsPartialUpdateRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["kpUuid"] == null) {
+            throw new runtime.RequiredError(
+                "kpUuid",
+                'Required parameter "kpUuid" was null or undefined when calling cryptoCertificatekeypairsPartialUpdate().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters["Content-Type"] = "application/json";
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/crypto/certificatekeypairs/{kp_uuid}/`;
+        urlPath = urlPath.replace(
+            `{${"kp_uuid"}}`,
+            encodeURIComponent(String(requestParameters["kpUuid"])),
+        );
+
+        return {
+            path: urlPath,
+            method: "PATCH",
+            headers: headerParameters,
+            query: queryParameters,
+            body: PatchedCertificateKeyPairRequestToJSON(
+                requestParameters["patchedCertificateKeyPairRequest"],
+            ),
+        };
+    }
+
+    /**
+     * CertificateKeyPair Viewset
+     */
+    async cryptoCertificatekeypairsPartialUpdateRaw(
+        requestParameters: CryptoCertificatekeypairsPartialUpdateRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<CertificateKeyPair>> {
+        const requestOptions =
+            await this.cryptoCertificatekeypairsPartialUpdateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) =>
+            CertificateKeyPairFromJSON(jsonValue),
+        );
+    }
+
+    /**
+     * CertificateKeyPair Viewset
+     */
+    async cryptoCertificatekeypairsPartialUpdate(
+        requestParameters: CryptoCertificatekeypairsPartialUpdateRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<CertificateKeyPair> {
+        const response = await this.cryptoCertificatekeypairsPartialUpdateRaw(
+            requestParameters,
+            initOverrides,
+        );
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for cryptoCertificatekeypairsRetrieve without sending the request
+     */
+    async cryptoCertificatekeypairsRetrieveRequestOpts(
+        requestParameters: CryptoCertificatekeypairsRetrieveRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["kpUuid"] == null) {
+            throw new runtime.RequiredError(
+                "kpUuid",
+                'Required parameter "kpUuid" was null or undefined when calling cryptoCertificatekeypairsRetrieve().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/crypto/certificatekeypairs/{kp_uuid}/`;
+        urlPath = urlPath.replace(
+            `{${"kp_uuid"}}`,
+            encodeURIComponent(String(requestParameters["kpUuid"])),
+        );
+
+        return {
+            path: urlPath,
+            method: "GET",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * CertificateKeyPair Viewset
+     */
+    async cryptoCertificatekeypairsRetrieveRaw(
+        requestParameters: CryptoCertificatekeypairsRetrieveRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<CertificateKeyPair>> {
+        const requestOptions =
+            await this.cryptoCertificatekeypairsRetrieveRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) =>
+            CertificateKeyPairFromJSON(jsonValue),
+        );
+    }
+
+    /**
+     * CertificateKeyPair Viewset
+     */
+    async cryptoCertificatekeypairsRetrieve(
+        requestParameters: CryptoCertificatekeypairsRetrieveRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<CertificateKeyPair> {
+        const response = await this.cryptoCertificatekeypairsRetrieveRaw(
+            requestParameters,
+            initOverrides,
+        );
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for cryptoCertificatekeypairsUpdate without sending the request
+     */
+    async cryptoCertificatekeypairsUpdateRequestOpts(
+        requestParameters: CryptoCertificatekeypairsUpdateRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["kpUuid"] == null) {
+            throw new runtime.RequiredError(
+                "kpUuid",
+                'Required parameter "kpUuid" was null or undefined when calling cryptoCertificatekeypairsUpdate().',
+            );
+        }
+
+        if (requestParameters["certificateKeyPairRequest"] == null) {
+            throw new runtime.RequiredError(
+                "certificateKeyPairRequest",
+                'Required parameter "certificateKeyPairRequest" was null or undefined when calling cryptoCertificatekeypairsUpdate().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters["Content-Type"] = "application/json";
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/crypto/certificatekeypairs/{kp_uuid}/`;
+        urlPath = urlPath.replace(
+            `{${"kp_uuid"}}`,
+            encodeURIComponent(String(requestParameters["kpUuid"])),
+        );
+
+        return {
+            path: urlPath,
+            method: "PUT",
+            headers: headerParameters,
+            query: queryParameters,
+            body: CertificateKeyPairRequestToJSON(requestParameters["certificateKeyPairRequest"]),
+        };
+    }
+
+    /**
+     * CertificateKeyPair Viewset
+     */
+    async cryptoCertificatekeypairsUpdateRaw(
+        requestParameters: CryptoCertificatekeypairsUpdateRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<CertificateKeyPair>> {
+        const requestOptions =
+            await this.cryptoCertificatekeypairsUpdateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) =>
+            CertificateKeyPairFromJSON(jsonValue),
+        );
+    }
+
+    /**
+     * CertificateKeyPair Viewset
+     */
+    async cryptoCertificatekeypairsUpdate(
+        requestParameters: CryptoCertificatekeypairsUpdateRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<CertificateKeyPair> {
+        const response = await this.cryptoCertificatekeypairsUpdateRaw(
+            requestParameters,
+            initOverrides,
+        );
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for cryptoCertificatekeypairsUsedByList without sending the request
+     */
+    async cryptoCertificatekeypairsUsedByListRequestOpts(
+        requestParameters: CryptoCertificatekeypairsUsedByListRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["kpUuid"] == null) {
+            throw new runtime.RequiredError(
+                "kpUuid",
+                'Required parameter "kpUuid" was null or undefined when calling cryptoCertificatekeypairsUsedByList().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/crypto/certificatekeypairs/{kp_uuid}/used_by/`;
+        urlPath = urlPath.replace(
+            `{${"kp_uuid"}}`,
+            encodeURIComponent(String(requestParameters["kpUuid"])),
+        );
+
+        return {
+            path: urlPath,
+            method: "GET",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Get a list of all objects that use this object
+     */
+    async cryptoCertificatekeypairsUsedByListRaw(
+        requestParameters: CryptoCertificatekeypairsUsedByListRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<Array<UsedBy>>> {
+        const requestOptions =
+            await this.cryptoCertificatekeypairsUsedByListRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => jsonValue.map(UsedByFromJSON));
+    }
+
+    /**
+     * Get a list of all objects that use this object
+     */
+    async cryptoCertificatekeypairsUsedByList(
+        requestParameters: CryptoCertificatekeypairsUsedByListRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<Array<UsedBy>> {
+        const response = await this.cryptoCertificatekeypairsUsedByListRaw(
+            requestParameters,
+            initOverrides,
+        );
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for cryptoCertificatekeypairsViewCertificateRetrieve without sending the request
+     */
+    async cryptoCertificatekeypairsViewCertificateRetrieveRequestOpts(
+        requestParameters: CryptoCertificatekeypairsViewCertificateRetrieveRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["kpUuid"] == null) {
+            throw new runtime.RequiredError(
+                "kpUuid",
+                'Required parameter "kpUuid" was null or undefined when calling cryptoCertificatekeypairsViewCertificateRetrieve().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        if (requestParameters["download"] != null) {
+            queryParameters["download"] = requestParameters["download"];
+        }
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/crypto/certificatekeypairs/{kp_uuid}/view_certificate/`;
+        urlPath = urlPath.replace(
+            `{${"kp_uuid"}}`,
+            encodeURIComponent(String(requestParameters["kpUuid"])),
+        );
+
+        return {
+            path: urlPath,
+            method: "GET",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Return certificate-key pairs certificate and log access
+     */
+    async cryptoCertificatekeypairsViewCertificateRetrieveRaw(
+        requestParameters: CryptoCertificatekeypairsViewCertificateRetrieveRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<CertificateData>> {
+        const requestOptions =
+            await this.cryptoCertificatekeypairsViewCertificateRetrieveRequestOpts(
+                requestParameters,
+            );
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) =>
+            CertificateDataFromJSON(jsonValue),
+        );
+    }
+
+    /**
+     * Return certificate-key pairs certificate and log access
+     */
+    async cryptoCertificatekeypairsViewCertificateRetrieve(
+        requestParameters: CryptoCertificatekeypairsViewCertificateRetrieveRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<CertificateData> {
+        const response = await this.cryptoCertificatekeypairsViewCertificateRetrieveRaw(
+            requestParameters,
+            initOverrides,
+        );
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for cryptoCertificatekeypairsViewPrivateKeyRetrieve without sending the request
+     */
+    async cryptoCertificatekeypairsViewPrivateKeyRetrieveRequestOpts(
+        requestParameters: CryptoCertificatekeypairsViewPrivateKeyRetrieveRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["kpUuid"] == null) {
+            throw new runtime.RequiredError(
+                "kpUuid",
+                'Required parameter "kpUuid" was null or undefined when calling cryptoCertificatekeypairsViewPrivateKeyRetrieve().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        if (requestParameters["download"] != null) {
+            queryParameters["download"] = requestParameters["download"];
+        }
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/crypto/certificatekeypairs/{kp_uuid}/view_private_key/`;
+        urlPath = urlPath.replace(
+            `{${"kp_uuid"}}`,
+            encodeURIComponent(String(requestParameters["kpUuid"])),
+        );
+
+        return {
+            path: urlPath,
+            method: "GET",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Return certificate-key pairs private key and log access
+     */
+    async cryptoCertificatekeypairsViewPrivateKeyRetrieveRaw(
+        requestParameters: CryptoCertificatekeypairsViewPrivateKeyRetrieveRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<CertificateData>> {
+        const requestOptions =
+            await this.cryptoCertificatekeypairsViewPrivateKeyRetrieveRequestOpts(
+                requestParameters,
+            );
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) =>
+            CertificateDataFromJSON(jsonValue),
+        );
+    }
+
+    /**
+     * Return certificate-key pairs private key and log access
+     */
+    async cryptoCertificatekeypairsViewPrivateKeyRetrieve(
+        requestParameters: CryptoCertificatekeypairsViewPrivateKeyRetrieveRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<CertificateData> {
+        const response = await this.cryptoCertificatekeypairsViewPrivateKeyRetrieveRaw(
+            requestParameters,
+            initOverrides,
+        );
+        return await response.value();
+    }
+}

packages/client-ts/src/apis/EnterpriseApi.ts

@@ -0,0 +1,718 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import type {
+    InstallID,
+    License,
+    LicenseForecast,
+    LicenseRequest,
+    LicenseSummary,
+    PaginatedLicenseList,
+    PatchedLicenseRequest,
+    UsedBy,
+} from "../models/index";
+import {
+    InstallIDFromJSON,
+    LicenseForecastFromJSON,
+    LicenseFromJSON,
+    LicenseRequestToJSON,
+    LicenseSummaryFromJSON,
+    PaginatedLicenseListFromJSON,
+    PatchedLicenseRequestToJSON,
+    UsedByFromJSON,
+} from "../models/index";
+import * as runtime from "../runtime";
+
+export interface EnterpriseLicenseCreateRequest {
+    licenseRequest: LicenseRequest;
+}
+
+export interface EnterpriseLicenseDestroyRequest {
+    licenseUuid: string;
+}
+
+export interface EnterpriseLicenseListRequest {
+    name?: string;
+    ordering?: string;
+    page?: number;
+    pageSize?: number;
+    search?: string;
+}
+
+export interface EnterpriseLicensePartialUpdateRequest {
+    licenseUuid: string;
+    patchedLicenseRequest?: PatchedLicenseRequest;
+}
+
+export interface EnterpriseLicenseRetrieveRequest {
+    licenseUuid: string;
+}
+
+export interface EnterpriseLicenseSummaryRetrieveRequest {
+    cached?: boolean;
+}
+
+export interface EnterpriseLicenseUpdateRequest {
+    licenseUuid: string;
+    licenseRequest: LicenseRequest;
+}
+
+export interface EnterpriseLicenseUsedByListRequest {
+    licenseUuid: string;
+}
+
+/**
+ *
+ */
+export class EnterpriseApi extends runtime.BaseAPI {
+    /**
+     * Creates request options for enterpriseLicenseCreate without sending the request
+     */
+    async enterpriseLicenseCreateRequestOpts(
+        requestParameters: EnterpriseLicenseCreateRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["licenseRequest"] == null) {
+            throw new runtime.RequiredError(
+                "licenseRequest",
+                'Required parameter "licenseRequest" was null or undefined when calling enterpriseLicenseCreate().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters["Content-Type"] = "application/json";
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/enterprise/license/`;
+
+        return {
+            path: urlPath,
+            method: "POST",
+            headers: headerParameters,
+            query: queryParameters,
+            body: LicenseRequestToJSON(requestParameters["licenseRequest"]),
+        };
+    }
+
+    /**
+     * License Viewset
+     */
+    async enterpriseLicenseCreateRaw(
+        requestParameters: EnterpriseLicenseCreateRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<License>> {
+        const requestOptions = await this.enterpriseLicenseCreateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => LicenseFromJSON(jsonValue));
+    }
+
+    /**
+     * License Viewset
+     */
+    async enterpriseLicenseCreate(
+        requestParameters: EnterpriseLicenseCreateRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<License> {
+        const response = await this.enterpriseLicenseCreateRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for enterpriseLicenseDestroy without sending the request
+     */
+    async enterpriseLicenseDestroyRequestOpts(
+        requestParameters: EnterpriseLicenseDestroyRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["licenseUuid"] == null) {
+            throw new runtime.RequiredError(
+                "licenseUuid",
+                'Required parameter "licenseUuid" was null or undefined when calling enterpriseLicenseDestroy().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/enterprise/license/{license_uuid}/`;
+        urlPath = urlPath.replace(
+            `{${"license_uuid"}}`,
+            encodeURIComponent(String(requestParameters["licenseUuid"])),
+        );
+
+        return {
+            path: urlPath,
+            method: "DELETE",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * License Viewset
+     */
+    async enterpriseLicenseDestroyRaw(
+        requestParameters: EnterpriseLicenseDestroyRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<void>> {
+        const requestOptions = await this.enterpriseLicenseDestroyRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.VoidApiResponse(response);
+    }
+
+    /**
+     * License Viewset
+     */
+    async enterpriseLicenseDestroy(
+        requestParameters: EnterpriseLicenseDestroyRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<void> {
+        await this.enterpriseLicenseDestroyRaw(requestParameters, initOverrides);
+    }
+
+    /**
+     * Creates request options for enterpriseLicenseForecastRetrieve without sending the request
+     */
+    async enterpriseLicenseForecastRetrieveRequestOpts(): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/enterprise/license/forecast/`;
+
+        return {
+            path: urlPath,
+            method: "GET",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Forecast how many users will be required in a year
+     */
+    async enterpriseLicenseForecastRetrieveRaw(
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<LicenseForecast>> {
+        const requestOptions = await this.enterpriseLicenseForecastRetrieveRequestOpts();
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) =>
+            LicenseForecastFromJSON(jsonValue),
+        );
+    }
+
+    /**
+     * Forecast how many users will be required in a year
+     */
+    async enterpriseLicenseForecastRetrieve(
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<LicenseForecast> {
+        const response = await this.enterpriseLicenseForecastRetrieveRaw(initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for enterpriseLicenseInstallIdRetrieve without sending the request
+     */
+    async enterpriseLicenseInstallIdRetrieveRequestOpts(): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/enterprise/license/install_id/`;
+
+        return {
+            path: urlPath,
+            method: "GET",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Get install_id
+     */
+    async enterpriseLicenseInstallIdRetrieveRaw(
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<InstallID>> {
+        const requestOptions = await this.enterpriseLicenseInstallIdRetrieveRequestOpts();
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => InstallIDFromJSON(jsonValue));
+    }
+
+    /**
+     * Get install_id
+     */
+    async enterpriseLicenseInstallIdRetrieve(
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<InstallID> {
+        const response = await this.enterpriseLicenseInstallIdRetrieveRaw(initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for enterpriseLicenseList without sending the request
+     */
+    async enterpriseLicenseListRequestOpts(
+        requestParameters: EnterpriseLicenseListRequest,
+    ): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        if (requestParameters["name"] != null) {
+            queryParameters["name"] = requestParameters["name"];
+        }
+
+        if (requestParameters["ordering"] != null) {
+            queryParameters["ordering"] = requestParameters["ordering"];
+        }
+
+        if (requestParameters["page"] != null) {
+            queryParameters["page"] = requestParameters["page"];
+        }
+
+        if (requestParameters["pageSize"] != null) {
+            queryParameters["page_size"] = requestParameters["pageSize"];
+        }
+
+        if (requestParameters["search"] != null) {
+            queryParameters["search"] = requestParameters["search"];
+        }
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/enterprise/license/`;
+
+        return {
+            path: urlPath,
+            method: "GET",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * License Viewset
+     */
+    async enterpriseLicenseListRaw(
+        requestParameters: EnterpriseLicenseListRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<PaginatedLicenseList>> {
+        const requestOptions = await this.enterpriseLicenseListRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) =>
+            PaginatedLicenseListFromJSON(jsonValue),
+        );
+    }
+
+    /**
+     * License Viewset
+     */
+    async enterpriseLicenseList(
+        requestParameters: EnterpriseLicenseListRequest = {},
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<PaginatedLicenseList> {
+        const response = await this.enterpriseLicenseListRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for enterpriseLicensePartialUpdate without sending the request
+     */
+    async enterpriseLicensePartialUpdateRequestOpts(
+        requestParameters: EnterpriseLicensePartialUpdateRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["licenseUuid"] == null) {
+            throw new runtime.RequiredError(
+                "licenseUuid",
+                'Required parameter "licenseUuid" was null or undefined when calling enterpriseLicensePartialUpdate().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters["Content-Type"] = "application/json";
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/enterprise/license/{license_uuid}/`;
+        urlPath = urlPath.replace(
+            `{${"license_uuid"}}`,
+            encodeURIComponent(String(requestParameters["licenseUuid"])),
+        );
+
+        return {
+            path: urlPath,
+            method: "PATCH",
+            headers: headerParameters,
+            query: queryParameters,
+            body: PatchedLicenseRequestToJSON(requestParameters["patchedLicenseRequest"]),
+        };
+    }
+
+    /**
+     * License Viewset
+     */
+    async enterpriseLicensePartialUpdateRaw(
+        requestParameters: EnterpriseLicensePartialUpdateRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<License>> {
+        const requestOptions =
+            await this.enterpriseLicensePartialUpdateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => LicenseFromJSON(jsonValue));
+    }
+
+    /**
+     * License Viewset
+     */
+    async enterpriseLicensePartialUpdate(
+        requestParameters: EnterpriseLicensePartialUpdateRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<License> {
+        const response = await this.enterpriseLicensePartialUpdateRaw(
+            requestParameters,
+            initOverrides,
+        );
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for enterpriseLicenseRetrieve without sending the request
+     */
+    async enterpriseLicenseRetrieveRequestOpts(
+        requestParameters: EnterpriseLicenseRetrieveRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["licenseUuid"] == null) {
+            throw new runtime.RequiredError(
+                "licenseUuid",
+                'Required parameter "licenseUuid" was null or undefined when calling enterpriseLicenseRetrieve().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/enterprise/license/{license_uuid}/`;
+        urlPath = urlPath.replace(
+            `{${"license_uuid"}}`,
+            encodeURIComponent(String(requestParameters["licenseUuid"])),
+        );
+
+        return {
+            path: urlPath,
+            method: "GET",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * License Viewset
+     */
+    async enterpriseLicenseRetrieveRaw(
+        requestParameters: EnterpriseLicenseRetrieveRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<License>> {
+        const requestOptions = await this.enterpriseLicenseRetrieveRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => LicenseFromJSON(jsonValue));
+    }
+
+    /**
+     * License Viewset
+     */
+    async enterpriseLicenseRetrieve(
+        requestParameters: EnterpriseLicenseRetrieveRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<License> {
+        const response = await this.enterpriseLicenseRetrieveRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for enterpriseLicenseSummaryRetrieve without sending the request
+     */
+    async enterpriseLicenseSummaryRetrieveRequestOpts(
+        requestParameters: EnterpriseLicenseSummaryRetrieveRequest,
+    ): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        if (requestParameters["cached"] != null) {
+            queryParameters["cached"] = requestParameters["cached"];
+        }
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/enterprise/license/summary/`;
+
+        return {
+            path: urlPath,
+            method: "GET",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Get the total license status
+     */
+    async enterpriseLicenseSummaryRetrieveRaw(
+        requestParameters: EnterpriseLicenseSummaryRetrieveRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<LicenseSummary>> {
+        const requestOptions =
+            await this.enterpriseLicenseSummaryRetrieveRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) =>
+            LicenseSummaryFromJSON(jsonValue),
+        );
+    }
+
+    /**
+     * Get the total license status
+     */
+    async enterpriseLicenseSummaryRetrieve(
+        requestParameters: EnterpriseLicenseSummaryRetrieveRequest = {},
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<LicenseSummary> {
+        const response = await this.enterpriseLicenseSummaryRetrieveRaw(
+            requestParameters,
+            initOverrides,
+        );
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for enterpriseLicenseUpdate without sending the request
+     */
+    async enterpriseLicenseUpdateRequestOpts(
+        requestParameters: EnterpriseLicenseUpdateRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["licenseUuid"] == null) {
+            throw new runtime.RequiredError(
+                "licenseUuid",
+                'Required parameter "licenseUuid" was null or undefined when calling enterpriseLicenseUpdate().',
+            );
+        }
+
+        if (requestParameters["licenseRequest"] == null) {
+            throw new runtime.RequiredError(
+                "licenseRequest",
+                'Required parameter "licenseRequest" was null or undefined when calling enterpriseLicenseUpdate().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters["Content-Type"] = "application/json";
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/enterprise/license/{license_uuid}/`;
+        urlPath = urlPath.replace(
+            `{${"license_uuid"}}`,
+            encodeURIComponent(String(requestParameters["licenseUuid"])),
+        );
+
+        return {
+            path: urlPath,
+            method: "PUT",
+            headers: headerParameters,
+            query: queryParameters,
+            body: LicenseRequestToJSON(requestParameters["licenseRequest"]),
+        };
+    }
+
+    /**
+     * License Viewset
+     */
+    async enterpriseLicenseUpdateRaw(
+        requestParameters: EnterpriseLicenseUpdateRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<License>> {
+        const requestOptions = await this.enterpriseLicenseUpdateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => LicenseFromJSON(jsonValue));
+    }
+
+    /**
+     * License Viewset
+     */
+    async enterpriseLicenseUpdate(
+        requestParameters: EnterpriseLicenseUpdateRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<License> {
+        const response = await this.enterpriseLicenseUpdateRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for enterpriseLicenseUsedByList without sending the request
+     */
+    async enterpriseLicenseUsedByListRequestOpts(
+        requestParameters: EnterpriseLicenseUsedByListRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["licenseUuid"] == null) {
+            throw new runtime.RequiredError(
+                "licenseUuid",
+                'Required parameter "licenseUuid" was null or undefined when calling enterpriseLicenseUsedByList().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/enterprise/license/{license_uuid}/used_by/`;
+        urlPath = urlPath.replace(
+            `{${"license_uuid"}}`,
+            encodeURIComponent(String(requestParameters["licenseUuid"])),
+        );
+
+        return {
+            path: urlPath,
+            method: "GET",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Get a list of all objects that use this object
+     */
+    async enterpriseLicenseUsedByListRaw(
+        requestParameters: EnterpriseLicenseUsedByListRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<Array<UsedBy>>> {
+        const requestOptions = await this.enterpriseLicenseUsedByListRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => jsonValue.map(UsedByFromJSON));
+    }
+
+    /**
+     * Get a list of all objects that use this object
+     */
+    async enterpriseLicenseUsedByList(
+        requestParameters: EnterpriseLicenseUsedByListRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<Array<UsedBy>> {
+        const response = await this.enterpriseLicenseUsedByListRaw(
+            requestParameters,
+            initOverrides,
+        );
+        return await response.value();
+    }
+}

packages/client-ts/src/apis/LifecycleApi.ts

@@ -0,0 +1,775 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import type {
+    LifecycleIteration,
+    LifecycleIterationRequest,
+    LifecycleRule,
+    LifecycleRuleRequest,
+    PaginatedLifecycleIterationList,
+    PaginatedLifecycleRuleList,
+    PatchedLifecycleRuleRequest,
+    Review,
+    ReviewRequest,
+} from "../models/index";
+import {
+    LifecycleIterationFromJSON,
+    LifecycleIterationRequestToJSON,
+    LifecycleRuleFromJSON,
+    LifecycleRuleRequestToJSON,
+    PaginatedLifecycleIterationListFromJSON,
+    PaginatedLifecycleRuleListFromJSON,
+    PatchedLifecycleRuleRequestToJSON,
+    ReviewFromJSON,
+    ReviewRequestToJSON,
+} from "../models/index";
+import * as runtime from "../runtime";
+
+export interface LifecycleIterationsCreateRequest {
+    lifecycleIterationRequest: LifecycleIterationRequest;
+}
+
+export interface LifecycleIterationsLatestRetrieveRequest {
+    contentType: string;
+    objectId: string;
+}
+
+export interface LifecycleIterationsListOpenRequest {
+    ordering?: string;
+    page?: number;
+    pageSize?: number;
+    search?: string;
+    userIsReviewer?: boolean;
+}
+
+export interface LifecycleReviewsCreateRequest {
+    reviewRequest: ReviewRequest;
+}
+
+export interface LifecycleRulesCreateRequest {
+    lifecycleRuleRequest: LifecycleRuleRequest;
+}
+
+export interface LifecycleRulesDestroyRequest {
+    id: string;
+}
+
+export interface LifecycleRulesListRequest {
+    contentTypeModel?: string;
+    ordering?: string;
+    page?: number;
+    pageSize?: number;
+    search?: string;
+}
+
+export interface LifecycleRulesPartialUpdateRequest {
+    id: string;
+    patchedLifecycleRuleRequest?: PatchedLifecycleRuleRequest;
+}
+
+export interface LifecycleRulesRetrieveRequest {
+    id: string;
+}
+
+export interface LifecycleRulesUpdateRequest {
+    id: string;
+    lifecycleRuleRequest: LifecycleRuleRequest;
+}
+
+/**
+ *
+ */
+export class LifecycleApi extends runtime.BaseAPI {
+    /**
+     * Creates request options for lifecycleIterationsCreate without sending the request
+     */
+    async lifecycleIterationsCreateRequestOpts(
+        requestParameters: LifecycleIterationsCreateRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["lifecycleIterationRequest"] == null) {
+            throw new runtime.RequiredError(
+                "lifecycleIterationRequest",
+                'Required parameter "lifecycleIterationRequest" was null or undefined when calling lifecycleIterationsCreate().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters["Content-Type"] = "application/json";
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/lifecycle/iterations/`;
+
+        return {
+            path: urlPath,
+            method: "POST",
+            headers: headerParameters,
+            query: queryParameters,
+            body: LifecycleIterationRequestToJSON(requestParameters["lifecycleIterationRequest"]),
+        };
+    }
+
+    /**
+     * Mixin to validate that a valid enterprise license exists before allowing to save the object
+     */
+    async lifecycleIterationsCreateRaw(
+        requestParameters: LifecycleIterationsCreateRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<LifecycleIteration>> {
+        const requestOptions = await this.lifecycleIterationsCreateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) =>
+            LifecycleIterationFromJSON(jsonValue),
+        );
+    }
+
+    /**
+     * Mixin to validate that a valid enterprise license exists before allowing to save the object
+     */
+    async lifecycleIterationsCreate(
+        requestParameters: LifecycleIterationsCreateRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<LifecycleIteration> {
+        const response = await this.lifecycleIterationsCreateRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for lifecycleIterationsLatestRetrieve without sending the request
+     */
+    async lifecycleIterationsLatestRetrieveRequestOpts(
+        requestParameters: LifecycleIterationsLatestRetrieveRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["contentType"] == null) {
+            throw new runtime.RequiredError(
+                "contentType",
+                'Required parameter "contentType" was null or undefined when calling lifecycleIterationsLatestRetrieve().',
+            );
+        }
+
+        if (requestParameters["objectId"] == null) {
+            throw new runtime.RequiredError(
+                "objectId",
+                'Required parameter "objectId" was null or undefined when calling lifecycleIterationsLatestRetrieve().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/lifecycle/iterations/latest/{content_type}/{object_id}/`;
+        urlPath = urlPath.replace(
+            `{${"content_type"}}`,
+            encodeURIComponent(String(requestParameters["contentType"])),
+        );
+        urlPath = urlPath.replace(
+            `{${"object_id"}}`,
+            encodeURIComponent(String(requestParameters["objectId"])),
+        );
+
+        return {
+            path: urlPath,
+            method: "GET",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Mixin to validate that a valid enterprise license exists before allowing to save the object
+     */
+    async lifecycleIterationsLatestRetrieveRaw(
+        requestParameters: LifecycleIterationsLatestRetrieveRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<LifecycleIteration>> {
+        const requestOptions =
+            await this.lifecycleIterationsLatestRetrieveRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) =>
+            LifecycleIterationFromJSON(jsonValue),
+        );
+    }
+
+    /**
+     * Mixin to validate that a valid enterprise license exists before allowing to save the object
+     */
+    async lifecycleIterationsLatestRetrieve(
+        requestParameters: LifecycleIterationsLatestRetrieveRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<LifecycleIteration> {
+        const response = await this.lifecycleIterationsLatestRetrieveRaw(
+            requestParameters,
+            initOverrides,
+        );
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for lifecycleIterationsListOpen without sending the request
+     */
+    async lifecycleIterationsListOpenRequestOpts(
+        requestParameters: LifecycleIterationsListOpenRequest,
+    ): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        if (requestParameters["ordering"] != null) {
+            queryParameters["ordering"] = requestParameters["ordering"];
+        }
+
+        if (requestParameters["page"] != null) {
+            queryParameters["page"] = requestParameters["page"];
+        }
+
+        if (requestParameters["pageSize"] != null) {
+            queryParameters["page_size"] = requestParameters["pageSize"];
+        }
+
+        if (requestParameters["search"] != null) {
+            queryParameters["search"] = requestParameters["search"];
+        }
+
+        if (requestParameters["userIsReviewer"] != null) {
+            queryParameters["user_is_reviewer"] = requestParameters["userIsReviewer"];
+        }
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/lifecycle/iterations/open/`;
+
+        return {
+            path: urlPath,
+            method: "GET",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Mixin to validate that a valid enterprise license exists before allowing to save the object
+     */
+    async lifecycleIterationsListOpenRaw(
+        requestParameters: LifecycleIterationsListOpenRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<PaginatedLifecycleIterationList>> {
+        const requestOptions = await this.lifecycleIterationsListOpenRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) =>
+            PaginatedLifecycleIterationListFromJSON(jsonValue),
+        );
+    }
+
+    /**
+     * Mixin to validate that a valid enterprise license exists before allowing to save the object
+     */
+    async lifecycleIterationsListOpen(
+        requestParameters: LifecycleIterationsListOpenRequest = {},
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<PaginatedLifecycleIterationList> {
+        const response = await this.lifecycleIterationsListOpenRaw(
+            requestParameters,
+            initOverrides,
+        );
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for lifecycleReviewsCreate without sending the request
+     */
+    async lifecycleReviewsCreateRequestOpts(
+        requestParameters: LifecycleReviewsCreateRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["reviewRequest"] == null) {
+            throw new runtime.RequiredError(
+                "reviewRequest",
+                'Required parameter "reviewRequest" was null or undefined when calling lifecycleReviewsCreate().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters["Content-Type"] = "application/json";
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/lifecycle/reviews/`;
+
+        return {
+            path: urlPath,
+            method: "POST",
+            headers: headerParameters,
+            query: queryParameters,
+            body: ReviewRequestToJSON(requestParameters["reviewRequest"]),
+        };
+    }
+
+    /**
+     * Mixin to validate that a valid enterprise license exists before allowing to save the object
+     */
+    async lifecycleReviewsCreateRaw(
+        requestParameters: LifecycleReviewsCreateRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<Review>> {
+        const requestOptions = await this.lifecycleReviewsCreateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => ReviewFromJSON(jsonValue));
+    }
+
+    /**
+     * Mixin to validate that a valid enterprise license exists before allowing to save the object
+     */
+    async lifecycleReviewsCreate(
+        requestParameters: LifecycleReviewsCreateRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<Review> {
+        const response = await this.lifecycleReviewsCreateRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for lifecycleRulesCreate without sending the request
+     */
+    async lifecycleRulesCreateRequestOpts(
+        requestParameters: LifecycleRulesCreateRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["lifecycleRuleRequest"] == null) {
+            throw new runtime.RequiredError(
+                "lifecycleRuleRequest",
+                'Required parameter "lifecycleRuleRequest" was null or undefined when calling lifecycleRulesCreate().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters["Content-Type"] = "application/json";
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/lifecycle/rules/`;
+
+        return {
+            path: urlPath,
+            method: "POST",
+            headers: headerParameters,
+            query: queryParameters,
+            body: LifecycleRuleRequestToJSON(requestParameters["lifecycleRuleRequest"]),
+        };
+    }
+
+    /**
+     */
+    async lifecycleRulesCreateRaw(
+        requestParameters: LifecycleRulesCreateRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<LifecycleRule>> {
+        const requestOptions = await this.lifecycleRulesCreateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) =>
+            LifecycleRuleFromJSON(jsonValue),
+        );
+    }
+
+    /**
+     */
+    async lifecycleRulesCreate(
+        requestParameters: LifecycleRulesCreateRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<LifecycleRule> {
+        const response = await this.lifecycleRulesCreateRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for lifecycleRulesDestroy without sending the request
+     */
+    async lifecycleRulesDestroyRequestOpts(
+        requestParameters: LifecycleRulesDestroyRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["id"] == null) {
+            throw new runtime.RequiredError(
+                "id",
+                'Required parameter "id" was null or undefined when calling lifecycleRulesDestroy().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/lifecycle/rules/{id}/`;
+        urlPath = urlPath.replace(`{${"id"}}`, encodeURIComponent(String(requestParameters["id"])));
+
+        return {
+            path: urlPath,
+            method: "DELETE",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     */
+    async lifecycleRulesDestroyRaw(
+        requestParameters: LifecycleRulesDestroyRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<void>> {
+        const requestOptions = await this.lifecycleRulesDestroyRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.VoidApiResponse(response);
+    }
+
+    /**
+     */
+    async lifecycleRulesDestroy(
+        requestParameters: LifecycleRulesDestroyRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<void> {
+        await this.lifecycleRulesDestroyRaw(requestParameters, initOverrides);
+    }
+
+    /**
+     * Creates request options for lifecycleRulesList without sending the request
+     */
+    async lifecycleRulesListRequestOpts(
+        requestParameters: LifecycleRulesListRequest,
+    ): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        if (requestParameters["contentTypeModel"] != null) {
+            queryParameters["content_type__model"] = requestParameters["contentTypeModel"];
+        }
+
+        if (requestParameters["ordering"] != null) {
+            queryParameters["ordering"] = requestParameters["ordering"];
+        }
+
+        if (requestParameters["page"] != null) {
+            queryParameters["page"] = requestParameters["page"];
+        }
+
+        if (requestParameters["pageSize"] != null) {
+            queryParameters["page_size"] = requestParameters["pageSize"];
+        }
+
+        if (requestParameters["search"] != null) {
+            queryParameters["search"] = requestParameters["search"];
+        }
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/lifecycle/rules/`;
+
+        return {
+            path: urlPath,
+            method: "GET",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     */
+    async lifecycleRulesListRaw(
+        requestParameters: LifecycleRulesListRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<PaginatedLifecycleRuleList>> {
+        const requestOptions = await this.lifecycleRulesListRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) =>
+            PaginatedLifecycleRuleListFromJSON(jsonValue),
+        );
+    }
+
+    /**
+     */
+    async lifecycleRulesList(
+        requestParameters: LifecycleRulesListRequest = {},
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<PaginatedLifecycleRuleList> {
+        const response = await this.lifecycleRulesListRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for lifecycleRulesPartialUpdate without sending the request
+     */
+    async lifecycleRulesPartialUpdateRequestOpts(
+        requestParameters: LifecycleRulesPartialUpdateRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["id"] == null) {
+            throw new runtime.RequiredError(
+                "id",
+                'Required parameter "id" was null or undefined when calling lifecycleRulesPartialUpdate().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters["Content-Type"] = "application/json";
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/lifecycle/rules/{id}/`;
+        urlPath = urlPath.replace(`{${"id"}}`, encodeURIComponent(String(requestParameters["id"])));
+
+        return {
+            path: urlPath,
+            method: "PATCH",
+            headers: headerParameters,
+            query: queryParameters,
+            body: PatchedLifecycleRuleRequestToJSON(
+                requestParameters["patchedLifecycleRuleRequest"],
+            ),
+        };
+    }
+
+    /**
+     */
+    async lifecycleRulesPartialUpdateRaw(
+        requestParameters: LifecycleRulesPartialUpdateRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<LifecycleRule>> {
+        const requestOptions = await this.lifecycleRulesPartialUpdateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) =>
+            LifecycleRuleFromJSON(jsonValue),
+        );
+    }
+
+    /**
+     */
+    async lifecycleRulesPartialUpdate(
+        requestParameters: LifecycleRulesPartialUpdateRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<LifecycleRule> {
+        const response = await this.lifecycleRulesPartialUpdateRaw(
+            requestParameters,
+            initOverrides,
+        );
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for lifecycleRulesRetrieve without sending the request
+     */
+    async lifecycleRulesRetrieveRequestOpts(
+        requestParameters: LifecycleRulesRetrieveRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["id"] == null) {
+            throw new runtime.RequiredError(
+                "id",
+                'Required parameter "id" was null or undefined when calling lifecycleRulesRetrieve().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/lifecycle/rules/{id}/`;
+        urlPath = urlPath.replace(`{${"id"}}`, encodeURIComponent(String(requestParameters["id"])));
+
+        return {
+            path: urlPath,
+            method: "GET",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     */
+    async lifecycleRulesRetrieveRaw(
+        requestParameters: LifecycleRulesRetrieveRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<LifecycleRule>> {
+        const requestOptions = await this.lifecycleRulesRetrieveRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) =>
+            LifecycleRuleFromJSON(jsonValue),
+        );
+    }
+
+    /**
+     */
+    async lifecycleRulesRetrieve(
+        requestParameters: LifecycleRulesRetrieveRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<LifecycleRule> {
+        const response = await this.lifecycleRulesRetrieveRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for lifecycleRulesUpdate without sending the request
+     */
+    async lifecycleRulesUpdateRequestOpts(
+        requestParameters: LifecycleRulesUpdateRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["id"] == null) {
+            throw new runtime.RequiredError(
+                "id",
+                'Required parameter "id" was null or undefined when calling lifecycleRulesUpdate().',
+            );
+        }
+
+        if (requestParameters["lifecycleRuleRequest"] == null) {
+            throw new runtime.RequiredError(
+                "lifecycleRuleRequest",
+                'Required parameter "lifecycleRuleRequest" was null or undefined when calling lifecycleRulesUpdate().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters["Content-Type"] = "application/json";
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/lifecycle/rules/{id}/`;
+        urlPath = urlPath.replace(`{${"id"}}`, encodeURIComponent(String(requestParameters["id"])));
+
+        return {
+            path: urlPath,
+            method: "PUT",
+            headers: headerParameters,
+            query: queryParameters,
+            body: LifecycleRuleRequestToJSON(requestParameters["lifecycleRuleRequest"]),
+        };
+    }
+
+    /**
+     */
+    async lifecycleRulesUpdateRaw(
+        requestParameters: LifecycleRulesUpdateRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<LifecycleRule>> {
+        const requestOptions = await this.lifecycleRulesUpdateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) =>
+            LifecycleRuleFromJSON(jsonValue),
+        );
+    }
+
+    /**
+     */
+    async lifecycleRulesUpdate(
+        requestParameters: LifecycleRulesUpdateRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<LifecycleRule> {
+        const response = await this.lifecycleRulesUpdateRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+}

