packages/client-ts: init (#21120)

Co-authored-by: Jens Langhammer <jens@goauthentik.io>

.github/codecov.yml

@@ -10,3 +10,4 @@ comment:
   after_n_builds: 3
 ignore:
   - packages/client-rust
+  - packages/client-ts

.github/dependabot.yml

@@ -272,9 +272,10 @@ updates:
       - dependencies
   - package-ecosystem: docker-compose
     directories:
+      - /packages/client-go
       - /packages/client-rust
+      - /packages/client-ts
       # - /scripts # Maybe
-      - /scripts/api
       - /tests/e2e
     schedule:
       interval: daily

.github/workflows/_reusable-docker-build-single.yml

@@ -75,9 +75,6 @@ jobs:
       - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
         with:
           go-version-file: "go.mod"
-      - name: Generate API Clients
-        run: |
-          make gen-client-ts
       - name: Build Docker Image
         uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
         id: push

.github/workflows/api-ts-publish.yml

@@ -1,66 +0,0 @@
----
-name: API - Publish Typescript client
-
-on:
-  push:
-    branches: [main]
-    paths:
-      - "schema.yml"
-  workflow_dispatch:
-
-permissions:
-  # Required for NPM OIDC trusted publisher
-  id-token: write
-  contents: read
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    steps:
-      - id: generate_token
-        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v2
-        with:
-          app-id: ${{ secrets.GH_APP_ID }}
-          private-key: ${{ secrets.GH_APP_PRIV_KEY }}
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5
-        with:
-          token: ${{ steps.generate_token.outputs.token }}
-      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v5
-        with:
-          node-version-file: web/package.json
-          registry-url: "https://registry.npmjs.org"
-      - name: Generate API Client
-        run: make gen-client-ts
-      - name: Publish package
-        working-directory: gen-ts-api/
-        run: |
-          npm i
-          npm publish --tag generated
-      - name: Upgrade /web
-        working-directory: web
-        run: |
-          export VERSION=`node -e 'console.log(require("../gen-ts-api/package.json").version)'`
-          npm i @goauthentik/api@$VERSION
-      - name: Upgrade /web/packages/sfe
-        working-directory: web/packages/sfe
-        run: |
-          export VERSION=`node -e 'console.log(require("../gen-ts-api/package.json").version)'`
-          npm i @goauthentik/api@$VERSION
-      - uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v7
-        id: cpr
-        with:
-          token: ${{ steps.generate_token.outputs.token }}
-          branch: update-web-api-client
-          commit-message: "web: bump API Client version"
-          title: "web: bump API Client version"
-          body: "web: bump API Client version"
-          delete-branch: true
-          signoff: true
-          # ID from https://api.github.com/users/authentik-automation[bot]
-          author: authentik-automation[bot] <135050075+authentik-automation[bot]@users.noreply.github.com>
-          labels: dependencies
-      - uses: peter-evans/enable-pull-request-automerge@a660677d5469627102a1c1e11409dd063606628d # v3
-        with:
-          token: ${{ steps.generate_token.outputs.token }}
-          pull-request-number: ${{ steps.cpr.outputs.pull-request-number }}
-          merge-method: squash

.github/workflows/ci-main.yml

@@ -62,16 +62,18 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
       - name: Setup authentik env
         uses: ./.github/actions/setup
         with:
-          dependencies: "system,python,runtime,rust-nightly"
+          dependencies: "system,python,go,node,runtime,rust-nightly"
       - name: generate schema
         run: make migrate gen-build
       - name: generate API clients
         run: make gen-clients
       - name: ensure schema is up-to-date
-        run: git diff --exit-code -- schema.yml blueprints/schema.json packages/client-go packages/client-rust
+        run: git diff --exit-code -- schema.yml blueprints/schema.json packages/client-go packages/client-rust packages/client-ts
   test-migrations:
     runs-on: ubuntu-latest
     steps:
@@ -244,7 +246,6 @@ jobs:
         working-directory: web
         run: |
           npm ci
-          make -C .. gen-client-ts
           npm run build
           npm run build:sfe
       - name: run e2e
@@ -287,7 +288,6 @@ jobs:
         working-directory: web
         run: |
           npm ci
-          make -C .. gen-client-ts
           npm run build
           npm run build:sfe
       - name: run conformance

.github/workflows/ci-web.yml

@@ -40,8 +40,6 @@ jobs:
       - working-directory: ${{ matrix.project }}/
         run: |
           npm ci
-      - name: Generate API
-        run: make gen-client-ts
       - name: Lint
         working-directory: ${{ matrix.project }}/
         run: npm run ${{ matrix.command }}
@@ -56,8 +54,6 @@ jobs:
           cache-dependency-path: web/package-lock.json
       - working-directory: web/
         run: npm ci
-      - name: Generate API
-        run: make gen-client-ts
       - name: build
         working-directory: web/
         run: npm run build
@@ -84,8 +80,6 @@ jobs:
           cache-dependency-path: web/package-lock.json
       - working-directory: web/
         run: npm ci
-      - name: Generate API
-        run: make gen-client-ts
       - name: test
         working-directory: web/
         run: npm run test || exit 0

.github/workflows/release-publish.yml

@@ -103,9 +103,6 @@ jobs:
           DOCKER_USERNAME: ${{ secrets.DOCKER_CORP_USERNAME }}
         with:
           image-name: ghcr.io/goauthentik/${{ matrix.type }},authentik/${{ matrix.type }}
-      - name: Generate API Clients
-        run: |
-          make gen-client-ts
       - name: Docker Login Registry
         uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
         with:
@@ -163,9 +160,6 @@ jobs:
         working-directory: web/
         run: |
           npm ci
-      - name: Generate API Clients
-        run: |
-          make gen-client-ts
       - name: Build web
         working-directory: web/
         run: |

.github/workflows/translation-extract-compile.yml

@@ -33,8 +33,6 @@ jobs:
         if: ${{ github.event_name == 'pull_request' }}
       - name: Setup authentik env
         uses: ./.github/actions/setup
-      - name: Generate API
-        run: make gen-client-ts
       - name: run extract
         run: |
           uv run make i18n-extract

CODEOWNERS

@@ -36,6 +36,7 @@ package.json                            @goauthentik/frontend
 package-lock.json                       @goauthentik/frontend
 packages/package.json                   @goauthentik/frontend
 packages/package-lock.json              @goauthentik/frontend
+packages/client-ts                      @goauthentik/frontend
 packages/docusaurus-config              @goauthentik/frontend
 packages/esbuild-plugin-live-reload     @goauthentik/frontend
 packages/eslint-config                  @goauthentik/frontend

Makefile

@@ -15,7 +15,6 @@ else
 	SED_INPLACE = sed -i
 endif
 
-GEN_API_TS = gen-ts-api
 GEN_API_PY = gen-py-api
 
 BREW_LDFLAGS :=
@@ -123,7 +122,7 @@ core-i18n-extract:
 		--no-obsolete \
 		--ignore web \
 		--ignore internal \
-		--ignore ${GEN_API_TS} \
+		--ignore packages/client-ts \
 		--ignore website \
 		-l en
 
@@ -199,10 +198,6 @@ gen-diff:  ## (Release) generate the changelog diff between the current schema a
 	$(SED_INPLACE) 's/}/}/g' diff.md
 	npx prettier --write diff.md
 
-gen-clean-ts:  ## Remove generated API client for TypeScript
-	rm -rf ${PWD}/${GEN_API_TS}/
-	rm -rf ${PWD}/web/node_modules/@goauthentik/api/
-
 gen-clean-py:  ## Remove generated API client for Python
 	rm -rf ${PWD}/${GEN_API_PY}
 
@@ -211,24 +206,13 @@ gen-clean: gen-clean-ts gen-clean-py  ## Remove generated API clients
 gen-client-go:  ## Build and install the authentik API for Golang
 	make -C "${PWD}/packages/client-go" build
 
-gen-client-rust:
+gen-client-rust:  ## Build and install the authentik API for Rust
 	make -C "${PWD}/packages/client-rust" build version=${NPM_VERSION}
 	make lint-fix-rust
 