packages/client-ts/src/apis/ManagedApi.ts

@@ -0,0 +1,775 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import type {
+    BlueprintFile,
+    BlueprintImportResult,
+    BlueprintInstance,
+    BlueprintInstanceRequest,
+    PaginatedBlueprintInstanceList,
+    PatchedBlueprintInstanceRequest,
+    UsedBy,
+} from "../models/index";
+import {
+    BlueprintFileFromJSON,
+    BlueprintImportResultFromJSON,
+    BlueprintInstanceFromJSON,
+    BlueprintInstanceRequestToJSON,
+    PaginatedBlueprintInstanceListFromJSON,
+    PatchedBlueprintInstanceRequestToJSON,
+    UsedByFromJSON,
+} from "../models/index";
+import * as runtime from "../runtime";
+
+export interface ManagedBlueprintsApplyCreateRequest {
+    instanceUuid: string;
+}
+
+export interface ManagedBlueprintsCreateRequest {
+    blueprintInstanceRequest: BlueprintInstanceRequest;
+}
+
+export interface ManagedBlueprintsDestroyRequest {
+    instanceUuid: string;
+}
+
+export interface ManagedBlueprintsImportCreateRequest {
+    file?: Blob;
+    path?: string;
+}
+
+export interface ManagedBlueprintsListRequest {
+    name?: string;
+    ordering?: string;
+    page?: number;
+    pageSize?: number;
+    path?: string;
+    search?: string;
+}
+
+export interface ManagedBlueprintsPartialUpdateRequest {
+    instanceUuid: string;
+    patchedBlueprintInstanceRequest?: PatchedBlueprintInstanceRequest;
+}
+
+export interface ManagedBlueprintsRetrieveRequest {
+    instanceUuid: string;
+}
+
+export interface ManagedBlueprintsUpdateRequest {
+    instanceUuid: string;
+    blueprintInstanceRequest: BlueprintInstanceRequest;
+}
+
+export interface ManagedBlueprintsUsedByListRequest {
+    instanceUuid: string;
+}
+
+/**
+ *
+ */
+export class ManagedApi extends runtime.BaseAPI {
+    /**
+     * Creates request options for managedBlueprintsApplyCreate without sending the request
+     */
+    async managedBlueprintsApplyCreateRequestOpts(
+        requestParameters: ManagedBlueprintsApplyCreateRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["instanceUuid"] == null) {
+            throw new runtime.RequiredError(
+                "instanceUuid",
+                'Required parameter "instanceUuid" was null or undefined when calling managedBlueprintsApplyCreate().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/managed/blueprints/{instance_uuid}/apply/`;
+        urlPath = urlPath.replace(
+            `{${"instance_uuid"}}`,
+            encodeURIComponent(String(requestParameters["instanceUuid"])),
+        );
+
+        return {
+            path: urlPath,
+            method: "POST",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Apply a blueprint
+     */
+    async managedBlueprintsApplyCreateRaw(
+        requestParameters: ManagedBlueprintsApplyCreateRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<BlueprintInstance>> {
+        const requestOptions =
+            await this.managedBlueprintsApplyCreateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) =>
+            BlueprintInstanceFromJSON(jsonValue),
+        );
+    }
+
+    /**
+     * Apply a blueprint
+     */
+    async managedBlueprintsApplyCreate(
+        requestParameters: ManagedBlueprintsApplyCreateRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<BlueprintInstance> {
+        const response = await this.managedBlueprintsApplyCreateRaw(
+            requestParameters,
+            initOverrides,
+        );
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for managedBlueprintsAvailableList without sending the request
+     */
+    async managedBlueprintsAvailableListRequestOpts(): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/managed/blueprints/available/`;
+
+        return {
+            path: urlPath,
+            method: "GET",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Get blueprints
+     */
+    async managedBlueprintsAvailableListRaw(
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<Array<BlueprintFile>>> {
+        const requestOptions = await this.managedBlueprintsAvailableListRequestOpts();
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) =>
+            jsonValue.map(BlueprintFileFromJSON),
+        );
+    }
+
+    /**
+     * Get blueprints
+     */
+    async managedBlueprintsAvailableList(
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<Array<BlueprintFile>> {
+        const response = await this.managedBlueprintsAvailableListRaw(initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for managedBlueprintsCreate without sending the request
+     */
+    async managedBlueprintsCreateRequestOpts(
+        requestParameters: ManagedBlueprintsCreateRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["blueprintInstanceRequest"] == null) {
+            throw new runtime.RequiredError(
+                "blueprintInstanceRequest",
+                'Required parameter "blueprintInstanceRequest" was null or undefined when calling managedBlueprintsCreate().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters["Content-Type"] = "application/json";
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/managed/blueprints/`;
+
+        return {
+            path: urlPath,
+            method: "POST",
+            headers: headerParameters,
+            query: queryParameters,
+            body: BlueprintInstanceRequestToJSON(requestParameters["blueprintInstanceRequest"]),
+        };
+    }
+
+    /**
+     * Blueprint instances
+     */
+    async managedBlueprintsCreateRaw(
+        requestParameters: ManagedBlueprintsCreateRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<BlueprintInstance>> {
+        const requestOptions = await this.managedBlueprintsCreateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) =>
+            BlueprintInstanceFromJSON(jsonValue),
+        );
+    }
+
+    /**
+     * Blueprint instances
+     */
+    async managedBlueprintsCreate(
+        requestParameters: ManagedBlueprintsCreateRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<BlueprintInstance> {
+        const response = await this.managedBlueprintsCreateRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for managedBlueprintsDestroy without sending the request
+     */
+    async managedBlueprintsDestroyRequestOpts(
+        requestParameters: ManagedBlueprintsDestroyRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["instanceUuid"] == null) {
+            throw new runtime.RequiredError(
+                "instanceUuid",
+                'Required parameter "instanceUuid" was null or undefined when calling managedBlueprintsDestroy().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/managed/blueprints/{instance_uuid}/`;
+        urlPath = urlPath.replace(
+            `{${"instance_uuid"}}`,
+            encodeURIComponent(String(requestParameters["instanceUuid"])),
+        );
+
+        return {
+            path: urlPath,
+            method: "DELETE",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Blueprint instances
+     */
+    async managedBlueprintsDestroyRaw(
+        requestParameters: ManagedBlueprintsDestroyRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<void>> {
+        const requestOptions = await this.managedBlueprintsDestroyRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.VoidApiResponse(response);
+    }
+
+    /**
+     * Blueprint instances
+     */
+    async managedBlueprintsDestroy(
+        requestParameters: ManagedBlueprintsDestroyRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<void> {
+        await this.managedBlueprintsDestroyRaw(requestParameters, initOverrides);
+    }
+
+    /**
+     * Creates request options for managedBlueprintsImportCreate without sending the request
+     */
+    async managedBlueprintsImportCreateRequestOpts(
+        requestParameters: ManagedBlueprintsImportCreateRequest,
+    ): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+        const consumes: runtime.Consume[] = [{ contentType: "multipart/form-data" }];
+        // @ts-ignore: canConsumeForm may be unused
+        const canConsumeForm = runtime.canConsumeForm(consumes);
+
+        let formParams: { append(param: string, value: any): any };
+        let useForm = false;
+        // use FormData to transmit files using content-type "multipart/form-data"
+        useForm = canConsumeForm;
+        if (useForm) {
+            formParams = new FormData();
+        } else {
+            formParams = new URLSearchParams();
+        }
+
+        if (requestParameters["file"] != null) {
+            formParams.append("file", requestParameters["file"] as any);
+        }
+
+        if (requestParameters["path"] != null) {
+            formParams.append("path", requestParameters["path"] as any);
+        }
+
+        let urlPath = `/managed/blueprints/import/`;
+
+        return {
+            path: urlPath,
+            method: "POST",
+            headers: headerParameters,
+            query: queryParameters,
+            body: formParams,
+        };
+    }
+
+    /**
+     * Import blueprint from .yaml file and apply it once, without creating an instance
+     */
+    async managedBlueprintsImportCreateRaw(
+        requestParameters: ManagedBlueprintsImportCreateRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<BlueprintImportResult>> {
+        const requestOptions =
+            await this.managedBlueprintsImportCreateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) =>
+            BlueprintImportResultFromJSON(jsonValue),
+        );
+    }
+
+    /**
+     * Import blueprint from .yaml file and apply it once, without creating an instance
+     */
+    async managedBlueprintsImportCreate(
+        requestParameters: ManagedBlueprintsImportCreateRequest = {},
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<BlueprintImportResult> {
+        const response = await this.managedBlueprintsImportCreateRaw(
+            requestParameters,
+            initOverrides,
+        );
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for managedBlueprintsList without sending the request
+     */
+    async managedBlueprintsListRequestOpts(
+        requestParameters: ManagedBlueprintsListRequest,
+    ): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        if (requestParameters["name"] != null) {
+            queryParameters["name"] = requestParameters["name"];
+        }
+
+        if (requestParameters["ordering"] != null) {
+            queryParameters["ordering"] = requestParameters["ordering"];
+        }
+
+        if (requestParameters["page"] != null) {
+            queryParameters["page"] = requestParameters["page"];
+        }
+
+        if (requestParameters["pageSize"] != null) {
+            queryParameters["page_size"] = requestParameters["pageSize"];
+        }
+
+        if (requestParameters["path"] != null) {
+            queryParameters["path"] = requestParameters["path"];
+        }
+
+        if (requestParameters["search"] != null) {
+            queryParameters["search"] = requestParameters["search"];
+        }
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/managed/blueprints/`;
+
+        return {
+            path: urlPath,
+            method: "GET",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Blueprint instances
+     */
+    async managedBlueprintsListRaw(
+        requestParameters: ManagedBlueprintsListRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<PaginatedBlueprintInstanceList>> {
+        const requestOptions = await this.managedBlueprintsListRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) =>
+            PaginatedBlueprintInstanceListFromJSON(jsonValue),
+        );
+    }
+
+    /**
+     * Blueprint instances
+     */
+    async managedBlueprintsList(
+        requestParameters: ManagedBlueprintsListRequest = {},
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<PaginatedBlueprintInstanceList> {
+        const response = await this.managedBlueprintsListRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for managedBlueprintsPartialUpdate without sending the request
+     */
+    async managedBlueprintsPartialUpdateRequestOpts(
+        requestParameters: ManagedBlueprintsPartialUpdateRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["instanceUuid"] == null) {
+            throw new runtime.RequiredError(
+                "instanceUuid",
+                'Required parameter "instanceUuid" was null or undefined when calling managedBlueprintsPartialUpdate().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters["Content-Type"] = "application/json";
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/managed/blueprints/{instance_uuid}/`;
+        urlPath = urlPath.replace(
+            `{${"instance_uuid"}}`,
+            encodeURIComponent(String(requestParameters["instanceUuid"])),
+        );
+
+        return {
+            path: urlPath,
+            method: "PATCH",
+            headers: headerParameters,
+            query: queryParameters,
+            body: PatchedBlueprintInstanceRequestToJSON(
+                requestParameters["patchedBlueprintInstanceRequest"],
+            ),
+        };
+    }
+
+    /**
+     * Blueprint instances
+     */
+    async managedBlueprintsPartialUpdateRaw(
+        requestParameters: ManagedBlueprintsPartialUpdateRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<BlueprintInstance>> {
+        const requestOptions =
+            await this.managedBlueprintsPartialUpdateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) =>
+            BlueprintInstanceFromJSON(jsonValue),
+        );
+    }
+
+    /**
+     * Blueprint instances
+     */
+    async managedBlueprintsPartialUpdate(
+        requestParameters: ManagedBlueprintsPartialUpdateRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<BlueprintInstance> {
+        const response = await this.managedBlueprintsPartialUpdateRaw(
+            requestParameters,
+            initOverrides,
+        );
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for managedBlueprintsRetrieve without sending the request
+     */
+    async managedBlueprintsRetrieveRequestOpts(
+        requestParameters: ManagedBlueprintsRetrieveRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["instanceUuid"] == null) {
+            throw new runtime.RequiredError(
+                "instanceUuid",
+                'Required parameter "instanceUuid" was null or undefined when calling managedBlueprintsRetrieve().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/managed/blueprints/{instance_uuid}/`;
+        urlPath = urlPath.replace(
+            `{${"instance_uuid"}}`,
+            encodeURIComponent(String(requestParameters["instanceUuid"])),
+        );
+
+        return {
+            path: urlPath,
+            method: "GET",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Blueprint instances
+     */
+    async managedBlueprintsRetrieveRaw(
+        requestParameters: ManagedBlueprintsRetrieveRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<BlueprintInstance>> {
+        const requestOptions = await this.managedBlueprintsRetrieveRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) =>
+            BlueprintInstanceFromJSON(jsonValue),
+        );
+    }
+
+    /**
+     * Blueprint instances
+     */
+    async managedBlueprintsRetrieve(
+        requestParameters: ManagedBlueprintsRetrieveRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<BlueprintInstance> {
+        const response = await this.managedBlueprintsRetrieveRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for managedBlueprintsUpdate without sending the request
+     */
+    async managedBlueprintsUpdateRequestOpts(
+        requestParameters: ManagedBlueprintsUpdateRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["instanceUuid"] == null) {
+            throw new runtime.RequiredError(
+                "instanceUuid",
+                'Required parameter "instanceUuid" was null or undefined when calling managedBlueprintsUpdate().',
+            );
+        }
+
+        if (requestParameters["blueprintInstanceRequest"] == null) {
+            throw new runtime.RequiredError(
+                "blueprintInstanceRequest",
+                'Required parameter "blueprintInstanceRequest" was null or undefined when calling managedBlueprintsUpdate().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters["Content-Type"] = "application/json";
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/managed/blueprints/{instance_uuid}/`;
+        urlPath = urlPath.replace(
+            `{${"instance_uuid"}}`,
+            encodeURIComponent(String(requestParameters["instanceUuid"])),
+        );
+
+        return {
+            path: urlPath,
+            method: "PUT",
+            headers: headerParameters,
+            query: queryParameters,
+            body: BlueprintInstanceRequestToJSON(requestParameters["blueprintInstanceRequest"]),
+        };
+    }
+
+    /**
+     * Blueprint instances
+     */
+    async managedBlueprintsUpdateRaw(
+        requestParameters: ManagedBlueprintsUpdateRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<BlueprintInstance>> {
+        const requestOptions = await this.managedBlueprintsUpdateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) =>
+            BlueprintInstanceFromJSON(jsonValue),
+        );
+    }
+
+    /**
+     * Blueprint instances
+     */
+    async managedBlueprintsUpdate(
+        requestParameters: ManagedBlueprintsUpdateRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<BlueprintInstance> {
+        const response = await this.managedBlueprintsUpdateRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for managedBlueprintsUsedByList without sending the request
+     */
+    async managedBlueprintsUsedByListRequestOpts(
+        requestParameters: ManagedBlueprintsUsedByListRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["instanceUuid"] == null) {
+            throw new runtime.RequiredError(
+                "instanceUuid",
+                'Required parameter "instanceUuid" was null or undefined when calling managedBlueprintsUsedByList().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/managed/blueprints/{instance_uuid}/used_by/`;
+        urlPath = urlPath.replace(
+            `{${"instance_uuid"}}`,
+            encodeURIComponent(String(requestParameters["instanceUuid"])),
+        );
+
+        return {
+            path: urlPath,
+            method: "GET",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Get a list of all objects that use this object
+     */
+    async managedBlueprintsUsedByListRaw(
+        requestParameters: ManagedBlueprintsUsedByListRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<Array<UsedBy>>> {
+        const requestOptions = await this.managedBlueprintsUsedByListRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => jsonValue.map(UsedByFromJSON));
+    }
+
+    /**
+     * Get a list of all objects that use this object
+     */
+    async managedBlueprintsUsedByList(
+        requestParameters: ManagedBlueprintsUsedByListRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<Array<UsedBy>> {
+        const response = await this.managedBlueprintsUsedByListRaw(
+            requestParameters,
+            initOverrides,
+        );
+        return await response.value();
+    }
+}

packages/client-ts/src/apis/Oauth2Api.ts

@@ -0,0 +1,906 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import type {
+    ExpiringBaseGrantModel,
+    PaginatedExpiringBaseGrantModelList,
+    PaginatedTokenModelList,
+    TokenModel,
+    UsedBy,
+} from "../models/index";
+import {
+    ExpiringBaseGrantModelFromJSON,
+    PaginatedExpiringBaseGrantModelListFromJSON,
+    PaginatedTokenModelListFromJSON,
+    TokenModelFromJSON,
+    UsedByFromJSON,
+} from "../models/index";
+import * as runtime from "../runtime";
+
+export interface Oauth2AccessTokensDestroyRequest {
+    id: number;
+}
+
+export interface Oauth2AccessTokensListRequest {
+    ordering?: string;
+    page?: number;
+    pageSize?: number;
+    provider?: number;
+    search?: string;
+    user?: number;
+}
+
+export interface Oauth2AccessTokensRetrieveRequest {
+    id: number;
+}
+
+export interface Oauth2AccessTokensUsedByListRequest {
+    id: number;
+}
+
+export interface Oauth2AuthorizationCodesDestroyRequest {
+    id: number;
+}
+
+export interface Oauth2AuthorizationCodesListRequest {
+    ordering?: string;
+    page?: number;
+    pageSize?: number;
+    provider?: number;
+    search?: string;
+    user?: number;
+}
+
+export interface Oauth2AuthorizationCodesRetrieveRequest {
+    id: number;
+}
+
+export interface Oauth2AuthorizationCodesUsedByListRequest {
+    id: number;
+}
+
+export interface Oauth2RefreshTokensDestroyRequest {
+    id: number;
+}
+
+export interface Oauth2RefreshTokensListRequest {
+    ordering?: string;
+    page?: number;
+    pageSize?: number;
+    provider?: number;
+    search?: string;
+    user?: number;
+}
+
+export interface Oauth2RefreshTokensRetrieveRequest {
+    id: number;
+}
+
+export interface Oauth2RefreshTokensUsedByListRequest {
+    id: number;
+}
+
+/**
+ *
+ */
+export class Oauth2Api extends runtime.BaseAPI {
+    /**
+     * Creates request options for oauth2AccessTokensDestroy without sending the request
+     */
+    async oauth2AccessTokensDestroyRequestOpts(
+        requestParameters: Oauth2AccessTokensDestroyRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["id"] == null) {
+            throw new runtime.RequiredError(
+                "id",
+                'Required parameter "id" was null or undefined when calling oauth2AccessTokensDestroy().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/oauth2/access_tokens/{id}/`;
+        urlPath = urlPath.replace(`{${"id"}}`, encodeURIComponent(String(requestParameters["id"])));
+
+        return {
+            path: urlPath,
+            method: "DELETE",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * AccessToken Viewset
+     */
+    async oauth2AccessTokensDestroyRaw(
+        requestParameters: Oauth2AccessTokensDestroyRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<void>> {
+        const requestOptions = await this.oauth2AccessTokensDestroyRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.VoidApiResponse(response);
+    }
+
+    /**
+     * AccessToken Viewset
+     */
+    async oauth2AccessTokensDestroy(
+        requestParameters: Oauth2AccessTokensDestroyRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<void> {
+        await this.oauth2AccessTokensDestroyRaw(requestParameters, initOverrides);
+    }
+
+    /**
+     * Creates request options for oauth2AccessTokensList without sending the request
+     */
+    async oauth2AccessTokensListRequestOpts(
+        requestParameters: Oauth2AccessTokensListRequest,
+    ): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        if (requestParameters["ordering"] != null) {
+            queryParameters["ordering"] = requestParameters["ordering"];
+        }
+
+        if (requestParameters["page"] != null) {
+            queryParameters["page"] = requestParameters["page"];
+        }
+
+        if (requestParameters["pageSize"] != null) {
+            queryParameters["page_size"] = requestParameters["pageSize"];
+        }
+
+        if (requestParameters["provider"] != null) {
+            queryParameters["provider"] = requestParameters["provider"];
+        }
+
+        if (requestParameters["search"] != null) {
+            queryParameters["search"] = requestParameters["search"];
+        }
+
+        if (requestParameters["user"] != null) {
+            queryParameters["user"] = requestParameters["user"];
+        }
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/oauth2/access_tokens/`;
+
+        return {
+            path: urlPath,
+            method: "GET",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * AccessToken Viewset
+     */
+    async oauth2AccessTokensListRaw(
+        requestParameters: Oauth2AccessTokensListRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<PaginatedTokenModelList>> {
+        const requestOptions = await this.oauth2AccessTokensListRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) =>
+            PaginatedTokenModelListFromJSON(jsonValue),
+        );
+    }
+
+    /**
+     * AccessToken Viewset
+     */
+    async oauth2AccessTokensList(
+        requestParameters: Oauth2AccessTokensListRequest = {},
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<PaginatedTokenModelList> {
+        const response = await this.oauth2AccessTokensListRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for oauth2AccessTokensRetrieve without sending the request
+     */
+    async oauth2AccessTokensRetrieveRequestOpts(
+        requestParameters: Oauth2AccessTokensRetrieveRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["id"] == null) {
+            throw new runtime.RequiredError(
+                "id",
+                'Required parameter "id" was null or undefined when calling oauth2AccessTokensRetrieve().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/oauth2/access_tokens/{id}/`;
+        urlPath = urlPath.replace(`{${"id"}}`, encodeURIComponent(String(requestParameters["id"])));
+
+        return {
+            path: urlPath,
+            method: "GET",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * AccessToken Viewset
+     */
+    async oauth2AccessTokensRetrieveRaw(
+        requestParameters: Oauth2AccessTokensRetrieveRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<TokenModel>> {
+        const requestOptions = await this.oauth2AccessTokensRetrieveRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => TokenModelFromJSON(jsonValue));
+    }
+
+    /**
+     * AccessToken Viewset
+     */
+    async oauth2AccessTokensRetrieve(
+        requestParameters: Oauth2AccessTokensRetrieveRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<TokenModel> {
+        const response = await this.oauth2AccessTokensRetrieveRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for oauth2AccessTokensUsedByList without sending the request
+     */
+    async oauth2AccessTokensUsedByListRequestOpts(
+        requestParameters: Oauth2AccessTokensUsedByListRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["id"] == null) {
+            throw new runtime.RequiredError(
+                "id",
+                'Required parameter "id" was null or undefined when calling oauth2AccessTokensUsedByList().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/oauth2/access_tokens/{id}/used_by/`;
+        urlPath = urlPath.replace(`{${"id"}}`, encodeURIComponent(String(requestParameters["id"])));
+
+        return {
+            path: urlPath,
+            method: "GET",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Get a list of all objects that use this object
+     */
+    async oauth2AccessTokensUsedByListRaw(
+        requestParameters: Oauth2AccessTokensUsedByListRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<Array<UsedBy>>> {
+        const requestOptions =
+            await this.oauth2AccessTokensUsedByListRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => jsonValue.map(UsedByFromJSON));
+    }
+
+    /**
+     * Get a list of all objects that use this object
+     */
+    async oauth2AccessTokensUsedByList(
+        requestParameters: Oauth2AccessTokensUsedByListRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<Array<UsedBy>> {
+        const response = await this.oauth2AccessTokensUsedByListRaw(
+            requestParameters,
+            initOverrides,
+        );
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for oauth2AuthorizationCodesDestroy without sending the request
+     */
+    async oauth2AuthorizationCodesDestroyRequestOpts(
+        requestParameters: Oauth2AuthorizationCodesDestroyRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["id"] == null) {
+            throw new runtime.RequiredError(
+                "id",
+                'Required parameter "id" was null or undefined when calling oauth2AuthorizationCodesDestroy().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/oauth2/authorization_codes/{id}/`;
+        urlPath = urlPath.replace(`{${"id"}}`, encodeURIComponent(String(requestParameters["id"])));
+
+        return {
+            path: urlPath,
+            method: "DELETE",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * AuthorizationCode Viewset
+     */
+    async oauth2AuthorizationCodesDestroyRaw(
+        requestParameters: Oauth2AuthorizationCodesDestroyRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<void>> {
+        const requestOptions =
+            await this.oauth2AuthorizationCodesDestroyRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.VoidApiResponse(response);
+    }
+
+    /**
+     * AuthorizationCode Viewset
+     */
+    async oauth2AuthorizationCodesDestroy(
+        requestParameters: Oauth2AuthorizationCodesDestroyRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<void> {
+        await this.oauth2AuthorizationCodesDestroyRaw(requestParameters, initOverrides);
+    }
+
+    /**
+     * Creates request options for oauth2AuthorizationCodesList without sending the request
+     */
+    async oauth2AuthorizationCodesListRequestOpts(
+        requestParameters: Oauth2AuthorizationCodesListRequest,
+    ): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        if (requestParameters["ordering"] != null) {
+            queryParameters["ordering"] = requestParameters["ordering"];
+        }
+
+        if (requestParameters["page"] != null) {
+            queryParameters["page"] = requestParameters["page"];
+        }
+
+        if (requestParameters["pageSize"] != null) {
+            queryParameters["page_size"] = requestParameters["pageSize"];
+        }
+
+        if (requestParameters["provider"] != null) {
+            queryParameters["provider"] = requestParameters["provider"];
+        }
+
+        if (requestParameters["search"] != null) {
+            queryParameters["search"] = requestParameters["search"];
+        }
+
+        if (requestParameters["user"] != null) {
+            queryParameters["user"] = requestParameters["user"];
+        }
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/oauth2/authorization_codes/`;
+
+        return {
+            path: urlPath,
+            method: "GET",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * AuthorizationCode Viewset
+     */
+    async oauth2AuthorizationCodesListRaw(
+        requestParameters: Oauth2AuthorizationCodesListRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<PaginatedExpiringBaseGrantModelList>> {
+        const requestOptions =
+            await this.oauth2AuthorizationCodesListRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) =>
+            PaginatedExpiringBaseGrantModelListFromJSON(jsonValue),
+        );
+    }
+
+    /**
+     * AuthorizationCode Viewset
+     */
+    async oauth2AuthorizationCodesList(
+        requestParameters: Oauth2AuthorizationCodesListRequest = {},
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<PaginatedExpiringBaseGrantModelList> {
+        const response = await this.oauth2AuthorizationCodesListRaw(
+            requestParameters,
+            initOverrides,
+        );
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for oauth2AuthorizationCodesRetrieve without sending the request
+     */
+    async oauth2AuthorizationCodesRetrieveRequestOpts(
+        requestParameters: Oauth2AuthorizationCodesRetrieveRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["id"] == null) {
+            throw new runtime.RequiredError(
+                "id",
+                'Required parameter "id" was null or undefined when calling oauth2AuthorizationCodesRetrieve().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/oauth2/authorization_codes/{id}/`;
+        urlPath = urlPath.replace(`{${"id"}}`, encodeURIComponent(String(requestParameters["id"])));
+
+        return {
+            path: urlPath,
+            method: "GET",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * AuthorizationCode Viewset
+     */
+    async oauth2AuthorizationCodesRetrieveRaw(
+        requestParameters: Oauth2AuthorizationCodesRetrieveRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<ExpiringBaseGrantModel>> {
+        const requestOptions =
+            await this.oauth2AuthorizationCodesRetrieveRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) =>
+            ExpiringBaseGrantModelFromJSON(jsonValue),
+        );
+    }
+
+    /**
+     * AuthorizationCode Viewset
+     */
+    async oauth2AuthorizationCodesRetrieve(
+        requestParameters: Oauth2AuthorizationCodesRetrieveRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<ExpiringBaseGrantModel> {
+        const response = await this.oauth2AuthorizationCodesRetrieveRaw(
+            requestParameters,
+            initOverrides,
+        );
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for oauth2AuthorizationCodesUsedByList without sending the request
+     */
+    async oauth2AuthorizationCodesUsedByListRequestOpts(
+        requestParameters: Oauth2AuthorizationCodesUsedByListRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["id"] == null) {
+            throw new runtime.RequiredError(
+                "id",
+                'Required parameter "id" was null or undefined when calling oauth2AuthorizationCodesUsedByList().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/oauth2/authorization_codes/{id}/used_by/`;
+        urlPath = urlPath.replace(`{${"id"}}`, encodeURIComponent(String(requestParameters["id"])));
+
+        return {
+            path: urlPath,
+            method: "GET",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Get a list of all objects that use this object
+     */
+    async oauth2AuthorizationCodesUsedByListRaw(
+        requestParameters: Oauth2AuthorizationCodesUsedByListRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<Array<UsedBy>>> {
+        const requestOptions =
+            await this.oauth2AuthorizationCodesUsedByListRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => jsonValue.map(UsedByFromJSON));
+    }
+
+    /**
+     * Get a list of all objects that use this object
+     */
+    async oauth2AuthorizationCodesUsedByList(
+        requestParameters: Oauth2AuthorizationCodesUsedByListRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<Array<UsedBy>> {
+        const response = await this.oauth2AuthorizationCodesUsedByListRaw(
+            requestParameters,
+            initOverrides,
+        );
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for oauth2RefreshTokensDestroy without sending the request
+     */
+    async oauth2RefreshTokensDestroyRequestOpts(
+        requestParameters: Oauth2RefreshTokensDestroyRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["id"] == null) {
+            throw new runtime.RequiredError(
+                "id",
+                'Required parameter "id" was null or undefined when calling oauth2RefreshTokensDestroy().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/oauth2/refresh_tokens/{id}/`;
+        urlPath = urlPath.replace(`{${"id"}}`, encodeURIComponent(String(requestParameters["id"])));
+
+        return {
+            path: urlPath,
+            method: "DELETE",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * RefreshToken Viewset
+     */
+    async oauth2RefreshTokensDestroyRaw(
+        requestParameters: Oauth2RefreshTokensDestroyRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<void>> {
+        const requestOptions = await this.oauth2RefreshTokensDestroyRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.VoidApiResponse(response);
+    }
+
+    /**
+     * RefreshToken Viewset
+     */
+    async oauth2RefreshTokensDestroy(
+        requestParameters: Oauth2RefreshTokensDestroyRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<void> {
+        await this.oauth2RefreshTokensDestroyRaw(requestParameters, initOverrides);
+    }
+
+    /**
+     * Creates request options for oauth2RefreshTokensList without sending the request
+     */
+    async oauth2RefreshTokensListRequestOpts(
+        requestParameters: Oauth2RefreshTokensListRequest,
+    ): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        if (requestParameters["ordering"] != null) {
+            queryParameters["ordering"] = requestParameters["ordering"];
+        }
+
+        if (requestParameters["page"] != null) {
+            queryParameters["page"] = requestParameters["page"];
+        }
+
+        if (requestParameters["pageSize"] != null) {
+            queryParameters["page_size"] = requestParameters["pageSize"];
+        }
+
+        if (requestParameters["provider"] != null) {
+            queryParameters["provider"] = requestParameters["provider"];
+        }
+
+        if (requestParameters["search"] != null) {
+            queryParameters["search"] = requestParameters["search"];
+        }
+
+        if (requestParameters["user"] != null) {
+            queryParameters["user"] = requestParameters["user"];
+        }
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/oauth2/refresh_tokens/`;
+
+        return {
+            path: urlPath,
+            method: "GET",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * RefreshToken Viewset
+     */
+    async oauth2RefreshTokensListRaw(
+        requestParameters: Oauth2RefreshTokensListRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<PaginatedTokenModelList>> {
+        const requestOptions = await this.oauth2RefreshTokensListRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) =>
+            PaginatedTokenModelListFromJSON(jsonValue),
+        );
+    }
+
+    /**
+     * RefreshToken Viewset
+     */
+    async oauth2RefreshTokensList(
+        requestParameters: Oauth2RefreshTokensListRequest = {},
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<PaginatedTokenModelList> {
+        const response = await this.oauth2RefreshTokensListRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for oauth2RefreshTokensRetrieve without sending the request
+     */
+    async oauth2RefreshTokensRetrieveRequestOpts(
+        requestParameters: Oauth2RefreshTokensRetrieveRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["id"] == null) {
+            throw new runtime.RequiredError(
+                "id",
+                'Required parameter "id" was null or undefined when calling oauth2RefreshTokensRetrieve().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/oauth2/refresh_tokens/{id}/`;
+        urlPath = urlPath.replace(`{${"id"}}`, encodeURIComponent(String(requestParameters["id"])));
+
+        return {
+            path: urlPath,
+            method: "GET",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * RefreshToken Viewset
+     */
+    async oauth2RefreshTokensRetrieveRaw(
+        requestParameters: Oauth2RefreshTokensRetrieveRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<TokenModel>> {
+        const requestOptions = await this.oauth2RefreshTokensRetrieveRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => TokenModelFromJSON(jsonValue));
+    }
+
+    /**
+     * RefreshToken Viewset
+     */
+    async oauth2RefreshTokensRetrieve(
+        requestParameters: Oauth2RefreshTokensRetrieveRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<TokenModel> {
+        const response = await this.oauth2RefreshTokensRetrieveRaw(
+            requestParameters,
+            initOverrides,
+        );
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for oauth2RefreshTokensUsedByList without sending the request
+     */
+    async oauth2RefreshTokensUsedByListRequestOpts(
+        requestParameters: Oauth2RefreshTokensUsedByListRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["id"] == null) {
+            throw new runtime.RequiredError(
+                "id",
+                'Required parameter "id" was null or undefined when calling oauth2RefreshTokensUsedByList().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/oauth2/refresh_tokens/{id}/used_by/`;
+        urlPath = urlPath.replace(`{${"id"}}`, encodeURIComponent(String(requestParameters["id"])));
+
+        return {
+            path: urlPath,
+            method: "GET",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Get a list of all objects that use this object
+     */
+    async oauth2RefreshTokensUsedByListRaw(
+        requestParameters: Oauth2RefreshTokensUsedByListRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<Array<UsedBy>>> {
+        const requestOptions =
+            await this.oauth2RefreshTokensUsedByListRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => jsonValue.map(UsedByFromJSON));
+    }
+
+    /**
+     * Get a list of all objects that use this object
+     */
+    async oauth2RefreshTokensUsedByList(
+        requestParameters: Oauth2RefreshTokensUsedByListRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<Array<UsedBy>> {
+        const response = await this.oauth2RefreshTokensUsedByListRaw(
+            requestParameters,
+            initOverrides,
+        );
+        return await response.value();
+    }
+}

packages/client-ts/src/apis/ReportsApi.ts

@@ -0,0 +1,223 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import type { DataExport, PaginatedDataExportList } from "../models/index";
+import { DataExportFromJSON, PaginatedDataExportListFromJSON } from "../models/index";
+import * as runtime from "../runtime";
+
+export interface ReportsExportsDestroyRequest {
+    id: string;
+}
+
+export interface ReportsExportsListRequest {
+    ordering?: string;
+    page?: number;
+    pageSize?: number;
+    search?: string;
+}
+
+export interface ReportsExportsRetrieveRequest {
+    id: string;
+}
+
+/**
+ *
+ */
+export class ReportsApi extends runtime.BaseAPI {
+    /**
+     * Creates request options for reportsExportsDestroy without sending the request
+     */
+    async reportsExportsDestroyRequestOpts(
+        requestParameters: ReportsExportsDestroyRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["id"] == null) {
+            throw new runtime.RequiredError(
+                "id",
+                'Required parameter "id" was null or undefined when calling reportsExportsDestroy().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/reports/exports/{id}/`;
+        urlPath = urlPath.replace(`{${"id"}}`, encodeURIComponent(String(requestParameters["id"])));
+
+        return {
+            path: urlPath,
+            method: "DELETE",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     */
+    async reportsExportsDestroyRaw(
+        requestParameters: ReportsExportsDestroyRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<void>> {
+        const requestOptions = await this.reportsExportsDestroyRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.VoidApiResponse(response);
+    }
+
+    /**
+     */
+    async reportsExportsDestroy(
+        requestParameters: ReportsExportsDestroyRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<void> {
+        await this.reportsExportsDestroyRaw(requestParameters, initOverrides);
+    }
+
+    /**
+     * Creates request options for reportsExportsList without sending the request
+     */
+    async reportsExportsListRequestOpts(
+        requestParameters: ReportsExportsListRequest,
+    ): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        if (requestParameters["ordering"] != null) {
+            queryParameters["ordering"] = requestParameters["ordering"];
+        }
+
+        if (requestParameters["page"] != null) {
+            queryParameters["page"] = requestParameters["page"];
+        }
+
+        if (requestParameters["pageSize"] != null) {
+            queryParameters["page_size"] = requestParameters["pageSize"];
+        }
+
+        if (requestParameters["search"] != null) {
+            queryParameters["search"] = requestParameters["search"];
+        }
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/reports/exports/`;
+
+        return {
+            path: urlPath,
+            method: "GET",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     */
+    async reportsExportsListRaw(
+        requestParameters: ReportsExportsListRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<PaginatedDataExportList>> {
+        const requestOptions = await this.reportsExportsListRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) =>
+            PaginatedDataExportListFromJSON(jsonValue),
+        );
+    }
+
+    /**
+     */
+    async reportsExportsList(
+        requestParameters: ReportsExportsListRequest = {},
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<PaginatedDataExportList> {
+        const response = await this.reportsExportsListRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for reportsExportsRetrieve without sending the request
+     */
+    async reportsExportsRetrieveRequestOpts(
+        requestParameters: ReportsExportsRetrieveRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["id"] == null) {
+            throw new runtime.RequiredError(
+                "id",
+                'Required parameter "id" was null or undefined when calling reportsExportsRetrieve().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/reports/exports/{id}/`;
+        urlPath = urlPath.replace(`{${"id"}}`, encodeURIComponent(String(requestParameters["id"])));
+
+        return {
+            path: urlPath,
+            method: "GET",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     */
+    async reportsExportsRetrieveRaw(
+        requestParameters: ReportsExportsRetrieveRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<DataExport>> {
+        const requestOptions = await this.reportsExportsRetrieveRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => DataExportFromJSON(jsonValue));
+    }
+
+    /**
+     */
+    async reportsExportsRetrieve(
+        requestParameters: ReportsExportsRetrieveRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<DataExport> {
+        const response = await this.reportsExportsRetrieveRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+}

packages/client-ts/src/apis/RootApi.ts

@@ -0,0 +1,71 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import type { Config } from "../models/index";
+import { ConfigFromJSON } from "../models/index";
+import * as runtime from "../runtime";
+
+/**
+ *
+ */
+export class RootApi extends runtime.BaseAPI {
+    /**
+     * Creates request options for rootConfigRetrieve without sending the request
+     */
+    async rootConfigRetrieveRequestOpts(): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/root/config/`;
+
+        return {
+            path: urlPath,
+            method: "GET",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Retrieve public configuration options
+     */
+    async rootConfigRetrieveRaw(
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<Config>> {
+        const requestOptions = await this.rootConfigRetrieveRequestOpts();
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => ConfigFromJSON(jsonValue));
+    }
+
+    /**
+     * Retrieve public configuration options
+     */
+    async rootConfigRetrieve(
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<Config> {
+        const response = await this.rootConfigRetrieveRaw(initOverrides);
+        return await response.value();
+    }
+}

packages/client-ts/src/apis/SchemaApi.ts

@@ -0,0 +1,87 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import type { FormatEnum, LangEnum } from "../models/index";
+import * as runtime from "../runtime";
+
+export interface SchemaRetrieveRequest {
+    format?: FormatEnum;
+    lang?: LangEnum;
+}
+
+/**
+ *
+ */
+export class SchemaApi extends runtime.BaseAPI {
+    /**
+     * Creates request options for schemaRetrieve without sending the request
+     */
+    async schemaRetrieveRequestOpts(
+        requestParameters: SchemaRetrieveRequest,
+    ): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        if (requestParameters["format"] != null) {
+            queryParameters["format"] = requestParameters["format"];
+        }
+
+        if (requestParameters["lang"] != null) {
+            queryParameters["lang"] = requestParameters["lang"];
+        }
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/schema/`;
+
+        return {
+            path: urlPath,
+            method: "GET",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * OpenApi3 schema for this API. Format can be selected via content negotiation.  - YAML: application/vnd.oai.openapi - JSON: application/vnd.oai.openapi+json
+     */
+    async schemaRetrieveRaw(
+        requestParameters: SchemaRetrieveRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<{ [key: string]: any }>> {
+        const requestOptions = await this.schemaRetrieveRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse<any>(response);
+    }
+
+    /**
+     * OpenApi3 schema for this API. Format can be selected via content negotiation.  - YAML: application/vnd.oai.openapi - JSON: application/vnd.oai.openapi+json
+     */
+    async schemaRetrieve(
+        requestParameters: SchemaRetrieveRequest = {},
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<{ [key: string]: any }> {
+        const response = await this.schemaRetrieveRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+}

packages/client-ts/src/apis/SsfApi.ts

@@ -0,0 +1,250 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import type { DeliveryMethodEnum, PaginatedSSFStreamList, SSFStream } from "../models/index";
+import { PaginatedSSFStreamListFromJSON, SSFStreamFromJSON } from "../models/index";
+import * as runtime from "../runtime";
+
+export interface SsfStreamsDestroyRequest {
+    uuid: string;
+}
+
+export interface SsfStreamsListRequest {
+    deliveryMethod?: DeliveryMethodEnum;
+    endpointUrl?: string;
+    ordering?: string;
+    page?: number;
+    pageSize?: number;
+    provider?: number;
+    search?: string;
+}
+
+export interface SsfStreamsRetrieveRequest {
+    uuid: string;
+}
+
+/**
+ *
+ */
+export class SsfApi extends runtime.BaseAPI {
+    /**
+     * Creates request options for ssfStreamsDestroy without sending the request
+     */
+    async ssfStreamsDestroyRequestOpts(
+        requestParameters: SsfStreamsDestroyRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["uuid"] == null) {
+            throw new runtime.RequiredError(
+                "uuid",
+                'Required parameter "uuid" was null or undefined when calling ssfStreamsDestroy().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/ssf/streams/{uuid}/`;
+        urlPath = urlPath.replace(
+            `{${"uuid"}}`,
+            encodeURIComponent(String(requestParameters["uuid"])),
+        );
+
+        return {
+            path: urlPath,
+            method: "DELETE",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * SSFStream Viewset
+     */
+    async ssfStreamsDestroyRaw(
+        requestParameters: SsfStreamsDestroyRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<void>> {
+        const requestOptions = await this.ssfStreamsDestroyRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.VoidApiResponse(response);
+    }
+
+    /**
+     * SSFStream Viewset
+     */
+    async ssfStreamsDestroy(
+        requestParameters: SsfStreamsDestroyRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<void> {
+        await this.ssfStreamsDestroyRaw(requestParameters, initOverrides);
+    }
+
+    /**
+     * Creates request options for ssfStreamsList without sending the request
+     */
+    async ssfStreamsListRequestOpts(
+        requestParameters: SsfStreamsListRequest,
+    ): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        if (requestParameters["deliveryMethod"] != null) {
+            queryParameters["delivery_method"] = requestParameters["deliveryMethod"];
+        }
+
+        if (requestParameters["endpointUrl"] != null) {
+            queryParameters["endpoint_url"] = requestParameters["endpointUrl"];
+        }
+
+        if (requestParameters["ordering"] != null) {
+            queryParameters["ordering"] = requestParameters["ordering"];
+        }
+
+        if (requestParameters["page"] != null) {
+            queryParameters["page"] = requestParameters["page"];
+        }
+
+        if (requestParameters["pageSize"] != null) {
+            queryParameters["page_size"] = requestParameters["pageSize"];
+        }
+
+        if (requestParameters["provider"] != null) {
+            queryParameters["provider"] = requestParameters["provider"];
+        }
+
+        if (requestParameters["search"] != null) {
+            queryParameters["search"] = requestParameters["search"];
+        }
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/ssf/streams/`;
+
+        return {
+            path: urlPath,
+            method: "GET",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * SSFStream Viewset
+     */
+    async ssfStreamsListRaw(
+        requestParameters: SsfStreamsListRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<PaginatedSSFStreamList>> {
+        const requestOptions = await this.ssfStreamsListRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) =>
+            PaginatedSSFStreamListFromJSON(jsonValue),
+        );
+    }
+
+    /**
+     * SSFStream Viewset
+     */
+    async ssfStreamsList(
+        requestParameters: SsfStreamsListRequest = {},
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<PaginatedSSFStreamList> {
+        const response = await this.ssfStreamsListRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for ssfStreamsRetrieve without sending the request
+     */
+    async ssfStreamsRetrieveRequestOpts(
+        requestParameters: SsfStreamsRetrieveRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["uuid"] == null) {
+            throw new runtime.RequiredError(
+                "uuid",
+                'Required parameter "uuid" was null or undefined when calling ssfStreamsRetrieve().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/ssf/streams/{uuid}/`;
+        urlPath = urlPath.replace(
+            `{${"uuid"}}`,
+            encodeURIComponent(String(requestParameters["uuid"])),
+        );
+
+        return {
+            path: urlPath,
+            method: "GET",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * SSFStream Viewset
+     */
+    async ssfStreamsRetrieveRaw(
+        requestParameters: SsfStreamsRetrieveRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<SSFStream>> {
+        const requestOptions = await this.ssfStreamsRetrieveRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => SSFStreamFromJSON(jsonValue));
+    }
+
+    /**
+     * SSFStream Viewset
+     */
+    async ssfStreamsRetrieve(
+        requestParameters: SsfStreamsRetrieveRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<SSFStream> {
+        const response = await this.ssfStreamsRetrieveRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+}

packages/client-ts/src/apis/TasksApi.ts

@@ -0,0 +1,772 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import type {
+    GlobalTaskStatus,
+    PaginatedScheduleList,
+    PaginatedTaskList,
+    PatchedScheduleRequest,
+    Schedule,
+    ScheduleRequest,
+    Task,
+    TaskAggregatedStatusEnum,
+    TaskStatusEnum,
+    Worker,
+} from "../models/index";
+import {
+    GlobalTaskStatusFromJSON,
+    PaginatedScheduleListFromJSON,
+    PaginatedTaskListFromJSON,
+    PatchedScheduleRequestToJSON,
+    ScheduleFromJSON,
+    ScheduleRequestToJSON,
+    TaskFromJSON,
+    WorkerFromJSON,
+} from "../models/index";
+import * as runtime from "../runtime";
+
+export interface TasksSchedulesListRequest {
+    actorName?: string;
+    ordering?: string;
+    page?: number;
+    pageSize?: number;
+    paused?: boolean;
+    relObjContentTypeAppLabel?: string;
+    relObjContentTypeModel?: string;
+    relObjId?: string;
+    relObjIdIsnull?: boolean;
+    search?: string;
+}
+
+export interface TasksSchedulesPartialUpdateRequest {
+    id: string;
+    patchedScheduleRequest?: PatchedScheduleRequest;
+}
+
+export interface TasksSchedulesRetrieveRequest {
+    id: string;
+}
+
+export interface TasksSchedulesSendCreateRequest {
+    id: string;
+}
+
+export interface TasksSchedulesUpdateRequest {
+    id: string;
+    scheduleRequest: ScheduleRequest;
+}
+
+export interface TasksTasksListRequest {
+    actorName?: string;
+    aggregatedStatus?: Array<TaskAggregatedStatusEnum>;
+    ordering?: string;
+    page?: number;
+    pageSize?: number;
+    queueName?: string;
+    relObjContentTypeAppLabel?: string;
+    relObjContentTypeModel?: string;
+    relObjId?: string;
+    relObjIdIsnull?: boolean;
+    search?: string;
+    state?: TaskStatusEnum;
+}
+
+export interface TasksTasksRetrieveRequest {
+    messageId: string;
+}
+
+export interface TasksTasksRetryCreateRequest {
+    messageId: string;
+}
+
+/**
+ *
+ */
+export class TasksApi extends runtime.BaseAPI {
+    /**
+     * Creates request options for tasksSchedulesList without sending the request
+     */
+    async tasksSchedulesListRequestOpts(
+        requestParameters: TasksSchedulesListRequest,
+    ): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        if (requestParameters["actorName"] != null) {
+            queryParameters["actor_name"] = requestParameters["actorName"];
+        }
+
+        if (requestParameters["ordering"] != null) {
+            queryParameters["ordering"] = requestParameters["ordering"];
+        }
+
+        if (requestParameters["page"] != null) {
+            queryParameters["page"] = requestParameters["page"];
+        }
+
+        if (requestParameters["pageSize"] != null) {
+            queryParameters["page_size"] = requestParameters["pageSize"];
+        }
+
+        if (requestParameters["paused"] != null) {
+            queryParameters["paused"] = requestParameters["paused"];
+        }
+
+        if (requestParameters["relObjContentTypeAppLabel"] != null) {
+            queryParameters["rel_obj_content_type__app_label"] =
+                requestParameters["relObjContentTypeAppLabel"];
+        }
+
+        if (requestParameters["relObjContentTypeModel"] != null) {
+            queryParameters["rel_obj_content_type__model"] =
+                requestParameters["relObjContentTypeModel"];
+        }
+
+        if (requestParameters["relObjId"] != null) {
+            queryParameters["rel_obj_id"] = requestParameters["relObjId"];
+        }
+
+        if (requestParameters["relObjIdIsnull"] != null) {
+            queryParameters["rel_obj_id__isnull"] = requestParameters["relObjIdIsnull"];
+        }
+
+        if (requestParameters["search"] != null) {
+            queryParameters["search"] = requestParameters["search"];
+        }
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/tasks/schedules/`;
+
+        return {
+            path: urlPath,
+            method: "GET",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     */
+    async tasksSchedulesListRaw(
+        requestParameters: TasksSchedulesListRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<PaginatedScheduleList>> {
+        const requestOptions = await this.tasksSchedulesListRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) =>
+            PaginatedScheduleListFromJSON(jsonValue),
+        );
+    }
+
+    /**
+     */
+    async tasksSchedulesList(
+        requestParameters: TasksSchedulesListRequest = {},
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<PaginatedScheduleList> {
+        const response = await this.tasksSchedulesListRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for tasksSchedulesPartialUpdate without sending the request
+     */
+    async tasksSchedulesPartialUpdateRequestOpts(
+        requestParameters: TasksSchedulesPartialUpdateRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["id"] == null) {
+            throw new runtime.RequiredError(
+                "id",
+                'Required parameter "id" was null or undefined when calling tasksSchedulesPartialUpdate().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters["Content-Type"] = "application/json";
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/tasks/schedules/{id}/`;
+        urlPath = urlPath.replace(`{${"id"}}`, encodeURIComponent(String(requestParameters["id"])));
+
+        return {
+            path: urlPath,
+            method: "PATCH",
+            headers: headerParameters,
+            query: queryParameters,
+            body: PatchedScheduleRequestToJSON(requestParameters["patchedScheduleRequest"]),
+        };
+    }
+
+    /**
+     */
+    async tasksSchedulesPartialUpdateRaw(
+        requestParameters: TasksSchedulesPartialUpdateRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<Schedule>> {
+        const requestOptions = await this.tasksSchedulesPartialUpdateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => ScheduleFromJSON(jsonValue));
+    }
+
+    /**
+     */
+    async tasksSchedulesPartialUpdate(
+        requestParameters: TasksSchedulesPartialUpdateRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<Schedule> {
+        const response = await this.tasksSchedulesPartialUpdateRaw(
+            requestParameters,
+            initOverrides,
+        );
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for tasksSchedulesRetrieve without sending the request
+     */
+    async tasksSchedulesRetrieveRequestOpts(
+        requestParameters: TasksSchedulesRetrieveRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["id"] == null) {
+            throw new runtime.RequiredError(
+                "id",
+                'Required parameter "id" was null or undefined when calling tasksSchedulesRetrieve().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/tasks/schedules/{id}/`;
+        urlPath = urlPath.replace(`{${"id"}}`, encodeURIComponent(String(requestParameters["id"])));
+
+        return {
+            path: urlPath,
+            method: "GET",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     */
+    async tasksSchedulesRetrieveRaw(
+        requestParameters: TasksSchedulesRetrieveRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<Schedule>> {
+        const requestOptions = await this.tasksSchedulesRetrieveRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => ScheduleFromJSON(jsonValue));
+    }
+
+    /**
+     */
+    async tasksSchedulesRetrieve(
+        requestParameters: TasksSchedulesRetrieveRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<Schedule> {
+        const response = await this.tasksSchedulesRetrieveRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for tasksSchedulesSendCreate without sending the request
+     */
+    async tasksSchedulesSendCreateRequestOpts(
+        requestParameters: TasksSchedulesSendCreateRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["id"] == null) {
+            throw new runtime.RequiredError(
+                "id",
+                'Required parameter "id" was null or undefined when calling tasksSchedulesSendCreate().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/tasks/schedules/{id}/send/`;
+        urlPath = urlPath.replace(`{${"id"}}`, encodeURIComponent(String(requestParameters["id"])));
+
+        return {
+            path: urlPath,
+            method: "POST",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Trigger this schedule now
+     */
+    async tasksSchedulesSendCreateRaw(
+        requestParameters: TasksSchedulesSendCreateRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<void>> {
+        const requestOptions = await this.tasksSchedulesSendCreateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.VoidApiResponse(response);
+    }
+
+    /**
+     * Trigger this schedule now
+     */
+    async tasksSchedulesSendCreate(
+        requestParameters: TasksSchedulesSendCreateRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<void> {
+        await this.tasksSchedulesSendCreateRaw(requestParameters, initOverrides);
+    }
+
+    /**
+     * Creates request options for tasksSchedulesUpdate without sending the request
+     */
+    async tasksSchedulesUpdateRequestOpts(
+        requestParameters: TasksSchedulesUpdateRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["id"] == null) {
+            throw new runtime.RequiredError(
+                "id",
+                'Required parameter "id" was null or undefined when calling tasksSchedulesUpdate().',
+            );
+        }
+
+        if (requestParameters["scheduleRequest"] == null) {
+            throw new runtime.RequiredError(
+                "scheduleRequest",
+                'Required parameter "scheduleRequest" was null or undefined when calling tasksSchedulesUpdate().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters["Content-Type"] = "application/json";
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/tasks/schedules/{id}/`;
+        urlPath = urlPath.replace(`{${"id"}}`, encodeURIComponent(String(requestParameters["id"])));
+
+        return {
+            path: urlPath,
+            method: "PUT",
+            headers: headerParameters,
+            query: queryParameters,
+            body: ScheduleRequestToJSON(requestParameters["scheduleRequest"]),
+        };
+    }
+
+    /**
+     */
+    async tasksSchedulesUpdateRaw(
+        requestParameters: TasksSchedulesUpdateRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<Schedule>> {
+        const requestOptions = await this.tasksSchedulesUpdateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => ScheduleFromJSON(jsonValue));
+    }
+
+    /**
+     */
+    async tasksSchedulesUpdate(
+        requestParameters: TasksSchedulesUpdateRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<Schedule> {
+        const response = await this.tasksSchedulesUpdateRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for tasksTasksList without sending the request
+     */
+    async tasksTasksListRequestOpts(
+        requestParameters: TasksTasksListRequest,
+    ): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        if (requestParameters["actorName"] != null) {
+            queryParameters["actor_name"] = requestParameters["actorName"];
+        }
+
+        if (requestParameters["aggregatedStatus"] != null) {
+            queryParameters["aggregated_status"] = requestParameters["aggregatedStatus"];
+        }
+
+        if (requestParameters["ordering"] != null) {
+            queryParameters["ordering"] = requestParameters["ordering"];
+        }
+
+        if (requestParameters["page"] != null) {
+            queryParameters["page"] = requestParameters["page"];
+        }
+
+        if (requestParameters["pageSize"] != null) {
+            queryParameters["page_size"] = requestParameters["pageSize"];
+        }
+
+        if (requestParameters["queueName"] != null) {
+            queryParameters["queue_name"] = requestParameters["queueName"];
+        }
+
+        if (requestParameters["relObjContentTypeAppLabel"] != null) {
+            queryParameters["rel_obj_content_type__app_label"] =
+                requestParameters["relObjContentTypeAppLabel"];
+        }
+
+        if (requestParameters["relObjContentTypeModel"] != null) {
+            queryParameters["rel_obj_content_type__model"] =
+                requestParameters["relObjContentTypeModel"];
+        }
+
+        if (requestParameters["relObjId"] != null) {
+            queryParameters["rel_obj_id"] = requestParameters["relObjId"];
+        }
+
+        if (requestParameters["relObjIdIsnull"] != null) {
+            queryParameters["rel_obj_id__isnull"] = requestParameters["relObjIdIsnull"];
+        }
+
+        if (requestParameters["search"] != null) {
+            queryParameters["search"] = requestParameters["search"];
+        }
+
+        if (requestParameters["state"] != null) {
+            queryParameters["state"] = requestParameters["state"];
+        }
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/tasks/tasks/`;
+
+        return {
+            path: urlPath,
+            method: "GET",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     */
+    async tasksTasksListRaw(
+        requestParameters: TasksTasksListRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<PaginatedTaskList>> {
+        const requestOptions = await this.tasksTasksListRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) =>
+            PaginatedTaskListFromJSON(jsonValue),
+        );
+    }
+
+    /**
+     */
+    async tasksTasksList(
+        requestParameters: TasksTasksListRequest = {},
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<PaginatedTaskList> {
+        const response = await this.tasksTasksListRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for tasksTasksRetrieve without sending the request
+     */
+    async tasksTasksRetrieveRequestOpts(
+        requestParameters: TasksTasksRetrieveRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["messageId"] == null) {
+            throw new runtime.RequiredError(
+                "messageId",
+                'Required parameter "messageId" was null or undefined when calling tasksTasksRetrieve().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/tasks/tasks/{message_id}/`;
+        urlPath = urlPath.replace(
+            `{${"message_id"}}`,
+            encodeURIComponent(String(requestParameters["messageId"])),
+        );
+
+        return {
+            path: urlPath,
+            method: "GET",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     */
+    async tasksTasksRetrieveRaw(
+        requestParameters: TasksTasksRetrieveRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<Task>> {
+        const requestOptions = await this.tasksTasksRetrieveRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => TaskFromJSON(jsonValue));
+    }
+
+    /**
+     */
+    async tasksTasksRetrieve(
+        requestParameters: TasksTasksRetrieveRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<Task> {
+        const response = await this.tasksTasksRetrieveRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for tasksTasksRetryCreate without sending the request
+     */
+    async tasksTasksRetryCreateRequestOpts(
+        requestParameters: TasksTasksRetryCreateRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["messageId"] == null) {
+            throw new runtime.RequiredError(
+                "messageId",
+                'Required parameter "messageId" was null or undefined when calling tasksTasksRetryCreate().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/tasks/tasks/{message_id}/retry/`;
+        urlPath = urlPath.replace(
+            `{${"message_id"}}`,
+            encodeURIComponent(String(requestParameters["messageId"])),
+        );
+
+        return {
+            path: urlPath,
+            method: "POST",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Retry task
+     */
+    async tasksTasksRetryCreateRaw(
+        requestParameters: TasksTasksRetryCreateRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<void>> {
+        const requestOptions = await this.tasksTasksRetryCreateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.VoidApiResponse(response);
+    }
+
+    /**
+     * Retry task
+     */
+    async tasksTasksRetryCreate(
+        requestParameters: TasksTasksRetryCreateRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<void> {
+        await this.tasksTasksRetryCreateRaw(requestParameters, initOverrides);
+    }
+
+    /**
+     * Creates request options for tasksTasksStatusRetrieve without sending the request
+     */
+    async tasksTasksStatusRetrieveRequestOpts(): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/tasks/tasks/status/`;
+
+        return {
+            path: urlPath,
+            method: "GET",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Global status summary for all tasks
+     */
+    async tasksTasksStatusRetrieveRaw(
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<GlobalTaskStatus>> {
+        const requestOptions = await this.tasksTasksStatusRetrieveRequestOpts();
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) =>
+            GlobalTaskStatusFromJSON(jsonValue),
+        );
+    }
+
+    /**
+     * Global status summary for all tasks
+     */
+    async tasksTasksStatusRetrieve(
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<GlobalTaskStatus> {
+        const response = await this.tasksTasksStatusRetrieveRaw(initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for tasksWorkersList without sending the request
+     */
+    async tasksWorkersListRequestOpts(): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/tasks/workers/`;
+
+        return {
+            path: urlPath,
+            method: "GET",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Get currently connected worker count.
+     */
+    async tasksWorkersListRaw(
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<Array<Worker>>> {
+        const requestOptions = await this.tasksWorkersListRequestOpts();
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => jsonValue.map(WorkerFromJSON));
+    }
+
+    /**
+     * Get currently connected worker count.
+     */
+    async tasksWorkersList(
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<Array<Worker>> {
+        const response = await this.tasksWorkersListRaw(initOverrides);
+        return await response.value();
+    }
+}

packages/client-ts/src/apis/TenantsApi.ts

@@ -0,0 +1,944 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import type {
+    Domain,
+    DomainRequest,
+    PaginatedDomainList,
+    PaginatedTenantList,
+    PatchedDomainRequest,
+    PatchedTenantRequest,
+    Tenant,
+    TenantAdminGroupRequestRequest,
+    TenantRecoveryKeyRequestRequest,
+    TenantRecoveryKeyResponse,
+    TenantRequest,
+} from "../models/index";
+import {
+    DomainFromJSON,
+    DomainRequestToJSON,
+    PaginatedDomainListFromJSON,
+    PaginatedTenantListFromJSON,
+    PatchedDomainRequestToJSON,
+    PatchedTenantRequestToJSON,
+    TenantAdminGroupRequestRequestToJSON,
+    TenantFromJSON,
+    TenantRecoveryKeyRequestRequestToJSON,
+    TenantRecoveryKeyResponseFromJSON,
+    TenantRequestToJSON,
+} from "../models/index";
+import * as runtime from "../runtime";
+
+export interface TenantsDomainsCreateRequest {
+    domainRequest: DomainRequest;
+}
+
+export interface TenantsDomainsDestroyRequest {
+    id: number;
+}
+
+export interface TenantsDomainsListRequest {
+    ordering?: string;
+    page?: number;
+    pageSize?: number;
+    search?: string;
+}
+
+export interface TenantsDomainsPartialUpdateRequest {
+    id: number;
+    patchedDomainRequest?: PatchedDomainRequest;
+}
+
+export interface TenantsDomainsRetrieveRequest {
+    id: number;
+}
+
+export interface TenantsDomainsUpdateRequest {
+    id: number;
+    domainRequest: DomainRequest;
+}
+
+export interface TenantsTenantsCreateRequest {
+    tenantRequest: TenantRequest;
+}
+
+export interface TenantsTenantsCreateAdminGroupCreateRequest {
+    tenantUuid: string;
+    tenantAdminGroupRequestRequest: TenantAdminGroupRequestRequest;
+}
+
+export interface TenantsTenantsCreateRecoveryKeyCreateRequest {
+    tenantUuid: string;
+    tenantRecoveryKeyRequestRequest: TenantRecoveryKeyRequestRequest;
+}
+
+export interface TenantsTenantsDestroyRequest {
+    tenantUuid: string;
+}
+
+export interface TenantsTenantsListRequest {
+    ordering?: string;
+    page?: number;
+    pageSize?: number;
+    search?: string;
+}
+
+export interface TenantsTenantsPartialUpdateRequest {
+    tenantUuid: string;
+    patchedTenantRequest?: PatchedTenantRequest;
+}
+
+export interface TenantsTenantsRetrieveRequest {
+    tenantUuid: string;
+}
+
+export interface TenantsTenantsUpdateRequest {
+    tenantUuid: string;
+    tenantRequest: TenantRequest;
+}
+
+/**
+ *
+ */
+export class TenantsApi extends runtime.BaseAPI {
+    /**
+     * Creates request options for tenantsDomainsCreate without sending the request
+     */
+    async tenantsDomainsCreateRequestOpts(
+        requestParameters: TenantsDomainsCreateRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["domainRequest"] == null) {
+            throw new runtime.RequiredError(
+                "domainRequest",
+                'Required parameter "domainRequest" was null or undefined when calling tenantsDomainsCreate().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters["Content-Type"] = "application/json";
+
+        let urlPath = `/tenants/domains/`;
+
+        return {
+            path: urlPath,
+            method: "POST",
+            headers: headerParameters,
+            query: queryParameters,
+            body: DomainRequestToJSON(requestParameters["domainRequest"]),
+        };
+    }
+
+    /**
+     * Domain ViewSet
+     */
+    async tenantsDomainsCreateRaw(
+        requestParameters: TenantsDomainsCreateRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<Domain>> {
+        const requestOptions = await this.tenantsDomainsCreateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => DomainFromJSON(jsonValue));
+    }
+
+    /**
+     * Domain ViewSet
+     */
+    async tenantsDomainsCreate(
+        requestParameters: TenantsDomainsCreateRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<Domain> {
+        const response = await this.tenantsDomainsCreateRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for tenantsDomainsDestroy without sending the request
+     */
+    async tenantsDomainsDestroyRequestOpts(
+        requestParameters: TenantsDomainsDestroyRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["id"] == null) {
+            throw new runtime.RequiredError(
+                "id",
+                'Required parameter "id" was null or undefined when calling tenantsDomainsDestroy().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        let urlPath = `/tenants/domains/{id}/`;
+        urlPath = urlPath.replace(`{${"id"}}`, encodeURIComponent(String(requestParameters["id"])));
+
+        return {
+            path: urlPath,
+            method: "DELETE",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Domain ViewSet
+     */
+    async tenantsDomainsDestroyRaw(
+        requestParameters: TenantsDomainsDestroyRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<void>> {
+        const requestOptions = await this.tenantsDomainsDestroyRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.VoidApiResponse(response);
+    }
+
+    /**
+     * Domain ViewSet
+     */
+    async tenantsDomainsDestroy(
+        requestParameters: TenantsDomainsDestroyRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<void> {
+        await this.tenantsDomainsDestroyRaw(requestParameters, initOverrides);
+    }
+
+    /**
+     * Creates request options for tenantsDomainsList without sending the request
+     */
+    async tenantsDomainsListRequestOpts(
+        requestParameters: TenantsDomainsListRequest,
+    ): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        if (requestParameters["ordering"] != null) {
+            queryParameters["ordering"] = requestParameters["ordering"];
+        }
+
+        if (requestParameters["page"] != null) {
+            queryParameters["page"] = requestParameters["page"];
+        }
+
+        if (requestParameters["pageSize"] != null) {
+            queryParameters["page_size"] = requestParameters["pageSize"];
+        }
+
+        if (requestParameters["search"] != null) {
+            queryParameters["search"] = requestParameters["search"];
+        }
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        let urlPath = `/tenants/domains/`;
+
+        return {
+            path: urlPath,
+            method: "GET",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Domain ViewSet
+     */
+    async tenantsDomainsListRaw(
+        requestParameters: TenantsDomainsListRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<PaginatedDomainList>> {
+        const requestOptions = await this.tenantsDomainsListRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) =>
+            PaginatedDomainListFromJSON(jsonValue),
+        );
+    }
+
+    /**
+     * Domain ViewSet
+     */
+    async tenantsDomainsList(
+        requestParameters: TenantsDomainsListRequest = {},
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<PaginatedDomainList> {
+        const response = await this.tenantsDomainsListRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for tenantsDomainsPartialUpdate without sending the request
+     */
+    async tenantsDomainsPartialUpdateRequestOpts(
+        requestParameters: TenantsDomainsPartialUpdateRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["id"] == null) {
+            throw new runtime.RequiredError(
+                "id",
+                'Required parameter "id" was null or undefined when calling tenantsDomainsPartialUpdate().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters["Content-Type"] = "application/json";
+
+        let urlPath = `/tenants/domains/{id}/`;
+        urlPath = urlPath.replace(`{${"id"}}`, encodeURIComponent(String(requestParameters["id"])));
+
+        return {
+            path: urlPath,
+            method: "PATCH",
+            headers: headerParameters,
+            query: queryParameters,
+            body: PatchedDomainRequestToJSON(requestParameters["patchedDomainRequest"]),
+        };
+    }
+
+    /**
+     * Domain ViewSet
+     */
+    async tenantsDomainsPartialUpdateRaw(
+        requestParameters: TenantsDomainsPartialUpdateRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<Domain>> {
+        const requestOptions = await this.tenantsDomainsPartialUpdateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => DomainFromJSON(jsonValue));
+    }
+
+    /**
+     * Domain ViewSet
+     */
+    async tenantsDomainsPartialUpdate(
+        requestParameters: TenantsDomainsPartialUpdateRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<Domain> {
+        const response = await this.tenantsDomainsPartialUpdateRaw(
+            requestParameters,
+            initOverrides,
+        );
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for tenantsDomainsRetrieve without sending the request
+     */
+    async tenantsDomainsRetrieveRequestOpts(
+        requestParameters: TenantsDomainsRetrieveRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["id"] == null) {
+            throw new runtime.RequiredError(
+                "id",
+                'Required parameter "id" was null or undefined when calling tenantsDomainsRetrieve().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        let urlPath = `/tenants/domains/{id}/`;
+        urlPath = urlPath.replace(`{${"id"}}`, encodeURIComponent(String(requestParameters["id"])));
+
+        return {
+            path: urlPath,
+            method: "GET",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Domain ViewSet
+     */
+    async tenantsDomainsRetrieveRaw(
+        requestParameters: TenantsDomainsRetrieveRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<Domain>> {
+        const requestOptions = await this.tenantsDomainsRetrieveRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => DomainFromJSON(jsonValue));
+    }
+
+    /**
+     * Domain ViewSet
+     */
+    async tenantsDomainsRetrieve(
+        requestParameters: TenantsDomainsRetrieveRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<Domain> {
+        const response = await this.tenantsDomainsRetrieveRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for tenantsDomainsUpdate without sending the request
+     */
+    async tenantsDomainsUpdateRequestOpts(
+        requestParameters: TenantsDomainsUpdateRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["id"] == null) {
+            throw new runtime.RequiredError(
+                "id",
+                'Required parameter "id" was null or undefined when calling tenantsDomainsUpdate().',
+            );
+        }
+
+        if (requestParameters["domainRequest"] == null) {
+            throw new runtime.RequiredError(
+                "domainRequest",
+                'Required parameter "domainRequest" was null or undefined when calling tenantsDomainsUpdate().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters["Content-Type"] = "application/json";
+
+        let urlPath = `/tenants/domains/{id}/`;
+        urlPath = urlPath.replace(`{${"id"}}`, encodeURIComponent(String(requestParameters["id"])));
+
+        return {
+            path: urlPath,
+            method: "PUT",
+            headers: headerParameters,
+            query: queryParameters,
+            body: DomainRequestToJSON(requestParameters["domainRequest"]),
+        };
+    }
+
+    /**
+     * Domain ViewSet
+     */
+    async tenantsDomainsUpdateRaw(
+        requestParameters: TenantsDomainsUpdateRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<Domain>> {
+        const requestOptions = await this.tenantsDomainsUpdateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => DomainFromJSON(jsonValue));
+    }
+
+    /**
+     * Domain ViewSet
+     */
+    async tenantsDomainsUpdate(
+        requestParameters: TenantsDomainsUpdateRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<Domain> {
+        const response = await this.tenantsDomainsUpdateRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for tenantsTenantsCreate without sending the request
+     */
+    async tenantsTenantsCreateRequestOpts(
+        requestParameters: TenantsTenantsCreateRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["tenantRequest"] == null) {
+            throw new runtime.RequiredError(
+                "tenantRequest",
+                'Required parameter "tenantRequest" was null or undefined when calling tenantsTenantsCreate().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters["Content-Type"] = "application/json";
+
+        let urlPath = `/tenants/tenants/`;
+
+        return {
+            path: urlPath,
+            method: "POST",
+            headers: headerParameters,
+            query: queryParameters,
+            body: TenantRequestToJSON(requestParameters["tenantRequest"]),
+        };
+    }
+
+    /**
+     * Tenant Viewset
+     */
+    async tenantsTenantsCreateRaw(
+        requestParameters: TenantsTenantsCreateRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<Tenant>> {
+        const requestOptions = await this.tenantsTenantsCreateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => TenantFromJSON(jsonValue));
+    }
+
+    /**
+     * Tenant Viewset
+     */
+    async tenantsTenantsCreate(
+        requestParameters: TenantsTenantsCreateRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<Tenant> {
+        const response = await this.tenantsTenantsCreateRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for tenantsTenantsCreateAdminGroupCreate without sending the request
+     */
+    async tenantsTenantsCreateAdminGroupCreateRequestOpts(
+        requestParameters: TenantsTenantsCreateAdminGroupCreateRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["tenantUuid"] == null) {
+            throw new runtime.RequiredError(
+                "tenantUuid",
+                'Required parameter "tenantUuid" was null or undefined when calling tenantsTenantsCreateAdminGroupCreate().',
+            );
+        }
+
+        if (requestParameters["tenantAdminGroupRequestRequest"] == null) {
+            throw new runtime.RequiredError(
+                "tenantAdminGroupRequestRequest",
+                'Required parameter "tenantAdminGroupRequestRequest" was null or undefined when calling tenantsTenantsCreateAdminGroupCreate().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters["Content-Type"] = "application/json";
+
+        let urlPath = `/tenants/tenants/{tenant_uuid}/create_admin_group/`;
+        urlPath = urlPath.replace(
+            `{${"tenant_uuid"}}`,
+            encodeURIComponent(String(requestParameters["tenantUuid"])),
+        );
+
+        return {
+            path: urlPath,
+            method: "POST",
+            headers: headerParameters,
+            query: queryParameters,
+            body: TenantAdminGroupRequestRequestToJSON(
+                requestParameters["tenantAdminGroupRequestRequest"],
+            ),
+        };
+    }
+
+    /**
+     * Create admin group and add user to it.
+     */
+    async tenantsTenantsCreateAdminGroupCreateRaw(
+        requestParameters: TenantsTenantsCreateAdminGroupCreateRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<void>> {
+        const requestOptions =
+            await this.tenantsTenantsCreateAdminGroupCreateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.VoidApiResponse(response);
+    }
+
+    /**
+     * Create admin group and add user to it.
+     */
+    async tenantsTenantsCreateAdminGroupCreate(
+        requestParameters: TenantsTenantsCreateAdminGroupCreateRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<void> {
+        await this.tenantsTenantsCreateAdminGroupCreateRaw(requestParameters, initOverrides);
+    }
+
+    /**
+     * Creates request options for tenantsTenantsCreateRecoveryKeyCreate without sending the request
+     */
+    async tenantsTenantsCreateRecoveryKeyCreateRequestOpts(
+        requestParameters: TenantsTenantsCreateRecoveryKeyCreateRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["tenantUuid"] == null) {
+            throw new runtime.RequiredError(
+                "tenantUuid",
+                'Required parameter "tenantUuid" was null or undefined when calling tenantsTenantsCreateRecoveryKeyCreate().',
+            );
+        }
+
+        if (requestParameters["tenantRecoveryKeyRequestRequest"] == null) {
+            throw new runtime.RequiredError(
+                "tenantRecoveryKeyRequestRequest",
+                'Required parameter "tenantRecoveryKeyRequestRequest" was null or undefined when calling tenantsTenantsCreateRecoveryKeyCreate().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters["Content-Type"] = "application/json";
+
+        let urlPath = `/tenants/tenants/{tenant_uuid}/create_recovery_key/`;
+        urlPath = urlPath.replace(
+            `{${"tenant_uuid"}}`,
+            encodeURIComponent(String(requestParameters["tenantUuid"])),
+        );
+
+        return {
+            path: urlPath,
+            method: "POST",
+            headers: headerParameters,
+            query: queryParameters,
+            body: TenantRecoveryKeyRequestRequestToJSON(
+                requestParameters["tenantRecoveryKeyRequestRequest"],
+            ),
+        };
+    }
+
+    /**
+     * Create recovery key for user.
+     */
+    async tenantsTenantsCreateRecoveryKeyCreateRaw(
+        requestParameters: TenantsTenantsCreateRecoveryKeyCreateRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<TenantRecoveryKeyResponse>> {
+        const requestOptions =
+            await this.tenantsTenantsCreateRecoveryKeyCreateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) =>
+            TenantRecoveryKeyResponseFromJSON(jsonValue),
+        );
+    }
+
+    /**
+     * Create recovery key for user.
+     */
+    async tenantsTenantsCreateRecoveryKeyCreate(
+        requestParameters: TenantsTenantsCreateRecoveryKeyCreateRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<TenantRecoveryKeyResponse> {
+        const response = await this.tenantsTenantsCreateRecoveryKeyCreateRaw(
+            requestParameters,
+            initOverrides,
+        );
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for tenantsTenantsDestroy without sending the request
+     */
+    async tenantsTenantsDestroyRequestOpts(
+        requestParameters: TenantsTenantsDestroyRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["tenantUuid"] == null) {
+            throw new runtime.RequiredError(
+                "tenantUuid",
+                'Required parameter "tenantUuid" was null or undefined when calling tenantsTenantsDestroy().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        let urlPath = `/tenants/tenants/{tenant_uuid}/`;
+        urlPath = urlPath.replace(
+            `{${"tenant_uuid"}}`,
+            encodeURIComponent(String(requestParameters["tenantUuid"])),
+        );
+
+        return {
+            path: urlPath,
+            method: "DELETE",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Tenant Viewset
+     */
+    async tenantsTenantsDestroyRaw(
+        requestParameters: TenantsTenantsDestroyRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<void>> {
+        const requestOptions = await this.tenantsTenantsDestroyRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.VoidApiResponse(response);
+    }
+
+    /**
+     * Tenant Viewset
+     */
+    async tenantsTenantsDestroy(
+        requestParameters: TenantsTenantsDestroyRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<void> {
+        await this.tenantsTenantsDestroyRaw(requestParameters, initOverrides);
+    }
+
+    /**
+     * Creates request options for tenantsTenantsList without sending the request
+     */
+    async tenantsTenantsListRequestOpts(
+        requestParameters: TenantsTenantsListRequest,
+    ): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        if (requestParameters["ordering"] != null) {
+            queryParameters["ordering"] = requestParameters["ordering"];
+        }
+
+        if (requestParameters["page"] != null) {
+            queryParameters["page"] = requestParameters["page"];
+        }
+
+        if (requestParameters["pageSize"] != null) {
+            queryParameters["page_size"] = requestParameters["pageSize"];
+        }
+
+        if (requestParameters["search"] != null) {
+            queryParameters["search"] = requestParameters["search"];
+        }
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        let urlPath = `/tenants/tenants/`;
+
+        return {
+            path: urlPath,
+            method: "GET",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Tenant Viewset
+     */
+    async tenantsTenantsListRaw(
+        requestParameters: TenantsTenantsListRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<PaginatedTenantList>> {
+        const requestOptions = await this.tenantsTenantsListRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) =>
+            PaginatedTenantListFromJSON(jsonValue),
+        );
+    }
+
+    /**
+     * Tenant Viewset
+     */
+    async tenantsTenantsList(
+        requestParameters: TenantsTenantsListRequest = {},
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<PaginatedTenantList> {
+        const response = await this.tenantsTenantsListRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for tenantsTenantsPartialUpdate without sending the request
+     */
+    async tenantsTenantsPartialUpdateRequestOpts(
+        requestParameters: TenantsTenantsPartialUpdateRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["tenantUuid"] == null) {
+            throw new runtime.RequiredError(
+                "tenantUuid",
+                'Required parameter "tenantUuid" was null or undefined when calling tenantsTenantsPartialUpdate().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters["Content-Type"] = "application/json";
+
+        let urlPath = `/tenants/tenants/{tenant_uuid}/`;
+        urlPath = urlPath.replace(
+            `{${"tenant_uuid"}}`,
+            encodeURIComponent(String(requestParameters["tenantUuid"])),
+        );
+
+        return {
+            path: urlPath,
+            method: "PATCH",
+            headers: headerParameters,
+            query: queryParameters,
+            body: PatchedTenantRequestToJSON(requestParameters["patchedTenantRequest"]),
+        };
+    }
+
+    /**
+     * Tenant Viewset
+     */
+    async tenantsTenantsPartialUpdateRaw(
+        requestParameters: TenantsTenantsPartialUpdateRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<Tenant>> {
+        const requestOptions = await this.tenantsTenantsPartialUpdateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => TenantFromJSON(jsonValue));
+    }
+
+    /**
+     * Tenant Viewset
+     */
+    async tenantsTenantsPartialUpdate(
+        requestParameters: TenantsTenantsPartialUpdateRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<Tenant> {
+        const response = await this.tenantsTenantsPartialUpdateRaw(
+            requestParameters,
+            initOverrides,
+        );
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for tenantsTenantsRetrieve without sending the request
+     */
+    async tenantsTenantsRetrieveRequestOpts(
+        requestParameters: TenantsTenantsRetrieveRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["tenantUuid"] == null) {
+            throw new runtime.RequiredError(
+                "tenantUuid",
+                'Required parameter "tenantUuid" was null or undefined when calling tenantsTenantsRetrieve().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        let urlPath = `/tenants/tenants/{tenant_uuid}/`;
+        urlPath = urlPath.replace(
+            `{${"tenant_uuid"}}`,
+            encodeURIComponent(String(requestParameters["tenantUuid"])),
+        );
+
+        return {
+            path: urlPath,
+            method: "GET",
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Tenant Viewset
+     */
+    async tenantsTenantsRetrieveRaw(
+        requestParameters: TenantsTenantsRetrieveRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<Tenant>> {
+        const requestOptions = await this.tenantsTenantsRetrieveRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => TenantFromJSON(jsonValue));
+    }
+
+    /**
+     * Tenant Viewset
+     */
+    async tenantsTenantsRetrieve(
+        requestParameters: TenantsTenantsRetrieveRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<Tenant> {
+        const response = await this.tenantsTenantsRetrieveRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for tenantsTenantsUpdate without sending the request
+     */
+    async tenantsTenantsUpdateRequestOpts(
+        requestParameters: TenantsTenantsUpdateRequest,
+    ): Promise<runtime.RequestOpts> {
+        if (requestParameters["tenantUuid"] == null) {
+            throw new runtime.RequiredError(
+                "tenantUuid",
+                'Required parameter "tenantUuid" was null or undefined when calling tenantsTenantsUpdate().',
+            );
+        }
+
+        if (requestParameters["tenantRequest"] == null) {
+            throw new runtime.RequiredError(
+                "tenantRequest",
+                'Required parameter "tenantRequest" was null or undefined when calling tenantsTenantsUpdate().',
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters["Content-Type"] = "application/json";
+
+        let urlPath = `/tenants/tenants/{tenant_uuid}/`;
+        urlPath = urlPath.replace(
+            `{${"tenant_uuid"}}`,
+            encodeURIComponent(String(requestParameters["tenantUuid"])),
+        );
+
+        return {
+            path: urlPath,
+            method: "PUT",
+            headers: headerParameters,
+            query: queryParameters,
+            body: TenantRequestToJSON(requestParameters["tenantRequest"]),
+        };
+    }
+
+    /**
+     * Tenant Viewset
+     */
+    async tenantsTenantsUpdateRaw(
+        requestParameters: TenantsTenantsUpdateRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<runtime.ApiResponse<Tenant>> {
+        const requestOptions = await this.tenantsTenantsUpdateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => TenantFromJSON(jsonValue));
+    }
+
+    /**
+     * Tenant Viewset
+     */
+    async tenantsTenantsUpdate(
+        requestParameters: TenantsTenantsUpdateRequest,
+        initOverrides?: RequestInit | runtime.InitOverrideFunction,
+    ): Promise<Tenant> {
+        const response = await this.tenantsTenantsUpdateRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+}

packages/client-ts/src/apis/index.ts

@@ -0,0 +1,27 @@
+/* tslint:disable */
+/* eslint-disable */
+export * from "./AdminApi";
+export * from "./AuthenticatorsApi";
+export * from "./CoreApi";
+export * from "./CryptoApi";
+export * from "./EndpointsApi";
+export * from "./EnterpriseApi";
+export * from "./EventsApi";
+export * from "./FlowsApi";
+export * from "./LifecycleApi";
+export * from "./ManagedApi";
+export * from "./Oauth2Api";
+export * from "./OutpostsApi";
+export * from "./PoliciesApi";
+export * from "./PropertymappingsApi";
+export * from "./ProvidersApi";
+export * from "./RacApi";
+export * from "./RbacApi";
+export * from "./ReportsApi";
+export * from "./RootApi";
+export * from "./SchemaApi";
+export * from "./SourcesApi";
+export * from "./SsfApi";
+export * from "./StagesApi";
+export * from "./TasksApi";
+export * from "./TenantsApi";

packages/client-ts/src/index.ts

@@ -0,0 +1,5 @@
+/* tslint:disable */
+/* eslint-disable */
+export * from "./runtime";
+export * from "./apis/index";
+export * from "./models/index";

packages/client-ts/src/models/AccessDeniedChallenge.ts

@@ -0,0 +1,114 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import type { ContextualFlowInfo } from "./ContextualFlowInfo";
+import { ContextualFlowInfoFromJSON, ContextualFlowInfoToJSON } from "./ContextualFlowInfo";
+import type { ErrorDetail } from "./ErrorDetail";
+
+/**
+ * Challenge when a flow's active stage calls `stage_invalid()`.
+ * @export
+ * @interface AccessDeniedChallenge
+ */
+export interface AccessDeniedChallenge {
+    /**
+     *
+     * @type {ContextualFlowInfo}
+     * @memberof AccessDeniedChallenge
+     */
+    flowInfo?: ContextualFlowInfo;
+    /**
+     *
+     * @type {string}
+     * @memberof AccessDeniedChallenge
+     */
+    component?: string;
+    /**
+     *
+     * @type {{ [key: string]: Array<ErrorDetail>; }}
+     * @memberof AccessDeniedChallenge
+     */
+    responseErrors?: { [key: string]: Array<ErrorDetail> };
+    /**
+     *
+     * @type {string}
+     * @memberof AccessDeniedChallenge
+     */
+    pendingUser: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AccessDeniedChallenge
+     */
+    pendingUserAvatar: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AccessDeniedChallenge
+     */
+    errorMessage?: string;
+}
+
+/**
+ * Check if a given object implements the AccessDeniedChallenge interface.
+ */
+export function instanceOfAccessDeniedChallenge(value: object): value is AccessDeniedChallenge {
+    if (!("pendingUser" in value) || value["pendingUser"] === undefined) return false;
+    if (!("pendingUserAvatar" in value) || value["pendingUserAvatar"] === undefined) return false;
+    return true;
+}
+
+export function AccessDeniedChallengeFromJSON(json: any): AccessDeniedChallenge {
+    return AccessDeniedChallengeFromJSONTyped(json, false);
+}
+
+export function AccessDeniedChallengeFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): AccessDeniedChallenge {
+    if (json == null) {
+        return json;
+    }
+    return {
+        flowInfo:
+            json["flow_info"] == null ? undefined : ContextualFlowInfoFromJSON(json["flow_info"]),
+        component: json["component"] == null ? undefined : json["component"],
+        responseErrors: json["response_errors"] == null ? undefined : json["response_errors"],
+        pendingUser: json["pending_user"],
+        pendingUserAvatar: json["pending_user_avatar"],
+        errorMessage: json["error_message"] == null ? undefined : json["error_message"],
+    };
+}
+
+export function AccessDeniedChallengeToJSON(json: any): AccessDeniedChallenge {
+    return AccessDeniedChallengeToJSONTyped(json, false);
+}
+
+export function AccessDeniedChallengeToJSONTyped(
+    value?: AccessDeniedChallenge | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        flow_info: ContextualFlowInfoToJSON(value["flowInfo"]),
+        component: value["component"],
+        response_errors: value["responseErrors"],
+        pending_user: value["pendingUser"],
+        pending_user_avatar: value["pendingUserAvatar"],
+        error_message: value["errorMessage"],
+    };
+}

packages/client-ts/src/models/AgentAuthenticationResponse.ts

@@ -0,0 +1,70 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+/**
+ * Base serializer class which doesn't implement create/update methods
+ * @export
+ * @interface AgentAuthenticationResponse
+ */
+export interface AgentAuthenticationResponse {
+    /**
+     *
+     * @type {string}
+     * @memberof AgentAuthenticationResponse
+     */
+    url: string;
+}
+
+/**
+ * Check if a given object implements the AgentAuthenticationResponse interface.
+ */
+export function instanceOfAgentAuthenticationResponse(
+    value: object,
+): value is AgentAuthenticationResponse {
+    if (!("url" in value) || value["url"] === undefined) return false;
+    return true;
+}
+
+export function AgentAuthenticationResponseFromJSON(json: any): AgentAuthenticationResponse {
+    return AgentAuthenticationResponseFromJSONTyped(json, false);
+}
+
+export function AgentAuthenticationResponseFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): AgentAuthenticationResponse {
+    if (json == null) {
+        return json;
+    }
+    return {
+        url: json["url"],
+    };
+}
+
+export function AgentAuthenticationResponseToJSON(json: any): AgentAuthenticationResponse {
+    return AgentAuthenticationResponseToJSONTyped(json, false);
+}
+
+export function AgentAuthenticationResponseToJSONTyped(
+    value?: AgentAuthenticationResponse | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        url: value["url"],
+    };
+}

packages/client-ts/src/models/AgentConfig.ts

@@ -0,0 +1,157 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import type { Config } from "./Config";
+import { ConfigFromJSON } from "./Config";
+import type { LicenseStatusEnum } from "./LicenseStatusEnum";
+import { LicenseStatusEnumFromJSON } from "./LicenseStatusEnum";
+
+/**
+ * Base serializer class which doesn't implement create/update methods
+ * @export
+ * @interface AgentConfig
+ */
+export interface AgentConfig {
+    /**
+     *
+     * @type {string}
+     * @memberof AgentConfig
+     */
+    readonly deviceId: string;
+    /**
+     *
+     * @type {number}
+     * @memberof AgentConfig
+     */
+    readonly refreshInterval: number;
+    /**
+     *
+     * @type {string}
+     * @memberof AgentConfig
+     */
+    readonly authorizationFlow: string | null;
+    /**
+     *
+     * @type {{ [key: string]: any; }}
+     * @memberof AgentConfig
+     */
+    readonly jwksAuth: { [key: string]: any };
+    /**
+     *
+     * @type {{ [key: string]: any; }}
+     * @memberof AgentConfig
+     */
+    readonly jwksChallenge: { [key: string]: any } | null;
+    /**
+     *
+     * @type {number}
+     * @memberof AgentConfig
+     */
+    nssUidOffset: number;
+    /**
+     *
+     * @type {number}
+     * @memberof AgentConfig
+     */
+    nssGidOffset: number;
+    /**
+     *
+     * @type {boolean}
+     * @memberof AgentConfig
+     */
+    authTerminateSessionOnExpiry: boolean;
+    /**
+     *
+     * @type {Config}
+     * @memberof AgentConfig
+     */
+    readonly systemConfig: Config;
+    /**
+     *
+     * @type {LicenseStatusEnum}
+     * @memberof AgentConfig
+     */
+    readonly licenseStatus: LicenseStatusEnum | null;
+}
+
+/**
+ * Check if a given object implements the AgentConfig interface.
+ */
+export function instanceOfAgentConfig(value: object): value is AgentConfig {
+    if (!("deviceId" in value) || value["deviceId"] === undefined) return false;
+    if (!("refreshInterval" in value) || value["refreshInterval"] === undefined) return false;
+    if (!("authorizationFlow" in value) || value["authorizationFlow"] === undefined) return false;
+    if (!("jwksAuth" in value) || value["jwksAuth"] === undefined) return false;
+    if (!("jwksChallenge" in value) || value["jwksChallenge"] === undefined) return false;
+    if (!("nssUidOffset" in value) || value["nssUidOffset"] === undefined) return false;
+    if (!("nssGidOffset" in value) || value["nssGidOffset"] === undefined) return false;
+    if (
+        !("authTerminateSessionOnExpiry" in value) ||
+        value["authTerminateSessionOnExpiry"] === undefined
+    )
+        return false;
+    if (!("systemConfig" in value) || value["systemConfig"] === undefined) return false;
+    if (!("licenseStatus" in value) || value["licenseStatus"] === undefined) return false;
+    return true;
+}
+
+export function AgentConfigFromJSON(json: any): AgentConfig {
+    return AgentConfigFromJSONTyped(json, false);
+}
+
+export function AgentConfigFromJSONTyped(json: any, ignoreDiscriminator: boolean): AgentConfig {
+    if (json == null) {
+        return json;
+    }
+    return {
+        deviceId: json["device_id"],
+        refreshInterval: json["refresh_interval"],
+        authorizationFlow: json["authorization_flow"],
+        jwksAuth: json["jwks_auth"],
+        jwksChallenge: json["jwks_challenge"],
+        nssUidOffset: json["nss_uid_offset"],
+        nssGidOffset: json["nss_gid_offset"],
+        authTerminateSessionOnExpiry: json["auth_terminate_session_on_expiry"],
+        systemConfig: ConfigFromJSON(json["system_config"]),
+        licenseStatus: LicenseStatusEnumFromJSON(json["license_status"]),
+    };
+}
+
+export function AgentConfigToJSON(json: any): AgentConfig {
+    return AgentConfigToJSONTyped(json, false);
+}
+
+export function AgentConfigToJSONTyped(
+    value?: Omit<
+        AgentConfig,
+        | "device_id"
+        | "refresh_interval"
+        | "authorization_flow"
+        | "jwks_auth"
+        | "jwks_challenge"
+        | "system_config"
+        | "license_status"
+    > | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        nss_uid_offset: value["nssUidOffset"],
+        nss_gid_offset: value["nssGidOffset"],
+        auth_terminate_session_on_expiry: value["authTerminateSessionOnExpiry"],
+    };
+}