-gen-client-ts: gen-clean-ts  ## Build and install the authentik API for Typescript into the authentik UI Application
-	docker compose -f scripts/api/compose.yml run --rm --user "${UID}:${GID}" gen \
-		generate \
-		-i /local/schema.yml \
-		-g typescript-fetch \
-		-o /local/${GEN_API_TS} \
-		-c /local/scripts/api/ts-config.yaml \
-		--additional-properties=npmVersion=${NPM_VERSION} \
-		--git-repo-id authentik \
-		--git-user-id goauthentik
-
-	cd ${PWD}/${GEN_API_TS} && npm i
-	cd ${PWD}/${GEN_API_TS} && npm link
-	cd ${PWD}/web && npm link @goauthentik/api
+gen-client-ts:  ## Build and install the authentik API for Typescript into the authentik UI Application
+	make -C "${PWD}/packages/client-ts" build
+	npm --prefix web install
 
 gen-client-py: gen-clean-py ## Build and install the authentik API for Python
 	mkdir -p ${PWD}/${GEN_API_PY}
@@ -324,7 +308,6 @@ docs-api-clean: ## Clean generated API documentation
 #########################
 
 docker:  ## Build a docker image of the current source tree
-	mkdir -p ${GEN_API_TS}
 	DOCKER_BUILDKIT=1 docker build . -f lifecycle/container/Dockerfile --progress plain --tag ${DOCKER_IMAGE}
 
 test-docker:

cspell.config.jsonc

@@ -231,8 +231,9 @@
         "./blueprints/schema.json", // Generated blueprint schema
         "custom-elements.json", // TypeScript custom element definitions
         "./gen-*-api", // Generated API Client
-        "./packages/client-rust/src", // Generated API Client
         "./packages/client-go", // Generated API Client
+        "./packages/client-rust/src", // Generated API Client
+        "./packages/client-ts/src", // Generated API Client
         "./schemas/**", // XML Schemas
         "./authentik/sources/**/schemas", // Source schemas
         "**vendored**", // Vendored files

lifecycle/container/Dockerfile

@@ -9,6 +9,10 @@ ENV NODE_ENV=production
 
 WORKDIR /work/web
 
+# These files need to be copied and cannot be mounted as `npm ci` will build the client's typescript
+COPY ./packages /work/packages
+COPY ./web/packages /work/web/packages
+
 RUN --mount=type=bind,target=/work/web/package.json,src=./web/package.json \
     --mount=type=bind,target=/work/web/package-lock.json,src=./web/package-lock.json \
     --mount=type=bind,target=/work/web/packages/sfe/package.json,src=./web/packages/sfe/package.json \
@@ -20,7 +24,6 @@ COPY ./package.json /work
 COPY ./web /work/web/
 # TODO: Update this after moving website to docs
 COPY ./website /work/website/
-COPY ./gen-ts-api /work/web/node_modules/@goauthentik/api
 
 RUN npm run build && \
     npm run build:sfe

packages/client-ts/.gitignore

@@ -0,0 +1,5 @@
+wwwroot/*.js
+node_modules
+typings
+dist
+*.tsbuildinfo

packages/client-ts/.openapi-generator-ignore

@@ -0,0 +1 @@
+.gitignore

packages/client-ts/Makefile

@@ -0,0 +1,21 @@
+.SHELLFLAGS += -x -e
+PWD = $(shell pwd)
+UID = $(shell id -u)
+GID = $(shell id -g)
+
+build:
+	rm -rf src
+	docker compose run --rm --user "${UID}:${GID}" gen \
+		generate \
+		-i /schema.yml \
+		-g typescript-fetch \
+		-o local \
+		-c /local/config.yaml \
+		--additional-properties=npmVersion=0.0.0 \
+		--git-repo-id authentik \
+		--git-user-id goauthentik
+	rm -rf \
+		.npmignore \
+		.openapi-generator \
+		docs \
+		README.md

packages/client-ts/compose.yml

@@ -0,0 +1,9 @@
+---
+services:
+    gen:
+        image: docker.io/openapitools/openapi-generator-cli:v7.20.0
+        restart: never
+        network_mode: none
+        volumes:
+            - ./:/local
+            - ../../schema.yml:/schema.yml:ro

packages/client-ts/config.yaml

@@ -1,4 +1,5 @@
-templateDir: /local/scripts/api/ts-templates/
+---
+templateDir: /local/templates/
 additionalProperties:
   typescriptThreePlus: true
   supportsES6: true
@@ -6,7 +7,3 @@ additionalProperties:
   fileContentDataType: Blob
   enumUnknownDefaultCase: true
   useObjectParameters: true
-files:
-  README.mustache:
-    templateType: SupportingFiles
-    destinationFilename: README.md

packages/client-ts/package.json

@@ -0,0 +1,21 @@
+{
+  "name": "@goauthentik/api",
+  "version": "0.0.0",
+  "description": "OpenAPI client for @goauthentik/api",
+  "author": "OpenAPI-Generator",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/goauthentik/authentik.git"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "module": "./dist/esm/index.js",
+  "sideEffects": false,
+  "scripts": {
+    "build": "tsc && tsc -p tsconfig.esm.json",
+    "prepare": "npm run build"
+  },
+  "devDependencies": {
+    "typescript": "^4.0 || ^5.0"
+  }
+}