packages/client-ts/src/models/AgentConnector.ts

@@ -0,0 +1,217 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+/**
+ *
+ * @export
+ * @interface AgentConnector
+ */
+export interface AgentConnector {
+    /**
+     *
+     * @type {string}
+     * @memberof AgentConnector
+     */
+    connectorUuid?: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AgentConnector
+     */
+    name: string;
+    /**
+     *
+     * @type {boolean}
+     * @memberof AgentConnector
+     */
+    enabled?: boolean;
+    /**
+     * Get object component so that we know how to edit the object
+     * @type {string}
+     * @memberof AgentConnector
+     */
+    readonly component: string;
+    /**
+     * Return object's verbose_name
+     * @type {string}
+     * @memberof AgentConnector
+     */
+    readonly verboseName: string;
+    /**
+     * Return object's plural verbose_name
+     * @type {string}
+     * @memberof AgentConnector
+     */
+    readonly verboseNamePlural: string;
+    /**
+     * Return internal model name
+     * @type {string}
+     * @memberof AgentConnector
+     */
+    readonly metaModelName: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AgentConnector
+     */
+    snapshotExpiry?: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AgentConnector
+     */
+    authSessionDuration?: string;
+    /**
+     *
+     * @type {boolean}
+     * @memberof AgentConnector
+     */
+    authTerminateSessionOnExpiry?: boolean;
+    /**
+     *
+     * @type {string}
+     * @memberof AgentConnector
+     */
+    refreshInterval?: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AgentConnector
+     */
+    authorizationFlow?: string | null;
+    /**
+     *
+     * @type {number}
+     * @memberof AgentConnector
+     */
+    nssUidOffset?: number;
+    /**
+     *
+     * @type {number}
+     * @memberof AgentConnector
+     */
+    nssGidOffset?: number;
+    /**
+     *
+     * @type {string}
+     * @memberof AgentConnector
+     */
+    challengeKey?: string | null;
+    /**
+     *
+     * @type {string}
+     * @memberof AgentConnector
+     */
+    challengeIdleTimeout?: string;
+    /**
+     *
+     * @type {boolean}
+     * @memberof AgentConnector
+     */
+    challengeTriggerCheckIn?: boolean;
+    /**
+     *
+     * @type {Array<number>}
+     * @memberof AgentConnector
+     */
+    jwtFederationProviders?: Array<number>;
+}
+
+/**
+ * Check if a given object implements the AgentConnector interface.
+ */
+export function instanceOfAgentConnector(value: object): value is AgentConnector {
+    if (!("name" in value) || value["name"] === undefined) return false;
+    if (!("component" in value) || value["component"] === undefined) return false;
+    if (!("verboseName" in value) || value["verboseName"] === undefined) return false;
+    if (!("verboseNamePlural" in value) || value["verboseNamePlural"] === undefined) return false;
+    if (!("metaModelName" in value) || value["metaModelName"] === undefined) return false;
+    return true;
+}
+
+export function AgentConnectorFromJSON(json: any): AgentConnector {
+    return AgentConnectorFromJSONTyped(json, false);
+}
+
+export function AgentConnectorFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): AgentConnector {
+    if (json == null) {
+        return json;
+    }
+    return {
+        connectorUuid: json["connector_uuid"] == null ? undefined : json["connector_uuid"],
+        name: json["name"],
+        enabled: json["enabled"] == null ? undefined : json["enabled"],
+        component: json["component"],
+        verboseName: json["verbose_name"],
+        verboseNamePlural: json["verbose_name_plural"],
+        metaModelName: json["meta_model_name"],
+        snapshotExpiry: json["snapshot_expiry"] == null ? undefined : json["snapshot_expiry"],
+        authSessionDuration:
+            json["auth_session_duration"] == null ? undefined : json["auth_session_duration"],
+        authTerminateSessionOnExpiry:
+            json["auth_terminate_session_on_expiry"] == null
+                ? undefined
+                : json["auth_terminate_session_on_expiry"],
+        refreshInterval: json["refresh_interval"] == null ? undefined : json["refresh_interval"],
+        authorizationFlow:
+            json["authorization_flow"] == null ? undefined : json["authorization_flow"],
+        nssUidOffset: json["nss_uid_offset"] == null ? undefined : json["nss_uid_offset"],
+        nssGidOffset: json["nss_gid_offset"] == null ? undefined : json["nss_gid_offset"],
+        challengeKey: json["challenge_key"] == null ? undefined : json["challenge_key"],
+        challengeIdleTimeout:
+            json["challenge_idle_timeout"] == null ? undefined : json["challenge_idle_timeout"],
+        challengeTriggerCheckIn:
+            json["challenge_trigger_check_in"] == null
+                ? undefined
+                : json["challenge_trigger_check_in"],
+        jwtFederationProviders:
+            json["jwt_federation_providers"] == null ? undefined : json["jwt_federation_providers"],
+    };
+}
+
+export function AgentConnectorToJSON(json: any): AgentConnector {
+    return AgentConnectorToJSONTyped(json, false);
+}
+
+export function AgentConnectorToJSONTyped(
+    value?: Omit<
+        AgentConnector,
+        "component" | "verbose_name" | "verbose_name_plural" | "meta_model_name"
+    > | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        connector_uuid: value["connectorUuid"],
+        name: value["name"],
+        enabled: value["enabled"],
+        snapshot_expiry: value["snapshotExpiry"],
+        auth_session_duration: value["authSessionDuration"],
+        auth_terminate_session_on_expiry: value["authTerminateSessionOnExpiry"],
+        refresh_interval: value["refreshInterval"],
+        authorization_flow: value["authorizationFlow"],
+        nss_uid_offset: value["nssUidOffset"],
+        nss_gid_offset: value["nssGidOffset"],
+        challenge_key: value["challengeKey"],
+        challenge_idle_timeout: value["challengeIdleTimeout"],
+        challenge_trigger_check_in: value["challengeTriggerCheckIn"],
+        jwt_federation_providers: value["jwtFederationProviders"],
+    };
+}

packages/client-ts/src/models/AgentConnectorRequest.ts

@@ -0,0 +1,182 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+/**
+ *
+ * @export
+ * @interface AgentConnectorRequest
+ */
+export interface AgentConnectorRequest {
+    /**
+     *
+     * @type {string}
+     * @memberof AgentConnectorRequest
+     */
+    connectorUuid?: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AgentConnectorRequest
+     */
+    name: string;
+    /**
+     *
+     * @type {boolean}
+     * @memberof AgentConnectorRequest
+     */
+    enabled?: boolean;
+    /**
+     *
+     * @type {string}
+     * @memberof AgentConnectorRequest
+     */
+    snapshotExpiry?: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AgentConnectorRequest
+     */
+    authSessionDuration?: string;
+    /**
+     *
+     * @type {boolean}
+     * @memberof AgentConnectorRequest
+     */
+    authTerminateSessionOnExpiry?: boolean;
+    /**
+     *
+     * @type {string}
+     * @memberof AgentConnectorRequest
+     */
+    refreshInterval?: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AgentConnectorRequest
+     */
+    authorizationFlow?: string | null;
+    /**
+     *
+     * @type {number}
+     * @memberof AgentConnectorRequest
+     */
+    nssUidOffset?: number;
+    /**
+     *
+     * @type {number}
+     * @memberof AgentConnectorRequest
+     */
+    nssGidOffset?: number;
+    /**
+     *
+     * @type {string}
+     * @memberof AgentConnectorRequest
+     */
+    challengeKey?: string | null;
+    /**
+     *
+     * @type {string}
+     * @memberof AgentConnectorRequest
+     */
+    challengeIdleTimeout?: string;
+    /**
+     *
+     * @type {boolean}
+     * @memberof AgentConnectorRequest
+     */
+    challengeTriggerCheckIn?: boolean;
+    /**
+     *
+     * @type {Array<number>}
+     * @memberof AgentConnectorRequest
+     */
+    jwtFederationProviders?: Array<number>;
+}
+
+/**
+ * Check if a given object implements the AgentConnectorRequest interface.
+ */
+export function instanceOfAgentConnectorRequest(value: object): value is AgentConnectorRequest {
+    if (!("name" in value) || value["name"] === undefined) return false;
+    return true;
+}
+
+export function AgentConnectorRequestFromJSON(json: any): AgentConnectorRequest {
+    return AgentConnectorRequestFromJSONTyped(json, false);
+}
+
+export function AgentConnectorRequestFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): AgentConnectorRequest {
+    if (json == null) {
+        return json;
+    }
+    return {
+        connectorUuid: json["connector_uuid"] == null ? undefined : json["connector_uuid"],
+        name: json["name"],
+        enabled: json["enabled"] == null ? undefined : json["enabled"],
+        snapshotExpiry: json["snapshot_expiry"] == null ? undefined : json["snapshot_expiry"],
+        authSessionDuration:
+            json["auth_session_duration"] == null ? undefined : json["auth_session_duration"],
+        authTerminateSessionOnExpiry:
+            json["auth_terminate_session_on_expiry"] == null
+                ? undefined
+                : json["auth_terminate_session_on_expiry"],
+        refreshInterval: json["refresh_interval"] == null ? undefined : json["refresh_interval"],
+        authorizationFlow:
+            json["authorization_flow"] == null ? undefined : json["authorization_flow"],
+        nssUidOffset: json["nss_uid_offset"] == null ? undefined : json["nss_uid_offset"],
+        nssGidOffset: json["nss_gid_offset"] == null ? undefined : json["nss_gid_offset"],
+        challengeKey: json["challenge_key"] == null ? undefined : json["challenge_key"],
+        challengeIdleTimeout:
+            json["challenge_idle_timeout"] == null ? undefined : json["challenge_idle_timeout"],
+        challengeTriggerCheckIn:
+            json["challenge_trigger_check_in"] == null
+                ? undefined
+                : json["challenge_trigger_check_in"],
+        jwtFederationProviders:
+            json["jwt_federation_providers"] == null ? undefined : json["jwt_federation_providers"],
+    };
+}
+
+export function AgentConnectorRequestToJSON(json: any): AgentConnectorRequest {
+    return AgentConnectorRequestToJSONTyped(json, false);
+}
+
+export function AgentConnectorRequestToJSONTyped(
+    value?: AgentConnectorRequest | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        connector_uuid: value["connectorUuid"],
+        name: value["name"],
+        enabled: value["enabled"],
+        snapshot_expiry: value["snapshotExpiry"],
+        auth_session_duration: value["authSessionDuration"],
+        auth_terminate_session_on_expiry: value["authTerminateSessionOnExpiry"],
+        refresh_interval: value["refreshInterval"],
+        authorization_flow: value["authorizationFlow"],
+        nss_uid_offset: value["nssUidOffset"],
+        nss_gid_offset: value["nssGidOffset"],
+        challenge_key: value["challengeKey"],
+        challenge_idle_timeout: value["challengeIdleTimeout"],
+        challenge_trigger_check_in: value["challengeTriggerCheckIn"],
+        jwt_federation_providers: value["jwtFederationProviders"],
+    };
+}

packages/client-ts/src/models/AgentPSSODeviceRegistrationRequest.ts

@@ -0,0 +1,102 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+/**
+ * Register Apple device via Platform SSO
+ * @export
+ * @interface AgentPSSODeviceRegistrationRequest
+ */
+export interface AgentPSSODeviceRegistrationRequest {
+    /**
+     *
+     * @type {string}
+     * @memberof AgentPSSODeviceRegistrationRequest
+     */
+    deviceSigningKey: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AgentPSSODeviceRegistrationRequest
+     */
+    deviceEncryptionKey: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AgentPSSODeviceRegistrationRequest
+     */
+    signKeyId: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AgentPSSODeviceRegistrationRequest
+     */
+    encKeyId: string;
+}
+
+/**
+ * Check if a given object implements the AgentPSSODeviceRegistrationRequest interface.
+ */
+export function instanceOfAgentPSSODeviceRegistrationRequest(
+    value: object,
+): value is AgentPSSODeviceRegistrationRequest {
+    if (!("deviceSigningKey" in value) || value["deviceSigningKey"] === undefined) return false;
+    if (!("deviceEncryptionKey" in value) || value["deviceEncryptionKey"] === undefined)
+        return false;
+    if (!("signKeyId" in value) || value["signKeyId"] === undefined) return false;
+    if (!("encKeyId" in value) || value["encKeyId"] === undefined) return false;
+    return true;
+}
+
+export function AgentPSSODeviceRegistrationRequestFromJSON(
+    json: any,
+): AgentPSSODeviceRegistrationRequest {
+    return AgentPSSODeviceRegistrationRequestFromJSONTyped(json, false);
+}
+
+export function AgentPSSODeviceRegistrationRequestFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): AgentPSSODeviceRegistrationRequest {
+    if (json == null) {
+        return json;
+    }
+    return {
+        deviceSigningKey: json["device_signing_key"],
+        deviceEncryptionKey: json["device_encryption_key"],
+        signKeyId: json["sign_key_id"],
+        encKeyId: json["enc_key_id"],
+    };
+}
+
+export function AgentPSSODeviceRegistrationRequestToJSON(
+    json: any,
+): AgentPSSODeviceRegistrationRequest {
+    return AgentPSSODeviceRegistrationRequestToJSONTyped(json, false);
+}
+
+export function AgentPSSODeviceRegistrationRequestToJSONTyped(
+    value?: AgentPSSODeviceRegistrationRequest | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        device_signing_key: value["deviceSigningKey"],
+        device_encryption_key: value["deviceEncryptionKey"],
+        sign_key_id: value["signKeyId"],
+        enc_key_id: value["encKeyId"],
+    };
+}

packages/client-ts/src/models/AgentPSSODeviceRegistrationResponse.ts

@@ -0,0 +1,119 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+/**
+ * authentik settings for Platform SSO tokens
+ * @export
+ * @interface AgentPSSODeviceRegistrationResponse
+ */
+export interface AgentPSSODeviceRegistrationResponse {
+    /**
+     *
+     * @type {string}
+     * @memberof AgentPSSODeviceRegistrationResponse
+     */
+    clientId: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AgentPSSODeviceRegistrationResponse
+     */
+    issuer: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AgentPSSODeviceRegistrationResponse
+     */
+    tokenEndpoint: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AgentPSSODeviceRegistrationResponse
+     */
+    jwksEndpoint: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AgentPSSODeviceRegistrationResponse
+     */
+    audience: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AgentPSSODeviceRegistrationResponse
+     */
+    nonceEndpoint: string;
+}
+
+/**
+ * Check if a given object implements the AgentPSSODeviceRegistrationResponse interface.
+ */
+export function instanceOfAgentPSSODeviceRegistrationResponse(
+    value: object,
+): value is AgentPSSODeviceRegistrationResponse {
+    if (!("clientId" in value) || value["clientId"] === undefined) return false;
+    if (!("issuer" in value) || value["issuer"] === undefined) return false;
+    if (!("tokenEndpoint" in value) || value["tokenEndpoint"] === undefined) return false;
+    if (!("jwksEndpoint" in value) || value["jwksEndpoint"] === undefined) return false;
+    if (!("audience" in value) || value["audience"] === undefined) return false;
+    if (!("nonceEndpoint" in value) || value["nonceEndpoint"] === undefined) return false;
+    return true;
+}
+
+export function AgentPSSODeviceRegistrationResponseFromJSON(
+    json: any,
+): AgentPSSODeviceRegistrationResponse {
+    return AgentPSSODeviceRegistrationResponseFromJSONTyped(json, false);
+}
+
+export function AgentPSSODeviceRegistrationResponseFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): AgentPSSODeviceRegistrationResponse {
+    if (json == null) {
+        return json;
+    }
+    return {
+        clientId: json["client_id"],
+        issuer: json["issuer"],
+        tokenEndpoint: json["token_endpoint"],
+        jwksEndpoint: json["jwks_endpoint"],
+        audience: json["audience"],
+        nonceEndpoint: json["nonce_endpoint"],
+    };
+}
+
+export function AgentPSSODeviceRegistrationResponseToJSON(
+    json: any,
+): AgentPSSODeviceRegistrationResponse {
+    return AgentPSSODeviceRegistrationResponseToJSONTyped(json, false);
+}
+
+export function AgentPSSODeviceRegistrationResponseToJSONTyped(
+    value?: AgentPSSODeviceRegistrationResponse | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        client_id: value["clientId"],
+        issuer: value["issuer"],
+        token_endpoint: value["tokenEndpoint"],
+        jwks_endpoint: value["jwksEndpoint"],
+        audience: value["audience"],
+        nonce_endpoint: value["nonceEndpoint"],
+    };
+}

packages/client-ts/src/models/AgentPSSOUserRegistrationRequest.ts

@@ -0,0 +1,93 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+/**
+ * Register Apple device user via Platform SSO
+ * @export
+ * @interface AgentPSSOUserRegistrationRequest
+ */
+export interface AgentPSSOUserRegistrationRequest {
+    /**
+     *
+     * @type {string}
+     * @memberof AgentPSSOUserRegistrationRequest
+     */
+    userAuth: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AgentPSSOUserRegistrationRequest
+     */
+    userSecureEnclaveKey: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AgentPSSOUserRegistrationRequest
+     */
+    enclaveKeyId: string;
+}
+
+/**
+ * Check if a given object implements the AgentPSSOUserRegistrationRequest interface.
+ */
+export function instanceOfAgentPSSOUserRegistrationRequest(
+    value: object,
+): value is AgentPSSOUserRegistrationRequest {
+    if (!("userAuth" in value) || value["userAuth"] === undefined) return false;
+    if (!("userSecureEnclaveKey" in value) || value["userSecureEnclaveKey"] === undefined)
+        return false;
+    if (!("enclaveKeyId" in value) || value["enclaveKeyId"] === undefined) return false;
+    return true;
+}
+
+export function AgentPSSOUserRegistrationRequestFromJSON(
+    json: any,
+): AgentPSSOUserRegistrationRequest {
+    return AgentPSSOUserRegistrationRequestFromJSONTyped(json, false);
+}
+
+export function AgentPSSOUserRegistrationRequestFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): AgentPSSOUserRegistrationRequest {
+    if (json == null) {
+        return json;
+    }
+    return {
+        userAuth: json["user_auth"],
+        userSecureEnclaveKey: json["user_secure_enclave_key"],
+        enclaveKeyId: json["enclave_key_id"],
+    };
+}
+
+export function AgentPSSOUserRegistrationRequestToJSON(
+    json: any,
+): AgentPSSOUserRegistrationRequest {
+    return AgentPSSOUserRegistrationRequestToJSONTyped(json, false);
+}
+
+export function AgentPSSOUserRegistrationRequestToJSONTyped(
+    value?: AgentPSSOUserRegistrationRequest | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        user_auth: value["userAuth"],
+        user_secure_enclave_key: value["userSecureEnclaveKey"],
+        enclave_key_id: value["enclaveKeyId"],
+    };
+}

packages/client-ts/src/models/AgentTokenResponse.ts

@@ -0,0 +1,76 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+/**
+ * Base serializer class which doesn't implement create/update methods
+ * @export
+ * @interface AgentTokenResponse
+ */
+export interface AgentTokenResponse {
+    /**
+     *
+     * @type {string}
+     * @memberof AgentTokenResponse
+     */
+    token: string;
+    /**
+     *
+     * @type {number}
+     * @memberof AgentTokenResponse
+     */
+    expiresIn?: number;
+}
+
+/**
+ * Check if a given object implements the AgentTokenResponse interface.
+ */
+export function instanceOfAgentTokenResponse(value: object): value is AgentTokenResponse {
+    if (!("token" in value) || value["token"] === undefined) return false;
+    return true;
+}
+
+export function AgentTokenResponseFromJSON(json: any): AgentTokenResponse {
+    return AgentTokenResponseFromJSONTyped(json, false);
+}
+
+export function AgentTokenResponseFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): AgentTokenResponse {
+    if (json == null) {
+        return json;
+    }
+    return {
+        token: json["token"],
+        expiresIn: json["expires_in"] == null ? undefined : json["expires_in"],
+    };
+}
+
+export function AgentTokenResponseToJSON(json: any): AgentTokenResponse {
+    return AgentTokenResponseToJSONTyped(json, false);
+}
+
+export function AgentTokenResponseToJSONTyped(
+    value?: AgentTokenResponse | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        token: value["token"],
+        expires_in: value["expiresIn"],
+    };
+}

packages/client-ts/src/models/AlgEnum.ts

@@ -0,0 +1,53 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+/**
+ *
+ * @export
+ */
+export const AlgEnum = {
+    Rsa: "rsa",
+    Ecdsa: "ecdsa",
+    Ed25519: "ed25519",
+    Ed448: "ed448",
+    UnknownDefaultOpenApi: "11184809",
+} as const;
+export type AlgEnum = (typeof AlgEnum)[keyof typeof AlgEnum];
+
+export function instanceOfAlgEnum(value: any): boolean {
+    for (const key in AlgEnum) {
+        if (Object.prototype.hasOwnProperty.call(AlgEnum, key)) {
+            if (AlgEnum[key as keyof typeof AlgEnum] === value) {
+                return true;
+            }
+        }
+    }
+    return false;
+}
+
+export function AlgEnumFromJSON(json: any): AlgEnum {
+    return AlgEnumFromJSONTyped(json, false);
+}
+
+export function AlgEnumFromJSONTyped(json: any, ignoreDiscriminator: boolean): AlgEnum {
+    return json as AlgEnum;
+}
+
+export function AlgEnumToJSON(value?: AlgEnum | null): any {
+    return value as any;
+}
+
+export function AlgEnumToJSONTyped(value: any, ignoreDiscriminator: boolean): AlgEnum {
+    return value as AlgEnum;
+}

packages/client-ts/src/models/App.ts

@@ -0,0 +1,71 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+/**
+ * Serialize Application info
+ * @export
+ * @interface App
+ */
+export interface App {
+    /**
+     *
+     * @type {string}
+     * @memberof App
+     */
+    name: string;
+    /**
+     *
+     * @type {string}
+     * @memberof App
+     */
+    label: string;
+}
+
+/**
+ * Check if a given object implements the App interface.
+ */
+export function instanceOfApp(value: object): value is App {
+    if (!("name" in value) || value["name"] === undefined) return false;
+    if (!("label" in value) || value["label"] === undefined) return false;
+    return true;
+}
+
+export function AppFromJSON(json: any): App {
+    return AppFromJSONTyped(json, false);
+}
+
+export function AppFromJSONTyped(json: any, ignoreDiscriminator: boolean): App {
+    if (json == null) {
+        return json;
+    }
+    return {
+        name: json["name"],
+        label: json["label"],
+    };
+}
+
+export function AppToJSON(json: any): App {
+    return AppToJSONTyped(json, false);
+}
+
+export function AppToJSONTyped(value?: App | null, ignoreDiscriminator: boolean = false): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        name: value["name"],
+        label: value["label"],
+    };
+}

packages/client-ts/src/models/AppEnum.ts

@@ -0,0 +1,130 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+/**
+ *
+ * @export
+ */
+export const AppEnum = {
+    AuthentikCommands: "authentik.commands",
+    AuthentikTenants: "authentik.tenants",
+    AuthentikTasks: "authentik.tasks",
+    AuthentikAdmin: "authentik.admin",
+    AuthentikApi: "authentik.api",
+    AuthentikCore: "authentik.core",
+    AuthentikCrypto: "authentik.crypto",
+    AuthentikEndpoints: "authentik.endpoints",
+    AuthentikEndpointsConnectorsAgent: "authentik.endpoints.connectors.agent",
+    AuthentikEnterprise: "authentik.enterprise",
+    AuthentikEvents: "authentik.events",
+    AuthentikAdminFiles: "authentik.admin.files",
+    AuthentikFlows: "authentik.flows",
+    AuthentikOutposts: "authentik.outposts",
+    AuthentikPoliciesDummy: "authentik.policies.dummy",
+    AuthentikPoliciesEventMatcher: "authentik.policies.event_matcher",
+    AuthentikPoliciesExpiry: "authentik.policies.expiry",
+    AuthentikPoliciesExpression: "authentik.policies.expression",
+    AuthentikPoliciesGeoip: "authentik.policies.geoip",
+    AuthentikPoliciesPassword: "authentik.policies.password",
+    AuthentikPoliciesReputation: "authentik.policies.reputation",
+    AuthentikPolicies: "authentik.policies",
+    AuthentikProvidersLdap: "authentik.providers.ldap",
+    AuthentikProvidersOauth2: "authentik.providers.oauth2",
+    AuthentikProvidersProxy: "authentik.providers.proxy",
+    AuthentikProvidersRac: "authentik.providers.rac",
+    AuthentikProvidersRadius: "authentik.providers.radius",
+    AuthentikProvidersSaml: "authentik.providers.saml",
+    AuthentikProvidersScim: "authentik.providers.scim",
+    AuthentikRbac: "authentik.rbac",
+    AuthentikRecovery: "authentik.recovery",
+    AuthentikSourcesKerberos: "authentik.sources.kerberos",
+    AuthentikSourcesLdap: "authentik.sources.ldap",
+    AuthentikSourcesOauth: "authentik.sources.oauth",
+    AuthentikSourcesPlex: "authentik.sources.plex",
+    AuthentikSourcesSaml: "authentik.sources.saml",
+    AuthentikSourcesScim: "authentik.sources.scim",
+    AuthentikSourcesTelegram: "authentik.sources.telegram",
+    AuthentikStagesAuthenticator: "authentik.stages.authenticator",
+    AuthentikStagesAuthenticatorDuo: "authentik.stages.authenticator_duo",
+    AuthentikStagesAuthenticatorEmail: "authentik.stages.authenticator_email",
+    AuthentikStagesAuthenticatorSms: "authentik.stages.authenticator_sms",
+    AuthentikStagesAuthenticatorStatic: "authentik.stages.authenticator_static",
+    AuthentikStagesAuthenticatorTotp: "authentik.stages.authenticator_totp",
+    AuthentikStagesAuthenticatorValidate: "authentik.stages.authenticator_validate",
+    AuthentikStagesAuthenticatorWebauthn: "authentik.stages.authenticator_webauthn",
+    AuthentikStagesCaptcha: "authentik.stages.captcha",
+    AuthentikStagesConsent: "authentik.stages.consent",
+    AuthentikStagesDeny: "authentik.stages.deny",
+    AuthentikStagesDummy: "authentik.stages.dummy",
+    AuthentikStagesEmail: "authentik.stages.email",
+    AuthentikStagesIdentification: "authentik.stages.identification",
+    AuthentikStagesInvitation: "authentik.stages.invitation",
+    AuthentikStagesPassword: "authentik.stages.password",
+    AuthentikStagesPrompt: "authentik.stages.prompt",
+    AuthentikStagesRedirect: "authentik.stages.redirect",
+    AuthentikStagesUserDelete: "authentik.stages.user_delete",
+    AuthentikStagesUserLogin: "authentik.stages.user_login",
+    AuthentikStagesUserLogout: "authentik.stages.user_logout",
+    AuthentikStagesUserWrite: "authentik.stages.user_write",
+    AuthentikTasksSchedules: "authentik.tasks.schedules",
+    AuthentikBrands: "authentik.brands",
+    AuthentikBlueprints: "authentik.blueprints",
+    AuthentikEnterpriseAudit: "authentik.enterprise.audit",
+    AuthentikEnterpriseEndpointsConnectorsAgent: "authentik.enterprise.endpoints.connectors.agent",
+    AuthentikEnterpriseEndpointsConnectorsFleet: "authentik.enterprise.endpoints.connectors.fleet",
+    AuthentikEnterpriseEndpointsConnectorsGoogleChrome:
+        "authentik.enterprise.endpoints.connectors.google_chrome",
+    AuthentikEnterpriseLifecycle: "authentik.enterprise.lifecycle",
+    AuthentikEnterprisePoliciesUniquePassword: "authentik.enterprise.policies.unique_password",
+    AuthentikEnterpriseProvidersGoogleWorkspace: "authentik.enterprise.providers.google_workspace",
+    AuthentikEnterpriseProvidersMicrosoftEntra: "authentik.enterprise.providers.microsoft_entra",
+    AuthentikEnterpriseProvidersRadius: "authentik.enterprise.providers.radius",
+    AuthentikEnterpriseProvidersScim: "authentik.enterprise.providers.scim",
+    AuthentikEnterpriseProvidersSsf: "authentik.enterprise.providers.ssf",
+    AuthentikEnterpriseProvidersWsFederation: "authentik.enterprise.providers.ws_federation",
+    AuthentikEnterpriseReports: "authentik.enterprise.reports",
+    AuthentikEnterpriseStagesAuthenticatorEndpointGdtc:
+        "authentik.enterprise.stages.authenticator_endpoint_gdtc",
+    AuthentikEnterpriseStagesMtls: "authentik.enterprise.stages.mtls",
+    AuthentikEnterpriseStagesSource: "authentik.enterprise.stages.source",
+    UnknownDefaultOpenApi: "11184809",
+} as const;
+export type AppEnum = (typeof AppEnum)[keyof typeof AppEnum];
+
+export function instanceOfAppEnum(value: any): boolean {
+    for (const key in AppEnum) {
+        if (Object.prototype.hasOwnProperty.call(AppEnum, key)) {
+            if (AppEnum[key as keyof typeof AppEnum] === value) {
+                return true;
+            }
+        }
+    }
+    return false;
+}
+
+export function AppEnumFromJSON(json: any): AppEnum {
+    return AppEnumFromJSONTyped(json, false);
+}
+
+export function AppEnumFromJSONTyped(json: any, ignoreDiscriminator: boolean): AppEnum {
+    return json as AppEnum;
+}
+
+export function AppEnumToJSON(value?: AppEnum | null): any {
+    return value as any;
+}
+
+export function AppEnumToJSONTyped(value: any, ignoreDiscriminator: boolean): AppEnum {
+    return value as AppEnum;
+}

packages/client-ts/src/models/AppleChallengeResponseRequest.ts

@@ -0,0 +1,69 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+/**
+ * Pseudo class for apple response
+ * @export
+ * @interface AppleChallengeResponseRequest
+ */
+export interface AppleChallengeResponseRequest {
+    /**
+     *
+     * @type {string}
+     * @memberof AppleChallengeResponseRequest
+     */
+    component?: string;
+}
+
+/**
+ * Check if a given object implements the AppleChallengeResponseRequest interface.
+ */
+export function instanceOfAppleChallengeResponseRequest(
+    value: object,
+): value is AppleChallengeResponseRequest {
+    return true;
+}
+
+export function AppleChallengeResponseRequestFromJSON(json: any): AppleChallengeResponseRequest {
+    return AppleChallengeResponseRequestFromJSONTyped(json, false);
+}
+
+export function AppleChallengeResponseRequestFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): AppleChallengeResponseRequest {
+    if (json == null) {
+        return json;
+    }
+    return {
+        component: json["component"] == null ? undefined : json["component"],
+    };
+}
+
+export function AppleChallengeResponseRequestToJSON(json: any): AppleChallengeResponseRequest {
+    return AppleChallengeResponseRequestToJSONTyped(json, false);
+}
+
+export function AppleChallengeResponseRequestToJSONTyped(
+    value?: AppleChallengeResponseRequest | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        component: value["component"],
+    };
+}

packages/client-ts/src/models/AppleLoginChallenge.ts

@@ -0,0 +1,124 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import type { ContextualFlowInfo } from "./ContextualFlowInfo";
+import { ContextualFlowInfoFromJSON, ContextualFlowInfoToJSON } from "./ContextualFlowInfo";
+import type { ErrorDetail } from "./ErrorDetail";
+
+/**
+ * Special challenge for apple-native authentication flow, which happens on the client.
+ * @export
+ * @interface AppleLoginChallenge
+ */
+export interface AppleLoginChallenge {
+    /**
+     *
+     * @type {ContextualFlowInfo}
+     * @memberof AppleLoginChallenge
+     */
+    flowInfo?: ContextualFlowInfo;
+    /**
+     *
+     * @type {string}
+     * @memberof AppleLoginChallenge
+     */
+    component?: string;
+    /**
+     *
+     * @type {{ [key: string]: Array<ErrorDetail>; }}
+     * @memberof AppleLoginChallenge
+     */
+    responseErrors?: { [key: string]: Array<ErrorDetail> };
+    /**
+     *
+     * @type {string}
+     * @memberof AppleLoginChallenge
+     */
+    clientId: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AppleLoginChallenge
+     */
+    scope: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AppleLoginChallenge
+     */
+    redirectUri: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AppleLoginChallenge
+     */
+    state: string;
+}
+
+/**
+ * Check if a given object implements the AppleLoginChallenge interface.
+ */
+export function instanceOfAppleLoginChallenge(value: object): value is AppleLoginChallenge {
+    if (!("clientId" in value) || value["clientId"] === undefined) return false;
+    if (!("scope" in value) || value["scope"] === undefined) return false;
+    if (!("redirectUri" in value) || value["redirectUri"] === undefined) return false;
+    if (!("state" in value) || value["state"] === undefined) return false;
+    return true;
+}
+
+export function AppleLoginChallengeFromJSON(json: any): AppleLoginChallenge {
+    return AppleLoginChallengeFromJSONTyped(json, false);
+}
+
+export function AppleLoginChallengeFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): AppleLoginChallenge {
+    if (json == null) {
+        return json;
+    }
+    return {
+        flowInfo:
+            json["flow_info"] == null ? undefined : ContextualFlowInfoFromJSON(json["flow_info"]),
+        component: json["component"] == null ? undefined : json["component"],
+        responseErrors: json["response_errors"] == null ? undefined : json["response_errors"],
+        clientId: json["client_id"],
+        scope: json["scope"],
+        redirectUri: json["redirect_uri"],
+        state: json["state"],
+    };
+}
+
+export function AppleLoginChallengeToJSON(json: any): AppleLoginChallenge {
+    return AppleLoginChallengeToJSONTyped(json, false);
+}
+
+export function AppleLoginChallengeToJSONTyped(
+    value?: AppleLoginChallenge | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        flow_info: ContextualFlowInfoToJSON(value["flowInfo"]),
+        component: value["component"],
+        response_errors: value["responseErrors"],
+        client_id: value["clientId"],
+        scope: value["scope"],
+        redirect_uri: value["redirectUri"],
+        state: value["state"],
+    };
+}

packages/client-ts/src/models/Application.ts

@@ -0,0 +1,216 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import type { PolicyEngineMode } from "./PolicyEngineMode";
+import { PolicyEngineModeFromJSON, PolicyEngineModeToJSON } from "./PolicyEngineMode";
+import type { Provider } from "./Provider";
+import { ProviderFromJSON } from "./Provider";
+import type { ThemedUrls } from "./ThemedUrls";
+import { ThemedUrlsFromJSON } from "./ThemedUrls";
+
+/**
+ * Application Serializer
+ * @export
+ * @interface Application
+ */
+export interface Application {
+    /**
+     *
+     * @type {string}
+     * @memberof Application
+     */
+    readonly pk: string;
+    /**
+     * Application's display Name.
+     * @type {string}
+     * @memberof Application
+     */
+    name: string;
+    /**
+     * Internal application name, used in URLs.
+     * @type {string}
+     * @memberof Application
+     */
+    slug: string;
+    /**
+     *
+     * @type {number}
+     * @memberof Application
+     */
+    provider?: number | null;
+    /**
+     *
+     * @type {Provider}
+     * @memberof Application
+     */
+    readonly providerObj: Provider | null;
+    /**
+     *
+     * @type {Array<number>}
+     * @memberof Application
+     */
+    backchannelProviders?: Array<number>;
+    /**
+     *
+     * @type {Array<Provider>}
+     * @memberof Application
+     */
+    readonly backchannelProvidersObj: Array<Provider>;
+    /**
+     * Allow formatting of launch URL
+     * @type {string}
+     * @memberof Application
+     */
+    readonly launchUrl: string | null;
+    /**
+     * Open launch URL in a new browser tab or window.
+     * @type {boolean}
+     * @memberof Application
+     */
+    openInNewTab?: boolean;
+    /**
+     *
+     * @type {string}
+     * @memberof Application
+     */
+    metaLaunchUrl?: string;
+    /**
+     *
+     * @type {string}
+     * @memberof Application
+     */
+    metaIcon?: string;
+    /**
+     * Get the URL to the App Icon image
+     * @type {string}
+     * @memberof Application
+     */
+    readonly metaIconUrl: string | null;
+    /**
+     *
+     * @type {ThemedUrls}
+     * @memberof Application
+     */
+    readonly metaIconThemedUrls: ThemedUrls | null;
+    /**
+     *
+     * @type {string}
+     * @memberof Application
+     */
+    metaDescription?: string;
+    /**
+     *
+     * @type {string}
+     * @memberof Application
+     */
+    metaPublisher?: string;
+    /**
+     *
+     * @type {PolicyEngineMode}
+     * @memberof Application
+     */
+    policyEngineMode?: PolicyEngineMode;
+    /**
+     *
+     * @type {string}
+     * @memberof Application
+     */
+    group?: string;
+}
+
+/**
+ * Check if a given object implements the Application interface.
+ */
+export function instanceOfApplication(value: object): value is Application {
+    if (!("pk" in value) || value["pk"] === undefined) return false;
+    if (!("name" in value) || value["name"] === undefined) return false;
+    if (!("slug" in value) || value["slug"] === undefined) return false;
+    if (!("providerObj" in value) || value["providerObj"] === undefined) return false;
+    if (!("backchannelProvidersObj" in value) || value["backchannelProvidersObj"] === undefined)
+        return false;
+    if (!("launchUrl" in value) || value["launchUrl"] === undefined) return false;
+    if (!("metaIconUrl" in value) || value["metaIconUrl"] === undefined) return false;
+    if (!("metaIconThemedUrls" in value) || value["metaIconThemedUrls"] === undefined) return false;
+    return true;
+}
+
+export function ApplicationFromJSON(json: any): Application {
+    return ApplicationFromJSONTyped(json, false);
+}
+
+export function ApplicationFromJSONTyped(json: any, ignoreDiscriminator: boolean): Application {
+    if (json == null) {
+        return json;
+    }
+    return {
+        pk: json["pk"],
+        name: json["name"],
+        slug: json["slug"],
+        provider: json["provider"] == null ? undefined : json["provider"],
+        providerObj: ProviderFromJSON(json["provider_obj"]),
+        backchannelProviders:
+            json["backchannel_providers"] == null ? undefined : json["backchannel_providers"],
+        backchannelProvidersObj: (json["backchannel_providers_obj"] as Array<any>).map(
+            ProviderFromJSON,
+        ),
+        launchUrl: json["launch_url"],
+        openInNewTab: json["open_in_new_tab"] == null ? undefined : json["open_in_new_tab"],
+        metaLaunchUrl: json["meta_launch_url"] == null ? undefined : json["meta_launch_url"],
+        metaIcon: json["meta_icon"] == null ? undefined : json["meta_icon"],
+        metaIconUrl: json["meta_icon_url"],
+        metaIconThemedUrls: ThemedUrlsFromJSON(json["meta_icon_themed_urls"]),
+        metaDescription: json["meta_description"] == null ? undefined : json["meta_description"],
+        metaPublisher: json["meta_publisher"] == null ? undefined : json["meta_publisher"],
+        policyEngineMode:
+            json["policy_engine_mode"] == null
+                ? undefined
+                : PolicyEngineModeFromJSON(json["policy_engine_mode"]),
+        group: json["group"] == null ? undefined : json["group"],
+    };
+}
+
+export function ApplicationToJSON(json: any): Application {
+    return ApplicationToJSONTyped(json, false);
+}
+
+export function ApplicationToJSONTyped(
+    value?: Omit<
+        Application,
+        | "pk"
+        | "provider_obj"
+        | "backchannel_providers_obj"
+        | "launch_url"
+        | "meta_icon_url"
+        | "meta_icon_themed_urls"
+    > | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        name: value["name"],
+        slug: value["slug"],
+        provider: value["provider"],
+        backchannel_providers: value["backchannelProviders"],
+        open_in_new_tab: value["openInNewTab"],
+        meta_launch_url: value["metaLaunchUrl"],
+        meta_icon: value["metaIcon"],
+        meta_description: value["metaDescription"],
+        meta_publisher: value["metaPublisher"],
+        policy_engine_mode: PolicyEngineModeToJSON(value["policyEngineMode"]),
+        group: value["group"],
+    };
+}

packages/client-ts/src/models/ApplicationEntitlement.ts

@@ -0,0 +1,93 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+/**
+ * ApplicationEntitlement Serializer
+ * @export
+ * @interface ApplicationEntitlement
+ */
+export interface ApplicationEntitlement {
+    /**
+     *
+     * @type {string}
+     * @memberof ApplicationEntitlement
+     */
+    readonly pbmUuid: string;
+    /**
+     *
+     * @type {string}
+     * @memberof ApplicationEntitlement
+     */
+    name: string;
+    /**
+     *
+     * @type {string}
+     * @memberof ApplicationEntitlement
+     */
+    app: string;
+    /**
+     *
+     * @type {{ [key: string]: any; }}
+     * @memberof ApplicationEntitlement
+     */
+    attributes?: { [key: string]: any };
+}
+
+/**
+ * Check if a given object implements the ApplicationEntitlement interface.
+ */
+export function instanceOfApplicationEntitlement(value: object): value is ApplicationEntitlement {
+    if (!("pbmUuid" in value) || value["pbmUuid"] === undefined) return false;
+    if (!("name" in value) || value["name"] === undefined) return false;
+    if (!("app" in value) || value["app"] === undefined) return false;
+    return true;
+}
+
+export function ApplicationEntitlementFromJSON(json: any): ApplicationEntitlement {
+    return ApplicationEntitlementFromJSONTyped(json, false);
+}
+
+export function ApplicationEntitlementFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): ApplicationEntitlement {
+    if (json == null) {
+        return json;
+    }
+    return {
+        pbmUuid: json["pbm_uuid"],
+        name: json["name"],
+        app: json["app"],
+        attributes: json["attributes"] == null ? undefined : json["attributes"],
+    };
+}
+
+export function ApplicationEntitlementToJSON(json: any): ApplicationEntitlement {
+    return ApplicationEntitlementToJSONTyped(json, false);
+}
+
+export function ApplicationEntitlementToJSONTyped(
+    value?: Omit<ApplicationEntitlement, "pbm_uuid"> | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        name: value["name"],
+        app: value["app"],
+        attributes: value["attributes"],
+    };
+}

packages/client-ts/src/models/ApplicationEntitlementRequest.ts

@@ -0,0 +1,87 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+/**
+ * ApplicationEntitlement Serializer
+ * @export
+ * @interface ApplicationEntitlementRequest
+ */
+export interface ApplicationEntitlementRequest {
+    /**
+     *
+     * @type {string}
+     * @memberof ApplicationEntitlementRequest
+     */
+    name: string;
+    /**
+     *
+     * @type {string}
+     * @memberof ApplicationEntitlementRequest
+     */
+    app: string;
+    /**
+     *
+     * @type {{ [key: string]: any; }}
+     * @memberof ApplicationEntitlementRequest
+     */
+    attributes?: { [key: string]: any };
+}
+
+/**
+ * Check if a given object implements the ApplicationEntitlementRequest interface.
+ */
+export function instanceOfApplicationEntitlementRequest(
+    value: object,
+): value is ApplicationEntitlementRequest {
+    if (!("name" in value) || value["name"] === undefined) return false;
+    if (!("app" in value) || value["app"] === undefined) return false;
+    return true;
+}
+
+export function ApplicationEntitlementRequestFromJSON(json: any): ApplicationEntitlementRequest {
+    return ApplicationEntitlementRequestFromJSONTyped(json, false);
+}
+
+export function ApplicationEntitlementRequestFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): ApplicationEntitlementRequest {
+    if (json == null) {
+        return json;
+    }
+    return {
+        name: json["name"],
+        app: json["app"],
+        attributes: json["attributes"] == null ? undefined : json["attributes"],
+    };
+}
+
+export function ApplicationEntitlementRequestToJSON(json: any): ApplicationEntitlementRequest {
+    return ApplicationEntitlementRequestToJSONTyped(json, false);
+}
+
+export function ApplicationEntitlementRequestToJSONTyped(
+    value?: ApplicationEntitlementRequest | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        name: value["name"],
+        app: value["app"],
+        attributes: value["attributes"],
+    };
+}

packages/client-ts/src/models/ApplicationRequest.ts

@@ -0,0 +1,156 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import type { PolicyEngineMode } from "./PolicyEngineMode";
+import { PolicyEngineModeFromJSON, PolicyEngineModeToJSON } from "./PolicyEngineMode";
+
+/**
+ * Application Serializer
+ * @export
+ * @interface ApplicationRequest
+ */
+export interface ApplicationRequest {
+    /**
+     * Application's display Name.
+     * @type {string}
+     * @memberof ApplicationRequest
+     */
+    name: string;
+    /**
+     * Internal application name, used in URLs.
+     * @type {string}
+     * @memberof ApplicationRequest
+     */
+    slug: string;
+    /**
+     *
+     * @type {number}
+     * @memberof ApplicationRequest
+     */
+    provider?: number | null;
+    /**
+     *
+     * @type {Array<number>}
+     * @memberof ApplicationRequest
+     */
+    backchannelProviders?: Array<number>;
+    /**
+     * Open launch URL in a new browser tab or window.
+     * @type {boolean}
+     * @memberof ApplicationRequest
+     */
+    openInNewTab?: boolean;
+    /**
+     *
+     * @type {string}
+     * @memberof ApplicationRequest
+     */
+    metaLaunchUrl?: string;
+    /**
+     *
+     * @type {string}
+     * @memberof ApplicationRequest
+     */
+    metaIcon?: string;
+    /**
+     *
+     * @type {string}
+     * @memberof ApplicationRequest
+     */
+    metaDescription?: string;
+    /**
+     *
+     * @type {string}
+     * @memberof ApplicationRequest
+     */
+    metaPublisher?: string;
+    /**
+     *
+     * @type {PolicyEngineMode}
+     * @memberof ApplicationRequest
+     */
+    policyEngineMode?: PolicyEngineMode;
+    /**
+     *
+     * @type {string}
+     * @memberof ApplicationRequest
+     */
+    group?: string;
+}
+
+/**
+ * Check if a given object implements the ApplicationRequest interface.
+ */
+export function instanceOfApplicationRequest(value: object): value is ApplicationRequest {
+    if (!("name" in value) || value["name"] === undefined) return false;
+    if (!("slug" in value) || value["slug"] === undefined) return false;
+    return true;
+}
+
+export function ApplicationRequestFromJSON(json: any): ApplicationRequest {
+    return ApplicationRequestFromJSONTyped(json, false);
+}
+
+export function ApplicationRequestFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): ApplicationRequest {
+    if (json == null) {
+        return json;
+    }
+    return {
+        name: json["name"],
+        slug: json["slug"],
+        provider: json["provider"] == null ? undefined : json["provider"],
+        backchannelProviders:
+            json["backchannel_providers"] == null ? undefined : json["backchannel_providers"],
+        openInNewTab: json["open_in_new_tab"] == null ? undefined : json["open_in_new_tab"],
+        metaLaunchUrl: json["meta_launch_url"] == null ? undefined : json["meta_launch_url"],
+        metaIcon: json["meta_icon"] == null ? undefined : json["meta_icon"],
+        metaDescription: json["meta_description"] == null ? undefined : json["meta_description"],
+        metaPublisher: json["meta_publisher"] == null ? undefined : json["meta_publisher"],
+        policyEngineMode:
+            json["policy_engine_mode"] == null
+                ? undefined
+                : PolicyEngineModeFromJSON(json["policy_engine_mode"]),
+        group: json["group"] == null ? undefined : json["group"],
+    };
+}
+
+export function ApplicationRequestToJSON(json: any): ApplicationRequest {
+    return ApplicationRequestToJSONTyped(json, false);
+}
+
+export function ApplicationRequestToJSONTyped(
+    value?: ApplicationRequest | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        name: value["name"],
+        slug: value["slug"],
+        provider: value["provider"],
+        backchannel_providers: value["backchannelProviders"],
+        open_in_new_tab: value["openInNewTab"],
+        meta_launch_url: value["metaLaunchUrl"],
+        meta_icon: value["metaIcon"],
+        meta_description: value["metaDescription"],
+        meta_publisher: value["metaPublisher"],
+        policy_engine_mode: PolicyEngineModeToJSON(value["policyEngineMode"]),
+        group: value["group"],
+    };
+}

packages/client-ts/src/models/AuthTypeEnum.ts

@@ -0,0 +1,51 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+/**
+ *
+ * @export
+ */
+export const AuthTypeEnum = {
+    Basic: "basic",
+    Bearer: "bearer",
+    UnknownDefaultOpenApi: "11184809",
+} as const;
+export type AuthTypeEnum = (typeof AuthTypeEnum)[keyof typeof AuthTypeEnum];
+
+export function instanceOfAuthTypeEnum(value: any): boolean {
+    for (const key in AuthTypeEnum) {
+        if (Object.prototype.hasOwnProperty.call(AuthTypeEnum, key)) {
+            if (AuthTypeEnum[key as keyof typeof AuthTypeEnum] === value) {
+                return true;
+            }
+        }
+    }
+    return false;
+}
+
+export function AuthTypeEnumFromJSON(json: any): AuthTypeEnum {
+    return AuthTypeEnumFromJSONTyped(json, false);
+}
+
+export function AuthTypeEnumFromJSONTyped(json: any, ignoreDiscriminator: boolean): AuthTypeEnum {
+    return json as AuthTypeEnum;
+}
+
+export function AuthTypeEnumToJSON(value?: AuthTypeEnum | null): any {
+    return value as any;
+}
+
+export function AuthTypeEnumToJSONTyped(value: any, ignoreDiscriminator: boolean): AuthTypeEnum {
+    return value as AuthTypeEnum;
+}

packages/client-ts/src/models/AuthenticatedSession.ts

@@ -0,0 +1,162 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import type { AuthenticatedSessionAsn } from "./AuthenticatedSessionAsn";
+import {
+    AuthenticatedSessionAsnFromJSON,
+    AuthenticatedSessionAsnToJSON,
+} from "./AuthenticatedSessionAsn";
+import type { AuthenticatedSessionGeoIp } from "./AuthenticatedSessionGeoIp";
+import {
+    AuthenticatedSessionGeoIpFromJSON,
+    AuthenticatedSessionGeoIpToJSON,
+} from "./AuthenticatedSessionGeoIp";
+import type { AuthenticatedSessionUserAgent } from "./AuthenticatedSessionUserAgent";
+import {
+    AuthenticatedSessionUserAgentFromJSON,
+    AuthenticatedSessionUserAgentToJSON,
+} from "./AuthenticatedSessionUserAgent";
+
+/**
+ * AuthenticatedSession Serializer
+ * @export
+ * @interface AuthenticatedSession
+ */
+export interface AuthenticatedSession {
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatedSession
+     */
+    uuid?: string;
+    /**
+     * Check if session is currently active session
+     * @type {boolean}
+     * @memberof AuthenticatedSession
+     */
+    readonly current: boolean;
+    /**
+     *
+     * @type {AuthenticatedSessionUserAgent}
+     * @memberof AuthenticatedSession
+     */
+    userAgent: AuthenticatedSessionUserAgent;
+    /**
+     *
+     * @type {AuthenticatedSessionGeoIp}
+     * @memberof AuthenticatedSession
+     */
+    geoIp: AuthenticatedSessionGeoIp | null;
+    /**
+     *
+     * @type {AuthenticatedSessionAsn}
+     * @memberof AuthenticatedSession
+     */
+    asn: AuthenticatedSessionAsn | null;
+    /**
+     *
+     * @type {number}
+     * @memberof AuthenticatedSession
+     */
+    user: number;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatedSession
+     */
+    readonly lastIp: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatedSession
+     */
+    readonly lastUserAgent: string;
+    /**
+     *
+     * @type {Date}
+     * @memberof AuthenticatedSession
+     */
+    readonly lastUsed: Date;
+    /**
+     *
+     * @type {Date}
+     * @memberof AuthenticatedSession
+     */
+    readonly expires: Date;
+}
+
+/**
+ * Check if a given object implements the AuthenticatedSession interface.
+ */
+export function instanceOfAuthenticatedSession(value: object): value is AuthenticatedSession {
+    if (!("current" in value) || value["current"] === undefined) return false;
+    if (!("userAgent" in value) || value["userAgent"] === undefined) return false;
+    if (!("geoIp" in value) || value["geoIp"] === undefined) return false;
+    if (!("asn" in value) || value["asn"] === undefined) return false;
+    if (!("user" in value) || value["user"] === undefined) return false;
+    if (!("lastIp" in value) || value["lastIp"] === undefined) return false;
+    if (!("lastUserAgent" in value) || value["lastUserAgent"] === undefined) return false;
+    if (!("lastUsed" in value) || value["lastUsed"] === undefined) return false;
+    if (!("expires" in value) || value["expires"] === undefined) return false;
+    return true;
+}
+
+export function AuthenticatedSessionFromJSON(json: any): AuthenticatedSession {
+    return AuthenticatedSessionFromJSONTyped(json, false);
+}
+
+export function AuthenticatedSessionFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): AuthenticatedSession {
+    if (json == null) {
+        return json;
+    }
+    return {
+        uuid: json["uuid"] == null ? undefined : json["uuid"],
+        current: json["current"],
+        userAgent: AuthenticatedSessionUserAgentFromJSON(json["user_agent"]),
+        geoIp: AuthenticatedSessionGeoIpFromJSON(json["geo_ip"]),
+        asn: AuthenticatedSessionAsnFromJSON(json["asn"]),
+        user: json["user"],
+        lastIp: json["last_ip"],
+        lastUserAgent: json["last_user_agent"],
+        lastUsed: new Date(json["last_used"]),
+        expires: new Date(json["expires"]),
+    };
+}
+
+export function AuthenticatedSessionToJSON(json: any): AuthenticatedSession {
+    return AuthenticatedSessionToJSONTyped(json, false);
+}
+
+export function AuthenticatedSessionToJSONTyped(
+    value?: Omit<
+        AuthenticatedSession,
+        "current" | "last_ip" | "last_user_agent" | "last_used" | "expires"
+    > | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        uuid: value["uuid"],
+        user_agent: AuthenticatedSessionUserAgentToJSON(value["userAgent"]),
+        geo_ip: AuthenticatedSessionGeoIpToJSON(value["geoIp"]),
+        asn: AuthenticatedSessionAsnToJSON(value["asn"]),
+        user: value["user"],
+    };
+}

packages/client-ts/src/models/AuthenticatedSessionAsn.ts

@@ -0,0 +1,86 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+/**
+ * Get ASN Data
+ * @export
+ * @interface AuthenticatedSessionAsn
+ */
+export interface AuthenticatedSessionAsn {
+    /**
+     *
+     * @type {number}
+     * @memberof AuthenticatedSessionAsn
+     */
+    asn: number | null;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatedSessionAsn
+     */
+    asOrg: string | null;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatedSessionAsn
+     */
+    network: string | null;
+}
+
+/**
+ * Check if a given object implements the AuthenticatedSessionAsn interface.
+ */
+export function instanceOfAuthenticatedSessionAsn(value: object): value is AuthenticatedSessionAsn {
+    if (!("asn" in value) || value["asn"] === undefined) return false;
+    if (!("asOrg" in value) || value["asOrg"] === undefined) return false;
+    if (!("network" in value) || value["network"] === undefined) return false;
+    return true;
+}
+
+export function AuthenticatedSessionAsnFromJSON(json: any): AuthenticatedSessionAsn {
+    return AuthenticatedSessionAsnFromJSONTyped(json, false);
+}
+
+export function AuthenticatedSessionAsnFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): AuthenticatedSessionAsn {
+    if (json == null) {
+        return json;
+    }
+    return {
+        asn: json["asn"],
+        asOrg: json["as_org"],
+        network: json["network"],
+    };
+}
+
+export function AuthenticatedSessionAsnToJSON(json: any): AuthenticatedSessionAsn {
+    return AuthenticatedSessionAsnToJSONTyped(json, false);
+}
+
+export function AuthenticatedSessionAsnToJSONTyped(
+    value?: AuthenticatedSessionAsn | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        asn: value["asn"],
+        as_org: value["asOrg"],
+        network: value["network"],
+    };
+}

packages/client-ts/src/models/AuthenticatedSessionGeoIp.ts

@@ -0,0 +1,106 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+/**
+ * Get GeoIP Data
+ * @export
+ * @interface AuthenticatedSessionGeoIp
+ */
+export interface AuthenticatedSessionGeoIp {
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatedSessionGeoIp
+     */
+    continent: string | null;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatedSessionGeoIp
+     */
+    country: string | null;
+    /**
+     *
+     * @type {number}
+     * @memberof AuthenticatedSessionGeoIp
+     */
+    lat: number | null;
+    /**
+     *
+     * @type {number}
+     * @memberof AuthenticatedSessionGeoIp
+     */
+    _long: number | null;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatedSessionGeoIp
+     */
+    city: string;
+}
+
+/**
+ * Check if a given object implements the AuthenticatedSessionGeoIp interface.
+ */
+export function instanceOfAuthenticatedSessionGeoIp(
+    value: object,
+): value is AuthenticatedSessionGeoIp {
+    if (!("continent" in value) || value["continent"] === undefined) return false;
+    if (!("country" in value) || value["country"] === undefined) return false;
+    if (!("lat" in value) || value["lat"] === undefined) return false;
+    if (!("_long" in value) || value["_long"] === undefined) return false;
+    if (!("city" in value) || value["city"] === undefined) return false;
+    return true;
+}
+
+export function AuthenticatedSessionGeoIpFromJSON(json: any): AuthenticatedSessionGeoIp {
+    return AuthenticatedSessionGeoIpFromJSONTyped(json, false);
+}
+
+export function AuthenticatedSessionGeoIpFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): AuthenticatedSessionGeoIp {
+    if (json == null) {
+        return json;
+    }
+    return {
+        continent: json["continent"],
+        country: json["country"],
+        lat: json["lat"],
+        _long: json["long"],
+        city: json["city"],
+    };
+}
+
+export function AuthenticatedSessionGeoIpToJSON(json: any): AuthenticatedSessionGeoIp {
+    return AuthenticatedSessionGeoIpToJSONTyped(json, false);
+}
+
+export function AuthenticatedSessionGeoIpToJSONTyped(
+    value?: AuthenticatedSessionGeoIp | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        continent: value["continent"],
+        country: value["country"],
+        lat: value["lat"],
+        long: value["_long"],
+        city: value["city"],
+    };
+}

packages/client-ts/src/models/AuthenticatedSessionUserAgent.ts

@@ -0,0 +1,113 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import type { AuthenticatedSessionUserAgentDevice } from "./AuthenticatedSessionUserAgentDevice";
+import {
+    AuthenticatedSessionUserAgentDeviceFromJSON,
+    AuthenticatedSessionUserAgentDeviceToJSON,
+} from "./AuthenticatedSessionUserAgentDevice";
+import type { AuthenticatedSessionUserAgentOs } from "./AuthenticatedSessionUserAgentOs";
+import {
+    AuthenticatedSessionUserAgentOsFromJSON,
+    AuthenticatedSessionUserAgentOsToJSON,
+} from "./AuthenticatedSessionUserAgentOs";
+import type { AuthenticatedSessionUserAgentUserAgent } from "./AuthenticatedSessionUserAgentUserAgent";
+import {
+    AuthenticatedSessionUserAgentUserAgentFromJSON,
+    AuthenticatedSessionUserAgentUserAgentToJSON,
+} from "./AuthenticatedSessionUserAgentUserAgent";
+
+/**
+ * Get parsed user agent
+ * @export
+ * @interface AuthenticatedSessionUserAgent
+ */
+export interface AuthenticatedSessionUserAgent {
+    /**
+     *
+     * @type {AuthenticatedSessionUserAgentDevice}
+     * @memberof AuthenticatedSessionUserAgent
+     */
+    device: AuthenticatedSessionUserAgentDevice;
+    /**
+     *
+     * @type {AuthenticatedSessionUserAgentOs}
+     * @memberof AuthenticatedSessionUserAgent
+     */
+    os: AuthenticatedSessionUserAgentOs;
+    /**
+     *
+     * @type {AuthenticatedSessionUserAgentUserAgent}
+     * @memberof AuthenticatedSessionUserAgent
+     */
+    userAgent: AuthenticatedSessionUserAgentUserAgent;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatedSessionUserAgent
+     */
+    string: string;
+}
+
+/**
+ * Check if a given object implements the AuthenticatedSessionUserAgent interface.
+ */
+export function instanceOfAuthenticatedSessionUserAgent(
+    value: object,
+): value is AuthenticatedSessionUserAgent {
+    if (!("device" in value) || value["device"] === undefined) return false;
+    if (!("os" in value) || value["os"] === undefined) return false;
+    if (!("userAgent" in value) || value["userAgent"] === undefined) return false;
+    if (!("string" in value) || value["string"] === undefined) return false;
+    return true;
+}
+
+export function AuthenticatedSessionUserAgentFromJSON(json: any): AuthenticatedSessionUserAgent {
+    return AuthenticatedSessionUserAgentFromJSONTyped(json, false);
+}
+
+export function AuthenticatedSessionUserAgentFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): AuthenticatedSessionUserAgent {
+    if (json == null) {
+        return json;
+    }
+    return {
+        device: AuthenticatedSessionUserAgentDeviceFromJSON(json["device"]),
+        os: AuthenticatedSessionUserAgentOsFromJSON(json["os"]),
+        userAgent: AuthenticatedSessionUserAgentUserAgentFromJSON(json["user_agent"]),
+        string: json["string"],
+    };
+}
+
+export function AuthenticatedSessionUserAgentToJSON(json: any): AuthenticatedSessionUserAgent {
+    return AuthenticatedSessionUserAgentToJSONTyped(json, false);
+}
+
+export function AuthenticatedSessionUserAgentToJSONTyped(
+    value?: AuthenticatedSessionUserAgent | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        device: AuthenticatedSessionUserAgentDeviceToJSON(value["device"]),
+        os: AuthenticatedSessionUserAgentOsToJSON(value["os"]),
+        user_agent: AuthenticatedSessionUserAgentUserAgentToJSON(value["userAgent"]),
+        string: value["string"],
+    };
+}

packages/client-ts/src/models/AuthenticatedSessionUserAgentDevice.ts

@@ -0,0 +1,92 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+/**
+ * User agent device
+ * @export
+ * @interface AuthenticatedSessionUserAgentDevice
+ */
+export interface AuthenticatedSessionUserAgentDevice {
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatedSessionUserAgentDevice
+     */
+    brand: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatedSessionUserAgentDevice
+     */
+    family: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatedSessionUserAgentDevice
+     */
+    model: string;
+}
+
+/**
+ * Check if a given object implements the AuthenticatedSessionUserAgentDevice interface.
+ */
+export function instanceOfAuthenticatedSessionUserAgentDevice(
+    value: object,
+): value is AuthenticatedSessionUserAgentDevice {
+    if (!("brand" in value) || value["brand"] === undefined) return false;
+    if (!("family" in value) || value["family"] === undefined) return false;
+    if (!("model" in value) || value["model"] === undefined) return false;
+    return true;
+}
+
+export function AuthenticatedSessionUserAgentDeviceFromJSON(
+    json: any,
+): AuthenticatedSessionUserAgentDevice {
+    return AuthenticatedSessionUserAgentDeviceFromJSONTyped(json, false);
+}
+
+export function AuthenticatedSessionUserAgentDeviceFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): AuthenticatedSessionUserAgentDevice {
+    if (json == null) {
+        return json;
+    }
+    return {
+        brand: json["brand"],
+        family: json["family"],
+        model: json["model"],
+    };
+}
+
+export function AuthenticatedSessionUserAgentDeviceToJSON(
+    json: any,
+): AuthenticatedSessionUserAgentDevice {
+    return AuthenticatedSessionUserAgentDeviceToJSONTyped(json, false);
+}
+
+export function AuthenticatedSessionUserAgentDeviceToJSONTyped(
+    value?: AuthenticatedSessionUserAgentDevice | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        brand: value["brand"],
+        family: value["family"],
+        model: value["model"],
+    };
+}

packages/client-ts/src/models/AuthenticatedSessionUserAgentOs.ts

@@ -0,0 +1,108 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+/**
+ * User agent os
+ * @export
+ * @interface AuthenticatedSessionUserAgentOs
+ */
+export interface AuthenticatedSessionUserAgentOs {
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatedSessionUserAgentOs
+     */
+    family: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatedSessionUserAgentOs
+     */
+    major: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatedSessionUserAgentOs
+     */
+    minor: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatedSessionUserAgentOs
+     */
+    patch: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatedSessionUserAgentOs
+     */
+    patchMinor: string;
+}
+
+/**
+ * Check if a given object implements the AuthenticatedSessionUserAgentOs interface.
+ */
+export function instanceOfAuthenticatedSessionUserAgentOs(
+    value: object,
+): value is AuthenticatedSessionUserAgentOs {
+    if (!("family" in value) || value["family"] === undefined) return false;
+    if (!("major" in value) || value["major"] === undefined) return false;
+    if (!("minor" in value) || value["minor"] === undefined) return false;
+    if (!("patch" in value) || value["patch"] === undefined) return false;
+    if (!("patchMinor" in value) || value["patchMinor"] === undefined) return false;
+    return true;
+}
+
+export function AuthenticatedSessionUserAgentOsFromJSON(
+    json: any,
+): AuthenticatedSessionUserAgentOs {
+    return AuthenticatedSessionUserAgentOsFromJSONTyped(json, false);
+}
+
+export function AuthenticatedSessionUserAgentOsFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): AuthenticatedSessionUserAgentOs {
+    if (json == null) {
+        return json;
+    }
+    return {
+        family: json["family"],
+        major: json["major"],
+        minor: json["minor"],
+        patch: json["patch"],
+        patchMinor: json["patch_minor"],
+    };
+}
+
+export function AuthenticatedSessionUserAgentOsToJSON(json: any): AuthenticatedSessionUserAgentOs {
+    return AuthenticatedSessionUserAgentOsToJSONTyped(json, false);
+}
+
+export function AuthenticatedSessionUserAgentOsToJSONTyped(
+    value?: AuthenticatedSessionUserAgentOs | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        family: value["family"],
+        major: value["major"],
+        minor: value["minor"],
+        patch: value["patch"],
+        patch_minor: value["patchMinor"],
+    };
+}

packages/client-ts/src/models/AuthenticatedSessionUserAgentUserAgent.ts

@@ -0,0 +1,101 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+/**
+ * User agent browser
+ * @export
+ * @interface AuthenticatedSessionUserAgentUserAgent
+ */
+export interface AuthenticatedSessionUserAgentUserAgent {
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatedSessionUserAgentUserAgent
+     */
+    family: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatedSessionUserAgentUserAgent
+     */
+    major: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatedSessionUserAgentUserAgent
+     */
+    minor: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatedSessionUserAgentUserAgent
+     */
+    patch: string;
+}
+
+/**
+ * Check if a given object implements the AuthenticatedSessionUserAgentUserAgent interface.
+ */
+export function instanceOfAuthenticatedSessionUserAgentUserAgent(
+    value: object,
+): value is AuthenticatedSessionUserAgentUserAgent {
+    if (!("family" in value) || value["family"] === undefined) return false;
+    if (!("major" in value) || value["major"] === undefined) return false;
+    if (!("minor" in value) || value["minor"] === undefined) return false;
+    if (!("patch" in value) || value["patch"] === undefined) return false;
+    return true;
+}
+
+export function AuthenticatedSessionUserAgentUserAgentFromJSON(
+    json: any,
+): AuthenticatedSessionUserAgentUserAgent {
+    return AuthenticatedSessionUserAgentUserAgentFromJSONTyped(json, false);
+}
+
+export function AuthenticatedSessionUserAgentUserAgentFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): AuthenticatedSessionUserAgentUserAgent {
+    if (json == null) {
+        return json;
+    }
+    return {
+        family: json["family"],
+        major: json["major"],
+        minor: json["minor"],
+        patch: json["patch"],
+    };
+}
+
+export function AuthenticatedSessionUserAgentUserAgentToJSON(
+    json: any,
+): AuthenticatedSessionUserAgentUserAgent {
+    return AuthenticatedSessionUserAgentUserAgentToJSONTyped(json, false);
+}
+
+export function AuthenticatedSessionUserAgentUserAgentToJSONTyped(
+    value?: AuthenticatedSessionUserAgentUserAgent | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        family: value["family"],
+        major: value["major"],
+        minor: value["minor"],
+        patch: value["patch"],
+    };
+}

packages/client-ts/src/models/AuthenticationEnum.ts

@@ -0,0 +1,61 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+/**
+ *
+ * @export
+ */
+export const AuthenticationEnum = {
+    None: "none",
+    RequireAuthenticated: "require_authenticated",
+    RequireUnauthenticated: "require_unauthenticated",
+    RequireSuperuser: "require_superuser",
+    RequireRedirect: "require_redirect",
+    RequireOutpost: "require_outpost",
+    UnknownDefaultOpenApi: "11184809",
+} as const;
+export type AuthenticationEnum = (typeof AuthenticationEnum)[keyof typeof AuthenticationEnum];
+
+export function instanceOfAuthenticationEnum(value: any): boolean {
+    for (const key in AuthenticationEnum) {
+        if (Object.prototype.hasOwnProperty.call(AuthenticationEnum, key)) {
+            if (AuthenticationEnum[key as keyof typeof AuthenticationEnum] === value) {
+                return true;
+            }
+        }
+    }
+    return false;
+}
+
+export function AuthenticationEnumFromJSON(json: any): AuthenticationEnum {
+    return AuthenticationEnumFromJSONTyped(json, false);
+}
+
+export function AuthenticationEnumFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): AuthenticationEnum {
+    return json as AuthenticationEnum;
+}
+
+export function AuthenticationEnumToJSON(value?: AuthenticationEnum | null): any {
+    return value as any;
+}
+
+export function AuthenticationEnumToJSONTyped(
+    value: any,
+    ignoreDiscriminator: boolean,
+): AuthenticationEnum {
+    return value as AuthenticationEnum;
+}

packages/client-ts/src/models/AuthenticatorAttachmentEnum.ts

@@ -0,0 +1,61 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+/**
+ *
+ * @export
+ */
+export const AuthenticatorAttachmentEnum = {
+    Platform: "platform",
+    CrossPlatform: "cross-platform",
+    UnknownDefaultOpenApi: "11184809",
+} as const;
+export type AuthenticatorAttachmentEnum =
+    (typeof AuthenticatorAttachmentEnum)[keyof typeof AuthenticatorAttachmentEnum];
+
+export function instanceOfAuthenticatorAttachmentEnum(value: any): boolean {
+    for (const key in AuthenticatorAttachmentEnum) {
+        if (Object.prototype.hasOwnProperty.call(AuthenticatorAttachmentEnum, key)) {
+            if (
+                AuthenticatorAttachmentEnum[key as keyof typeof AuthenticatorAttachmentEnum] ===
+                value
+            ) {
+                return true;
+            }
+        }
+    }
+    return false;
+}
+
+export function AuthenticatorAttachmentEnumFromJSON(json: any): AuthenticatorAttachmentEnum {
+    return AuthenticatorAttachmentEnumFromJSONTyped(json, false);
+}
+
+export function AuthenticatorAttachmentEnumFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): AuthenticatorAttachmentEnum {
+    return json as AuthenticatorAttachmentEnum;
+}
+
+export function AuthenticatorAttachmentEnumToJSON(value?: AuthenticatorAttachmentEnum | null): any {
+    return value as any;
+}
+
+export function AuthenticatorAttachmentEnumToJSONTyped(
+    value: any,
+    ignoreDiscriminator: boolean,
+): AuthenticatorAttachmentEnum {
+    return value as AuthenticatorAttachmentEnum;
+}

packages/client-ts/src/models/AuthenticatorDuoChallenge.ts

@@ -0,0 +1,135 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import type { ContextualFlowInfo } from "./ContextualFlowInfo";
+import { ContextualFlowInfoFromJSON, ContextualFlowInfoToJSON } from "./ContextualFlowInfo";
+import type { ErrorDetail } from "./ErrorDetail";
+
+/**
+ * Duo Challenge
+ * @export
+ * @interface AuthenticatorDuoChallenge
+ */
+export interface AuthenticatorDuoChallenge {
+    /**
+     *
+     * @type {ContextualFlowInfo}
+     * @memberof AuthenticatorDuoChallenge
+     */
+    flowInfo?: ContextualFlowInfo;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorDuoChallenge
+     */
+    component?: string;
+    /**
+     *
+     * @type {{ [key: string]: Array<ErrorDetail>; }}
+     * @memberof AuthenticatorDuoChallenge
+     */
+    responseErrors?: { [key: string]: Array<ErrorDetail> };
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorDuoChallenge
+     */
+    pendingUser: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorDuoChallenge
+     */
+    pendingUserAvatar: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorDuoChallenge
+     */
+    activationBarcode: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorDuoChallenge
+     */
+    activationCode: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorDuoChallenge
+     */
+    stageUuid: string;
+}
+
+/**
+ * Check if a given object implements the AuthenticatorDuoChallenge interface.
+ */
+export function instanceOfAuthenticatorDuoChallenge(
+    value: object,
+): value is AuthenticatorDuoChallenge {
+    if (!("pendingUser" in value) || value["pendingUser"] === undefined) return false;
+    if (!("pendingUserAvatar" in value) || value["pendingUserAvatar"] === undefined) return false;
+    if (!("activationBarcode" in value) || value["activationBarcode"] === undefined) return false;
+    if (!("activationCode" in value) || value["activationCode"] === undefined) return false;
+    if (!("stageUuid" in value) || value["stageUuid"] === undefined) return false;
+    return true;
+}
+
+export function AuthenticatorDuoChallengeFromJSON(json: any): AuthenticatorDuoChallenge {
+    return AuthenticatorDuoChallengeFromJSONTyped(json, false);
+}
+
+export function AuthenticatorDuoChallengeFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): AuthenticatorDuoChallenge {
+    if (json == null) {
+        return json;
+    }
+    return {
+        flowInfo:
+            json["flow_info"] == null ? undefined : ContextualFlowInfoFromJSON(json["flow_info"]),
+        component: json["component"] == null ? undefined : json["component"],
+        responseErrors: json["response_errors"] == null ? undefined : json["response_errors"],
+        pendingUser: json["pending_user"],
+        pendingUserAvatar: json["pending_user_avatar"],
+        activationBarcode: json["activation_barcode"],
+        activationCode: json["activation_code"],
+        stageUuid: json["stage_uuid"],
+    };
+}
+
+export function AuthenticatorDuoChallengeToJSON(json: any): AuthenticatorDuoChallenge {
+    return AuthenticatorDuoChallengeToJSONTyped(json, false);
+}
+
+export function AuthenticatorDuoChallengeToJSONTyped(
+    value?: AuthenticatorDuoChallenge | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        flow_info: ContextualFlowInfoToJSON(value["flowInfo"]),
+        component: value["component"],
+        response_errors: value["responseErrors"],
+        pending_user: value["pendingUser"],
+        pending_user_avatar: value["pendingUserAvatar"],
+        activation_barcode: value["activationBarcode"],
+        activation_code: value["activationCode"],
+        stage_uuid: value["stageUuid"],
+    };
+}

packages/client-ts/src/models/AuthenticatorDuoChallengeResponseRequest.ts

@@ -0,0 +1,73 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+/**
+ * Pseudo class for duo response
+ * @export
+ * @interface AuthenticatorDuoChallengeResponseRequest
+ */
+export interface AuthenticatorDuoChallengeResponseRequest {
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorDuoChallengeResponseRequest
+     */
+    component?: string;
+}
+
+/**
+ * Check if a given object implements the AuthenticatorDuoChallengeResponseRequest interface.
+ */
+export function instanceOfAuthenticatorDuoChallengeResponseRequest(
+    value: object,
+): value is AuthenticatorDuoChallengeResponseRequest {
+    return true;
+}
+
+export function AuthenticatorDuoChallengeResponseRequestFromJSON(
+    json: any,
+): AuthenticatorDuoChallengeResponseRequest {
+    return AuthenticatorDuoChallengeResponseRequestFromJSONTyped(json, false);
+}
+
+export function AuthenticatorDuoChallengeResponseRequestFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): AuthenticatorDuoChallengeResponseRequest {
+    if (json == null) {
+        return json;
+    }
+    return {
+        component: json["component"] == null ? undefined : json["component"],
+    };
+}
+
+export function AuthenticatorDuoChallengeResponseRequestToJSON(
+    json: any,
+): AuthenticatorDuoChallengeResponseRequest {
+    return AuthenticatorDuoChallengeResponseRequestToJSONTyped(json, false);
+}
+
+export function AuthenticatorDuoChallengeResponseRequestToJSONTyped(
+    value?: AuthenticatorDuoChallengeResponseRequest | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        component: value["component"],
+    };
+}

packages/client-ts/src/models/AuthenticatorDuoStage.ts

@@ -0,0 +1,165 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import type { FlowSet } from "./FlowSet";
+import { FlowSetFromJSON } from "./FlowSet";
+
+/**
+ * AuthenticatorDuoStage Serializer
+ * @export
+ * @interface AuthenticatorDuoStage
+ */
+export interface AuthenticatorDuoStage {
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorDuoStage
+     */
+    readonly pk: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorDuoStage
+     */
+    name: string;
+    /**
+     * Get object type so that we know how to edit the object
+     * @type {string}
+     * @memberof AuthenticatorDuoStage
+     */
+    readonly component: string;
+    /**
+     * Return object's verbose_name
+     * @type {string}
+     * @memberof AuthenticatorDuoStage
+     */
+    readonly verboseName: string;
+    /**
+     * Return object's plural verbose_name
+     * @type {string}
+     * @memberof AuthenticatorDuoStage
+     */
+    readonly verboseNamePlural: string;
+    /**
+     * Return internal model name
+     * @type {string}
+     * @memberof AuthenticatorDuoStage
+     */
+    readonly metaModelName: string;
+    /**
+     *
+     * @type {Array<FlowSet>}
+     * @memberof AuthenticatorDuoStage
+     */
+    readonly flowSet: Array<FlowSet>;
+    /**
+     * Flow used by an authenticated user to configure this Stage. If empty, user will not be able to configure this stage.
+     * @type {string}
+     * @memberof AuthenticatorDuoStage
+     */
+    configureFlow?: string | null;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorDuoStage
+     */
+    friendlyName?: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorDuoStage
+     */
+    clientId: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorDuoStage
+     */
+    apiHostname: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorDuoStage
+     */
+    adminIntegrationKey?: string;
+}
+
+/**
+ * Check if a given object implements the AuthenticatorDuoStage interface.
+ */
+export function instanceOfAuthenticatorDuoStage(value: object): value is AuthenticatorDuoStage {
+    if (!("pk" in value) || value["pk"] === undefined) return false;
+    if (!("name" in value) || value["name"] === undefined) return false;
+    if (!("component" in value) || value["component"] === undefined) return false;
+    if (!("verboseName" in value) || value["verboseName"] === undefined) return false;
+    if (!("verboseNamePlural" in value) || value["verboseNamePlural"] === undefined) return false;
+    if (!("metaModelName" in value) || value["metaModelName"] === undefined) return false;
+    if (!("flowSet" in value) || value["flowSet"] === undefined) return false;
+    if (!("clientId" in value) || value["clientId"] === undefined) return false;
+    if (!("apiHostname" in value) || value["apiHostname"] === undefined) return false;
+    return true;
+}
+
+export function AuthenticatorDuoStageFromJSON(json: any): AuthenticatorDuoStage {
+    return AuthenticatorDuoStageFromJSONTyped(json, false);
+}
+
+export function AuthenticatorDuoStageFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): AuthenticatorDuoStage {
+    if (json == null) {
+        return json;
+    }
+    return {
+        pk: json["pk"],
+        name: json["name"],
+        component: json["component"],
+        verboseName: json["verbose_name"],
+        verboseNamePlural: json["verbose_name_plural"],
+        metaModelName: json["meta_model_name"],
+        flowSet: (json["flow_set"] as Array<any>).map(FlowSetFromJSON),
+        configureFlow: json["configure_flow"] == null ? undefined : json["configure_flow"],
+        friendlyName: json["friendly_name"] == null ? undefined : json["friendly_name"],
+        clientId: json["client_id"],
+        apiHostname: json["api_hostname"],
+        adminIntegrationKey:
+            json["admin_integration_key"] == null ? undefined : json["admin_integration_key"],
+    };
+}
+
+export function AuthenticatorDuoStageToJSON(json: any): AuthenticatorDuoStage {
+    return AuthenticatorDuoStageToJSONTyped(json, false);
+}
+
+export function AuthenticatorDuoStageToJSONTyped(
+    value?: Omit<
+        AuthenticatorDuoStage,
+        "pk" | "component" | "verbose_name" | "verbose_name_plural" | "meta_model_name" | "flow_set"
+    > | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        name: value["name"],
+        configure_flow: value["configureFlow"],
+        friendly_name: value["friendlyName"],
+        client_id: value["clientId"],
+        api_hostname: value["apiHostname"],
+        admin_integration_key: value["adminIntegrationKey"],
+    };
+}

packages/client-ts/src/models/AuthenticatorDuoStageDeviceImportResponse.ts

@@ -0,0 +1,80 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+/**
+ *
+ * @export
+ * @interface AuthenticatorDuoStageDeviceImportResponse
+ */
+export interface AuthenticatorDuoStageDeviceImportResponse {
+    /**
+     *
+     * @type {number}
+     * @memberof AuthenticatorDuoStageDeviceImportResponse
+     */
+    readonly count: number;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorDuoStageDeviceImportResponse
+     */
+    readonly error: string;
+}
+
+/**
+ * Check if a given object implements the AuthenticatorDuoStageDeviceImportResponse interface.
+ */
+export function instanceOfAuthenticatorDuoStageDeviceImportResponse(
+    value: object,
+): value is AuthenticatorDuoStageDeviceImportResponse {
+    if (!("count" in value) || value["count"] === undefined) return false;
+    if (!("error" in value) || value["error"] === undefined) return false;
+    return true;
+}
+
+export function AuthenticatorDuoStageDeviceImportResponseFromJSON(
+    json: any,
+): AuthenticatorDuoStageDeviceImportResponse {
+    return AuthenticatorDuoStageDeviceImportResponseFromJSONTyped(json, false);
+}
+
+export function AuthenticatorDuoStageDeviceImportResponseFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): AuthenticatorDuoStageDeviceImportResponse {
+    if (json == null) {
+        return json;
+    }
+    return {
+        count: json["count"],
+        error: json["error"],
+    };
+}
+
+export function AuthenticatorDuoStageDeviceImportResponseToJSON(
+    json: any,
+): AuthenticatorDuoStageDeviceImportResponse {
+    return AuthenticatorDuoStageDeviceImportResponseToJSONTyped(json, false);
+}
+
+export function AuthenticatorDuoStageDeviceImportResponseToJSONTyped(
+    value?: Omit<AuthenticatorDuoStageDeviceImportResponse, "count" | "error"> | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {};
+}

packages/client-ts/src/models/AuthenticatorDuoStageManualDeviceImportRequest.ts

@@ -0,0 +1,83 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+/**
+ *
+ * @export
+ * @interface AuthenticatorDuoStageManualDeviceImportRequest
+ */
+export interface AuthenticatorDuoStageManualDeviceImportRequest {
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorDuoStageManualDeviceImportRequest
+     */
+    duoUserId: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorDuoStageManualDeviceImportRequest
+     */
+    username: string;
+}
+
+/**
+ * Check if a given object implements the AuthenticatorDuoStageManualDeviceImportRequest interface.
+ */
+export function instanceOfAuthenticatorDuoStageManualDeviceImportRequest(
+    value: object,
+): value is AuthenticatorDuoStageManualDeviceImportRequest {
+    if (!("duoUserId" in value) || value["duoUserId"] === undefined) return false;
+    if (!("username" in value) || value["username"] === undefined) return false;
+    return true;
+}
+
+export function AuthenticatorDuoStageManualDeviceImportRequestFromJSON(
+    json: any,
+): AuthenticatorDuoStageManualDeviceImportRequest {
+    return AuthenticatorDuoStageManualDeviceImportRequestFromJSONTyped(json, false);
+}
+
+export function AuthenticatorDuoStageManualDeviceImportRequestFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): AuthenticatorDuoStageManualDeviceImportRequest {
+    if (json == null) {
+        return json;
+    }
+    return {
+        duoUserId: json["duo_user_id"],
+        username: json["username"],
+    };
+}
+
+export function AuthenticatorDuoStageManualDeviceImportRequestToJSON(
+    json: any,
+): AuthenticatorDuoStageManualDeviceImportRequest {
+    return AuthenticatorDuoStageManualDeviceImportRequestToJSONTyped(json, false);
+}
+
+export function AuthenticatorDuoStageManualDeviceImportRequestToJSONTyped(
+    value?: AuthenticatorDuoStageManualDeviceImportRequest | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        duo_user_id: value["duoUserId"],
+        username: value["username"],
+    };
+}

packages/client-ts/src/models/AuthenticatorDuoStageRequest.ts

@@ -0,0 +1,130 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+/**
+ * AuthenticatorDuoStage Serializer
+ * @export
+ * @interface AuthenticatorDuoStageRequest
+ */
+export interface AuthenticatorDuoStageRequest {
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorDuoStageRequest
+     */
+    name: string;
+    /**
+     * Flow used by an authenticated user to configure this Stage. If empty, user will not be able to configure this stage.
+     * @type {string}
+     * @memberof AuthenticatorDuoStageRequest
+     */
+    configureFlow?: string | null;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorDuoStageRequest
+     */
+    friendlyName?: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorDuoStageRequest
+     */
+    clientId: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorDuoStageRequest
+     */
+    clientSecret: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorDuoStageRequest
+     */
+    apiHostname: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorDuoStageRequest
+     */
+    adminIntegrationKey?: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorDuoStageRequest
+     */
+    adminSecretKey?: string;
+}
+
+/**
+ * Check if a given object implements the AuthenticatorDuoStageRequest interface.
+ */
+export function instanceOfAuthenticatorDuoStageRequest(
+    value: object,
+): value is AuthenticatorDuoStageRequest {
+    if (!("name" in value) || value["name"] === undefined) return false;
+    if (!("clientId" in value) || value["clientId"] === undefined) return false;
+    if (!("clientSecret" in value) || value["clientSecret"] === undefined) return false;
+    if (!("apiHostname" in value) || value["apiHostname"] === undefined) return false;
+    return true;
+}
+
+export function AuthenticatorDuoStageRequestFromJSON(json: any): AuthenticatorDuoStageRequest {
+    return AuthenticatorDuoStageRequestFromJSONTyped(json, false);
+}
+
+export function AuthenticatorDuoStageRequestFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): AuthenticatorDuoStageRequest {
+    if (json == null) {
+        return json;
+    }
+    return {
+        name: json["name"],
+        configureFlow: json["configure_flow"] == null ? undefined : json["configure_flow"],
+        friendlyName: json["friendly_name"] == null ? undefined : json["friendly_name"],
+        clientId: json["client_id"],
+        clientSecret: json["client_secret"],
+        apiHostname: json["api_hostname"],
+        adminIntegrationKey:
+            json["admin_integration_key"] == null ? undefined : json["admin_integration_key"],
+        adminSecretKey: json["admin_secret_key"] == null ? undefined : json["admin_secret_key"],
+    };
+}
+
+export function AuthenticatorDuoStageRequestToJSON(json: any): AuthenticatorDuoStageRequest {
+    return AuthenticatorDuoStageRequestToJSONTyped(json, false);
+}
+
+export function AuthenticatorDuoStageRequestToJSONTyped(
+    value?: AuthenticatorDuoStageRequest | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        name: value["name"],
+        configure_flow: value["configureFlow"],
+        friendly_name: value["friendlyName"],
+        client_id: value["clientId"],
+        client_secret: value["clientSecret"],
+        api_hostname: value["apiHostname"],
+        admin_integration_key: value["adminIntegrationKey"],
+        admin_secret_key: value["adminSecretKey"],
+    };
+}

packages/client-ts/src/models/AuthenticatorEmailChallenge.ts

@@ -0,0 +1,124 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import type { ContextualFlowInfo } from "./ContextualFlowInfo";
+import { ContextualFlowInfoFromJSON, ContextualFlowInfoToJSON } from "./ContextualFlowInfo";
+import type { ErrorDetail } from "./ErrorDetail";
+
+/**
+ * Authenticator Email Setup challenge
+ * @export
+ * @interface AuthenticatorEmailChallenge
+ */
+export interface AuthenticatorEmailChallenge {
+    /**
+     *
+     * @type {ContextualFlowInfo}
+     * @memberof AuthenticatorEmailChallenge
+     */
+    flowInfo?: ContextualFlowInfo;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorEmailChallenge
+     */
+    component?: string;
+    /**
+     *
+     * @type {{ [key: string]: Array<ErrorDetail>; }}
+     * @memberof AuthenticatorEmailChallenge
+     */
+    responseErrors?: { [key: string]: Array<ErrorDetail> };
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorEmailChallenge
+     */
+    pendingUser: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorEmailChallenge
+     */
+    pendingUserAvatar: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorEmailChallenge
+     */
+    email?: string | null;
+    /**
+     *
+     * @type {boolean}
+     * @memberof AuthenticatorEmailChallenge
+     */
+    emailRequired?: boolean;
+}
+
+/**
+ * Check if a given object implements the AuthenticatorEmailChallenge interface.
+ */
+export function instanceOfAuthenticatorEmailChallenge(
+    value: object,
+): value is AuthenticatorEmailChallenge {
+    if (!("pendingUser" in value) || value["pendingUser"] === undefined) return false;
+    if (!("pendingUserAvatar" in value) || value["pendingUserAvatar"] === undefined) return false;
+    return true;
+}
+
+export function AuthenticatorEmailChallengeFromJSON(json: any): AuthenticatorEmailChallenge {
+    return AuthenticatorEmailChallengeFromJSONTyped(json, false);
+}
+
+export function AuthenticatorEmailChallengeFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): AuthenticatorEmailChallenge {
+    if (json == null) {
+        return json;
+    }
+    return {
+        flowInfo:
+            json["flow_info"] == null ? undefined : ContextualFlowInfoFromJSON(json["flow_info"]),
+        component: json["component"] == null ? undefined : json["component"],
+        responseErrors: json["response_errors"] == null ? undefined : json["response_errors"],
+        pendingUser: json["pending_user"],
+        pendingUserAvatar: json["pending_user_avatar"],
+        email: json["email"] == null ? undefined : json["email"],
+        emailRequired: json["email_required"] == null ? undefined : json["email_required"],
+    };
+}
+
+export function AuthenticatorEmailChallengeToJSON(json: any): AuthenticatorEmailChallenge {
+    return AuthenticatorEmailChallengeToJSONTyped(json, false);
+}
+
+export function AuthenticatorEmailChallengeToJSONTyped(
+    value?: AuthenticatorEmailChallenge | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        flow_info: ContextualFlowInfoToJSON(value["flowInfo"]),
+        component: value["component"],
+        response_errors: value["responseErrors"],
+        pending_user: value["pendingUser"],
+        pending_user_avatar: value["pendingUserAvatar"],
+        email: value["email"],
+        email_required: value["emailRequired"],
+    };
+}