packages/client-ts/src/apis/AdminApi.ts

@@ -0,0 +1,840 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+
+import * as runtime from '../runtime';
+import type {
+  App,
+  FileList,
+  GenericError,
+  PatchedSettingsRequest,
+  Settings,
+  SettingsRequest,
+  SystemInfo,
+  UsedBy,
+  ValidationError,
+  Version,
+  VersionHistory,
+} from '../models/index';
+import {
+    AppFromJSON,
+    AppToJSON,
+    FileListFromJSON,
+    FileListToJSON,
+    GenericErrorFromJSON,
+    GenericErrorToJSON,
+    PatchedSettingsRequestFromJSON,
+    PatchedSettingsRequestToJSON,
+    SettingsFromJSON,
+    SettingsToJSON,
+    SettingsRequestFromJSON,
+    SettingsRequestToJSON,
+    SystemInfoFromJSON,
+    SystemInfoToJSON,
+    UsedByFromJSON,
+    UsedByToJSON,
+    ValidationErrorFromJSON,
+    ValidationErrorToJSON,
+    VersionFromJSON,
+    VersionToJSON,
+    VersionHistoryFromJSON,
+    VersionHistoryToJSON,
+} from '../models/index';
+
+export interface AdminFileCreateRequest {
+    file: Blob;
+    name?: string;
+    usage?: string;
+}
+
+export interface AdminFileDestroyRequest {
+    name?: string;
+    usage?: AdminFileDestroyUsageEnum;
+}
+
+export interface AdminFileListRequest {
+    manageableOnly?: boolean;
+    search?: string;
+    usage?: AdminFileListUsageEnum;
+}
+
+export interface AdminFileUsedByListRequest {
+    name?: string;
+}
+
+export interface AdminSettingsPartialUpdateRequest {
+    patchedSettingsRequest?: PatchedSettingsRequest;
+}
+
+export interface AdminSettingsUpdateRequest {
+    settingsRequest: SettingsRequest;
+}
+
+export interface AdminVersionHistoryListRequest {
+    build?: string;
+    ordering?: string;
+    search?: string;
+    version?: string;
+}
+
+export interface AdminVersionHistoryRetrieveRequest {
+    id: number;
+}
+
+/**
+ * 
+ */
+export class AdminApi extends runtime.BaseAPI {
+
+    /**
+     * Creates request options for adminAppsList without sending the request
+     */
+    async adminAppsListRequestOpts(): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/admin/apps/`;
+
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Read-only view list all installed apps
+     */
+    async adminAppsListRaw(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<Array<App>>> {
+        const requestOptions = await this.adminAppsListRequestOpts();
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => jsonValue.map(AppFromJSON));
+    }
+
+    /**
+     * Read-only view list all installed apps
+     */
+    async adminAppsList(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<Array<App>> {
+        const response = await this.adminAppsListRaw(initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for adminFileCreate without sending the request
+     */
+    async adminFileCreateRequestOpts(requestParameters: AdminFileCreateRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['file'] == null) {
+            throw new runtime.RequiredError(
+                'file',
+                'Required parameter "file" was null or undefined when calling adminFileCreate().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+        const consumes: runtime.Consume[] = [
+            { contentType: 'multipart/form-data' },
+        ];
+        // @ts-ignore: canConsumeForm may be unused
+        const canConsumeForm = runtime.canConsumeForm(consumes);
+
+        let formParams: { append(param: string, value: any): any };
+        let useForm = false;
+        // use FormData to transmit files using content-type "multipart/form-data"
+        useForm = canConsumeForm;
+        if (useForm) {
+            formParams = new FormData();
+        } else {
+            formParams = new URLSearchParams();
+        }
+
+        if (requestParameters['file'] != null) {
+            formParams.append('file', requestParameters['file'] as any);
+        }
+
+        if (requestParameters['name'] != null) {
+            formParams.append('name', requestParameters['name'] as any);
+        }
+
+        if (requestParameters['usage'] != null) {
+            formParams.append('usage', requestParameters['usage'] as any);
+        }
+
+
+        let urlPath = `/admin/file/`;
+
+        return {
+            path: urlPath,
+            method: 'POST',
+            headers: headerParameters,
+            query: queryParameters,
+            body: formParams,
+        };
+    }
+
+    /**
+     * Upload file to storage backend.
+     */
+    async adminFileCreateRaw(requestParameters: AdminFileCreateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>> {
+        const requestOptions = await this.adminFileCreateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.VoidApiResponse(response);
+    }
+
+    /**
+     * Upload file to storage backend.
+     */
+    async adminFileCreate(requestParameters: AdminFileCreateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void> {
+        await this.adminFileCreateRaw(requestParameters, initOverrides);
+    }
+
+    /**
+     * Creates request options for adminFileDestroy without sending the request
+     */
+    async adminFileDestroyRequestOpts(requestParameters: AdminFileDestroyRequest): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        if (requestParameters['name'] != null) {
+            queryParameters['name'] = requestParameters['name'];
+        }
+
+        if (requestParameters['usage'] != null) {
+            queryParameters['usage'] = requestParameters['usage'];
+        }
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/admin/file/`;
+
+        return {
+            path: urlPath,
+            method: 'DELETE',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Delete file from storage backend.
+     */
+    async adminFileDestroyRaw(requestParameters: AdminFileDestroyRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>> {
+        const requestOptions = await this.adminFileDestroyRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.VoidApiResponse(response);
+    }
+
+    /**
+     * Delete file from storage backend.
+     */
+    async adminFileDestroy(requestParameters: AdminFileDestroyRequest = {}, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void> {
+        await this.adminFileDestroyRaw(requestParameters, initOverrides);
+    }
+
+    /**
+     * Creates request options for adminFileList without sending the request
+     */
+    async adminFileListRequestOpts(requestParameters: AdminFileListRequest): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        if (requestParameters['manageableOnly'] != null) {
+            queryParameters['manageable_only'] = requestParameters['manageableOnly'];
+        }
+
+        if (requestParameters['search'] != null) {
+            queryParameters['search'] = requestParameters['search'];
+        }
+
+        if (requestParameters['usage'] != null) {
+            queryParameters['usage'] = requestParameters['usage'];
+        }
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/admin/file/`;
+
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * List files from storage backend.
+     */
+    async adminFileListRaw(requestParameters: AdminFileListRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<Array<FileList>>> {
+        const requestOptions = await this.adminFileListRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => jsonValue.map(FileListFromJSON));
+    }
+
+    /**
+     * List files from storage backend.
+     */
+    async adminFileList(requestParameters: AdminFileListRequest = {}, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<Array<FileList>> {
+        const response = await this.adminFileListRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for adminFileUsedByList without sending the request
+     */
+    async adminFileUsedByListRequestOpts(requestParameters: AdminFileUsedByListRequest): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        if (requestParameters['name'] != null) {
+            queryParameters['name'] = requestParameters['name'];
+        }
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/admin/file/used_by/`;
+
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     */
+    async adminFileUsedByListRaw(requestParameters: AdminFileUsedByListRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<Array<UsedBy>>> {
+        const requestOptions = await this.adminFileUsedByListRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => jsonValue.map(UsedByFromJSON));
+    }
+
+    /**
+     */
+    async adminFileUsedByList(requestParameters: AdminFileUsedByListRequest = {}, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<Array<UsedBy>> {
+        const response = await this.adminFileUsedByListRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for adminModelsList without sending the request
+     */
+    async adminModelsListRequestOpts(): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/admin/models/`;
+
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Read-only view list all installed models
+     */
+    async adminModelsListRaw(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<Array<App>>> {
+        const requestOptions = await this.adminModelsListRequestOpts();
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => jsonValue.map(AppFromJSON));
+    }
+
+    /**
+     * Read-only view list all installed models
+     */
+    async adminModelsList(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<Array<App>> {