packages/client-ts/src/models/AuthenticatorEmailChallengeResponseRequest.ts

@@ -0,0 +1,89 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+/**
+ * Authenticator Email Challenge response, device is set by get_response_instance
+ * @export
+ * @interface AuthenticatorEmailChallengeResponseRequest
+ */
+export interface AuthenticatorEmailChallengeResponseRequest {
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorEmailChallengeResponseRequest
+     */
+    component?: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorEmailChallengeResponseRequest
+     */
+    code?: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorEmailChallengeResponseRequest
+     */
+    email?: string;
+}
+
+/**
+ * Check if a given object implements the AuthenticatorEmailChallengeResponseRequest interface.
+ */
+export function instanceOfAuthenticatorEmailChallengeResponseRequest(
+    value: object,
+): value is AuthenticatorEmailChallengeResponseRequest {
+    return true;
+}
+
+export function AuthenticatorEmailChallengeResponseRequestFromJSON(
+    json: any,
+): AuthenticatorEmailChallengeResponseRequest {
+    return AuthenticatorEmailChallengeResponseRequestFromJSONTyped(json, false);
+}
+
+export function AuthenticatorEmailChallengeResponseRequestFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): AuthenticatorEmailChallengeResponseRequest {
+    if (json == null) {
+        return json;
+    }
+    return {
+        component: json["component"] == null ? undefined : json["component"],
+        code: json["code"] == null ? undefined : json["code"],
+        email: json["email"] == null ? undefined : json["email"],
+    };
+}
+
+export function AuthenticatorEmailChallengeResponseRequestToJSON(
+    json: any,
+): AuthenticatorEmailChallengeResponseRequest {
+    return AuthenticatorEmailChallengeResponseRequestToJSONTyped(json, false);
+}
+
+export function AuthenticatorEmailChallengeResponseRequestToJSONTyped(
+    value?: AuthenticatorEmailChallengeResponseRequest | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        component: value["component"],
+        code: value["code"],
+        email: value["email"],
+    };
+}

packages/client-ts/src/models/AuthenticatorEmailStage.ts

@@ -0,0 +1,235 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import type { FlowSet } from "./FlowSet";
+import { FlowSetFromJSON } from "./FlowSet";
+
+/**
+ * AuthenticatorEmailStage Serializer
+ * @export
+ * @interface AuthenticatorEmailStage
+ */
+export interface AuthenticatorEmailStage {
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorEmailStage
+     */
+    readonly pk: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorEmailStage
+     */
+    name: string;
+    /**
+     * Get object type so that we know how to edit the object
+     * @type {string}
+     * @memberof AuthenticatorEmailStage
+     */
+    readonly component: string;
+    /**
+     * Return object's verbose_name
+     * @type {string}
+     * @memberof AuthenticatorEmailStage
+     */
+    readonly verboseName: string;
+    /**
+     * Return object's plural verbose_name
+     * @type {string}
+     * @memberof AuthenticatorEmailStage
+     */
+    readonly verboseNamePlural: string;
+    /**
+     * Return internal model name
+     * @type {string}
+     * @memberof AuthenticatorEmailStage
+     */
+    readonly metaModelName: string;
+    /**
+     *
+     * @type {Array<FlowSet>}
+     * @memberof AuthenticatorEmailStage
+     */
+    readonly flowSet: Array<FlowSet>;
+    /**
+     * Flow used by an authenticated user to configure this Stage. If empty, user will not be able to configure this stage.
+     * @type {string}
+     * @memberof AuthenticatorEmailStage
+     */
+    configureFlow?: string | null;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorEmailStage
+     */
+    friendlyName?: string;
+    /**
+     * When enabled, global Email connection settings will be used and connection settings below will be ignored.
+     * @type {boolean}
+     * @memberof AuthenticatorEmailStage
+     */
+    useGlobalSettings?: boolean;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorEmailStage
+     */
+    host?: string;
+    /**
+     *
+     * @type {number}
+     * @memberof AuthenticatorEmailStage
+     */
+    port?: number;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorEmailStage
+     */
+    username?: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorEmailStage
+     */
+    password?: string;
+    /**
+     *
+     * @type {boolean}
+     * @memberof AuthenticatorEmailStage
+     */
+    useTls?: boolean;
+    /**
+     *
+     * @type {boolean}
+     * @memberof AuthenticatorEmailStage
+     */
+    useSsl?: boolean;
+    /**
+     *
+     * @type {number}
+     * @memberof AuthenticatorEmailStage
+     */
+    timeout?: number;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorEmailStage
+     */
+    fromAddress?: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorEmailStage
+     */
+    subject?: string;
+    /**
+     * Time the token sent is valid (Format: hours=3,minutes=17,seconds=300).
+     * @type {string}
+     * @memberof AuthenticatorEmailStage
+     */
+    tokenExpiry?: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorEmailStage
+     */
+    template?: string;
+}
+
+/**
+ * Check if a given object implements the AuthenticatorEmailStage interface.
+ */
+export function instanceOfAuthenticatorEmailStage(value: object): value is AuthenticatorEmailStage {
+    if (!("pk" in value) || value["pk"] === undefined) return false;
+    if (!("name" in value) || value["name"] === undefined) return false;
+    if (!("component" in value) || value["component"] === undefined) return false;
+    if (!("verboseName" in value) || value["verboseName"] === undefined) return false;
+    if (!("verboseNamePlural" in value) || value["verboseNamePlural"] === undefined) return false;
+    if (!("metaModelName" in value) || value["metaModelName"] === undefined) return false;
+    if (!("flowSet" in value) || value["flowSet"] === undefined) return false;
+    return true;
+}
+
+export function AuthenticatorEmailStageFromJSON(json: any): AuthenticatorEmailStage {
+    return AuthenticatorEmailStageFromJSONTyped(json, false);
+}
+
+export function AuthenticatorEmailStageFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): AuthenticatorEmailStage {
+    if (json == null) {
+        return json;
+    }
+    return {
+        pk: json["pk"],
+        name: json["name"],
+        component: json["component"],
+        verboseName: json["verbose_name"],
+        verboseNamePlural: json["verbose_name_plural"],
+        metaModelName: json["meta_model_name"],
+        flowSet: (json["flow_set"] as Array<any>).map(FlowSetFromJSON),
+        configureFlow: json["configure_flow"] == null ? undefined : json["configure_flow"],
+        friendlyName: json["friendly_name"] == null ? undefined : json["friendly_name"],
+        useGlobalSettings:
+            json["use_global_settings"] == null ? undefined : json["use_global_settings"],
+        host: json["host"] == null ? undefined : json["host"],
+        port: json["port"] == null ? undefined : json["port"],
+        username: json["username"] == null ? undefined : json["username"],
+        password: json["password"] == null ? undefined : json["password"],
+        useTls: json["use_tls"] == null ? undefined : json["use_tls"],
+        useSsl: json["use_ssl"] == null ? undefined : json["use_ssl"],
+        timeout: json["timeout"] == null ? undefined : json["timeout"],
+        fromAddress: json["from_address"] == null ? undefined : json["from_address"],
+        subject: json["subject"] == null ? undefined : json["subject"],
+        tokenExpiry: json["token_expiry"] == null ? undefined : json["token_expiry"],
+        template: json["template"] == null ? undefined : json["template"],
+    };
+}
+
+export function AuthenticatorEmailStageToJSON(json: any): AuthenticatorEmailStage {
+    return AuthenticatorEmailStageToJSONTyped(json, false);
+}
+
+export function AuthenticatorEmailStageToJSONTyped(
+    value?: Omit<
+        AuthenticatorEmailStage,
+        "pk" | "component" | "verbose_name" | "verbose_name_plural" | "meta_model_name" | "flow_set"
+    > | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        name: value["name"],
+        configure_flow: value["configureFlow"],
+        friendly_name: value["friendlyName"],
+        use_global_settings: value["useGlobalSettings"],
+        host: value["host"],
+        port: value["port"],
+        username: value["username"],
+        password: value["password"],
+        use_tls: value["useTls"],
+        use_ssl: value["useSsl"],
+        timeout: value["timeout"],
+        from_address: value["fromAddress"],
+        subject: value["subject"],
+        token_expiry: value["tokenExpiry"],
+        template: value["template"],
+    };
+}

packages/client-ts/src/models/AuthenticatorEmailStageRequest.ts

@@ -0,0 +1,183 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+/**
+ * AuthenticatorEmailStage Serializer
+ * @export
+ * @interface AuthenticatorEmailStageRequest
+ */
+export interface AuthenticatorEmailStageRequest {
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorEmailStageRequest
+     */
+    name: string;
+    /**
+     * Flow used by an authenticated user to configure this Stage. If empty, user will not be able to configure this stage.
+     * @type {string}
+     * @memberof AuthenticatorEmailStageRequest
+     */
+    configureFlow?: string | null;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorEmailStageRequest
+     */
+    friendlyName?: string;
+    /**
+     * When enabled, global Email connection settings will be used and connection settings below will be ignored.
+     * @type {boolean}
+     * @memberof AuthenticatorEmailStageRequest
+     */
+    useGlobalSettings?: boolean;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorEmailStageRequest
+     */
+    host?: string;
+    /**
+     *
+     * @type {number}
+     * @memberof AuthenticatorEmailStageRequest
+     */
+    port?: number;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorEmailStageRequest
+     */
+    username?: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorEmailStageRequest
+     */
+    password?: string;
+    /**
+     *
+     * @type {boolean}
+     * @memberof AuthenticatorEmailStageRequest
+     */
+    useTls?: boolean;
+    /**
+     *
+     * @type {boolean}
+     * @memberof AuthenticatorEmailStageRequest
+     */
+    useSsl?: boolean;
+    /**
+     *
+     * @type {number}
+     * @memberof AuthenticatorEmailStageRequest
+     */
+    timeout?: number;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorEmailStageRequest
+     */
+    fromAddress?: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorEmailStageRequest
+     */
+    subject?: string;
+    /**
+     * Time the token sent is valid (Format: hours=3,minutes=17,seconds=300).
+     * @type {string}
+     * @memberof AuthenticatorEmailStageRequest
+     */
+    tokenExpiry?: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorEmailStageRequest
+     */
+    template?: string;
+}
+
+/**
+ * Check if a given object implements the AuthenticatorEmailStageRequest interface.
+ */
+export function instanceOfAuthenticatorEmailStageRequest(
+    value: object,
+): value is AuthenticatorEmailStageRequest {
+    if (!("name" in value) || value["name"] === undefined) return false;
+    return true;
+}
+
+export function AuthenticatorEmailStageRequestFromJSON(json: any): AuthenticatorEmailStageRequest {
+    return AuthenticatorEmailStageRequestFromJSONTyped(json, false);
+}
+
+export function AuthenticatorEmailStageRequestFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): AuthenticatorEmailStageRequest {
+    if (json == null) {
+        return json;
+    }
+    return {
+        name: json["name"],
+        configureFlow: json["configure_flow"] == null ? undefined : json["configure_flow"],
+        friendlyName: json["friendly_name"] == null ? undefined : json["friendly_name"],
+        useGlobalSettings:
+            json["use_global_settings"] == null ? undefined : json["use_global_settings"],
+        host: json["host"] == null ? undefined : json["host"],
+        port: json["port"] == null ? undefined : json["port"],
+        username: json["username"] == null ? undefined : json["username"],
+        password: json["password"] == null ? undefined : json["password"],
+        useTls: json["use_tls"] == null ? undefined : json["use_tls"],
+        useSsl: json["use_ssl"] == null ? undefined : json["use_ssl"],
+        timeout: json["timeout"] == null ? undefined : json["timeout"],
+        fromAddress: json["from_address"] == null ? undefined : json["from_address"],
+        subject: json["subject"] == null ? undefined : json["subject"],
+        tokenExpiry: json["token_expiry"] == null ? undefined : json["token_expiry"],
+        template: json["template"] == null ? undefined : json["template"],
+    };
+}
+
+export function AuthenticatorEmailStageRequestToJSON(json: any): AuthenticatorEmailStageRequest {
+    return AuthenticatorEmailStageRequestToJSONTyped(json, false);
+}
+
+export function AuthenticatorEmailStageRequestToJSONTyped(
+    value?: AuthenticatorEmailStageRequest | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        name: value["name"],
+        configure_flow: value["configureFlow"],
+        friendly_name: value["friendlyName"],
+        use_global_settings: value["useGlobalSettings"],
+        host: value["host"],
+        port: value["port"],
+        username: value["username"],
+        password: value["password"],
+        use_tls: value["useTls"],
+        use_ssl: value["useSsl"],
+        timeout: value["timeout"],
+        from_address: value["fromAddress"],
+        subject: value["subject"],
+        token_expiry: value["tokenExpiry"],
+        template: value["template"],
+    };
+}

packages/client-ts/src/models/AuthenticatorEndpointGDTCStage.ts

@@ -0,0 +1,149 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import type { FlowSet } from "./FlowSet";
+import { FlowSetFromJSON } from "./FlowSet";
+
+/**
+ * AuthenticatorEndpointGDTCStage Serializer
+ * @export
+ * @interface AuthenticatorEndpointGDTCStage
+ */
+export interface AuthenticatorEndpointGDTCStage {
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorEndpointGDTCStage
+     */
+    readonly pk: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorEndpointGDTCStage
+     */
+    name: string;
+    /**
+     * Get object type so that we know how to edit the object
+     * @type {string}
+     * @memberof AuthenticatorEndpointGDTCStage
+     */
+    readonly component: string;
+    /**
+     * Return object's verbose_name
+     * @type {string}
+     * @memberof AuthenticatorEndpointGDTCStage
+     */
+    readonly verboseName: string;
+    /**
+     * Return object's plural verbose_name
+     * @type {string}
+     * @memberof AuthenticatorEndpointGDTCStage
+     */
+    readonly verboseNamePlural: string;
+    /**
+     * Return internal model name
+     * @type {string}
+     * @memberof AuthenticatorEndpointGDTCStage
+     */
+    readonly metaModelName: string;
+    /**
+     *
+     * @type {Array<FlowSet>}
+     * @memberof AuthenticatorEndpointGDTCStage
+     */
+    readonly flowSet: Array<FlowSet>;
+    /**
+     * Flow used by an authenticated user to configure this Stage. If empty, user will not be able to configure this stage.
+     * @type {string}
+     * @memberof AuthenticatorEndpointGDTCStage
+     */
+    configureFlow?: string | null;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorEndpointGDTCStage
+     */
+    friendlyName?: string;
+    /**
+     *
+     * @type {{ [key: string]: any; }}
+     * @memberof AuthenticatorEndpointGDTCStage
+     */
+    credentials: { [key: string]: any };
+}
+
+/**
+ * Check if a given object implements the AuthenticatorEndpointGDTCStage interface.
+ */
+export function instanceOfAuthenticatorEndpointGDTCStage(
+    value: object,
+): value is AuthenticatorEndpointGDTCStage {
+    if (!("pk" in value) || value["pk"] === undefined) return false;
+    if (!("name" in value) || value["name"] === undefined) return false;
+    if (!("component" in value) || value["component"] === undefined) return false;
+    if (!("verboseName" in value) || value["verboseName"] === undefined) return false;
+    if (!("verboseNamePlural" in value) || value["verboseNamePlural"] === undefined) return false;
+    if (!("metaModelName" in value) || value["metaModelName"] === undefined) return false;
+    if (!("flowSet" in value) || value["flowSet"] === undefined) return false;
+    if (!("credentials" in value) || value["credentials"] === undefined) return false;
+    return true;
+}
+
+export function AuthenticatorEndpointGDTCStageFromJSON(json: any): AuthenticatorEndpointGDTCStage {
+    return AuthenticatorEndpointGDTCStageFromJSONTyped(json, false);
+}
+
+export function AuthenticatorEndpointGDTCStageFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): AuthenticatorEndpointGDTCStage {
+    if (json == null) {
+        return json;
+    }
+    return {
+        pk: json["pk"],
+        name: json["name"],
+        component: json["component"],
+        verboseName: json["verbose_name"],
+        verboseNamePlural: json["verbose_name_plural"],
+        metaModelName: json["meta_model_name"],
+        flowSet: (json["flow_set"] as Array<any>).map(FlowSetFromJSON),
+        configureFlow: json["configure_flow"] == null ? undefined : json["configure_flow"],
+        friendlyName: json["friendly_name"] == null ? undefined : json["friendly_name"],
+        credentials: json["credentials"],
+    };
+}
+
+export function AuthenticatorEndpointGDTCStageToJSON(json: any): AuthenticatorEndpointGDTCStage {
+    return AuthenticatorEndpointGDTCStageToJSONTyped(json, false);
+}
+
+export function AuthenticatorEndpointGDTCStageToJSONTyped(
+    value?: Omit<
+        AuthenticatorEndpointGDTCStage,
+        "pk" | "component" | "verbose_name" | "verbose_name_plural" | "meta_model_name" | "flow_set"
+    > | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        name: value["name"],
+        configure_flow: value["configureFlow"],
+        friendly_name: value["friendlyName"],
+        credentials: value["credentials"],
+    };
+}

packages/client-ts/src/models/AuthenticatorEndpointGDTCStageRequest.ts

@@ -0,0 +1,99 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+/**
+ * AuthenticatorEndpointGDTCStage Serializer
+ * @export
+ * @interface AuthenticatorEndpointGDTCStageRequest
+ */
+export interface AuthenticatorEndpointGDTCStageRequest {
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorEndpointGDTCStageRequest
+     */
+    name: string;
+    /**
+     * Flow used by an authenticated user to configure this Stage. If empty, user will not be able to configure this stage.
+     * @type {string}
+     * @memberof AuthenticatorEndpointGDTCStageRequest
+     */
+    configureFlow?: string | null;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorEndpointGDTCStageRequest
+     */
+    friendlyName?: string;
+    /**
+     *
+     * @type {{ [key: string]: any; }}
+     * @memberof AuthenticatorEndpointGDTCStageRequest
+     */
+    credentials: { [key: string]: any };
+}
+
+/**
+ * Check if a given object implements the AuthenticatorEndpointGDTCStageRequest interface.
+ */
+export function instanceOfAuthenticatorEndpointGDTCStageRequest(
+    value: object,
+): value is AuthenticatorEndpointGDTCStageRequest {
+    if (!("name" in value) || value["name"] === undefined) return false;
+    if (!("credentials" in value) || value["credentials"] === undefined) return false;
+    return true;
+}
+
+export function AuthenticatorEndpointGDTCStageRequestFromJSON(
+    json: any,
+): AuthenticatorEndpointGDTCStageRequest {
+    return AuthenticatorEndpointGDTCStageRequestFromJSONTyped(json, false);
+}
+
+export function AuthenticatorEndpointGDTCStageRequestFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): AuthenticatorEndpointGDTCStageRequest {
+    if (json == null) {
+        return json;
+    }
+    return {
+        name: json["name"],
+        configureFlow: json["configure_flow"] == null ? undefined : json["configure_flow"],
+        friendlyName: json["friendly_name"] == null ? undefined : json["friendly_name"],
+        credentials: json["credentials"],
+    };
+}
+
+export function AuthenticatorEndpointGDTCStageRequestToJSON(
+    json: any,
+): AuthenticatorEndpointGDTCStageRequest {
+    return AuthenticatorEndpointGDTCStageRequestToJSONTyped(json, false);
+}
+
+export function AuthenticatorEndpointGDTCStageRequestToJSONTyped(
+    value?: AuthenticatorEndpointGDTCStageRequest | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        name: value["name"],
+        configure_flow: value["configureFlow"],
+        friendly_name: value["friendlyName"],
+        credentials: value["credentials"],
+    };
+}

packages/client-ts/src/models/AuthenticatorSMSChallenge.ts

@@ -0,0 +1,117 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import type { ContextualFlowInfo } from "./ContextualFlowInfo";
+import { ContextualFlowInfoFromJSON, ContextualFlowInfoToJSON } from "./ContextualFlowInfo";
+import type { ErrorDetail } from "./ErrorDetail";
+
+/**
+ * SMS Setup challenge
+ * @export
+ * @interface AuthenticatorSMSChallenge
+ */
+export interface AuthenticatorSMSChallenge {
+    /**
+     *
+     * @type {ContextualFlowInfo}
+     * @memberof AuthenticatorSMSChallenge
+     */
+    flowInfo?: ContextualFlowInfo;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorSMSChallenge
+     */
+    component?: string;
+    /**
+     *
+     * @type {{ [key: string]: Array<ErrorDetail>; }}
+     * @memberof AuthenticatorSMSChallenge
+     */
+    responseErrors?: { [key: string]: Array<ErrorDetail> };
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorSMSChallenge
+     */
+    pendingUser: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorSMSChallenge
+     */
+    pendingUserAvatar: string;
+    /**
+     *
+     * @type {boolean}
+     * @memberof AuthenticatorSMSChallenge
+     */
+    phoneNumberRequired?: boolean;
+}
+
+/**
+ * Check if a given object implements the AuthenticatorSMSChallenge interface.
+ */
+export function instanceOfAuthenticatorSMSChallenge(
+    value: object,
+): value is AuthenticatorSMSChallenge {
+    if (!("pendingUser" in value) || value["pendingUser"] === undefined) return false;
+    if (!("pendingUserAvatar" in value) || value["pendingUserAvatar"] === undefined) return false;
+    return true;
+}
+
+export function AuthenticatorSMSChallengeFromJSON(json: any): AuthenticatorSMSChallenge {
+    return AuthenticatorSMSChallengeFromJSONTyped(json, false);
+}
+
+export function AuthenticatorSMSChallengeFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): AuthenticatorSMSChallenge {
+    if (json == null) {
+        return json;
+    }
+    return {
+        flowInfo:
+            json["flow_info"] == null ? undefined : ContextualFlowInfoFromJSON(json["flow_info"]),
+        component: json["component"] == null ? undefined : json["component"],
+        responseErrors: json["response_errors"] == null ? undefined : json["response_errors"],
+        pendingUser: json["pending_user"],
+        pendingUserAvatar: json["pending_user_avatar"],
+        phoneNumberRequired:
+            json["phone_number_required"] == null ? undefined : json["phone_number_required"],
+    };
+}
+
+export function AuthenticatorSMSChallengeToJSON(json: any): AuthenticatorSMSChallenge {
+    return AuthenticatorSMSChallengeToJSONTyped(json, false);
+}
+
+export function AuthenticatorSMSChallengeToJSONTyped(
+    value?: AuthenticatorSMSChallenge | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        flow_info: ContextualFlowInfoToJSON(value["flowInfo"]),
+        component: value["component"],
+        response_errors: value["responseErrors"],
+        pending_user: value["pendingUser"],
+        pending_user_avatar: value["pendingUserAvatar"],
+        phone_number_required: value["phoneNumberRequired"],
+    };
+}

packages/client-ts/src/models/AuthenticatorSMSChallengeResponseRequest.ts

@@ -0,0 +1,89 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+/**
+ * SMS Challenge response, device is set by get_response_instance
+ * @export
+ * @interface AuthenticatorSMSChallengeResponseRequest
+ */
+export interface AuthenticatorSMSChallengeResponseRequest {
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorSMSChallengeResponseRequest
+     */
+    component?: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorSMSChallengeResponseRequest
+     */
+    code?: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorSMSChallengeResponseRequest
+     */
+    phoneNumber?: string;
+}
+
+/**
+ * Check if a given object implements the AuthenticatorSMSChallengeResponseRequest interface.
+ */
+export function instanceOfAuthenticatorSMSChallengeResponseRequest(
+    value: object,
+): value is AuthenticatorSMSChallengeResponseRequest {
+    return true;
+}
+
+export function AuthenticatorSMSChallengeResponseRequestFromJSON(
+    json: any,
+): AuthenticatorSMSChallengeResponseRequest {
+    return AuthenticatorSMSChallengeResponseRequestFromJSONTyped(json, false);
+}
+
+export function AuthenticatorSMSChallengeResponseRequestFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): AuthenticatorSMSChallengeResponseRequest {
+    if (json == null) {
+        return json;
+    }
+    return {
+        component: json["component"] == null ? undefined : json["component"],
+        code: json["code"] == null ? undefined : json["code"],
+        phoneNumber: json["phone_number"] == null ? undefined : json["phone_number"],
+    };
+}
+
+export function AuthenticatorSMSChallengeResponseRequestToJSON(
+    json: any,
+): AuthenticatorSMSChallengeResponseRequest {
+    return AuthenticatorSMSChallengeResponseRequestToJSONTyped(json, false);
+}
+
+export function AuthenticatorSMSChallengeResponseRequestToJSONTyped(
+    value?: AuthenticatorSMSChallengeResponseRequest | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        component: value["component"],
+        code: value["code"],
+        phone_number: value["phoneNumber"],
+    };
+}

packages/client-ts/src/models/AuthenticatorSMSStage.ts

@@ -0,0 +1,210 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import type { AuthTypeEnum } from "./AuthTypeEnum";
+import { AuthTypeEnumFromJSON, AuthTypeEnumToJSON } from "./AuthTypeEnum";
+import type { FlowSet } from "./FlowSet";
+import { FlowSetFromJSON } from "./FlowSet";
+import type { ProviderEnum } from "./ProviderEnum";
+import { ProviderEnumFromJSON, ProviderEnumToJSON } from "./ProviderEnum";
+
+/**
+ * AuthenticatorSMSStage Serializer
+ * @export
+ * @interface AuthenticatorSMSStage
+ */
+export interface AuthenticatorSMSStage {
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorSMSStage
+     */
+    readonly pk: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorSMSStage
+     */
+    name: string;
+    /**
+     * Get object type so that we know how to edit the object
+     * @type {string}
+     * @memberof AuthenticatorSMSStage
+     */
+    readonly component: string;
+    /**
+     * Return object's verbose_name
+     * @type {string}
+     * @memberof AuthenticatorSMSStage
+     */
+    readonly verboseName: string;
+    /**
+     * Return object's plural verbose_name
+     * @type {string}
+     * @memberof AuthenticatorSMSStage
+     */
+    readonly verboseNamePlural: string;
+    /**
+     * Return internal model name
+     * @type {string}
+     * @memberof AuthenticatorSMSStage
+     */
+    readonly metaModelName: string;
+    /**
+     *
+     * @type {Array<FlowSet>}
+     * @memberof AuthenticatorSMSStage
+     */
+    readonly flowSet: Array<FlowSet>;
+    /**
+     * Flow used by an authenticated user to configure this Stage. If empty, user will not be able to configure this stage.
+     * @type {string}
+     * @memberof AuthenticatorSMSStage
+     */
+    configureFlow?: string | null;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorSMSStage
+     */
+    friendlyName?: string;
+    /**
+     *
+     * @type {ProviderEnum}
+     * @memberof AuthenticatorSMSStage
+     */
+    provider: ProviderEnum;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorSMSStage
+     */
+    fromNumber: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorSMSStage
+     */
+    accountSid: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorSMSStage
+     */
+    auth: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorSMSStage
+     */
+    authPassword?: string;
+    /**
+     *
+     * @type {AuthTypeEnum}
+     * @memberof AuthenticatorSMSStage
+     */
+    authType?: AuthTypeEnum;
+    /**
+     * When enabled, the Phone number is only used during enrollment to verify the users authenticity. Only a hash of the phone number is saved to ensure it is not reused in the future.
+     * @type {boolean}
+     * @memberof AuthenticatorSMSStage
+     */
+    verifyOnly?: boolean;
+    /**
+     * Optionally modify the payload being sent to custom providers.
+     * @type {string}
+     * @memberof AuthenticatorSMSStage
+     */
+    mapping?: string | null;
+}
+
+/**
+ * Check if a given object implements the AuthenticatorSMSStage interface.
+ */
+export function instanceOfAuthenticatorSMSStage(value: object): value is AuthenticatorSMSStage {
+    if (!("pk" in value) || value["pk"] === undefined) return false;
+    if (!("name" in value) || value["name"] === undefined) return false;
+    if (!("component" in value) || value["component"] === undefined) return false;
+    if (!("verboseName" in value) || value["verboseName"] === undefined) return false;
+    if (!("verboseNamePlural" in value) || value["verboseNamePlural"] === undefined) return false;
+    if (!("metaModelName" in value) || value["metaModelName"] === undefined) return false;
+    if (!("flowSet" in value) || value["flowSet"] === undefined) return false;
+    if (!("provider" in value) || value["provider"] === undefined) return false;
+    if (!("fromNumber" in value) || value["fromNumber"] === undefined) return false;
+    if (!("accountSid" in value) || value["accountSid"] === undefined) return false;
+    if (!("auth" in value) || value["auth"] === undefined) return false;
+    return true;
+}
+
+export function AuthenticatorSMSStageFromJSON(json: any): AuthenticatorSMSStage {
+    return AuthenticatorSMSStageFromJSONTyped(json, false);
+}
+
+export function AuthenticatorSMSStageFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): AuthenticatorSMSStage {
+    if (json == null) {
+        return json;
+    }
+    return {
+        pk: json["pk"],
+        name: json["name"],
+        component: json["component"],
+        verboseName: json["verbose_name"],
+        verboseNamePlural: json["verbose_name_plural"],
+        metaModelName: json["meta_model_name"],
+        flowSet: (json["flow_set"] as Array<any>).map(FlowSetFromJSON),
+        configureFlow: json["configure_flow"] == null ? undefined : json["configure_flow"],
+        friendlyName: json["friendly_name"] == null ? undefined : json["friendly_name"],
+        provider: ProviderEnumFromJSON(json["provider"]),
+        fromNumber: json["from_number"],
+        accountSid: json["account_sid"],
+        auth: json["auth"],
+        authPassword: json["auth_password"] == null ? undefined : json["auth_password"],
+        authType: json["auth_type"] == null ? undefined : AuthTypeEnumFromJSON(json["auth_type"]),
+        verifyOnly: json["verify_only"] == null ? undefined : json["verify_only"],
+        mapping: json["mapping"] == null ? undefined : json["mapping"],
+    };
+}
+
+export function AuthenticatorSMSStageToJSON(json: any): AuthenticatorSMSStage {
+    return AuthenticatorSMSStageToJSONTyped(json, false);
+}
+
+export function AuthenticatorSMSStageToJSONTyped(
+    value?: Omit<
+        AuthenticatorSMSStage,
+        "pk" | "component" | "verbose_name" | "verbose_name_plural" | "meta_model_name" | "flow_set"
+    > | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        name: value["name"],
+        configure_flow: value["configureFlow"],
+        friendly_name: value["friendlyName"],
+        provider: ProviderEnumToJSON(value["provider"]),
+        from_number: value["fromNumber"],
+        account_sid: value["accountSid"],
+        auth: value["auth"],
+        auth_password: value["authPassword"],
+        auth_type: AuthTypeEnumToJSON(value["authType"]),
+        verify_only: value["verifyOnly"],
+        mapping: value["mapping"],
+    };
+}

packages/client-ts/src/models/AuthenticatorSMSStageRequest.ts

@@ -0,0 +1,159 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import type { AuthTypeEnum } from "./AuthTypeEnum";
+import { AuthTypeEnumFromJSON, AuthTypeEnumToJSON } from "./AuthTypeEnum";
+import type { ProviderEnum } from "./ProviderEnum";
+import { ProviderEnumFromJSON, ProviderEnumToJSON } from "./ProviderEnum";
+
+/**
+ * AuthenticatorSMSStage Serializer
+ * @export
+ * @interface AuthenticatorSMSStageRequest
+ */
+export interface AuthenticatorSMSStageRequest {
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorSMSStageRequest
+     */
+    name: string;
+    /**
+     * Flow used by an authenticated user to configure this Stage. If empty, user will not be able to configure this stage.
+     * @type {string}
+     * @memberof AuthenticatorSMSStageRequest
+     */
+    configureFlow?: string | null;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorSMSStageRequest
+     */
+    friendlyName?: string;
+    /**
+     *
+     * @type {ProviderEnum}
+     * @memberof AuthenticatorSMSStageRequest
+     */
+    provider: ProviderEnum;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorSMSStageRequest
+     */
+    fromNumber: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorSMSStageRequest
+     */
+    accountSid: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorSMSStageRequest
+     */
+    auth: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorSMSStageRequest
+     */
+    authPassword?: string;
+    /**
+     *
+     * @type {AuthTypeEnum}
+     * @memberof AuthenticatorSMSStageRequest
+     */
+    authType?: AuthTypeEnum;
+    /**
+     * When enabled, the Phone number is only used during enrollment to verify the users authenticity. Only a hash of the phone number is saved to ensure it is not reused in the future.
+     * @type {boolean}
+     * @memberof AuthenticatorSMSStageRequest
+     */
+    verifyOnly?: boolean;
+    /**
+     * Optionally modify the payload being sent to custom providers.
+     * @type {string}
+     * @memberof AuthenticatorSMSStageRequest
+     */
+    mapping?: string | null;
+}
+
+/**
+ * Check if a given object implements the AuthenticatorSMSStageRequest interface.
+ */
+export function instanceOfAuthenticatorSMSStageRequest(
+    value: object,
+): value is AuthenticatorSMSStageRequest {
+    if (!("name" in value) || value["name"] === undefined) return false;
+    if (!("provider" in value) || value["provider"] === undefined) return false;
+    if (!("fromNumber" in value) || value["fromNumber"] === undefined) return false;
+    if (!("accountSid" in value) || value["accountSid"] === undefined) return false;
+    if (!("auth" in value) || value["auth"] === undefined) return false;
+    return true;
+}
+
+export function AuthenticatorSMSStageRequestFromJSON(json: any): AuthenticatorSMSStageRequest {
+    return AuthenticatorSMSStageRequestFromJSONTyped(json, false);
+}
+
+export function AuthenticatorSMSStageRequestFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): AuthenticatorSMSStageRequest {
+    if (json == null) {
+        return json;
+    }
+    return {
+        name: json["name"],
+        configureFlow: json["configure_flow"] == null ? undefined : json["configure_flow"],
+        friendlyName: json["friendly_name"] == null ? undefined : json["friendly_name"],
+        provider: ProviderEnumFromJSON(json["provider"]),
+        fromNumber: json["from_number"],
+        accountSid: json["account_sid"],
+        auth: json["auth"],
+        authPassword: json["auth_password"] == null ? undefined : json["auth_password"],
+        authType: json["auth_type"] == null ? undefined : AuthTypeEnumFromJSON(json["auth_type"]),
+        verifyOnly: json["verify_only"] == null ? undefined : json["verify_only"],
+        mapping: json["mapping"] == null ? undefined : json["mapping"],
+    };
+}
+
+export function AuthenticatorSMSStageRequestToJSON(json: any): AuthenticatorSMSStageRequest {
+    return AuthenticatorSMSStageRequestToJSONTyped(json, false);
+}
+
+export function AuthenticatorSMSStageRequestToJSONTyped(
+    value?: AuthenticatorSMSStageRequest | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        name: value["name"],
+        configure_flow: value["configureFlow"],
+        friendly_name: value["friendlyName"],
+        provider: ProviderEnumToJSON(value["provider"]),
+        from_number: value["fromNumber"],
+        account_sid: value["accountSid"],
+        auth: value["auth"],
+        auth_password: value["authPassword"],
+        auth_type: AuthTypeEnumToJSON(value["authType"]),
+        verify_only: value["verifyOnly"],
+        mapping: value["mapping"],
+    };
+}

packages/client-ts/src/models/AuthenticatorStaticChallenge.ts

@@ -0,0 +1,117 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import type { ContextualFlowInfo } from "./ContextualFlowInfo";
+import { ContextualFlowInfoFromJSON, ContextualFlowInfoToJSON } from "./ContextualFlowInfo";
+import type { ErrorDetail } from "./ErrorDetail";
+
+/**
+ * Static authenticator challenge
+ * @export
+ * @interface AuthenticatorStaticChallenge
+ */
+export interface AuthenticatorStaticChallenge {
+    /**
+     *
+     * @type {ContextualFlowInfo}
+     * @memberof AuthenticatorStaticChallenge
+     */
+    flowInfo?: ContextualFlowInfo;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorStaticChallenge
+     */
+    component?: string;
+    /**
+     *
+     * @type {{ [key: string]: Array<ErrorDetail>; }}
+     * @memberof AuthenticatorStaticChallenge
+     */
+    responseErrors?: { [key: string]: Array<ErrorDetail> };
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorStaticChallenge
+     */
+    pendingUser: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorStaticChallenge
+     */
+    pendingUserAvatar: string;
+    /**
+     *
+     * @type {Array<string>}
+     * @memberof AuthenticatorStaticChallenge
+     */
+    codes: Array<string>;
+}
+
+/**
+ * Check if a given object implements the AuthenticatorStaticChallenge interface.
+ */
+export function instanceOfAuthenticatorStaticChallenge(
+    value: object,
+): value is AuthenticatorStaticChallenge {
+    if (!("pendingUser" in value) || value["pendingUser"] === undefined) return false;
+    if (!("pendingUserAvatar" in value) || value["pendingUserAvatar"] === undefined) return false;
+    if (!("codes" in value) || value["codes"] === undefined) return false;
+    return true;
+}
+
+export function AuthenticatorStaticChallengeFromJSON(json: any): AuthenticatorStaticChallenge {
+    return AuthenticatorStaticChallengeFromJSONTyped(json, false);
+}
+
+export function AuthenticatorStaticChallengeFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): AuthenticatorStaticChallenge {
+    if (json == null) {
+        return json;
+    }
+    return {
+        flowInfo:
+            json["flow_info"] == null ? undefined : ContextualFlowInfoFromJSON(json["flow_info"]),
+        component: json["component"] == null ? undefined : json["component"],
+        responseErrors: json["response_errors"] == null ? undefined : json["response_errors"],
+        pendingUser: json["pending_user"],
+        pendingUserAvatar: json["pending_user_avatar"],
+        codes: json["codes"],
+    };
+}
+
+export function AuthenticatorStaticChallengeToJSON(json: any): AuthenticatorStaticChallenge {
+    return AuthenticatorStaticChallengeToJSONTyped(json, false);
+}
+
+export function AuthenticatorStaticChallengeToJSONTyped(
+    value?: AuthenticatorStaticChallenge | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        flow_info: ContextualFlowInfoToJSON(value["flowInfo"]),
+        component: value["component"],
+        response_errors: value["responseErrors"],
+        pending_user: value["pendingUser"],
+        pending_user_avatar: value["pendingUserAvatar"],
+        codes: value["codes"],
+    };
+}

packages/client-ts/src/models/AuthenticatorStaticChallengeResponseRequest.ts

@@ -0,0 +1,73 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+/**
+ * Pseudo class for static response
+ * @export
+ * @interface AuthenticatorStaticChallengeResponseRequest
+ */
+export interface AuthenticatorStaticChallengeResponseRequest {
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorStaticChallengeResponseRequest
+     */
+    component?: string;
+}
+
+/**
+ * Check if a given object implements the AuthenticatorStaticChallengeResponseRequest interface.
+ */
+export function instanceOfAuthenticatorStaticChallengeResponseRequest(
+    value: object,
+): value is AuthenticatorStaticChallengeResponseRequest {
+    return true;
+}
+
+export function AuthenticatorStaticChallengeResponseRequestFromJSON(
+    json: any,
+): AuthenticatorStaticChallengeResponseRequest {
+    return AuthenticatorStaticChallengeResponseRequestFromJSONTyped(json, false);
+}
+
+export function AuthenticatorStaticChallengeResponseRequestFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): AuthenticatorStaticChallengeResponseRequest {
+    if (json == null) {
+        return json;
+    }
+    return {
+        component: json["component"] == null ? undefined : json["component"],
+    };
+}
+
+export function AuthenticatorStaticChallengeResponseRequestToJSON(
+    json: any,
+): AuthenticatorStaticChallengeResponseRequest {
+    return AuthenticatorStaticChallengeResponseRequestToJSONTyped(json, false);
+}
+
+export function AuthenticatorStaticChallengeResponseRequestToJSONTyped(
+    value?: AuthenticatorStaticChallengeResponseRequest | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        component: value["component"],
+    };
+}

packages/client-ts/src/models/AuthenticatorStaticStage.ts

@@ -0,0 +1,156 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import type { FlowSet } from "./FlowSet";
+import { FlowSetFromJSON } from "./FlowSet";
+
+/**
+ * AuthenticatorStaticStage Serializer
+ * @export
+ * @interface AuthenticatorStaticStage
+ */
+export interface AuthenticatorStaticStage {
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorStaticStage
+     */
+    readonly pk: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorStaticStage
+     */
+    name: string;
+    /**
+     * Get object type so that we know how to edit the object
+     * @type {string}
+     * @memberof AuthenticatorStaticStage
+     */
+    readonly component: string;
+    /**
+     * Return object's verbose_name
+     * @type {string}
+     * @memberof AuthenticatorStaticStage
+     */
+    readonly verboseName: string;
+    /**
+     * Return object's plural verbose_name
+     * @type {string}
+     * @memberof AuthenticatorStaticStage
+     */
+    readonly verboseNamePlural: string;
+    /**
+     * Return internal model name
+     * @type {string}
+     * @memberof AuthenticatorStaticStage
+     */
+    readonly metaModelName: string;
+    /**
+     *
+     * @type {Array<FlowSet>}
+     * @memberof AuthenticatorStaticStage
+     */
+    readonly flowSet: Array<FlowSet>;
+    /**
+     * Flow used by an authenticated user to configure this Stage. If empty, user will not be able to configure this stage.
+     * @type {string}
+     * @memberof AuthenticatorStaticStage
+     */
+    configureFlow?: string | null;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorStaticStage
+     */
+    friendlyName?: string;
+    /**
+     *
+     * @type {number}
+     * @memberof AuthenticatorStaticStage
+     */
+    tokenCount?: number;
+    /**
+     *
+     * @type {number}
+     * @memberof AuthenticatorStaticStage
+     */
+    tokenLength?: number;
+}
+
+/**
+ * Check if a given object implements the AuthenticatorStaticStage interface.
+ */
+export function instanceOfAuthenticatorStaticStage(
+    value: object,
+): value is AuthenticatorStaticStage {
+    if (!("pk" in value) || value["pk"] === undefined) return false;
+    if (!("name" in value) || value["name"] === undefined) return false;
+    if (!("component" in value) || value["component"] === undefined) return false;
+    if (!("verboseName" in value) || value["verboseName"] === undefined) return false;
+    if (!("verboseNamePlural" in value) || value["verboseNamePlural"] === undefined) return false;
+    if (!("metaModelName" in value) || value["metaModelName"] === undefined) return false;
+    if (!("flowSet" in value) || value["flowSet"] === undefined) return false;
+    return true;
+}
+
+export function AuthenticatorStaticStageFromJSON(json: any): AuthenticatorStaticStage {
+    return AuthenticatorStaticStageFromJSONTyped(json, false);
+}
+
+export function AuthenticatorStaticStageFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): AuthenticatorStaticStage {
+    if (json == null) {
+        return json;
+    }
+    return {
+        pk: json["pk"],
+        name: json["name"],
+        component: json["component"],
+        verboseName: json["verbose_name"],
+        verboseNamePlural: json["verbose_name_plural"],
+        metaModelName: json["meta_model_name"],
+        flowSet: (json["flow_set"] as Array<any>).map(FlowSetFromJSON),
+        configureFlow: json["configure_flow"] == null ? undefined : json["configure_flow"],
+        friendlyName: json["friendly_name"] == null ? undefined : json["friendly_name"],
+        tokenCount: json["token_count"] == null ? undefined : json["token_count"],
+        tokenLength: json["token_length"] == null ? undefined : json["token_length"],
+    };
+}
+
+export function AuthenticatorStaticStageToJSON(json: any): AuthenticatorStaticStage {
+    return AuthenticatorStaticStageToJSONTyped(json, false);
+}
+
+export function AuthenticatorStaticStageToJSONTyped(
+    value?: Omit<
+        AuthenticatorStaticStage,
+        "pk" | "component" | "verbose_name" | "verbose_name_plural" | "meta_model_name" | "flow_set"
+    > | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        name: value["name"],
+        configure_flow: value["configureFlow"],
+        friendly_name: value["friendlyName"],
+        token_count: value["tokenCount"],
+        token_length: value["tokenLength"],
+    };
+}