+        const response = await this.adminModelsListRaw(initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for adminSettingsPartialUpdate without sending the request
+     */
+    async adminSettingsPartialUpdateRequestOpts(requestParameters: AdminSettingsPartialUpdateRequest): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters['Content-Type'] = 'application/json';
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/admin/settings/`;
+
+        return {
+            path: urlPath,
+            method: 'PATCH',
+            headers: headerParameters,
+            query: queryParameters,
+            body: PatchedSettingsRequestToJSON(requestParameters['patchedSettingsRequest']),
+        };
+    }
+
+    /**
+     * Settings view
+     */
+    async adminSettingsPartialUpdateRaw(requestParameters: AdminSettingsPartialUpdateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<Settings>> {
+        const requestOptions = await this.adminSettingsPartialUpdateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => SettingsFromJSON(jsonValue));
+    }
+
+    /**
+     * Settings view
+     */
+    async adminSettingsPartialUpdate(requestParameters: AdminSettingsPartialUpdateRequest = {}, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<Settings> {
+        const response = await this.adminSettingsPartialUpdateRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for adminSettingsRetrieve without sending the request
+     */
+    async adminSettingsRetrieveRequestOpts(): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/admin/settings/`;
+
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Settings view
+     */
+    async adminSettingsRetrieveRaw(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<Settings>> {
+        const requestOptions = await this.adminSettingsRetrieveRequestOpts();
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => SettingsFromJSON(jsonValue));
+    }
+
+    /**
+     * Settings view
+     */
+    async adminSettingsRetrieve(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<Settings> {
+        const response = await this.adminSettingsRetrieveRaw(initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for adminSettingsUpdate without sending the request
+     */
+    async adminSettingsUpdateRequestOpts(requestParameters: AdminSettingsUpdateRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['settingsRequest'] == null) {
+            throw new runtime.RequiredError(
+                'settingsRequest',
+                'Required parameter "settingsRequest" was null or undefined when calling adminSettingsUpdate().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters['Content-Type'] = 'application/json';
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/admin/settings/`;
+
+        return {
+            path: urlPath,
+            method: 'PUT',
+            headers: headerParameters,
+            query: queryParameters,
+            body: SettingsRequestToJSON(requestParameters['settingsRequest']),
+        };
+    }
+
+    /**
+     * Settings view
+     */
+    async adminSettingsUpdateRaw(requestParameters: AdminSettingsUpdateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<Settings>> {
+        const requestOptions = await this.adminSettingsUpdateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => SettingsFromJSON(jsonValue));
+    }
+
+    /**
+     * Settings view
+     */
+    async adminSettingsUpdate(requestParameters: AdminSettingsUpdateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<Settings> {
+        const response = await this.adminSettingsUpdateRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for adminSystemCreate without sending the request
+     */
+    async adminSystemCreateRequestOpts(): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/admin/system/`;
+
+        return {
+            path: urlPath,
+            method: 'POST',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Get system information.
+     */
+    async adminSystemCreateRaw(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<SystemInfo>> {
+        const requestOptions = await this.adminSystemCreateRequestOpts();
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => SystemInfoFromJSON(jsonValue));
+    }
+
+    /**
+     * Get system information.
+     */
+    async adminSystemCreate(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<SystemInfo> {
+        const response = await this.adminSystemCreateRaw(initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for adminSystemRetrieve without sending the request
+     */
+    async adminSystemRetrieveRequestOpts(): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/admin/system/`;
+
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Get system information.
+     */
+    async adminSystemRetrieveRaw(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<SystemInfo>> {
+        const requestOptions = await this.adminSystemRetrieveRequestOpts();
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => SystemInfoFromJSON(jsonValue));
+    }
+
+    /**
+     * Get system information.
+     */
+    async adminSystemRetrieve(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<SystemInfo> {
+        const response = await this.adminSystemRetrieveRaw(initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for adminVersionHistoryList without sending the request
+     */
+    async adminVersionHistoryListRequestOpts(requestParameters: AdminVersionHistoryListRequest): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        if (requestParameters['build'] != null) {
+            queryParameters['build'] = requestParameters['build'];
+        }
+
+        if (requestParameters['ordering'] != null) {
+            queryParameters['ordering'] = requestParameters['ordering'];
+        }
+
+        if (requestParameters['search'] != null) {
+            queryParameters['search'] = requestParameters['search'];
+        }
+
+        if (requestParameters['version'] != null) {
+            queryParameters['version'] = requestParameters['version'];
+        }
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/admin/version/history/`;
+
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * VersionHistory Viewset
+     */
+    async adminVersionHistoryListRaw(requestParameters: AdminVersionHistoryListRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<Array<VersionHistory>>> {
+        const requestOptions = await this.adminVersionHistoryListRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => jsonValue.map(VersionHistoryFromJSON));
+    }
+
+    /**
+     * VersionHistory Viewset
+     */
+    async adminVersionHistoryList(requestParameters: AdminVersionHistoryListRequest = {}, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<Array<VersionHistory>> {
+        const response = await this.adminVersionHistoryListRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for adminVersionHistoryRetrieve without sending the request
+     */
+    async adminVersionHistoryRetrieveRequestOpts(requestParameters: AdminVersionHistoryRetrieveRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['id'] == null) {
+            throw new runtime.RequiredError(
+                'id',
+                'Required parameter "id" was null or undefined when calling adminVersionHistoryRetrieve().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/admin/version/history/{id}/`;
+        urlPath = urlPath.replace(`{${"id"}}`, encodeURIComponent(String(requestParameters['id'])));
+
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * VersionHistory Viewset
+     */
+    async adminVersionHistoryRetrieveRaw(requestParameters: AdminVersionHistoryRetrieveRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<VersionHistory>> {
+        const requestOptions = await this.adminVersionHistoryRetrieveRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => VersionHistoryFromJSON(jsonValue));
+    }
+
+    /**
+     * VersionHistory Viewset
+     */
+    async adminVersionHistoryRetrieve(requestParameters: AdminVersionHistoryRetrieveRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<VersionHistory> {
+        const response = await this.adminVersionHistoryRetrieveRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for adminVersionRetrieve without sending the request
+     */
+    async adminVersionRetrieveRequestOpts(): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/admin/version/`;
+
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Get running and latest version.
+     */
+    async adminVersionRetrieveRaw(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<Version>> {
+        const requestOptions = await this.adminVersionRetrieveRequestOpts();
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => VersionFromJSON(jsonValue));
+    }
+
+    /**
+     * Get running and latest version.
+     */
+    async adminVersionRetrieve(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<Version> {
+        const response = await this.adminVersionRetrieveRaw(initOverrides);
+        return await response.value();
+    }
+
+}
+
+/**
+ * @export
+ */
+export const AdminFileDestroyUsageEnum = {
+    Media: 'media',
+    UnknownDefaultOpenApi: '11184809'
+} as const;
+export type AdminFileDestroyUsageEnum = typeof AdminFileDestroyUsageEnum[keyof typeof AdminFileDestroyUsageEnum];
+/**
+ * @export
+ */
+export const AdminFileListUsageEnum = {
+    Media: 'media',
+    UnknownDefaultOpenApi: '11184809'
+} as const;
+export type AdminFileListUsageEnum = typeof AdminFileListUsageEnum[keyof typeof AdminFileListUsageEnum];