packages/client-ts/src/models/AuthenticatorStaticStageRequest.ts

@@ -0,0 +1,104 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+/**
+ * AuthenticatorStaticStage Serializer
+ * @export
+ * @interface AuthenticatorStaticStageRequest
+ */
+export interface AuthenticatorStaticStageRequest {
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorStaticStageRequest
+     */
+    name: string;
+    /**
+     * Flow used by an authenticated user to configure this Stage. If empty, user will not be able to configure this stage.
+     * @type {string}
+     * @memberof AuthenticatorStaticStageRequest
+     */
+    configureFlow?: string | null;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorStaticStageRequest
+     */
+    friendlyName?: string;
+    /**
+     *
+     * @type {number}
+     * @memberof AuthenticatorStaticStageRequest
+     */
+    tokenCount?: number;
+    /**
+     *
+     * @type {number}
+     * @memberof AuthenticatorStaticStageRequest
+     */
+    tokenLength?: number;
+}
+
+/**
+ * Check if a given object implements the AuthenticatorStaticStageRequest interface.
+ */
+export function instanceOfAuthenticatorStaticStageRequest(
+    value: object,
+): value is AuthenticatorStaticStageRequest {
+    if (!("name" in value) || value["name"] === undefined) return false;
+    return true;
+}
+
+export function AuthenticatorStaticStageRequestFromJSON(
+    json: any,
+): AuthenticatorStaticStageRequest {
+    return AuthenticatorStaticStageRequestFromJSONTyped(json, false);
+}
+
+export function AuthenticatorStaticStageRequestFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): AuthenticatorStaticStageRequest {
+    if (json == null) {
+        return json;
+    }
+    return {
+        name: json["name"],
+        configureFlow: json["configure_flow"] == null ? undefined : json["configure_flow"],
+        friendlyName: json["friendly_name"] == null ? undefined : json["friendly_name"],
+        tokenCount: json["token_count"] == null ? undefined : json["token_count"],
+        tokenLength: json["token_length"] == null ? undefined : json["token_length"],
+    };
+}
+
+export function AuthenticatorStaticStageRequestToJSON(json: any): AuthenticatorStaticStageRequest {
+    return AuthenticatorStaticStageRequestToJSONTyped(json, false);
+}
+
+export function AuthenticatorStaticStageRequestToJSONTyped(
+    value?: AuthenticatorStaticStageRequest | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        name: value["name"],
+        configure_flow: value["configureFlow"],
+        friendly_name: value["friendlyName"],
+        token_count: value["tokenCount"],
+        token_length: value["tokenLength"],
+    };
+}

packages/client-ts/src/models/AuthenticatorTOTPChallenge.ts

@@ -0,0 +1,117 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import type { ContextualFlowInfo } from "./ContextualFlowInfo";
+import { ContextualFlowInfoFromJSON, ContextualFlowInfoToJSON } from "./ContextualFlowInfo";
+import type { ErrorDetail } from "./ErrorDetail";
+
+/**
+ * TOTP Setup challenge
+ * @export
+ * @interface AuthenticatorTOTPChallenge
+ */
+export interface AuthenticatorTOTPChallenge {
+    /**
+     *
+     * @type {ContextualFlowInfo}
+     * @memberof AuthenticatorTOTPChallenge
+     */
+    flowInfo?: ContextualFlowInfo;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorTOTPChallenge
+     */
+    component?: string;
+    /**
+     *
+     * @type {{ [key: string]: Array<ErrorDetail>; }}
+     * @memberof AuthenticatorTOTPChallenge
+     */
+    responseErrors?: { [key: string]: Array<ErrorDetail> };
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorTOTPChallenge
+     */
+    pendingUser: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorTOTPChallenge
+     */
+    pendingUserAvatar: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorTOTPChallenge
+     */
+    configUrl: string;
+}
+
+/**
+ * Check if a given object implements the AuthenticatorTOTPChallenge interface.
+ */
+export function instanceOfAuthenticatorTOTPChallenge(
+    value: object,
+): value is AuthenticatorTOTPChallenge {
+    if (!("pendingUser" in value) || value["pendingUser"] === undefined) return false;
+    if (!("pendingUserAvatar" in value) || value["pendingUserAvatar"] === undefined) return false;
+    if (!("configUrl" in value) || value["configUrl"] === undefined) return false;
+    return true;
+}
+
+export function AuthenticatorTOTPChallengeFromJSON(json: any): AuthenticatorTOTPChallenge {
+    return AuthenticatorTOTPChallengeFromJSONTyped(json, false);
+}
+
+export function AuthenticatorTOTPChallengeFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): AuthenticatorTOTPChallenge {
+    if (json == null) {
+        return json;
+    }
+    return {
+        flowInfo:
+            json["flow_info"] == null ? undefined : ContextualFlowInfoFromJSON(json["flow_info"]),
+        component: json["component"] == null ? undefined : json["component"],
+        responseErrors: json["response_errors"] == null ? undefined : json["response_errors"],
+        pendingUser: json["pending_user"],
+        pendingUserAvatar: json["pending_user_avatar"],
+        configUrl: json["config_url"],
+    };
+}
+
+export function AuthenticatorTOTPChallengeToJSON(json: any): AuthenticatorTOTPChallenge {
+    return AuthenticatorTOTPChallengeToJSONTyped(json, false);
+}
+
+export function AuthenticatorTOTPChallengeToJSONTyped(
+    value?: AuthenticatorTOTPChallenge | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        flow_info: ContextualFlowInfoToJSON(value["flowInfo"]),
+        component: value["component"],
+        response_errors: value["responseErrors"],
+        pending_user: value["pendingUser"],
+        pending_user_avatar: value["pendingUserAvatar"],
+        config_url: value["configUrl"],
+    };
+}

packages/client-ts/src/models/AuthenticatorTOTPChallengeResponseRequest.ts

@@ -0,0 +1,82 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+/**
+ * TOTP Challenge response, device is set by get_response_instance
+ * @export
+ * @interface AuthenticatorTOTPChallengeResponseRequest
+ */
+export interface AuthenticatorTOTPChallengeResponseRequest {
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorTOTPChallengeResponseRequest
+     */
+    component?: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorTOTPChallengeResponseRequest
+     */
+    code: string;
+}
+
+/**
+ * Check if a given object implements the AuthenticatorTOTPChallengeResponseRequest interface.
+ */
+export function instanceOfAuthenticatorTOTPChallengeResponseRequest(
+    value: object,
+): value is AuthenticatorTOTPChallengeResponseRequest {
+    if (!("code" in value) || value["code"] === undefined) return false;
+    return true;
+}
+
+export function AuthenticatorTOTPChallengeResponseRequestFromJSON(
+    json: any,
+): AuthenticatorTOTPChallengeResponseRequest {
+    return AuthenticatorTOTPChallengeResponseRequestFromJSONTyped(json, false);
+}
+
+export function AuthenticatorTOTPChallengeResponseRequestFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): AuthenticatorTOTPChallengeResponseRequest {
+    if (json == null) {
+        return json;
+    }
+    return {
+        component: json["component"] == null ? undefined : json["component"],
+        code: json["code"],
+    };
+}
+
+export function AuthenticatorTOTPChallengeResponseRequestToJSON(
+    json: any,
+): AuthenticatorTOTPChallengeResponseRequest {
+    return AuthenticatorTOTPChallengeResponseRequestToJSONTyped(json, false);
+}
+
+export function AuthenticatorTOTPChallengeResponseRequestToJSONTyped(
+    value?: AuthenticatorTOTPChallengeResponseRequest | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        component: value["component"],
+        code: value["code"],
+    };
+}

packages/client-ts/src/models/AuthenticatorTOTPStage.ts

@@ -0,0 +1,149 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import type { DigitsEnum } from "./DigitsEnum";
+import { DigitsEnumFromJSON, DigitsEnumToJSON } from "./DigitsEnum";
+import type { FlowSet } from "./FlowSet";
+import { FlowSetFromJSON } from "./FlowSet";
+
+/**
+ * AuthenticatorTOTPStage Serializer
+ * @export
+ * @interface AuthenticatorTOTPStage
+ */
+export interface AuthenticatorTOTPStage {
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorTOTPStage
+     */
+    readonly pk: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorTOTPStage
+     */
+    name: string;
+    /**
+     * Get object type so that we know how to edit the object
+     * @type {string}
+     * @memberof AuthenticatorTOTPStage
+     */
+    readonly component: string;
+    /**
+     * Return object's verbose_name
+     * @type {string}
+     * @memberof AuthenticatorTOTPStage
+     */
+    readonly verboseName: string;
+    /**
+     * Return object's plural verbose_name
+     * @type {string}
+     * @memberof AuthenticatorTOTPStage
+     */
+    readonly verboseNamePlural: string;
+    /**
+     * Return internal model name
+     * @type {string}
+     * @memberof AuthenticatorTOTPStage
+     */
+    readonly metaModelName: string;
+    /**
+     *
+     * @type {Array<FlowSet>}
+     * @memberof AuthenticatorTOTPStage
+     */
+    readonly flowSet: Array<FlowSet>;
+    /**
+     * Flow used by an authenticated user to configure this Stage. If empty, user will not be able to configure this stage.
+     * @type {string}
+     * @memberof AuthenticatorTOTPStage
+     */
+    configureFlow?: string | null;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorTOTPStage
+     */
+    friendlyName?: string;
+    /**
+     *
+     * @type {DigitsEnum}
+     * @memberof AuthenticatorTOTPStage
+     */
+    digits: DigitsEnum;
+}
+
+/**
+ * Check if a given object implements the AuthenticatorTOTPStage interface.
+ */
+export function instanceOfAuthenticatorTOTPStage(value: object): value is AuthenticatorTOTPStage {
+    if (!("pk" in value) || value["pk"] === undefined) return false;
+    if (!("name" in value) || value["name"] === undefined) return false;
+    if (!("component" in value) || value["component"] === undefined) return false;
+    if (!("verboseName" in value) || value["verboseName"] === undefined) return false;
+    if (!("verboseNamePlural" in value) || value["verboseNamePlural"] === undefined) return false;
+    if (!("metaModelName" in value) || value["metaModelName"] === undefined) return false;
+    if (!("flowSet" in value) || value["flowSet"] === undefined) return false;
+    if (!("digits" in value) || value["digits"] === undefined) return false;
+    return true;
+}
+
+export function AuthenticatorTOTPStageFromJSON(json: any): AuthenticatorTOTPStage {
+    return AuthenticatorTOTPStageFromJSONTyped(json, false);
+}
+
+export function AuthenticatorTOTPStageFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): AuthenticatorTOTPStage {
+    if (json == null) {
+        return json;
+    }
+    return {
+        pk: json["pk"],
+        name: json["name"],
+        component: json["component"],
+        verboseName: json["verbose_name"],
+        verboseNamePlural: json["verbose_name_plural"],
+        metaModelName: json["meta_model_name"],
+        flowSet: (json["flow_set"] as Array<any>).map(FlowSetFromJSON),
+        configureFlow: json["configure_flow"] == null ? undefined : json["configure_flow"],
+        friendlyName: json["friendly_name"] == null ? undefined : json["friendly_name"],
+        digits: DigitsEnumFromJSON(json["digits"]),
+    };
+}
+
+export function AuthenticatorTOTPStageToJSON(json: any): AuthenticatorTOTPStage {
+    return AuthenticatorTOTPStageToJSONTyped(json, false);
+}
+
+export function AuthenticatorTOTPStageToJSONTyped(
+    value?: Omit<
+        AuthenticatorTOTPStage,
+        "pk" | "component" | "verbose_name" | "verbose_name_plural" | "meta_model_name" | "flow_set"
+    > | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        name: value["name"],
+        configure_flow: value["configureFlow"],
+        friendly_name: value["friendlyName"],
+        digits: DigitsEnumToJSON(value["digits"]),
+    };
+}

packages/client-ts/src/models/AuthenticatorTOTPStageRequest.ts

@@ -0,0 +1,98 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import type { DigitsEnum } from "./DigitsEnum";
+import { DigitsEnumFromJSON, DigitsEnumToJSON } from "./DigitsEnum";
+
+/**
+ * AuthenticatorTOTPStage Serializer
+ * @export
+ * @interface AuthenticatorTOTPStageRequest
+ */
+export interface AuthenticatorTOTPStageRequest {
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorTOTPStageRequest
+     */
+    name: string;
+    /**
+     * Flow used by an authenticated user to configure this Stage. If empty, user will not be able to configure this stage.
+     * @type {string}
+     * @memberof AuthenticatorTOTPStageRequest
+     */
+    configureFlow?: string | null;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorTOTPStageRequest
+     */
+    friendlyName?: string;
+    /**
+     *
+     * @type {DigitsEnum}
+     * @memberof AuthenticatorTOTPStageRequest
+     */
+    digits: DigitsEnum;
+}
+
+/**
+ * Check if a given object implements the AuthenticatorTOTPStageRequest interface.
+ */
+export function instanceOfAuthenticatorTOTPStageRequest(
+    value: object,
+): value is AuthenticatorTOTPStageRequest {
+    if (!("name" in value) || value["name"] === undefined) return false;
+    if (!("digits" in value) || value["digits"] === undefined) return false;
+    return true;
+}
+
+export function AuthenticatorTOTPStageRequestFromJSON(json: any): AuthenticatorTOTPStageRequest {
+    return AuthenticatorTOTPStageRequestFromJSONTyped(json, false);
+}
+
+export function AuthenticatorTOTPStageRequestFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): AuthenticatorTOTPStageRequest {
+    if (json == null) {
+        return json;
+    }
+    return {
+        name: json["name"],
+        configureFlow: json["configure_flow"] == null ? undefined : json["configure_flow"],
+        friendlyName: json["friendly_name"] == null ? undefined : json["friendly_name"],
+        digits: DigitsEnumFromJSON(json["digits"]),
+    };
+}
+
+export function AuthenticatorTOTPStageRequestToJSON(json: any): AuthenticatorTOTPStageRequest {
+    return AuthenticatorTOTPStageRequestToJSONTyped(json, false);
+}
+
+export function AuthenticatorTOTPStageRequestToJSONTyped(
+    value?: AuthenticatorTOTPStageRequest | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        name: value["name"],
+        configure_flow: value["configureFlow"],
+        friendly_name: value["friendlyName"],
+        digits: DigitsEnumToJSON(value["digits"]),
+    };
+}

packages/client-ts/src/models/AuthenticatorValidateStage.ts

@@ -0,0 +1,236 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import type { DeviceClassesEnum } from "./DeviceClassesEnum";
+import { DeviceClassesEnumFromJSON, DeviceClassesEnumToJSON } from "./DeviceClassesEnum";
+import type { FlowSet } from "./FlowSet";
+import { FlowSetFromJSON } from "./FlowSet";
+import type { NotConfiguredActionEnum } from "./NotConfiguredActionEnum";
+import {
+    NotConfiguredActionEnumFromJSON,
+    NotConfiguredActionEnumToJSON,
+} from "./NotConfiguredActionEnum";
+import type { UserVerificationEnum } from "./UserVerificationEnum";
+import { UserVerificationEnumFromJSON, UserVerificationEnumToJSON } from "./UserVerificationEnum";
+import type { WebAuthnDeviceType } from "./WebAuthnDeviceType";
+import { WebAuthnDeviceTypeFromJSON } from "./WebAuthnDeviceType";
+import type { WebAuthnHintEnum } from "./WebAuthnHintEnum";
+import { WebAuthnHintEnumFromJSON, WebAuthnHintEnumToJSON } from "./WebAuthnHintEnum";
+
+/**
+ * AuthenticatorValidateStage Serializer
+ * @export
+ * @interface AuthenticatorValidateStage
+ */
+export interface AuthenticatorValidateStage {
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorValidateStage
+     */
+    readonly pk: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorValidateStage
+     */
+    name: string;
+    /**
+     * Get object type so that we know how to edit the object
+     * @type {string}
+     * @memberof AuthenticatorValidateStage
+     */
+    readonly component: string;
+    /**
+     * Return object's verbose_name
+     * @type {string}
+     * @memberof AuthenticatorValidateStage
+     */
+    readonly verboseName: string;
+    /**
+     * Return object's plural verbose_name
+     * @type {string}
+     * @memberof AuthenticatorValidateStage
+     */
+    readonly verboseNamePlural: string;
+    /**
+     * Return internal model name
+     * @type {string}
+     * @memberof AuthenticatorValidateStage
+     */
+    readonly metaModelName: string;
+    /**
+     *
+     * @type {Array<FlowSet>}
+     * @memberof AuthenticatorValidateStage
+     */
+    readonly flowSet: Array<FlowSet>;
+    /**
+     *
+     * @type {NotConfiguredActionEnum}
+     * @memberof AuthenticatorValidateStage
+     */
+    notConfiguredAction?: NotConfiguredActionEnum;
+    /**
+     * Device classes which can be used to authenticate
+     * @type {Array<DeviceClassesEnum>}
+     * @memberof AuthenticatorValidateStage
+     */
+    deviceClasses?: Array<DeviceClassesEnum>;
+    /**
+     * Stages used to configure Authenticator when user doesn't have any compatible devices. After this configuration Stage passes, the user is not prompted again.
+     * @type {Array<string>}
+     * @memberof AuthenticatorValidateStage
+     */
+    configurationStages?: Array<string>;
+    /**
+     * If any of the user's device has been used within this threshold, this stage will be skipped
+     * @type {string}
+     * @memberof AuthenticatorValidateStage
+     */
+    lastAuthThreshold?: string;
+    /**
+     * Enforce user verification for WebAuthn devices.
+     * @type {UserVerificationEnum}
+     * @memberof AuthenticatorValidateStage
+     */
+    webauthnUserVerification?: UserVerificationEnum;
+    /**
+     *
+     * @type {Array<WebAuthnHintEnum>}
+     * @memberof AuthenticatorValidateStage
+     */
+    webauthnHints?: Array<WebAuthnHintEnum>;
+    /**
+     *
+     * @type {Array<string>}
+     * @memberof AuthenticatorValidateStage
+     */
+    webauthnAllowedDeviceTypes?: Array<string>;
+    /**
+     *
+     * @type {Array<WebAuthnDeviceType>}
+     * @memberof AuthenticatorValidateStage
+     */
+    readonly webauthnAllowedDeviceTypesObj: Array<WebAuthnDeviceType>;
+}
+
+/**
+ * Check if a given object implements the AuthenticatorValidateStage interface.
+ */
+export function instanceOfAuthenticatorValidateStage(
+    value: object,
+): value is AuthenticatorValidateStage {
+    if (!("pk" in value) || value["pk"] === undefined) return false;
+    if (!("name" in value) || value["name"] === undefined) return false;
+    if (!("component" in value) || value["component"] === undefined) return false;
+    if (!("verboseName" in value) || value["verboseName"] === undefined) return false;
+    if (!("verboseNamePlural" in value) || value["verboseNamePlural"] === undefined) return false;
+    if (!("metaModelName" in value) || value["metaModelName"] === undefined) return false;
+    if (!("flowSet" in value) || value["flowSet"] === undefined) return false;
+    if (
+        !("webauthnAllowedDeviceTypesObj" in value) ||
+        value["webauthnAllowedDeviceTypesObj"] === undefined
+    )
+        return false;
+    return true;
+}
+
+export function AuthenticatorValidateStageFromJSON(json: any): AuthenticatorValidateStage {
+    return AuthenticatorValidateStageFromJSONTyped(json, false);
+}
+
+export function AuthenticatorValidateStageFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): AuthenticatorValidateStage {
+    if (json == null) {
+        return json;
+    }
+    return {
+        pk: json["pk"],
+        name: json["name"],
+        component: json["component"],
+        verboseName: json["verbose_name"],
+        verboseNamePlural: json["verbose_name_plural"],
+        metaModelName: json["meta_model_name"],
+        flowSet: (json["flow_set"] as Array<any>).map(FlowSetFromJSON),
+        notConfiguredAction:
+            json["not_configured_action"] == null
+                ? undefined
+                : NotConfiguredActionEnumFromJSON(json["not_configured_action"]),
+        deviceClasses:
+            json["device_classes"] == null
+                ? undefined
+                : (json["device_classes"] as Array<any>).map(DeviceClassesEnumFromJSON),
+        configurationStages:
+            json["configuration_stages"] == null ? undefined : json["configuration_stages"],
+        lastAuthThreshold:
+            json["last_auth_threshold"] == null ? undefined : json["last_auth_threshold"],
+        webauthnUserVerification:
+            json["webauthn_user_verification"] == null
+                ? undefined
+                : UserVerificationEnumFromJSON(json["webauthn_user_verification"]),
+        webauthnHints:
+            json["webauthn_hints"] == null
+                ? undefined
+                : (json["webauthn_hints"] as Array<any>).map(WebAuthnHintEnumFromJSON),
+        webauthnAllowedDeviceTypes:
+            json["webauthn_allowed_device_types"] == null
+                ? undefined
+                : json["webauthn_allowed_device_types"],
+        webauthnAllowedDeviceTypesObj: (
+            json["webauthn_allowed_device_types_obj"] as Array<any>
+        ).map(WebAuthnDeviceTypeFromJSON),
+    };
+}
+
+export function AuthenticatorValidateStageToJSON(json: any): AuthenticatorValidateStage {
+    return AuthenticatorValidateStageToJSONTyped(json, false);
+}
+
+export function AuthenticatorValidateStageToJSONTyped(
+    value?: Omit<
+        AuthenticatorValidateStage,
+        | "pk"
+        | "component"
+        | "verbose_name"
+        | "verbose_name_plural"
+        | "meta_model_name"
+        | "flow_set"
+        | "webauthn_allowed_device_types_obj"
+    > | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        name: value["name"],
+        not_configured_action: NotConfiguredActionEnumToJSON(value["notConfiguredAction"]),
+        device_classes:
+            value["deviceClasses"] == null
+                ? undefined
+                : (value["deviceClasses"] as Array<any>).map(DeviceClassesEnumToJSON),
+        configuration_stages: value["configurationStages"],
+        last_auth_threshold: value["lastAuthThreshold"],
+        webauthn_user_verification: UserVerificationEnumToJSON(value["webauthnUserVerification"]),
+        webauthn_hints:
+            value["webauthnHints"] == null
+                ? undefined
+                : (value["webauthnHints"] as Array<any>).map(WebAuthnHintEnumToJSON),
+        webauthn_allowed_device_types: value["webauthnAllowedDeviceTypes"],
+    };
+}

packages/client-ts/src/models/AuthenticatorValidateStageRequest.ts

@@ -0,0 +1,165 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import type { DeviceClassesEnum } from "./DeviceClassesEnum";
+import { DeviceClassesEnumFromJSON, DeviceClassesEnumToJSON } from "./DeviceClassesEnum";
+import type { NotConfiguredActionEnum } from "./NotConfiguredActionEnum";
+import {
+    NotConfiguredActionEnumFromJSON,
+    NotConfiguredActionEnumToJSON,
+} from "./NotConfiguredActionEnum";
+import type { UserVerificationEnum } from "./UserVerificationEnum";
+import { UserVerificationEnumFromJSON, UserVerificationEnumToJSON } from "./UserVerificationEnum";
+import type { WebAuthnHintEnum } from "./WebAuthnHintEnum";
+import { WebAuthnHintEnumFromJSON, WebAuthnHintEnumToJSON } from "./WebAuthnHintEnum";
+
+/**
+ * AuthenticatorValidateStage Serializer
+ * @export
+ * @interface AuthenticatorValidateStageRequest
+ */
+export interface AuthenticatorValidateStageRequest {
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorValidateStageRequest
+     */
+    name: string;
+    /**
+     *
+     * @type {NotConfiguredActionEnum}
+     * @memberof AuthenticatorValidateStageRequest
+     */
+    notConfiguredAction?: NotConfiguredActionEnum;
+    /**
+     * Device classes which can be used to authenticate
+     * @type {Array<DeviceClassesEnum>}
+     * @memberof AuthenticatorValidateStageRequest
+     */
+    deviceClasses?: Array<DeviceClassesEnum>;
+    /**
+     * Stages used to configure Authenticator when user doesn't have any compatible devices. After this configuration Stage passes, the user is not prompted again.
+     * @type {Array<string>}
+     * @memberof AuthenticatorValidateStageRequest
+     */
+    configurationStages?: Array<string>;
+    /**
+     * If any of the user's device has been used within this threshold, this stage will be skipped
+     * @type {string}
+     * @memberof AuthenticatorValidateStageRequest
+     */
+    lastAuthThreshold?: string;
+    /**
+     * Enforce user verification for WebAuthn devices.
+     * @type {UserVerificationEnum}
+     * @memberof AuthenticatorValidateStageRequest
+     */
+    webauthnUserVerification?: UserVerificationEnum;
+    /**
+     *
+     * @type {Array<WebAuthnHintEnum>}
+     * @memberof AuthenticatorValidateStageRequest
+     */
+    webauthnHints?: Array<WebAuthnHintEnum>;
+    /**
+     *
+     * @type {Array<string>}
+     * @memberof AuthenticatorValidateStageRequest
+     */
+    webauthnAllowedDeviceTypes?: Array<string>;
+}
+
+/**
+ * Check if a given object implements the AuthenticatorValidateStageRequest interface.
+ */
+export function instanceOfAuthenticatorValidateStageRequest(
+    value: object,
+): value is AuthenticatorValidateStageRequest {
+    if (!("name" in value) || value["name"] === undefined) return false;
+    return true;
+}
+
+export function AuthenticatorValidateStageRequestFromJSON(
+    json: any,
+): AuthenticatorValidateStageRequest {
+    return AuthenticatorValidateStageRequestFromJSONTyped(json, false);
+}
+
+export function AuthenticatorValidateStageRequestFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): AuthenticatorValidateStageRequest {
+    if (json == null) {
+        return json;
+    }
+    return {
+        name: json["name"],
+        notConfiguredAction:
+            json["not_configured_action"] == null
+                ? undefined
+                : NotConfiguredActionEnumFromJSON(json["not_configured_action"]),
+        deviceClasses:
+            json["device_classes"] == null
+                ? undefined
+                : (json["device_classes"] as Array<any>).map(DeviceClassesEnumFromJSON),
+        configurationStages:
+            json["configuration_stages"] == null ? undefined : json["configuration_stages"],
+        lastAuthThreshold:
+            json["last_auth_threshold"] == null ? undefined : json["last_auth_threshold"],
+        webauthnUserVerification:
+            json["webauthn_user_verification"] == null
+                ? undefined
+                : UserVerificationEnumFromJSON(json["webauthn_user_verification"]),
+        webauthnHints:
+            json["webauthn_hints"] == null
+                ? undefined
+                : (json["webauthn_hints"] as Array<any>).map(WebAuthnHintEnumFromJSON),
+        webauthnAllowedDeviceTypes:
+            json["webauthn_allowed_device_types"] == null
+                ? undefined
+                : json["webauthn_allowed_device_types"],
+    };
+}
+
+export function AuthenticatorValidateStageRequestToJSON(
+    json: any,
+): AuthenticatorValidateStageRequest {
+    return AuthenticatorValidateStageRequestToJSONTyped(json, false);
+}
+
+export function AuthenticatorValidateStageRequestToJSONTyped(
+    value?: AuthenticatorValidateStageRequest | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        name: value["name"],
+        not_configured_action: NotConfiguredActionEnumToJSON(value["notConfiguredAction"]),
+        device_classes:
+            value["deviceClasses"] == null
+                ? undefined
+                : (value["deviceClasses"] as Array<any>).map(DeviceClassesEnumToJSON),
+        configuration_stages: value["configurationStages"],
+        last_auth_threshold: value["lastAuthThreshold"],
+        webauthn_user_verification: UserVerificationEnumToJSON(value["webauthnUserVerification"]),
+        webauthn_hints:
+            value["webauthnHints"] == null
+                ? undefined
+                : (value["webauthnHints"] as Array<any>).map(WebAuthnHintEnumToJSON),
+        webauthn_allowed_device_types: value["webauthnAllowedDeviceTypes"],
+    };
+}

packages/client-ts/src/models/AuthenticatorValidationChallenge.ts

@@ -0,0 +1,139 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import type { ContextualFlowInfo } from "./ContextualFlowInfo";
+import { ContextualFlowInfoFromJSON, ContextualFlowInfoToJSON } from "./ContextualFlowInfo";
+import type { DeviceChallenge } from "./DeviceChallenge";
+import { DeviceChallengeFromJSON, DeviceChallengeToJSON } from "./DeviceChallenge";
+import type { ErrorDetail } from "./ErrorDetail";
+import type { SelectableStage } from "./SelectableStage";
+import { SelectableStageFromJSON, SelectableStageToJSON } from "./SelectableStage";
+
+/**
+ * Authenticator challenge
+ * @export
+ * @interface AuthenticatorValidationChallenge
+ */
+export interface AuthenticatorValidationChallenge {
+    /**
+     *
+     * @type {ContextualFlowInfo}
+     * @memberof AuthenticatorValidationChallenge
+     */
+    flowInfo?: ContextualFlowInfo;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorValidationChallenge
+     */
+    component?: string;
+    /**
+     *
+     * @type {{ [key: string]: Array<ErrorDetail>; }}
+     * @memberof AuthenticatorValidationChallenge
+     */
+    responseErrors?: { [key: string]: Array<ErrorDetail> };
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorValidationChallenge
+     */
+    pendingUser: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorValidationChallenge
+     */
+    pendingUserAvatar: string;
+    /**
+     *
+     * @type {Array<DeviceChallenge>}
+     * @memberof AuthenticatorValidationChallenge
+     */
+    deviceChallenges: Array<DeviceChallenge>;
+    /**
+     *
+     * @type {Array<SelectableStage>}
+     * @memberof AuthenticatorValidationChallenge
+     */
+    configurationStages: Array<SelectableStage>;
+}
+
+/**
+ * Check if a given object implements the AuthenticatorValidationChallenge interface.
+ */
+export function instanceOfAuthenticatorValidationChallenge(
+    value: object,
+): value is AuthenticatorValidationChallenge {
+    if (!("pendingUser" in value) || value["pendingUser"] === undefined) return false;
+    if (!("pendingUserAvatar" in value) || value["pendingUserAvatar"] === undefined) return false;
+    if (!("deviceChallenges" in value) || value["deviceChallenges"] === undefined) return false;
+    if (!("configurationStages" in value) || value["configurationStages"] === undefined)
+        return false;
+    return true;
+}
+
+export function AuthenticatorValidationChallengeFromJSON(
+    json: any,
+): AuthenticatorValidationChallenge {
+    return AuthenticatorValidationChallengeFromJSONTyped(json, false);
+}
+
+export function AuthenticatorValidationChallengeFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): AuthenticatorValidationChallenge {
+    if (json == null) {
+        return json;
+    }
+    return {
+        flowInfo:
+            json["flow_info"] == null ? undefined : ContextualFlowInfoFromJSON(json["flow_info"]),
+        component: json["component"] == null ? undefined : json["component"],
+        responseErrors: json["response_errors"] == null ? undefined : json["response_errors"],
+        pendingUser: json["pending_user"],
+        pendingUserAvatar: json["pending_user_avatar"],
+        deviceChallenges: (json["device_challenges"] as Array<any>).map(DeviceChallengeFromJSON),
+        configurationStages: (json["configuration_stages"] as Array<any>).map(
+            SelectableStageFromJSON,
+        ),
+    };
+}
+
+export function AuthenticatorValidationChallengeToJSON(
+    json: any,
+): AuthenticatorValidationChallenge {
+    return AuthenticatorValidationChallengeToJSONTyped(json, false);
+}
+
+export function AuthenticatorValidationChallengeToJSONTyped(
+    value?: AuthenticatorValidationChallenge | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        flow_info: ContextualFlowInfoToJSON(value["flowInfo"]),
+        component: value["component"],
+        response_errors: value["responseErrors"],
+        pending_user: value["pendingUser"],
+        pending_user_avatar: value["pendingUserAvatar"],
+        device_challenges: (value["deviceChallenges"] as Array<any>).map(DeviceChallengeToJSON),
+        configuration_stages: (value["configurationStages"] as Array<any>).map(
+            SelectableStageToJSON,
+        ),
+    };
+}

packages/client-ts/src/models/AuthenticatorValidationChallengeResponseRequest.ts

@@ -0,0 +1,122 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import type { DeviceChallengeRequest } from "./DeviceChallengeRequest";
+import {
+    DeviceChallengeRequestFromJSON,
+    DeviceChallengeRequestToJSON,
+} from "./DeviceChallengeRequest";
+
+/**
+ * Challenge used for Code-based and WebAuthn authenticators
+ * @export
+ * @interface AuthenticatorValidationChallengeResponseRequest
+ */
+export interface AuthenticatorValidationChallengeResponseRequest {
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorValidationChallengeResponseRequest
+     */
+    component?: string;
+    /**
+     *
+     * @type {DeviceChallengeRequest}
+     * @memberof AuthenticatorValidationChallengeResponseRequest
+     */
+    selectedChallenge?: DeviceChallengeRequest;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorValidationChallengeResponseRequest
+     */
+    selectedStage?: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorValidationChallengeResponseRequest
+     */
+    code?: string;
+    /**
+     *
+     * @type {{ [key: string]: any; }}
+     * @memberof AuthenticatorValidationChallengeResponseRequest
+     */
+    webauthn?: { [key: string]: any };
+    /**
+     *
+     * @type {number}
+     * @memberof AuthenticatorValidationChallengeResponseRequest
+     */
+    duo?: number;
+}
+
+/**
+ * Check if a given object implements the AuthenticatorValidationChallengeResponseRequest interface.
+ */
+export function instanceOfAuthenticatorValidationChallengeResponseRequest(
+    value: object,
+): value is AuthenticatorValidationChallengeResponseRequest {
+    return true;
+}
+
+export function AuthenticatorValidationChallengeResponseRequestFromJSON(
+    json: any,
+): AuthenticatorValidationChallengeResponseRequest {
+    return AuthenticatorValidationChallengeResponseRequestFromJSONTyped(json, false);
+}
+
+export function AuthenticatorValidationChallengeResponseRequestFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): AuthenticatorValidationChallengeResponseRequest {
+    if (json == null) {
+        return json;
+    }
+    return {
+        component: json["component"] == null ? undefined : json["component"],
+        selectedChallenge:
+            json["selected_challenge"] == null
+                ? undefined
+                : DeviceChallengeRequestFromJSON(json["selected_challenge"]),
+        selectedStage: json["selected_stage"] == null ? undefined : json["selected_stage"],
+        code: json["code"] == null ? undefined : json["code"],
+        webauthn: json["webauthn"] == null ? undefined : json["webauthn"],
+        duo: json["duo"] == null ? undefined : json["duo"],
+    };
+}
+
+export function AuthenticatorValidationChallengeResponseRequestToJSON(
+    json: any,
+): AuthenticatorValidationChallengeResponseRequest {
+    return AuthenticatorValidationChallengeResponseRequestToJSONTyped(json, false);
+}
+
+export function AuthenticatorValidationChallengeResponseRequestToJSONTyped(
+    value?: AuthenticatorValidationChallengeResponseRequest | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        component: value["component"],
+        selected_challenge: DeviceChallengeRequestToJSON(value["selectedChallenge"]),
+        selected_stage: value["selectedStage"],
+        code: value["code"],
+        webauthn: value["webauthn"],
+        duo: value["duo"],
+    };
+}

packages/client-ts/src/models/AuthenticatorWebAuthnChallenge.ts

@@ -0,0 +1,117 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import type { ContextualFlowInfo } from "./ContextualFlowInfo";
+import { ContextualFlowInfoFromJSON, ContextualFlowInfoToJSON } from "./ContextualFlowInfo";
+import type { ErrorDetail } from "./ErrorDetail";
+
+/**
+ * WebAuthn Challenge
+ * @export
+ * @interface AuthenticatorWebAuthnChallenge
+ */
+export interface AuthenticatorWebAuthnChallenge {
+    /**
+     *
+     * @type {ContextualFlowInfo}
+     * @memberof AuthenticatorWebAuthnChallenge
+     */
+    flowInfo?: ContextualFlowInfo;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorWebAuthnChallenge
+     */
+    component?: string;
+    /**
+     *
+     * @type {{ [key: string]: Array<ErrorDetail>; }}
+     * @memberof AuthenticatorWebAuthnChallenge
+     */
+    responseErrors?: { [key: string]: Array<ErrorDetail> };
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorWebAuthnChallenge
+     */
+    pendingUser: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorWebAuthnChallenge
+     */
+    pendingUserAvatar: string;
+    /**
+     *
+     * @type {{ [key: string]: any; }}
+     * @memberof AuthenticatorWebAuthnChallenge
+     */
+    registration: { [key: string]: any };
+}
+
+/**
+ * Check if a given object implements the AuthenticatorWebAuthnChallenge interface.
+ */
+export function instanceOfAuthenticatorWebAuthnChallenge(
+    value: object,
+): value is AuthenticatorWebAuthnChallenge {
+    if (!("pendingUser" in value) || value["pendingUser"] === undefined) return false;
+    if (!("pendingUserAvatar" in value) || value["pendingUserAvatar"] === undefined) return false;
+    if (!("registration" in value) || value["registration"] === undefined) return false;
+    return true;
+}
+
+export function AuthenticatorWebAuthnChallengeFromJSON(json: any): AuthenticatorWebAuthnChallenge {
+    return AuthenticatorWebAuthnChallengeFromJSONTyped(json, false);
+}
+
+export function AuthenticatorWebAuthnChallengeFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): AuthenticatorWebAuthnChallenge {
+    if (json == null) {
+        return json;
+    }
+    return {
+        flowInfo:
+            json["flow_info"] == null ? undefined : ContextualFlowInfoFromJSON(json["flow_info"]),
+        component: json["component"] == null ? undefined : json["component"],
+        responseErrors: json["response_errors"] == null ? undefined : json["response_errors"],
+        pendingUser: json["pending_user"],
+        pendingUserAvatar: json["pending_user_avatar"],
+        registration: json["registration"],
+    };
+}
+
+export function AuthenticatorWebAuthnChallengeToJSON(json: any): AuthenticatorWebAuthnChallenge {
+    return AuthenticatorWebAuthnChallengeToJSONTyped(json, false);
+}
+
+export function AuthenticatorWebAuthnChallengeToJSONTyped(
+    value?: AuthenticatorWebAuthnChallenge | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        flow_info: ContextualFlowInfoToJSON(value["flowInfo"]),
+        component: value["component"],
+        response_errors: value["responseErrors"],
+        pending_user: value["pendingUser"],
+        pending_user_avatar: value["pendingUserAvatar"],
+        registration: value["registration"],
+    };
+}

packages/client-ts/src/models/AuthenticatorWebAuthnChallengeResponseRequest.ts

@@ -0,0 +1,82 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+/**
+ * WebAuthn Challenge response
+ * @export
+ * @interface AuthenticatorWebAuthnChallengeResponseRequest
+ */
+export interface AuthenticatorWebAuthnChallengeResponseRequest {
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorWebAuthnChallengeResponseRequest
+     */
+    component?: string;
+    /**
+     *
+     * @type {{ [key: string]: any; }}
+     * @memberof AuthenticatorWebAuthnChallengeResponseRequest
+     */
+    response: { [key: string]: any };
+}
+
+/**
+ * Check if a given object implements the AuthenticatorWebAuthnChallengeResponseRequest interface.
+ */
+export function instanceOfAuthenticatorWebAuthnChallengeResponseRequest(
+    value: object,
+): value is AuthenticatorWebAuthnChallengeResponseRequest {
+    if (!("response" in value) || value["response"] === undefined) return false;
+    return true;
+}
+
+export function AuthenticatorWebAuthnChallengeResponseRequestFromJSON(
+    json: any,
+): AuthenticatorWebAuthnChallengeResponseRequest {
+    return AuthenticatorWebAuthnChallengeResponseRequestFromJSONTyped(json, false);
+}
+
+export function AuthenticatorWebAuthnChallengeResponseRequestFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): AuthenticatorWebAuthnChallengeResponseRequest {
+    if (json == null) {
+        return json;
+    }
+    return {
+        component: json["component"] == null ? undefined : json["component"],
+        response: json["response"],
+    };
+}
+
+export function AuthenticatorWebAuthnChallengeResponseRequestToJSON(
+    json: any,
+): AuthenticatorWebAuthnChallengeResponseRequest {
+    return AuthenticatorWebAuthnChallengeResponseRequestToJSONTyped(json, false);
+}
+
+export function AuthenticatorWebAuthnChallengeResponseRequestToJSONTyped(
+    value?: AuthenticatorWebAuthnChallengeResponseRequest | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        component: value["component"],
+        response: value["response"],
+    };
+}