packages/client-ts/src/apis/CryptoApi.ts

@@ -0,0 +1,696 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+
+import * as runtime from '../runtime';
+import type {
+  CertificateData,
+  CertificateGenerationRequest,
+  CertificateKeyPair,
+  CertificateKeyPairRequest,
+  GenericError,
+  PaginatedCertificateKeyPairList,
+  PatchedCertificateKeyPairRequest,
+  UsedBy,
+  ValidationError,
+} from '../models/index';
+import {
+    CertificateDataFromJSON,
+    CertificateDataToJSON,
+    CertificateGenerationRequestFromJSON,
+    CertificateGenerationRequestToJSON,
+    CertificateKeyPairFromJSON,
+    CertificateKeyPairToJSON,
+    CertificateKeyPairRequestFromJSON,
+    CertificateKeyPairRequestToJSON,
+    GenericErrorFromJSON,
+    GenericErrorToJSON,
+    PaginatedCertificateKeyPairListFromJSON,
+    PaginatedCertificateKeyPairListToJSON,
+    PatchedCertificateKeyPairRequestFromJSON,
+    PatchedCertificateKeyPairRequestToJSON,
+    UsedByFromJSON,
+    UsedByToJSON,
+    ValidationErrorFromJSON,
+    ValidationErrorToJSON,
+} from '../models/index';
+
+export interface CryptoCertificatekeypairsCreateRequest {
+    certificateKeyPairRequest: CertificateKeyPairRequest;
+}
+
+export interface CryptoCertificatekeypairsDestroyRequest {
+    kpUuid: string;
+}
+
+export interface CryptoCertificatekeypairsGenerateCreateRequest {
+    certificateGenerationRequest: CertificateGenerationRequest;
+}
+
+export interface CryptoCertificatekeypairsListRequest {
+    hasKey?: boolean;
+    keyType?: Array<CryptoCertificatekeypairsListKeyTypeEnum>;
+    managed?: string;
+    name?: string;
+    ordering?: string;
+    page?: number;
+    pageSize?: number;
+    search?: string;
+}
+
+export interface CryptoCertificatekeypairsPartialUpdateRequest {
+    kpUuid: string;
+    patchedCertificateKeyPairRequest?: PatchedCertificateKeyPairRequest;
+}
+
+export interface CryptoCertificatekeypairsRetrieveRequest {
+    kpUuid: string;
+}
+
+export interface CryptoCertificatekeypairsUpdateRequest {
+    kpUuid: string;
+    certificateKeyPairRequest: CertificateKeyPairRequest;
+}
+
+export interface CryptoCertificatekeypairsUsedByListRequest {
+    kpUuid: string;
+}
+
+export interface CryptoCertificatekeypairsViewCertificateRetrieveRequest {
+    kpUuid: string;
+    download?: boolean;
+}
+
+export interface CryptoCertificatekeypairsViewPrivateKeyRetrieveRequest {
+    kpUuid: string;
+    download?: boolean;
+}
+
+/**
+ * 
+ */
+export class CryptoApi extends runtime.BaseAPI {
+
+    /**
+     * Creates request options for cryptoCertificatekeypairsCreate without sending the request
+     */
+    async cryptoCertificatekeypairsCreateRequestOpts(requestParameters: CryptoCertificatekeypairsCreateRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['certificateKeyPairRequest'] == null) {
+            throw new runtime.RequiredError(
+                'certificateKeyPairRequest',
+                'Required parameter "certificateKeyPairRequest" was null or undefined when calling cryptoCertificatekeypairsCreate().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters['Content-Type'] = 'application/json';
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/crypto/certificatekeypairs/`;
+
+        return {
+            path: urlPath,
+            method: 'POST',
+            headers: headerParameters,
+            query: queryParameters,
+            body: CertificateKeyPairRequestToJSON(requestParameters['certificateKeyPairRequest']),
+        };
+    }
+
+    /**
+     * CertificateKeyPair Viewset
+     */
+    async cryptoCertificatekeypairsCreateRaw(requestParameters: CryptoCertificatekeypairsCreateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<CertificateKeyPair>> {
+        const requestOptions = await this.cryptoCertificatekeypairsCreateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => CertificateKeyPairFromJSON(jsonValue));
+    }
+
+    /**
+     * CertificateKeyPair Viewset
+     */
+    async cryptoCertificatekeypairsCreate(requestParameters: CryptoCertificatekeypairsCreateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<CertificateKeyPair> {
+        const response = await this.cryptoCertificatekeypairsCreateRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for cryptoCertificatekeypairsDestroy without sending the request
+     */
+    async cryptoCertificatekeypairsDestroyRequestOpts(requestParameters: CryptoCertificatekeypairsDestroyRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['kpUuid'] == null) {
+            throw new runtime.RequiredError(
+                'kpUuid',
+                'Required parameter "kpUuid" was null or undefined when calling cryptoCertificatekeypairsDestroy().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/crypto/certificatekeypairs/{kp_uuid}/`;
+        urlPath = urlPath.replace(`{${"kp_uuid"}}`, encodeURIComponent(String(requestParameters['kpUuid'])));
+
+        return {
+            path: urlPath,
+            method: 'DELETE',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * CertificateKeyPair Viewset
+     */
+    async cryptoCertificatekeypairsDestroyRaw(requestParameters: CryptoCertificatekeypairsDestroyRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>> {
+        const requestOptions = await this.cryptoCertificatekeypairsDestroyRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.VoidApiResponse(response);
+    }
+
+    /**
+     * CertificateKeyPair Viewset
+     */
+    async cryptoCertificatekeypairsDestroy(requestParameters: CryptoCertificatekeypairsDestroyRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void> {
+        await this.cryptoCertificatekeypairsDestroyRaw(requestParameters, initOverrides);
+    }
+
+    /**
+     * Creates request options for cryptoCertificatekeypairsGenerateCreate without sending the request
+     */
+    async cryptoCertificatekeypairsGenerateCreateRequestOpts(requestParameters: CryptoCertificatekeypairsGenerateCreateRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['certificateGenerationRequest'] == null) {
+            throw new runtime.RequiredError(
+                'certificateGenerationRequest',
+                'Required parameter "certificateGenerationRequest" was null or undefined when calling cryptoCertificatekeypairsGenerateCreate().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters['Content-Type'] = 'application/json';
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/crypto/certificatekeypairs/generate/`;
+
+        return {
+            path: urlPath,
+            method: 'POST',
+            headers: headerParameters,
+            query: queryParameters,
+            body: CertificateGenerationRequestToJSON(requestParameters['certificateGenerationRequest']),
+        };
+    }
+
+    /**
+     * Generate a new, self-signed certificate-key pair
+     */
+    async cryptoCertificatekeypairsGenerateCreateRaw(requestParameters: CryptoCertificatekeypairsGenerateCreateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<CertificateKeyPair>> {
+        const requestOptions = await this.cryptoCertificatekeypairsGenerateCreateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => CertificateKeyPairFromJSON(jsonValue));
+    }
+
+    /**
+     * Generate a new, self-signed certificate-key pair
+     */
+    async cryptoCertificatekeypairsGenerateCreate(requestParameters: CryptoCertificatekeypairsGenerateCreateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<CertificateKeyPair> {
+        const response = await this.cryptoCertificatekeypairsGenerateCreateRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for cryptoCertificatekeypairsList without sending the request
+     */
+    async cryptoCertificatekeypairsListRequestOpts(requestParameters: CryptoCertificatekeypairsListRequest): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        if (requestParameters['hasKey'] != null) {
+            queryParameters['has_key'] = requestParameters['hasKey'];
+        }
+
+        if (requestParameters['keyType'] != null) {
+            queryParameters['key_type'] = requestParameters['keyType'];
+        }
+
+        if (requestParameters['managed'] != null) {
+            queryParameters['managed'] = requestParameters['managed'];
+        }
+
+        if (requestParameters['name'] != null) {
+            queryParameters['name'] = requestParameters['name'];
+        }
+
+        if (requestParameters['ordering'] != null) {
+            queryParameters['ordering'] = requestParameters['ordering'];
+        }
+
+        if (requestParameters['page'] != null) {
+            queryParameters['page'] = requestParameters['page'];
+        }
+
+        if (requestParameters['pageSize'] != null) {
+            queryParameters['page_size'] = requestParameters['pageSize'];
+        }
+
+        if (requestParameters['search'] != null) {
+            queryParameters['search'] = requestParameters['search'];
+        }
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/crypto/certificatekeypairs/`;
+
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * CertificateKeyPair Viewset
+     */
+    async cryptoCertificatekeypairsListRaw(requestParameters: CryptoCertificatekeypairsListRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<PaginatedCertificateKeyPairList>> {
+        const requestOptions = await this.cryptoCertificatekeypairsListRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => PaginatedCertificateKeyPairListFromJSON(jsonValue));
+    }
+
+    /**
+     * CertificateKeyPair Viewset
+     */
+    async cryptoCertificatekeypairsList(requestParameters: CryptoCertificatekeypairsListRequest = {}, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<PaginatedCertificateKeyPairList> {
+        const response = await this.cryptoCertificatekeypairsListRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for cryptoCertificatekeypairsPartialUpdate without sending the request
+     */
+    async cryptoCertificatekeypairsPartialUpdateRequestOpts(requestParameters: CryptoCertificatekeypairsPartialUpdateRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['kpUuid'] == null) {
+            throw new runtime.RequiredError(
+                'kpUuid',
+                'Required parameter "kpUuid" was null or undefined when calling cryptoCertificatekeypairsPartialUpdate().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters['Content-Type'] = 'application/json';