packages/client-ts/src/models/AuthenticatorWebAuthnStage.ts

@@ -0,0 +1,245 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import type { AuthenticatorAttachmentEnum } from "./AuthenticatorAttachmentEnum";
+import {
+    AuthenticatorAttachmentEnumFromJSON,
+    AuthenticatorAttachmentEnumToJSON,
+} from "./AuthenticatorAttachmentEnum";
+import type { FlowSet } from "./FlowSet";
+import { FlowSetFromJSON } from "./FlowSet";
+import type { UserVerificationEnum } from "./UserVerificationEnum";
+import { UserVerificationEnumFromJSON, UserVerificationEnumToJSON } from "./UserVerificationEnum";
+import type { WebAuthnDeviceType } from "./WebAuthnDeviceType";
+import { WebAuthnDeviceTypeFromJSON } from "./WebAuthnDeviceType";
+import type { WebAuthnHintEnum } from "./WebAuthnHintEnum";
+import { WebAuthnHintEnumFromJSON, WebAuthnHintEnumToJSON } from "./WebAuthnHintEnum";
+
+/**
+ * AuthenticatorWebAuthnStage Serializer
+ * @export
+ * @interface AuthenticatorWebAuthnStage
+ */
+export interface AuthenticatorWebAuthnStage {
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorWebAuthnStage
+     */
+    readonly pk: string;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorWebAuthnStage
+     */
+    name: string;
+    /**
+     * Get object type so that we know how to edit the object
+     * @type {string}
+     * @memberof AuthenticatorWebAuthnStage
+     */
+    readonly component: string;
+    /**
+     * Return object's verbose_name
+     * @type {string}
+     * @memberof AuthenticatorWebAuthnStage
+     */
+    readonly verboseName: string;
+    /**
+     * Return object's plural verbose_name
+     * @type {string}
+     * @memberof AuthenticatorWebAuthnStage
+     */
+    readonly verboseNamePlural: string;
+    /**
+     * Return internal model name
+     * @type {string}
+     * @memberof AuthenticatorWebAuthnStage
+     */
+    readonly metaModelName: string;
+    /**
+     *
+     * @type {Array<FlowSet>}
+     * @memberof AuthenticatorWebAuthnStage
+     */
+    readonly flowSet: Array<FlowSet>;
+    /**
+     * Flow used by an authenticated user to configure this Stage. If empty, user will not be able to configure this stage.
+     * @type {string}
+     * @memberof AuthenticatorWebAuthnStage
+     */
+    configureFlow?: string | null;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorWebAuthnStage
+     */
+    friendlyName?: string;
+    /**
+     *
+     * @type {UserVerificationEnum}
+     * @memberof AuthenticatorWebAuthnStage
+     */
+    userVerification?: UserVerificationEnum;
+    /**
+     *
+     * @type {AuthenticatorAttachmentEnum}
+     * @memberof AuthenticatorWebAuthnStage
+     */
+    authenticatorAttachment?: AuthenticatorAttachmentEnum | null;
+    /**
+     *
+     * @type {UserVerificationEnum}
+     * @memberof AuthenticatorWebAuthnStage
+     */
+    residentKeyRequirement?: UserVerificationEnum;
+    /**
+     *
+     * @type {Array<WebAuthnHintEnum>}
+     * @memberof AuthenticatorWebAuthnStage
+     */
+    hints?: Array<WebAuthnHintEnum>;
+    /**
+     *
+     * @type {Array<string>}
+     * @memberof AuthenticatorWebAuthnStage
+     */
+    deviceTypeRestrictions?: Array<string>;
+    /**
+     *
+     * @type {Array<WebAuthnDeviceType>}
+     * @memberof AuthenticatorWebAuthnStage
+     */
+    readonly deviceTypeRestrictionsObj: Array<WebAuthnDeviceType>;
+    /**
+     * When enabled, a given device can only be registered once.
+     * @type {boolean}
+     * @memberof AuthenticatorWebAuthnStage
+     */
+    preventDuplicateDevices?: boolean;
+    /**
+     *
+     * @type {number}
+     * @memberof AuthenticatorWebAuthnStage
+     */
+    maxAttempts?: number;
+}
+
+/**
+ * Check if a given object implements the AuthenticatorWebAuthnStage interface.
+ */
+export function instanceOfAuthenticatorWebAuthnStage(
+    value: object,
+): value is AuthenticatorWebAuthnStage {
+    if (!("pk" in value) || value["pk"] === undefined) return false;
+    if (!("name" in value) || value["name"] === undefined) return false;
+    if (!("component" in value) || value["component"] === undefined) return false;
+    if (!("verboseName" in value) || value["verboseName"] === undefined) return false;
+    if (!("verboseNamePlural" in value) || value["verboseNamePlural"] === undefined) return false;
+    if (!("metaModelName" in value) || value["metaModelName"] === undefined) return false;
+    if (!("flowSet" in value) || value["flowSet"] === undefined) return false;
+    if (!("deviceTypeRestrictionsObj" in value) || value["deviceTypeRestrictionsObj"] === undefined)
+        return false;
+    return true;
+}
+
+export function AuthenticatorWebAuthnStageFromJSON(json: any): AuthenticatorWebAuthnStage {
+    return AuthenticatorWebAuthnStageFromJSONTyped(json, false);
+}
+
+export function AuthenticatorWebAuthnStageFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): AuthenticatorWebAuthnStage {
+    if (json == null) {
+        return json;
+    }
+    return {
+        pk: json["pk"],
+        name: json["name"],
+        component: json["component"],
+        verboseName: json["verbose_name"],
+        verboseNamePlural: json["verbose_name_plural"],
+        metaModelName: json["meta_model_name"],
+        flowSet: (json["flow_set"] as Array<any>).map(FlowSetFromJSON),
+        configureFlow: json["configure_flow"] == null ? undefined : json["configure_flow"],
+        friendlyName: json["friendly_name"] == null ? undefined : json["friendly_name"],
+        userVerification:
+            json["user_verification"] == null
+                ? undefined
+                : UserVerificationEnumFromJSON(json["user_verification"]),
+        authenticatorAttachment:
+            json["authenticator_attachment"] == null
+                ? undefined
+                : AuthenticatorAttachmentEnumFromJSON(json["authenticator_attachment"]),
+        residentKeyRequirement:
+            json["resident_key_requirement"] == null
+                ? undefined
+                : UserVerificationEnumFromJSON(json["resident_key_requirement"]),
+        hints:
+            json["hints"] == null
+                ? undefined
+                : (json["hints"] as Array<any>).map(WebAuthnHintEnumFromJSON),
+        deviceTypeRestrictions:
+            json["device_type_restrictions"] == null ? undefined : json["device_type_restrictions"],
+        deviceTypeRestrictionsObj: (json["device_type_restrictions_obj"] as Array<any>).map(
+            WebAuthnDeviceTypeFromJSON,
+        ),
+        preventDuplicateDevices:
+            json["prevent_duplicate_devices"] == null
+                ? undefined
+                : json["prevent_duplicate_devices"],
+        maxAttempts: json["max_attempts"] == null ? undefined : json["max_attempts"],
+    };
+}
+
+export function AuthenticatorWebAuthnStageToJSON(json: any): AuthenticatorWebAuthnStage {
+    return AuthenticatorWebAuthnStageToJSONTyped(json, false);
+}
+
+export function AuthenticatorWebAuthnStageToJSONTyped(
+    value?: Omit<
+        AuthenticatorWebAuthnStage,
+        | "pk"
+        | "component"
+        | "verbose_name"
+        | "verbose_name_plural"
+        | "meta_model_name"
+        | "flow_set"
+        | "device_type_restrictions_obj"
+    > | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        name: value["name"],
+        configure_flow: value["configureFlow"],
+        friendly_name: value["friendlyName"],
+        user_verification: UserVerificationEnumToJSON(value["userVerification"]),
+        authenticator_attachment: AuthenticatorAttachmentEnumToJSON(
+            value["authenticatorAttachment"],
+        ),
+        resident_key_requirement: UserVerificationEnumToJSON(value["residentKeyRequirement"]),
+        hints:
+            value["hints"] == null
+                ? undefined
+                : (value["hints"] as Array<any>).map(WebAuthnHintEnumToJSON),
+        device_type_restrictions: value["deviceTypeRestrictions"],
+        prevent_duplicate_devices: value["preventDuplicateDevices"],
+        max_attempts: value["maxAttempts"],
+    };
+}

packages/client-ts/src/models/AuthenticatorWebAuthnStageRequest.ts

@@ -0,0 +1,177 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import type { AuthenticatorAttachmentEnum } from "./AuthenticatorAttachmentEnum";
+import {
+    AuthenticatorAttachmentEnumFromJSON,
+    AuthenticatorAttachmentEnumToJSON,
+} from "./AuthenticatorAttachmentEnum";
+import type { UserVerificationEnum } from "./UserVerificationEnum";
+import { UserVerificationEnumFromJSON, UserVerificationEnumToJSON } from "./UserVerificationEnum";
+import type { WebAuthnHintEnum } from "./WebAuthnHintEnum";
+import { WebAuthnHintEnumFromJSON, WebAuthnHintEnumToJSON } from "./WebAuthnHintEnum";
+
+/**
+ * AuthenticatorWebAuthnStage Serializer
+ * @export
+ * @interface AuthenticatorWebAuthnStageRequest
+ */
+export interface AuthenticatorWebAuthnStageRequest {
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorWebAuthnStageRequest
+     */
+    name: string;
+    /**
+     * Flow used by an authenticated user to configure this Stage. If empty, user will not be able to configure this stage.
+     * @type {string}
+     * @memberof AuthenticatorWebAuthnStageRequest
+     */
+    configureFlow?: string | null;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthenticatorWebAuthnStageRequest
+     */
+    friendlyName?: string;
+    /**
+     *
+     * @type {UserVerificationEnum}
+     * @memberof AuthenticatorWebAuthnStageRequest
+     */
+    userVerification?: UserVerificationEnum;
+    /**
+     *
+     * @type {AuthenticatorAttachmentEnum}
+     * @memberof AuthenticatorWebAuthnStageRequest
+     */
+    authenticatorAttachment?: AuthenticatorAttachmentEnum | null;
+    /**
+     *
+     * @type {UserVerificationEnum}
+     * @memberof AuthenticatorWebAuthnStageRequest
+     */
+    residentKeyRequirement?: UserVerificationEnum;
+    /**
+     *
+     * @type {Array<WebAuthnHintEnum>}
+     * @memberof AuthenticatorWebAuthnStageRequest
+     */
+    hints?: Array<WebAuthnHintEnum>;
+    /**
+     *
+     * @type {Array<string>}
+     * @memberof AuthenticatorWebAuthnStageRequest
+     */
+    deviceTypeRestrictions?: Array<string>;
+    /**
+     * When enabled, a given device can only be registered once.
+     * @type {boolean}
+     * @memberof AuthenticatorWebAuthnStageRequest
+     */
+    preventDuplicateDevices?: boolean;
+    /**
+     *
+     * @type {number}
+     * @memberof AuthenticatorWebAuthnStageRequest
+     */
+    maxAttempts?: number;
+}
+
+/**
+ * Check if a given object implements the AuthenticatorWebAuthnStageRequest interface.
+ */
+export function instanceOfAuthenticatorWebAuthnStageRequest(
+    value: object,
+): value is AuthenticatorWebAuthnStageRequest {
+    if (!("name" in value) || value["name"] === undefined) return false;
+    return true;
+}
+
+export function AuthenticatorWebAuthnStageRequestFromJSON(
+    json: any,
+): AuthenticatorWebAuthnStageRequest {
+    return AuthenticatorWebAuthnStageRequestFromJSONTyped(json, false);
+}
+
+export function AuthenticatorWebAuthnStageRequestFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): AuthenticatorWebAuthnStageRequest {
+    if (json == null) {
+        return json;
+    }
+    return {
+        name: json["name"],
+        configureFlow: json["configure_flow"] == null ? undefined : json["configure_flow"],
+        friendlyName: json["friendly_name"] == null ? undefined : json["friendly_name"],
+        userVerification:
+            json["user_verification"] == null
+                ? undefined
+                : UserVerificationEnumFromJSON(json["user_verification"]),
+        authenticatorAttachment:
+            json["authenticator_attachment"] == null
+                ? undefined
+                : AuthenticatorAttachmentEnumFromJSON(json["authenticator_attachment"]),
+        residentKeyRequirement:
+            json["resident_key_requirement"] == null
+                ? undefined
+                : UserVerificationEnumFromJSON(json["resident_key_requirement"]),
+        hints:
+            json["hints"] == null
+                ? undefined
+                : (json["hints"] as Array<any>).map(WebAuthnHintEnumFromJSON),
+        deviceTypeRestrictions:
+            json["device_type_restrictions"] == null ? undefined : json["device_type_restrictions"],
+        preventDuplicateDevices:
+            json["prevent_duplicate_devices"] == null
+                ? undefined
+                : json["prevent_duplicate_devices"],
+        maxAttempts: json["max_attempts"] == null ? undefined : json["max_attempts"],
+    };
+}
+
+export function AuthenticatorWebAuthnStageRequestToJSON(
+    json: any,
+): AuthenticatorWebAuthnStageRequest {
+    return AuthenticatorWebAuthnStageRequestToJSONTyped(json, false);
+}
+
+export function AuthenticatorWebAuthnStageRequestToJSONTyped(
+    value?: AuthenticatorWebAuthnStageRequest | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        name: value["name"],
+        configure_flow: value["configureFlow"],
+        friendly_name: value["friendlyName"],
+        user_verification: UserVerificationEnumToJSON(value["userVerification"]),
+        authenticator_attachment: AuthenticatorAttachmentEnumToJSON(
+            value["authenticatorAttachment"],
+        ),
+        resident_key_requirement: UserVerificationEnumToJSON(value["residentKeyRequirement"]),
+        hints:
+            value["hints"] == null
+                ? undefined
+                : (value["hints"] as Array<any>).map(WebAuthnHintEnumToJSON),
+        device_type_restrictions: value["deviceTypeRestrictions"],
+        prevent_duplicate_devices: value["preventDuplicateDevices"],
+        max_attempts: value["maxAttempts"],
+    };
+}

packages/client-ts/src/models/AuthorizationCodeAuthMethodEnum.ts

@@ -0,0 +1,66 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+/**
+ *
+ * @export
+ */
+export const AuthorizationCodeAuthMethodEnum = {
+    BasicAuth: "basic_auth",
+    PostBody: "post_body",
+    UnknownDefaultOpenApi: "11184809",
+} as const;
+export type AuthorizationCodeAuthMethodEnum =
+    (typeof AuthorizationCodeAuthMethodEnum)[keyof typeof AuthorizationCodeAuthMethodEnum];
+
+export function instanceOfAuthorizationCodeAuthMethodEnum(value: any): boolean {
+    for (const key in AuthorizationCodeAuthMethodEnum) {
+        if (Object.prototype.hasOwnProperty.call(AuthorizationCodeAuthMethodEnum, key)) {
+            if (
+                AuthorizationCodeAuthMethodEnum[
+                    key as keyof typeof AuthorizationCodeAuthMethodEnum
+                ] === value
+            ) {
+                return true;
+            }
+        }
+    }
+    return false;
+}
+
+export function AuthorizationCodeAuthMethodEnumFromJSON(
+    json: any,
+): AuthorizationCodeAuthMethodEnum {
+    return AuthorizationCodeAuthMethodEnumFromJSONTyped(json, false);
+}
+
+export function AuthorizationCodeAuthMethodEnumFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): AuthorizationCodeAuthMethodEnum {
+    return json as AuthorizationCodeAuthMethodEnum;
+}
+
+export function AuthorizationCodeAuthMethodEnumToJSON(
+    value?: AuthorizationCodeAuthMethodEnum | null,
+): any {
+    return value as any;
+}
+
+export function AuthorizationCodeAuthMethodEnumToJSONTyped(
+    value: any,
+    ignoreDiscriminator: boolean,
+): AuthorizationCodeAuthMethodEnum {
+    return value as AuthorizationCodeAuthMethodEnum;
+}

packages/client-ts/src/models/AutoSubmitChallengeResponseRequest.ts

@@ -0,0 +1,73 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+/**
+ * Pseudo class for autosubmit response
+ * @export
+ * @interface AutoSubmitChallengeResponseRequest
+ */
+export interface AutoSubmitChallengeResponseRequest {
+    /**
+     *
+     * @type {string}
+     * @memberof AutoSubmitChallengeResponseRequest
+     */
+    component?: string;
+}
+
+/**
+ * Check if a given object implements the AutoSubmitChallengeResponseRequest interface.
+ */
+export function instanceOfAutoSubmitChallengeResponseRequest(
+    value: object,
+): value is AutoSubmitChallengeResponseRequest {
+    return true;
+}
+
+export function AutoSubmitChallengeResponseRequestFromJSON(
+    json: any,
+): AutoSubmitChallengeResponseRequest {
+    return AutoSubmitChallengeResponseRequestFromJSONTyped(json, false);
+}
+
+export function AutoSubmitChallengeResponseRequestFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): AutoSubmitChallengeResponseRequest {
+    if (json == null) {
+        return json;
+    }
+    return {
+        component: json["component"] == null ? undefined : json["component"],
+    };
+}
+
+export function AutoSubmitChallengeResponseRequestToJSON(
+    json: any,
+): AutoSubmitChallengeResponseRequest {
+    return AutoSubmitChallengeResponseRequestToJSONTyped(json, false);
+}
+
+export function AutoSubmitChallengeResponseRequestToJSONTyped(
+    value?: AutoSubmitChallengeResponseRequest | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        component: value["component"],
+    };
+}

packages/client-ts/src/models/AutosubmitChallenge.ts

@@ -0,0 +1,114 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import type { ContextualFlowInfo } from "./ContextualFlowInfo";
+import { ContextualFlowInfoFromJSON, ContextualFlowInfoToJSON } from "./ContextualFlowInfo";
+import type { ErrorDetail } from "./ErrorDetail";
+
+/**
+ * Autosubmit challenge used to send and navigate a POST request
+ * @export
+ * @interface AutosubmitChallenge
+ */
+export interface AutosubmitChallenge {
+    /**
+     *
+     * @type {ContextualFlowInfo}
+     * @memberof AutosubmitChallenge
+     */
+    flowInfo?: ContextualFlowInfo;
+    /**
+     *
+     * @type {string}
+     * @memberof AutosubmitChallenge
+     */
+    component?: string;
+    /**
+     *
+     * @type {{ [key: string]: Array<ErrorDetail>; }}
+     * @memberof AutosubmitChallenge
+     */
+    responseErrors?: { [key: string]: Array<ErrorDetail> };
+    /**
+     *
+     * @type {string}
+     * @memberof AutosubmitChallenge
+     */
+    url: string;
+    /**
+     *
+     * @type {{ [key: string]: string; }}
+     * @memberof AutosubmitChallenge
+     */
+    attrs: { [key: string]: string };
+    /**
+     *
+     * @type {string}
+     * @memberof AutosubmitChallenge
+     */
+    title?: string;
+}
+
+/**
+ * Check if a given object implements the AutosubmitChallenge interface.
+ */
+export function instanceOfAutosubmitChallenge(value: object): value is AutosubmitChallenge {
+    if (!("url" in value) || value["url"] === undefined) return false;
+    if (!("attrs" in value) || value["attrs"] === undefined) return false;
+    return true;
+}
+
+export function AutosubmitChallengeFromJSON(json: any): AutosubmitChallenge {
+    return AutosubmitChallengeFromJSONTyped(json, false);
+}
+
+export function AutosubmitChallengeFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): AutosubmitChallenge {
+    if (json == null) {
+        return json;
+    }
+    return {
+        flowInfo:
+            json["flow_info"] == null ? undefined : ContextualFlowInfoFromJSON(json["flow_info"]),
+        component: json["component"] == null ? undefined : json["component"],
+        responseErrors: json["response_errors"] == null ? undefined : json["response_errors"],
+        url: json["url"],
+        attrs: json["attrs"],
+        title: json["title"] == null ? undefined : json["title"],
+    };
+}
+
+export function AutosubmitChallengeToJSON(json: any): AutosubmitChallenge {
+    return AutosubmitChallengeToJSONTyped(json, false);
+}
+
+export function AutosubmitChallengeToJSONTyped(
+    value?: AutosubmitChallenge | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        flow_info: ContextualFlowInfoToJSON(value["flowInfo"]),
+        component: value["component"],
+        response_errors: value["responseErrors"],
+        url: value["url"],
+        attrs: value["attrs"],
+        title: value["title"],
+    };
+}

packages/client-ts/src/models/BackendsEnum.ts

@@ -0,0 +1,53 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+/**
+ *
+ * @export
+ */
+export const BackendsEnum = {
+    AuthentikCoreAuthInbuiltBackend: "authentik.core.auth.InbuiltBackend",
+    AuthentikCoreAuthTokenBackend: "authentik.core.auth.TokenBackend",
+    AuthentikSourcesLdapAuthLdapBackend: "authentik.sources.ldap.auth.LDAPBackend",
+    AuthentikSourcesKerberosAuthKerberosBackend: "authentik.sources.kerberos.auth.KerberosBackend",
+    UnknownDefaultOpenApi: "11184809",
+} as const;
+export type BackendsEnum = (typeof BackendsEnum)[keyof typeof BackendsEnum];
+
+export function instanceOfBackendsEnum(value: any): boolean {
+    for (const key in BackendsEnum) {
+        if (Object.prototype.hasOwnProperty.call(BackendsEnum, key)) {
+            if (BackendsEnum[key as keyof typeof BackendsEnum] === value) {
+                return true;
+            }
+        }
+    }
+    return false;
+}
+
+export function BackendsEnumFromJSON(json: any): BackendsEnum {
+    return BackendsEnumFromJSONTyped(json, false);
+}
+
+export function BackendsEnumFromJSONTyped(json: any, ignoreDiscriminator: boolean): BackendsEnum {
+    return json as BackendsEnum;
+}
+
+export function BackendsEnumToJSON(value?: BackendsEnum | null): any {
+    return value as any;
+}
+
+export function BackendsEnumToJSONTyped(value: any, ignoreDiscriminator: boolean): BackendsEnum {
+    return value as BackendsEnum;
+}

packages/client-ts/src/models/BindingTypeEnum.ts

@@ -0,0 +1,58 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+/**
+ *
+ * @export
+ */
+export const BindingTypeEnum = {
+    Redirect: "REDIRECT",
+    Post: "POST",
+    PostAuto: "POST_AUTO",
+    UnknownDefaultOpenApi: "11184809",
+} as const;
+export type BindingTypeEnum = (typeof BindingTypeEnum)[keyof typeof BindingTypeEnum];
+
+export function instanceOfBindingTypeEnum(value: any): boolean {
+    for (const key in BindingTypeEnum) {
+        if (Object.prototype.hasOwnProperty.call(BindingTypeEnum, key)) {
+            if (BindingTypeEnum[key as keyof typeof BindingTypeEnum] === value) {
+                return true;
+            }
+        }
+    }
+    return false;
+}
+
+export function BindingTypeEnumFromJSON(json: any): BindingTypeEnum {
+    return BindingTypeEnumFromJSONTyped(json, false);
+}
+
+export function BindingTypeEnumFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): BindingTypeEnum {
+    return json as BindingTypeEnum;
+}
+
+export function BindingTypeEnumToJSON(value?: BindingTypeEnum | null): any {
+    return value as any;
+}
+
+export function BindingTypeEnumToJSONTyped(
+    value: any,
+    ignoreDiscriminator: boolean,
+): BindingTypeEnum {
+    return value as BindingTypeEnum;
+}

packages/client-ts/src/models/BlueprintFile.ts

@@ -0,0 +1,94 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import type { Metadata } from "./Metadata";
+import { MetadataFromJSON } from "./Metadata";
+
+/**
+ *
+ * @export
+ * @interface BlueprintFile
+ */
+export interface BlueprintFile {
+    /**
+     *
+     * @type {string}
+     * @memberof BlueprintFile
+     */
+    path: string;
+    /**
+     *
+     * @type {Date}
+     * @memberof BlueprintFile
+     */
+    lastM: Date;
+    /**
+     *
+     * @type {string}
+     * @memberof BlueprintFile
+     */
+    hash: string;
+    /**
+     *
+     * @type {Metadata}
+     * @memberof BlueprintFile
+     */
+    readonly meta: Metadata;
+}
+
+/**
+ * Check if a given object implements the BlueprintFile interface.
+ */
+export function instanceOfBlueprintFile(value: object): value is BlueprintFile {
+    if (!("path" in value) || value["path"] === undefined) return false;
+    if (!("lastM" in value) || value["lastM"] === undefined) return false;
+    if (!("hash" in value) || value["hash"] === undefined) return false;
+    if (!("meta" in value) || value["meta"] === undefined) return false;
+    return true;
+}
+
+export function BlueprintFileFromJSON(json: any): BlueprintFile {
+    return BlueprintFileFromJSONTyped(json, false);
+}
+
+export function BlueprintFileFromJSONTyped(json: any, ignoreDiscriminator: boolean): BlueprintFile {
+    if (json == null) {
+        return json;
+    }
+    return {
+        path: json["path"],
+        lastM: new Date(json["last_m"]),
+        hash: json["hash"],
+        meta: MetadataFromJSON(json["meta"]),
+    };
+}
+
+export function BlueprintFileToJSON(json: any): BlueprintFile {
+    return BlueprintFileToJSONTyped(json, false);
+}
+
+export function BlueprintFileToJSONTyped(
+    value?: Omit<BlueprintFile, "meta"> | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        path: value["path"],
+        last_m: value["lastM"].toISOString(),
+        hash: value["hash"],
+    };
+}

packages/client-ts/src/models/BlueprintImportResult.ts

@@ -0,0 +1,77 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import type { LogEvent } from "./LogEvent";
+import { LogEventFromJSON } from "./LogEvent";
+
+/**
+ * Logs of an attempted blueprint import
+ * @export
+ * @interface BlueprintImportResult
+ */
+export interface BlueprintImportResult {
+    /**
+     *
+     * @type {Array<LogEvent>}
+     * @memberof BlueprintImportResult
+     */
+    readonly logs: Array<LogEvent>;
+    /**
+     *
+     * @type {boolean}
+     * @memberof BlueprintImportResult
+     */
+    readonly success: boolean;
+}
+
+/**
+ * Check if a given object implements the BlueprintImportResult interface.
+ */
+export function instanceOfBlueprintImportResult(value: object): value is BlueprintImportResult {
+    if (!("logs" in value) || value["logs"] === undefined) return false;
+    if (!("success" in value) || value["success"] === undefined) return false;
+    return true;
+}
+
+export function BlueprintImportResultFromJSON(json: any): BlueprintImportResult {
+    return BlueprintImportResultFromJSONTyped(json, false);
+}
+
+export function BlueprintImportResultFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): BlueprintImportResult {
+    if (json == null) {
+        return json;
+    }
+    return {
+        logs: (json["logs"] as Array<any>).map(LogEventFromJSON),
+        success: json["success"],
+    };
+}
+
+export function BlueprintImportResultToJSON(json: any): BlueprintImportResult {
+    return BlueprintImportResultToJSONTyped(json, false);
+}
+
+export function BlueprintImportResultToJSONTyped(
+    value?: Omit<BlueprintImportResult, "logs" | "success"> | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {};
+}

packages/client-ts/src/models/BlueprintInstance.ts

@@ -0,0 +1,154 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import type { BlueprintInstanceStatusEnum } from "./BlueprintInstanceStatusEnum";
+import { BlueprintInstanceStatusEnumFromJSON } from "./BlueprintInstanceStatusEnum";
+
+/**
+ * Info about a single blueprint instance file
+ * @export
+ * @interface BlueprintInstance
+ */
+export interface BlueprintInstance {
+    /**
+     *
+     * @type {string}
+     * @memberof BlueprintInstance
+     */
+    readonly pk: string;
+    /**
+     *
+     * @type {string}
+     * @memberof BlueprintInstance
+     */
+    name: string;
+    /**
+     *
+     * @type {string}
+     * @memberof BlueprintInstance
+     */
+    path?: string;
+    /**
+     *
+     * @type {{ [key: string]: any; }}
+     * @memberof BlueprintInstance
+     */
+    context?: { [key: string]: any };
+    /**
+     *
+     * @type {Date}
+     * @memberof BlueprintInstance
+     */
+    readonly lastApplied: Date;
+    /**
+     *
+     * @type {string}
+     * @memberof BlueprintInstance
+     */
+    readonly lastAppliedHash: string;
+    /**
+     *
+     * @type {BlueprintInstanceStatusEnum}
+     * @memberof BlueprintInstance
+     */
+    readonly status: BlueprintInstanceStatusEnum;
+    /**
+     *
+     * @type {boolean}
+     * @memberof BlueprintInstance
+     */
+    enabled?: boolean;
+    /**
+     *
+     * @type {Array<string>}
+     * @memberof BlueprintInstance
+     */
+    readonly managedModels: Array<string>;
+    /**
+     *
+     * @type {{ [key: string]: any; }}
+     * @memberof BlueprintInstance
+     */
+    readonly metadata: { [key: string]: any };
+    /**
+     *
+     * @type {string}
+     * @memberof BlueprintInstance
+     */
+    content?: string;
+}
+
+/**
+ * Check if a given object implements the BlueprintInstance interface.
+ */
+export function instanceOfBlueprintInstance(value: object): value is BlueprintInstance {
+    if (!("pk" in value) || value["pk"] === undefined) return false;
+    if (!("name" in value) || value["name"] === undefined) return false;
+    if (!("lastApplied" in value) || value["lastApplied"] === undefined) return false;
+    if (!("lastAppliedHash" in value) || value["lastAppliedHash"] === undefined) return false;
+    if (!("status" in value) || value["status"] === undefined) return false;
+    if (!("managedModels" in value) || value["managedModels"] === undefined) return false;
+    if (!("metadata" in value) || value["metadata"] === undefined) return false;
+    return true;
+}
+
+export function BlueprintInstanceFromJSON(json: any): BlueprintInstance {
+    return BlueprintInstanceFromJSONTyped(json, false);
+}
+
+export function BlueprintInstanceFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): BlueprintInstance {
+    if (json == null) {
+        return json;
+    }
+    return {
+        pk: json["pk"],
+        name: json["name"],
+        path: json["path"] == null ? undefined : json["path"],
+        context: json["context"] == null ? undefined : json["context"],
+        lastApplied: new Date(json["last_applied"]),
+        lastAppliedHash: json["last_applied_hash"],
+        status: BlueprintInstanceStatusEnumFromJSON(json["status"]),
+        enabled: json["enabled"] == null ? undefined : json["enabled"],
+        managedModels: json["managed_models"],
+        metadata: json["metadata"],
+        content: json["content"] == null ? undefined : json["content"],
+    };
+}
+
+export function BlueprintInstanceToJSON(json: any): BlueprintInstance {
+    return BlueprintInstanceToJSONTyped(json, false);
+}
+
+export function BlueprintInstanceToJSONTyped(
+    value?: Omit<
+        BlueprintInstance,
+        "pk" | "last_applied" | "last_applied_hash" | "status" | "managed_models" | "metadata"
+    > | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        name: value["name"],
+        path: value["path"],
+        context: value["context"],
+        enabled: value["enabled"],
+        content: value["content"],
+    };
+}

packages/client-ts/src/models/BlueprintInstanceRequest.ts

@@ -0,0 +1,102 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+/**
+ * Info about a single blueprint instance file
+ * @export
+ * @interface BlueprintInstanceRequest
+ */
+export interface BlueprintInstanceRequest {
+    /**
+     *
+     * @type {string}
+     * @memberof BlueprintInstanceRequest
+     */
+    name: string;
+    /**
+     *
+     * @type {string}
+     * @memberof BlueprintInstanceRequest
+     */
+    path?: string;
+    /**
+     *
+     * @type {{ [key: string]: any; }}
+     * @memberof BlueprintInstanceRequest
+     */
+    context?: { [key: string]: any };
+    /**
+     *
+     * @type {boolean}
+     * @memberof BlueprintInstanceRequest
+     */
+    enabled?: boolean;
+    /**
+     *
+     * @type {string}
+     * @memberof BlueprintInstanceRequest
+     */
+    content?: string;
+}
+
+/**
+ * Check if a given object implements the BlueprintInstanceRequest interface.
+ */
+export function instanceOfBlueprintInstanceRequest(
+    value: object,
+): value is BlueprintInstanceRequest {
+    if (!("name" in value) || value["name"] === undefined) return false;
+    return true;
+}
+
+export function BlueprintInstanceRequestFromJSON(json: any): BlueprintInstanceRequest {
+    return BlueprintInstanceRequestFromJSONTyped(json, false);
+}
+
+export function BlueprintInstanceRequestFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): BlueprintInstanceRequest {
+    if (json == null) {
+        return json;
+    }
+    return {
+        name: json["name"],
+        path: json["path"] == null ? undefined : json["path"],
+        context: json["context"] == null ? undefined : json["context"],
+        enabled: json["enabled"] == null ? undefined : json["enabled"],
+        content: json["content"] == null ? undefined : json["content"],
+    };
+}
+
+export function BlueprintInstanceRequestToJSON(json: any): BlueprintInstanceRequest {
+    return BlueprintInstanceRequestToJSONTyped(json, false);
+}
+
+export function BlueprintInstanceRequestToJSONTyped(
+    value?: BlueprintInstanceRequest | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        name: value["name"],
+        path: value["path"],
+        context: value["context"],
+        enabled: value["enabled"],
+        content: value["content"],
+    };
+}

packages/client-ts/src/models/BlueprintInstanceStatusEnum.ts

@@ -0,0 +1,64 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+/**
+ *
+ * @export
+ */
+export const BlueprintInstanceStatusEnum = {
+    Successful: "successful",
+    Warning: "warning",
+    Error: "error",
+    Orphaned: "orphaned",
+    Unknown: "unknown",
+    UnknownDefaultOpenApi: "11184809",
+} as const;
+export type BlueprintInstanceStatusEnum =
+    (typeof BlueprintInstanceStatusEnum)[keyof typeof BlueprintInstanceStatusEnum];
+
+export function instanceOfBlueprintInstanceStatusEnum(value: any): boolean {
+    for (const key in BlueprintInstanceStatusEnum) {
+        if (Object.prototype.hasOwnProperty.call(BlueprintInstanceStatusEnum, key)) {
+            if (
+                BlueprintInstanceStatusEnum[key as keyof typeof BlueprintInstanceStatusEnum] ===
+                value
+            ) {
+                return true;
+            }
+        }
+    }
+    return false;
+}
+
+export function BlueprintInstanceStatusEnumFromJSON(json: any): BlueprintInstanceStatusEnum {
+    return BlueprintInstanceStatusEnumFromJSONTyped(json, false);
+}
+
+export function BlueprintInstanceStatusEnumFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): BlueprintInstanceStatusEnum {
+    return json as BlueprintInstanceStatusEnum;
+}
+
+export function BlueprintInstanceStatusEnumToJSON(value?: BlueprintInstanceStatusEnum | null): any {
+    return value as any;
+}
+
+export function BlueprintInstanceStatusEnumToJSONTyped(
+    value: any,
+    ignoreDiscriminator: boolean,
+): BlueprintInstanceStatusEnum {
+    return value as BlueprintInstanceStatusEnum;
+}

packages/client-ts/src/models/Brand.ts

@@ -0,0 +1,209 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+/**
+ * Brand Serializer
+ * @export
+ * @interface Brand
+ */
+export interface Brand {
+    /**
+     *
+     * @type {string}
+     * @memberof Brand
+     */
+    readonly brandUuid: string;
+    /**
+     * Domain that activates this brand. Can be a superset, i.e. `a.b` for `aa.b` and `ba.b`
+     * @type {string}
+     * @memberof Brand
+     */
+    domain: string;
+    /**
+     *
+     * @type {boolean}
+     * @memberof Brand
+     */
+    _default?: boolean;
+    /**
+     *
+     * @type {string}
+     * @memberof Brand
+     */
+    brandingTitle?: string;
+    /**
+     *
+     * @type {string}
+     * @memberof Brand
+     */
+    brandingLogo?: string;
+    /**
+     *
+     * @type {string}
+     * @memberof Brand
+     */
+    brandingFavicon?: string;
+    /**
+     *
+     * @type {string}
+     * @memberof Brand
+     */
+    brandingCustomCss?: string;
+    /**
+     *
+     * @type {string}
+     * @memberof Brand
+     */
+    brandingDefaultFlowBackground?: string;
+    /**
+     *
+     * @type {string}
+     * @memberof Brand
+     */
+    flowAuthentication?: string | null;
+    /**
+     *
+     * @type {string}
+     * @memberof Brand
+     */
+    flowInvalidation?: string | null;
+    /**
+     *
+     * @type {string}
+     * @memberof Brand
+     */
+    flowRecovery?: string | null;
+    /**
+     *
+     * @type {string}
+     * @memberof Brand
+     */
+    flowUnenrollment?: string | null;
+    /**
+     *
+     * @type {string}
+     * @memberof Brand
+     */
+    flowUserSettings?: string | null;
+    /**
+     *
+     * @type {string}
+     * @memberof Brand
+     */
+    flowDeviceCode?: string | null;
+    /**
+     * When set, external users will be redirected to this application after authenticating.
+     * @type {string}
+     * @memberof Brand
+     */
+    defaultApplication?: string | null;
+    /**
+     * Web Certificate used by the authentik Core webserver.
+     * @type {string}
+     * @memberof Brand
+     */
+    webCertificate?: string | null;
+    /**
+     * Certificates used for client authentication.
+     * @type {Array<string>}
+     * @memberof Brand
+     */
+    clientCertificates?: Array<string>;
+    /**
+     *
+     * @type {{ [key: string]: any; }}
+     * @memberof Brand
+     */
+    attributes?: { [key: string]: any };
+}
+
+/**
+ * Check if a given object implements the Brand interface.
+ */
+export function instanceOfBrand(value: object): value is Brand {
+    if (!("brandUuid" in value) || value["brandUuid"] === undefined) return false;
+    if (!("domain" in value) || value["domain"] === undefined) return false;
+    return true;
+}
+
+export function BrandFromJSON(json: any): Brand {
+    return BrandFromJSONTyped(json, false);
+}
+
+export function BrandFromJSONTyped(json: any, ignoreDiscriminator: boolean): Brand {
+    if (json == null) {
+        return json;
+    }
+    return {
+        brandUuid: json["brand_uuid"],
+        domain: json["domain"],
+        _default: json["default"] == null ? undefined : json["default"],
+        brandingTitle: json["branding_title"] == null ? undefined : json["branding_title"],
+        brandingLogo: json["branding_logo"] == null ? undefined : json["branding_logo"],
+        brandingFavicon: json["branding_favicon"] == null ? undefined : json["branding_favicon"],
+        brandingCustomCss:
+            json["branding_custom_css"] == null ? undefined : json["branding_custom_css"],
+        brandingDefaultFlowBackground:
+            json["branding_default_flow_background"] == null
+                ? undefined
+                : json["branding_default_flow_background"],
+        flowAuthentication:
+            json["flow_authentication"] == null ? undefined : json["flow_authentication"],
+        flowInvalidation: json["flow_invalidation"] == null ? undefined : json["flow_invalidation"],
+        flowRecovery: json["flow_recovery"] == null ? undefined : json["flow_recovery"],
+        flowUnenrollment: json["flow_unenrollment"] == null ? undefined : json["flow_unenrollment"],
+        flowUserSettings:
+            json["flow_user_settings"] == null ? undefined : json["flow_user_settings"],
+        flowDeviceCode: json["flow_device_code"] == null ? undefined : json["flow_device_code"],
+        defaultApplication:
+            json["default_application"] == null ? undefined : json["default_application"],
+        webCertificate: json["web_certificate"] == null ? undefined : json["web_certificate"],
+        clientCertificates:
+            json["client_certificates"] == null ? undefined : json["client_certificates"],
+        attributes: json["attributes"] == null ? undefined : json["attributes"],
+    };
+}
+
+export function BrandToJSON(json: any): Brand {
+    return BrandToJSONTyped(json, false);
+}
+
+export function BrandToJSONTyped(
+    value?: Omit<Brand, "brand_uuid"> | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        domain: value["domain"],
+        default: value["_default"],
+        branding_title: value["brandingTitle"],
+        branding_logo: value["brandingLogo"],
+        branding_favicon: value["brandingFavicon"],
+        branding_custom_css: value["brandingCustomCss"],
+        branding_default_flow_background: value["brandingDefaultFlowBackground"],
+        flow_authentication: value["flowAuthentication"],
+        flow_invalidation: value["flowInvalidation"],
+        flow_recovery: value["flowRecovery"],
+        flow_unenrollment: value["flowUnenrollment"],
+        flow_user_settings: value["flowUserSettings"],
+        flow_device_code: value["flowDeviceCode"],
+        default_application: value["defaultApplication"],
+        web_certificate: value["webCertificate"],
+        client_certificates: value["clientCertificates"],
+        attributes: value["attributes"],
+    };
+}

packages/client-ts/src/models/BrandRequest.ts

@@ -0,0 +1,201 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+/**
+ * Brand Serializer
+ * @export
+ * @interface BrandRequest
+ */
+export interface BrandRequest {
+    /**
+     * Domain that activates this brand. Can be a superset, i.e. `a.b` for `aa.b` and `ba.b`
+     * @type {string}
+     * @memberof BrandRequest
+     */
+    domain: string;
+    /**
+     *
+     * @type {boolean}
+     * @memberof BrandRequest
+     */
+    _default?: boolean;
+    /**
+     *
+     * @type {string}
+     * @memberof BrandRequest
+     */
+    brandingTitle?: string;
+    /**
+     *
+     * @type {string}
+     * @memberof BrandRequest
+     */
+    brandingLogo?: string;
+    /**
+     *
+     * @type {string}
+     * @memberof BrandRequest
+     */
+    brandingFavicon?: string;
+    /**
+     *
+     * @type {string}
+     * @memberof BrandRequest
+     */
+    brandingCustomCss?: string;
+    /**
+     *
+     * @type {string}
+     * @memberof BrandRequest
+     */
+    brandingDefaultFlowBackground?: string;
+    /**
+     *
+     * @type {string}
+     * @memberof BrandRequest
+     */
+    flowAuthentication?: string | null;
+    /**
+     *
+     * @type {string}
+     * @memberof BrandRequest
+     */
+    flowInvalidation?: string | null;
+    /**
+     *
+     * @type {string}
+     * @memberof BrandRequest
+     */
+    flowRecovery?: string | null;
+    /**
+     *
+     * @type {string}
+     * @memberof BrandRequest
+     */
+    flowUnenrollment?: string | null;
+    /**
+     *
+     * @type {string}
+     * @memberof BrandRequest
+     */
+    flowUserSettings?: string | null;
+    /**
+     *
+     * @type {string}
+     * @memberof BrandRequest
+     */
+    flowDeviceCode?: string | null;
+    /**
+     * When set, external users will be redirected to this application after authenticating.
+     * @type {string}
+     * @memberof BrandRequest
+     */
+    defaultApplication?: string | null;
+    /**
+     * Web Certificate used by the authentik Core webserver.
+     * @type {string}
+     * @memberof BrandRequest
+     */
+    webCertificate?: string | null;
+    /**
+     * Certificates used for client authentication.
+     * @type {Array<string>}
+     * @memberof BrandRequest
+     */
+    clientCertificates?: Array<string>;
+    /**
+     *
+     * @type {{ [key: string]: any; }}
+     * @memberof BrandRequest
+     */
+    attributes?: { [key: string]: any };
+}
+
+/**
+ * Check if a given object implements the BrandRequest interface.
+ */
+export function instanceOfBrandRequest(value: object): value is BrandRequest {
+    if (!("domain" in value) || value["domain"] === undefined) return false;
+    return true;
+}
+
+export function BrandRequestFromJSON(json: any): BrandRequest {
+    return BrandRequestFromJSONTyped(json, false);
+}
+
+export function BrandRequestFromJSONTyped(json: any, ignoreDiscriminator: boolean): BrandRequest {
+    if (json == null) {
+        return json;
+    }
+    return {
+        domain: json["domain"],
+        _default: json["default"] == null ? undefined : json["default"],
+        brandingTitle: json["branding_title"] == null ? undefined : json["branding_title"],
+        brandingLogo: json["branding_logo"] == null ? undefined : json["branding_logo"],
+        brandingFavicon: json["branding_favicon"] == null ? undefined : json["branding_favicon"],
+        brandingCustomCss:
+            json["branding_custom_css"] == null ? undefined : json["branding_custom_css"],
+        brandingDefaultFlowBackground:
+            json["branding_default_flow_background"] == null
+                ? undefined
+                : json["branding_default_flow_background"],
+        flowAuthentication:
+            json["flow_authentication"] == null ? undefined : json["flow_authentication"],
+        flowInvalidation: json["flow_invalidation"] == null ? undefined : json["flow_invalidation"],
+        flowRecovery: json["flow_recovery"] == null ? undefined : json["flow_recovery"],
+        flowUnenrollment: json["flow_unenrollment"] == null ? undefined : json["flow_unenrollment"],
+        flowUserSettings:
+            json["flow_user_settings"] == null ? undefined : json["flow_user_settings"],
+        flowDeviceCode: json["flow_device_code"] == null ? undefined : json["flow_device_code"],
+        defaultApplication:
+            json["default_application"] == null ? undefined : json["default_application"],
+        webCertificate: json["web_certificate"] == null ? undefined : json["web_certificate"],
+        clientCertificates:
+            json["client_certificates"] == null ? undefined : json["client_certificates"],
+        attributes: json["attributes"] == null ? undefined : json["attributes"],
+    };
+}
+
+export function BrandRequestToJSON(json: any): BrandRequest {
+    return BrandRequestToJSONTyped(json, false);
+}
+
+export function BrandRequestToJSONTyped(
+    value?: BrandRequest | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        domain: value["domain"],
+        default: value["_default"],
+        branding_title: value["brandingTitle"],
+        branding_logo: value["brandingLogo"],
+        branding_favicon: value["brandingFavicon"],
+        branding_custom_css: value["brandingCustomCss"],
+        branding_default_flow_background: value["brandingDefaultFlowBackground"],
+        flow_authentication: value["flowAuthentication"],
+        flow_invalidation: value["flowInvalidation"],
+        flow_recovery: value["flowRecovery"],
+        flow_unenrollment: value["flowUnenrollment"],
+        flow_user_settings: value["flowUserSettings"],
+        flow_device_code: value["flowDeviceCode"],
+        default_application: value["defaultApplication"],
+        web_certificate: value["webCertificate"],
+        client_certificates: value["clientCertificates"],
+        attributes: value["attributes"],
+    };
+}

packages/client-ts/src/models/BulkDeleteSessionResponse.ts

@@ -0,0 +1,70 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+/**
+ *
+ * @export
+ * @interface BulkDeleteSessionResponse
+ */
+export interface BulkDeleteSessionResponse {
+    /**
+     *
+     * @type {number}
+     * @memberof BulkDeleteSessionResponse
+     */
+    deleted: number;
+}
+
+/**
+ * Check if a given object implements the BulkDeleteSessionResponse interface.
+ */
+export function instanceOfBulkDeleteSessionResponse(
+    value: object,
+): value is BulkDeleteSessionResponse {
+    if (!("deleted" in value) || value["deleted"] === undefined) return false;
+    return true;
+}
+
+export function BulkDeleteSessionResponseFromJSON(json: any): BulkDeleteSessionResponse {
+    return BulkDeleteSessionResponseFromJSONTyped(json, false);
+}
+
+export function BulkDeleteSessionResponseFromJSONTyped(
+    json: any,
+    ignoreDiscriminator: boolean,
+): BulkDeleteSessionResponse {
+    if (json == null) {
+        return json;
+    }
+    return {
+        deleted: json["deleted"],
+    };
+}
+
+export function BulkDeleteSessionResponseToJSON(json: any): BulkDeleteSessionResponse {
+    return BulkDeleteSessionResponseToJSONTyped(json, false);
+}
+
+export function BulkDeleteSessionResponseToJSONTyped(
+    value?: BulkDeleteSessionResponse | null,
+    ignoreDiscriminator: boolean = false,
+): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        deleted: value["deleted"],
+    };
+}