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/crypto/certificatekeypairs/{kp_uuid}/`;
+        urlPath = urlPath.replace(`{${"kp_uuid"}}`, encodeURIComponent(String(requestParameters['kpUuid'])));
+
+        return {
+            path: urlPath,
+            method: 'PATCH',
+            headers: headerParameters,
+            query: queryParameters,
+            body: PatchedCertificateKeyPairRequestToJSON(requestParameters['patchedCertificateKeyPairRequest']),
+        };
+    }
+
+    /**
+     * CertificateKeyPair Viewset
+     */
+    async cryptoCertificatekeypairsPartialUpdateRaw(requestParameters: CryptoCertificatekeypairsPartialUpdateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<CertificateKeyPair>> {
+        const requestOptions = await this.cryptoCertificatekeypairsPartialUpdateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => CertificateKeyPairFromJSON(jsonValue));
+    }
+
+    /**
+     * CertificateKeyPair Viewset
+     */
+    async cryptoCertificatekeypairsPartialUpdate(requestParameters: CryptoCertificatekeypairsPartialUpdateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<CertificateKeyPair> {
+        const response = await this.cryptoCertificatekeypairsPartialUpdateRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for cryptoCertificatekeypairsRetrieve without sending the request
+     */
+    async cryptoCertificatekeypairsRetrieveRequestOpts(requestParameters: CryptoCertificatekeypairsRetrieveRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['kpUuid'] == null) {
+            throw new runtime.RequiredError(
+                'kpUuid',
+                'Required parameter "kpUuid" was null or undefined when calling cryptoCertificatekeypairsRetrieve().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/crypto/certificatekeypairs/{kp_uuid}/`;
+        urlPath = urlPath.replace(`{${"kp_uuid"}}`, encodeURIComponent(String(requestParameters['kpUuid'])));
+
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * CertificateKeyPair Viewset
+     */
+    async cryptoCertificatekeypairsRetrieveRaw(requestParameters: CryptoCertificatekeypairsRetrieveRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<CertificateKeyPair>> {
+        const requestOptions = await this.cryptoCertificatekeypairsRetrieveRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => CertificateKeyPairFromJSON(jsonValue));
+    }
+
+    /**
+     * CertificateKeyPair Viewset
+     */
+    async cryptoCertificatekeypairsRetrieve(requestParameters: CryptoCertificatekeypairsRetrieveRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<CertificateKeyPair> {
+        const response = await this.cryptoCertificatekeypairsRetrieveRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for cryptoCertificatekeypairsUpdate without sending the request
+     */
+    async cryptoCertificatekeypairsUpdateRequestOpts(requestParameters: CryptoCertificatekeypairsUpdateRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['kpUuid'] == null) {
+            throw new runtime.RequiredError(
+                'kpUuid',
+                'Required parameter "kpUuid" was null or undefined when calling cryptoCertificatekeypairsUpdate().'
+            );
+        }
+
+        if (requestParameters['certificateKeyPairRequest'] == null) {
+            throw new runtime.RequiredError(
+                'certificateKeyPairRequest',
+                'Required parameter "certificateKeyPairRequest" was null or undefined when calling cryptoCertificatekeypairsUpdate().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters['Content-Type'] = 'application/json';
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/crypto/certificatekeypairs/{kp_uuid}/`;
+        urlPath = urlPath.replace(`{${"kp_uuid"}}`, encodeURIComponent(String(requestParameters['kpUuid'])));
+
+        return {
+            path: urlPath,
+            method: 'PUT',
+            headers: headerParameters,
+            query: queryParameters,
+            body: CertificateKeyPairRequestToJSON(requestParameters['certificateKeyPairRequest']),
+        };
+    }
+
+    /**
+     * CertificateKeyPair Viewset
+     */
+    async cryptoCertificatekeypairsUpdateRaw(requestParameters: CryptoCertificatekeypairsUpdateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<CertificateKeyPair>> {
+        const requestOptions = await this.cryptoCertificatekeypairsUpdateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => CertificateKeyPairFromJSON(jsonValue));
+    }
+
+    /**
+     * CertificateKeyPair Viewset
+     */
+    async cryptoCertificatekeypairsUpdate(requestParameters: CryptoCertificatekeypairsUpdateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<CertificateKeyPair> {
+        const response = await this.cryptoCertificatekeypairsUpdateRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for cryptoCertificatekeypairsUsedByList without sending the request
+     */
+    async cryptoCertificatekeypairsUsedByListRequestOpts(requestParameters: CryptoCertificatekeypairsUsedByListRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['kpUuid'] == null) {
+            throw new runtime.RequiredError(
+                'kpUuid',
+                'Required parameter "kpUuid" was null or undefined when calling cryptoCertificatekeypairsUsedByList().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/crypto/certificatekeypairs/{kp_uuid}/used_by/`;
+        urlPath = urlPath.replace(`{${"kp_uuid"}}`, encodeURIComponent(String(requestParameters['kpUuid'])));
+
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Get a list of all objects that use this object
+     */
+    async cryptoCertificatekeypairsUsedByListRaw(requestParameters: CryptoCertificatekeypairsUsedByListRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<Array<UsedBy>>> {
+        const requestOptions = await this.cryptoCertificatekeypairsUsedByListRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => jsonValue.map(UsedByFromJSON));
+    }
+
+    /**
+     * Get a list of all objects that use this object
+     */
+    async cryptoCertificatekeypairsUsedByList(requestParameters: CryptoCertificatekeypairsUsedByListRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<Array<UsedBy>> {
+        const response = await this.cryptoCertificatekeypairsUsedByListRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for cryptoCertificatekeypairsViewCertificateRetrieve without sending the request
+     */
+    async cryptoCertificatekeypairsViewCertificateRetrieveRequestOpts(requestParameters: CryptoCertificatekeypairsViewCertificateRetrieveRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['kpUuid'] == null) {
+            throw new runtime.RequiredError(
+                'kpUuid',
+                'Required parameter "kpUuid" was null or undefined when calling cryptoCertificatekeypairsViewCertificateRetrieve().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        if (requestParameters['download'] != null) {
+            queryParameters['download'] = requestParameters['download'];
+        }
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/crypto/certificatekeypairs/{kp_uuid}/view_certificate/`;
+        urlPath = urlPath.replace(`{${"kp_uuid"}}`, encodeURIComponent(String(requestParameters['kpUuid'])));
+
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Return certificate-key pairs certificate and log access
+     */
+    async cryptoCertificatekeypairsViewCertificateRetrieveRaw(requestParameters: CryptoCertificatekeypairsViewCertificateRetrieveRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<CertificateData>> {
+        const requestOptions = await this.cryptoCertificatekeypairsViewCertificateRetrieveRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => CertificateDataFromJSON(jsonValue));
+    }
+
+    /**
+     * Return certificate-key pairs certificate and log access
+     */
+    async cryptoCertificatekeypairsViewCertificateRetrieve(requestParameters: CryptoCertificatekeypairsViewCertificateRetrieveRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<CertificateData> {
+        const response = await this.cryptoCertificatekeypairsViewCertificateRetrieveRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for cryptoCertificatekeypairsViewPrivateKeyRetrieve without sending the request
+     */
+    async cryptoCertificatekeypairsViewPrivateKeyRetrieveRequestOpts(requestParameters: CryptoCertificatekeypairsViewPrivateKeyRetrieveRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['kpUuid'] == null) {
+            throw new runtime.RequiredError(
+                'kpUuid',
+                'Required parameter "kpUuid" was null or undefined when calling cryptoCertificatekeypairsViewPrivateKeyRetrieve().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        if (requestParameters['download'] != null) {
+            queryParameters['download'] = requestParameters['download'];
+        }
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/crypto/certificatekeypairs/{kp_uuid}/view_private_key/`;
+        urlPath = urlPath.replace(`{${"kp_uuid"}}`, encodeURIComponent(String(requestParameters['kpUuid'])));
+
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Return certificate-key pairs private key and log access
+     */
+    async cryptoCertificatekeypairsViewPrivateKeyRetrieveRaw(requestParameters: CryptoCertificatekeypairsViewPrivateKeyRetrieveRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<CertificateData>> {
+        const requestOptions = await this.cryptoCertificatekeypairsViewPrivateKeyRetrieveRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => CertificateDataFromJSON(jsonValue));
+    }
+
+    /**
+     * Return certificate-key pairs private key and log access
+     */
+    async cryptoCertificatekeypairsViewPrivateKeyRetrieve(requestParameters: CryptoCertificatekeypairsViewPrivateKeyRetrieveRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<CertificateData> {
+        const response = await this.cryptoCertificatekeypairsViewPrivateKeyRetrieveRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+}
+
+/**
+ * @export
+ */
+export const CryptoCertificatekeypairsListKeyTypeEnum = {
+    Dsa: 'dsa',
+    Ec: 'ec',
+    Ed25519: 'ed25519',
+    Ed448: 'ed448',
+    Rsa: 'rsa',
+    UnknownDefaultOpenApi: '11184809'
+} as const;
+export type CryptoCertificatekeypairsListKeyTypeEnum = typeof CryptoCertificatekeypairsListKeyTypeEnum[keyof typeof CryptoCertificatekeypairsListKeyTypeEnum];

packages/client-ts/src/apis/EnterpriseApi.ts

@@ -0,0 +1,631 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+
+import * as runtime from '../runtime';
+import type {
+  GenericError,
+  InstallID,
+  License,
+  LicenseForecast,
+  LicenseRequest,
+  LicenseSummary,
+  PaginatedLicenseList,
+  PatchedLicenseRequest,
+  UsedBy,
+  ValidationError,
+} from '../models/index';
+import {
+    GenericErrorFromJSON,
+    GenericErrorToJSON,
+    InstallIDFromJSON,
+    InstallIDToJSON,
+    LicenseFromJSON,
+    LicenseToJSON,
+    LicenseForecastFromJSON,
+    LicenseForecastToJSON,
+    LicenseRequestFromJSON,
+    LicenseRequestToJSON,
+    LicenseSummaryFromJSON,
+    LicenseSummaryToJSON,
+    PaginatedLicenseListFromJSON,
+    PaginatedLicenseListToJSON,
+    PatchedLicenseRequestFromJSON,
+    PatchedLicenseRequestToJSON,
+    UsedByFromJSON,
+    UsedByToJSON,
+    ValidationErrorFromJSON,
+    ValidationErrorToJSON,
+} from '../models/index';
+
+export interface EnterpriseLicenseCreateRequest {
+    licenseRequest: LicenseRequest;
+}
+
+export interface EnterpriseLicenseDestroyRequest {
+    licenseUuid: string;
+}
+
+export interface EnterpriseLicenseListRequest {
+    name?: string;
+    ordering?: string;
+    page?: number;
+    pageSize?: number;
+    search?: string;
+}
+
+export interface EnterpriseLicensePartialUpdateRequest {
+    licenseUuid: string;
+    patchedLicenseRequest?: PatchedLicenseRequest;
+}
+
+export interface EnterpriseLicenseRetrieveRequest {
+    licenseUuid: string;
+}
+
+export interface EnterpriseLicenseSummaryRetrieveRequest {
+    cached?: boolean;
+}
+
+export interface EnterpriseLicenseUpdateRequest {
+    licenseUuid: string;
+    licenseRequest: LicenseRequest;
+}
+
+export interface EnterpriseLicenseUsedByListRequest {
+    licenseUuid: string;
+}
+
+/**
+ * 
+ */
+export class EnterpriseApi extends runtime.BaseAPI {
+
+    /**
+     * Creates request options for enterpriseLicenseCreate without sending the request
+     */
+    async enterpriseLicenseCreateRequestOpts(requestParameters: EnterpriseLicenseCreateRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['licenseRequest'] == null) {
+            throw new runtime.RequiredError(
+                'licenseRequest',
+                'Required parameter "licenseRequest" was null or undefined when calling enterpriseLicenseCreate().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters['Content-Type'] = 'application/json';
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/enterprise/license/`;
+
+        return {
+            path: urlPath,
+            method: 'POST',
+            headers: headerParameters,
+            query: queryParameters,
+            body: LicenseRequestToJSON(requestParameters['licenseRequest']),
+        };
+    }
+
+    /**
+     * License Viewset
+     */
+    async enterpriseLicenseCreateRaw(requestParameters: EnterpriseLicenseCreateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<License>> {
+        const requestOptions = await this.enterpriseLicenseCreateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => LicenseFromJSON(jsonValue));
+    }
+
+    /**
+     * License Viewset
+     */
+    async enterpriseLicenseCreate(requestParameters: EnterpriseLicenseCreateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<License> {
+        const response = await this.enterpriseLicenseCreateRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for enterpriseLicenseDestroy without sending the request
+     */
+    async enterpriseLicenseDestroyRequestOpts(requestParameters: EnterpriseLicenseDestroyRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['licenseUuid'] == null) {
+            throw new runtime.RequiredError(
+                'licenseUuid',
+                'Required parameter "licenseUuid" was null or undefined when calling enterpriseLicenseDestroy().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/enterprise/license/{license_uuid}/`;
+        urlPath = urlPath.replace(`{${"license_uuid"}}`, encodeURIComponent(String(requestParameters['licenseUuid'])));
+
+        return {
+            path: urlPath,
+            method: 'DELETE',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * License Viewset
+     */
+    async enterpriseLicenseDestroyRaw(requestParameters: EnterpriseLicenseDestroyRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>> {
+        const requestOptions = await this.enterpriseLicenseDestroyRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.VoidApiResponse(response);
+    }
+
+    /**
+     * License Viewset
+     */
+    async enterpriseLicenseDestroy(requestParameters: EnterpriseLicenseDestroyRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void> {
+        await this.enterpriseLicenseDestroyRaw(requestParameters, initOverrides);
+    }
+
+    /**
+     * Creates request options for enterpriseLicenseForecastRetrieve without sending the request
+     */
+    async enterpriseLicenseForecastRetrieveRequestOpts(): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/enterprise/license/forecast/`;
+
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Forecast how many users will be required in a year
+     */
+    async enterpriseLicenseForecastRetrieveRaw(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<LicenseForecast>> {
+        const requestOptions = await this.enterpriseLicenseForecastRetrieveRequestOpts();
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => LicenseForecastFromJSON(jsonValue));
+    }
+
+    /**
+     * Forecast how many users will be required in a year
+     */
+    async enterpriseLicenseForecastRetrieve(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<LicenseForecast> {
+        const response = await this.enterpriseLicenseForecastRetrieveRaw(initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for enterpriseLicenseInstallIdRetrieve without sending the request
+     */
+    async enterpriseLicenseInstallIdRetrieveRequestOpts(): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/enterprise/license/install_id/`;
+
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Get install_id
+     */
+    async enterpriseLicenseInstallIdRetrieveRaw(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<InstallID>> {
+        const requestOptions = await this.enterpriseLicenseInstallIdRetrieveRequestOpts();
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => InstallIDFromJSON(jsonValue));
+    }
+
+    /**
+     * Get install_id
+     */
+    async enterpriseLicenseInstallIdRetrieve(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<InstallID> {
+        const response = await this.enterpriseLicenseInstallIdRetrieveRaw(initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for enterpriseLicenseList without sending the request
+     */
+    async enterpriseLicenseListRequestOpts(requestParameters: EnterpriseLicenseListRequest): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        if (requestParameters['name'] != null) {
+            queryParameters['name'] = requestParameters['name'];
+        }
+
+        if (requestParameters['ordering'] != null) {
+            queryParameters['ordering'] = requestParameters['ordering'];
+        }
+
+        if (requestParameters['page'] != null) {
+            queryParameters['page'] = requestParameters['page'];
+        }
+
+        if (requestParameters['pageSize'] != null) {
+            queryParameters['page_size'] = requestParameters['pageSize'];
+        }
+
+        if (requestParameters['search'] != null) {
+            queryParameters['search'] = requestParameters['search'];
+        }
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/enterprise/license/`;
+
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * License Viewset
+     */
+    async enterpriseLicenseListRaw(requestParameters: EnterpriseLicenseListRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<PaginatedLicenseList>> {
+        const requestOptions = await this.enterpriseLicenseListRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => PaginatedLicenseListFromJSON(jsonValue));
+    }
+
+    /**
+     * License Viewset
+     */
+    async enterpriseLicenseList(requestParameters: EnterpriseLicenseListRequest = {}, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<PaginatedLicenseList> {
+        const response = await this.enterpriseLicenseListRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for enterpriseLicensePartialUpdate without sending the request
+     */
+    async enterpriseLicensePartialUpdateRequestOpts(requestParameters: EnterpriseLicensePartialUpdateRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['licenseUuid'] == null) {
+            throw new runtime.RequiredError(
+                'licenseUuid',
+                'Required parameter "licenseUuid" was null or undefined when calling enterpriseLicensePartialUpdate().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters['Content-Type'] = 'application/json';
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/enterprise/license/{license_uuid}/`;
+        urlPath = urlPath.replace(`{${"license_uuid"}}`, encodeURIComponent(String(requestParameters['licenseUuid'])));
+
+        return {
+            path: urlPath,
+            method: 'PATCH',
+            headers: headerParameters,
+            query: queryParameters,
+            body: PatchedLicenseRequestToJSON(requestParameters['patchedLicenseRequest']),
+        };
+    }
+
+    /**
+     * License Viewset
+     */
+    async enterpriseLicensePartialUpdateRaw(requestParameters: EnterpriseLicensePartialUpdateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<License>> {
+        const requestOptions = await this.enterpriseLicensePartialUpdateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => LicenseFromJSON(jsonValue));
+    }
+
+    /**
+     * License Viewset
+     */
+    async enterpriseLicensePartialUpdate(requestParameters: EnterpriseLicensePartialUpdateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<License> {
+        const response = await this.enterpriseLicensePartialUpdateRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for enterpriseLicenseRetrieve without sending the request
+     */
+    async enterpriseLicenseRetrieveRequestOpts(requestParameters: EnterpriseLicenseRetrieveRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['licenseUuid'] == null) {
+            throw new runtime.RequiredError(
+                'licenseUuid',
+                'Required parameter "licenseUuid" was null or undefined when calling enterpriseLicenseRetrieve().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/enterprise/license/{license_uuid}/`;
+        urlPath = urlPath.replace(`{${"license_uuid"}}`, encodeURIComponent(String(requestParameters['licenseUuid'])));
+
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * License Viewset
+     */
+    async enterpriseLicenseRetrieveRaw(requestParameters: EnterpriseLicenseRetrieveRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<License>> {
+        const requestOptions = await this.enterpriseLicenseRetrieveRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => LicenseFromJSON(jsonValue));
+    }
+
+    /**
+     * License Viewset
+     */
+    async enterpriseLicenseRetrieve(requestParameters: EnterpriseLicenseRetrieveRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<License> {
+        const response = await this.enterpriseLicenseRetrieveRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for enterpriseLicenseSummaryRetrieve without sending the request
+     */
+    async enterpriseLicenseSummaryRetrieveRequestOpts(requestParameters: EnterpriseLicenseSummaryRetrieveRequest): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        if (requestParameters['cached'] != null) {
+            queryParameters['cached'] = requestParameters['cached'];
+        }
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/enterprise/license/summary/`;
+
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Get the total license status
+     */
+    async enterpriseLicenseSummaryRetrieveRaw(requestParameters: EnterpriseLicenseSummaryRetrieveRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<LicenseSummary>> {
+        const requestOptions = await this.enterpriseLicenseSummaryRetrieveRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => LicenseSummaryFromJSON(jsonValue));
+    }
+
+    /**
+     * Get the total license status
+     */
+    async enterpriseLicenseSummaryRetrieve(requestParameters: EnterpriseLicenseSummaryRetrieveRequest = {}, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<LicenseSummary> {
+        const response = await this.enterpriseLicenseSummaryRetrieveRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for enterpriseLicenseUpdate without sending the request
+     */
+    async enterpriseLicenseUpdateRequestOpts(requestParameters: EnterpriseLicenseUpdateRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['licenseUuid'] == null) {
+            throw new runtime.RequiredError(
+                'licenseUuid',
+                'Required parameter "licenseUuid" was null or undefined when calling enterpriseLicenseUpdate().'
+            );
+        }
+
+        if (requestParameters['licenseRequest'] == null) {
+            throw new runtime.RequiredError(
+                'licenseRequest',
+                'Required parameter "licenseRequest" was null or undefined when calling enterpriseLicenseUpdate().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters['Content-Type'] = 'application/json';
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/enterprise/license/{license_uuid}/`;
+        urlPath = urlPath.replace(`{${"license_uuid"}}`, encodeURIComponent(String(requestParameters['licenseUuid'])));
+
+        return {
+            path: urlPath,
+            method: 'PUT',
+            headers: headerParameters,
+            query: queryParameters,
+            body: LicenseRequestToJSON(requestParameters['licenseRequest']),
+        };
+    }
+
+    /**
+     * License Viewset
+     */
+    async enterpriseLicenseUpdateRaw(requestParameters: EnterpriseLicenseUpdateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<License>> {
+        const requestOptions = await this.enterpriseLicenseUpdateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => LicenseFromJSON(jsonValue));
+    }
+
+    /**
+     * License Viewset
+     */
+    async enterpriseLicenseUpdate(requestParameters: EnterpriseLicenseUpdateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<License> {
+        const response = await this.enterpriseLicenseUpdateRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for enterpriseLicenseUsedByList without sending the request
+     */
+    async enterpriseLicenseUsedByListRequestOpts(requestParameters: EnterpriseLicenseUsedByListRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['licenseUuid'] == null) {
+            throw new runtime.RequiredError(
+                'licenseUuid',
+                'Required parameter "licenseUuid" was null or undefined when calling enterpriseLicenseUsedByList().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/enterprise/license/{license_uuid}/used_by/`;
+        urlPath = urlPath.replace(`{${"license_uuid"}}`, encodeURIComponent(String(requestParameters['licenseUuid'])));
+
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Get a list of all objects that use this object
+     */
+    async enterpriseLicenseUsedByListRaw(requestParameters: EnterpriseLicenseUsedByListRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<Array<UsedBy>>> {
+        const requestOptions = await this.enterpriseLicenseUsedByListRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => jsonValue.map(UsedByFromJSON));
+    }
+
+    /**
+     * Get a list of all objects that use this object
+     */
+    async enterpriseLicenseUsedByList(requestParameters: EnterpriseLicenseUsedByListRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<Array<UsedBy>> {
+        const response = await this.enterpriseLicenseUsedByListRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+}

packages/client-ts/src/apis/LifecycleApi.ts

@@ -0,0 +1,679 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+
+import * as runtime from '../runtime';
+import type {
+  GenericError,
+  LifecycleIteration,
+  LifecycleIterationRequest,
+  LifecycleRule,
+  LifecycleRuleRequest,
+  PaginatedLifecycleIterationList,
+  PaginatedLifecycleRuleList,
+  PatchedLifecycleRuleRequest,
+  Review,
+  ReviewRequest,
+  ValidationError,
+} from '../models/index';
+import {
+    GenericErrorFromJSON,
+    GenericErrorToJSON,
+    LifecycleIterationFromJSON,
+    LifecycleIterationToJSON,
+    LifecycleIterationRequestFromJSON,
+    LifecycleIterationRequestToJSON,
+    LifecycleRuleFromJSON,
+    LifecycleRuleToJSON,
+    LifecycleRuleRequestFromJSON,
+    LifecycleRuleRequestToJSON,
+    PaginatedLifecycleIterationListFromJSON,
+    PaginatedLifecycleIterationListToJSON,
+    PaginatedLifecycleRuleListFromJSON,
+    PaginatedLifecycleRuleListToJSON,
+    PatchedLifecycleRuleRequestFromJSON,
+    PatchedLifecycleRuleRequestToJSON,
+    ReviewFromJSON,
+    ReviewToJSON,
+    ReviewRequestFromJSON,
+    ReviewRequestToJSON,
+    ValidationErrorFromJSON,
+    ValidationErrorToJSON,
+} from '../models/index';
+
+export interface LifecycleIterationsCreateRequest {
+    lifecycleIterationRequest: LifecycleIterationRequest;
+}
+
+export interface LifecycleIterationsLatestRetrieveRequest {
+    contentType: string;
+    objectId: string;
+}
+
+export interface LifecycleIterationsListOpenRequest {
+    ordering?: string;
+    page?: number;
+    pageSize?: number;
+    search?: string;
+    userIsReviewer?: boolean;
+}
+
+export interface LifecycleReviewsCreateRequest {
+    reviewRequest: ReviewRequest;
+}
+
+export interface LifecycleRulesCreateRequest {
+    lifecycleRuleRequest: LifecycleRuleRequest;
+}
+
+export interface LifecycleRulesDestroyRequest {
+    id: string;
+}
+
+export interface LifecycleRulesListRequest {
+    contentTypeModel?: string;
+    ordering?: string;
+    page?: number;
+    pageSize?: number;
+    search?: string;
+}
+
+export interface LifecycleRulesPartialUpdateRequest {
+    id: string;
+    patchedLifecycleRuleRequest?: PatchedLifecycleRuleRequest;
+}
+
+export interface LifecycleRulesRetrieveRequest {
+    id: string;
+}
+
+export interface LifecycleRulesUpdateRequest {
+    id: string;
+    lifecycleRuleRequest: LifecycleRuleRequest;
+}
+
+/**
+ * 
+ */
+export class LifecycleApi extends runtime.BaseAPI {
+
+    /**
+     * Creates request options for lifecycleIterationsCreate without sending the request
+     */
+    async lifecycleIterationsCreateRequestOpts(requestParameters: LifecycleIterationsCreateRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['lifecycleIterationRequest'] == null) {
+            throw new runtime.RequiredError(
+                'lifecycleIterationRequest',
+                'Required parameter "lifecycleIterationRequest" was null or undefined when calling lifecycleIterationsCreate().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters['Content-Type'] = 'application/json';
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/lifecycle/iterations/`;
+
+        return {
+            path: urlPath,
+            method: 'POST',
+            headers: headerParameters,
+            query: queryParameters,
+            body: LifecycleIterationRequestToJSON(requestParameters['lifecycleIterationRequest']),
+        };
+    }
+
+    /**
+     * Mixin to validate that a valid enterprise license exists before allowing to save the object
+     */
+    async lifecycleIterationsCreateRaw(requestParameters: LifecycleIterationsCreateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<LifecycleIteration>> {
+        const requestOptions = await this.lifecycleIterationsCreateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => LifecycleIterationFromJSON(jsonValue));
+    }
+
+    /**
+     * Mixin to validate that a valid enterprise license exists before allowing to save the object
+     */
+    async lifecycleIterationsCreate(requestParameters: LifecycleIterationsCreateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<LifecycleIteration> {
+        const response = await this.lifecycleIterationsCreateRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for lifecycleIterationsLatestRetrieve without sending the request
+     */
+    async lifecycleIterationsLatestRetrieveRequestOpts(requestParameters: LifecycleIterationsLatestRetrieveRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['contentType'] == null) {
+            throw new runtime.RequiredError(
+                'contentType',
+                'Required parameter "contentType" was null or undefined when calling lifecycleIterationsLatestRetrieve().'
+            );
+        }
+
+        if (requestParameters['objectId'] == null) {
+            throw new runtime.RequiredError(
+                'objectId',
+                'Required parameter "objectId" was null or undefined when calling lifecycleIterationsLatestRetrieve().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/lifecycle/iterations/latest/{content_type}/{object_id}/`;
+        urlPath = urlPath.replace(`{${"content_type"}}`, encodeURIComponent(String(requestParameters['contentType'])));
+        urlPath = urlPath.replace(`{${"object_id"}}`, encodeURIComponent(String(requestParameters['objectId'])));
+
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Mixin to validate that a valid enterprise license exists before allowing to save the object
+     */
+    async lifecycleIterationsLatestRetrieveRaw(requestParameters: LifecycleIterationsLatestRetrieveRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<LifecycleIteration>> {
+        const requestOptions = await this.lifecycleIterationsLatestRetrieveRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => LifecycleIterationFromJSON(jsonValue));
+    }
+
+    /**
+     * Mixin to validate that a valid enterprise license exists before allowing to save the object
+     */
+    async lifecycleIterationsLatestRetrieve(requestParameters: LifecycleIterationsLatestRetrieveRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<LifecycleIteration> {
+        const response = await this.lifecycleIterationsLatestRetrieveRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for lifecycleIterationsListOpen without sending the request
+     */
+    async lifecycleIterationsListOpenRequestOpts(requestParameters: LifecycleIterationsListOpenRequest): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        if (requestParameters['ordering'] != null) {
+            queryParameters['ordering'] = requestParameters['ordering'];
+        }
+
+        if (requestParameters['page'] != null) {
+            queryParameters['page'] = requestParameters['page'];
+        }
+
+        if (requestParameters['pageSize'] != null) {
+            queryParameters['page_size'] = requestParameters['pageSize'];
+        }
+
+        if (requestParameters['search'] != null) {
+            queryParameters['search'] = requestParameters['search'];
+        }
+
+        if (requestParameters['userIsReviewer'] != null) {
+            queryParameters['user_is_reviewer'] = requestParameters['userIsReviewer'];
+        }
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/lifecycle/iterations/open/`;
+
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Mixin to validate that a valid enterprise license exists before allowing to save the object
+     */
+    async lifecycleIterationsListOpenRaw(requestParameters: LifecycleIterationsListOpenRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<PaginatedLifecycleIterationList>> {
+        const requestOptions = await this.lifecycleIterationsListOpenRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => PaginatedLifecycleIterationListFromJSON(jsonValue));
+    }
+
+    /**
+     * Mixin to validate that a valid enterprise license exists before allowing to save the object
+     */
+    async lifecycleIterationsListOpen(requestParameters: LifecycleIterationsListOpenRequest = {}, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<PaginatedLifecycleIterationList> {
+        const response = await this.lifecycleIterationsListOpenRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for lifecycleReviewsCreate without sending the request
+     */
+    async lifecycleReviewsCreateRequestOpts(requestParameters: LifecycleReviewsCreateRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['reviewRequest'] == null) {
+            throw new runtime.RequiredError(
+                'reviewRequest',
+                'Required parameter "reviewRequest" was null or undefined when calling lifecycleReviewsCreate().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters['Content-Type'] = 'application/json';
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/lifecycle/reviews/`;
+
+        return {
+            path: urlPath,
+            method: 'POST',
+            headers: headerParameters,
+            query: queryParameters,
+            body: ReviewRequestToJSON(requestParameters['reviewRequest']),
+        };
+    }
+
+    /**
+     * Mixin to validate that a valid enterprise license exists before allowing to save the object
+     */
+    async lifecycleReviewsCreateRaw(requestParameters: LifecycleReviewsCreateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<Review>> {
+        const requestOptions = await this.lifecycleReviewsCreateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => ReviewFromJSON(jsonValue));
+    }
+
+    /**
+     * Mixin to validate that a valid enterprise license exists before allowing to save the object
+     */
+    async lifecycleReviewsCreate(requestParameters: LifecycleReviewsCreateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<Review> {
+        const response = await this.lifecycleReviewsCreateRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for lifecycleRulesCreate without sending the request
+     */
+    async lifecycleRulesCreateRequestOpts(requestParameters: LifecycleRulesCreateRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['lifecycleRuleRequest'] == null) {
+            throw new runtime.RequiredError(
+                'lifecycleRuleRequest',
+                'Required parameter "lifecycleRuleRequest" was null or undefined when calling lifecycleRulesCreate().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters['Content-Type'] = 'application/json';
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/lifecycle/rules/`;
+
+        return {
+            path: urlPath,
+            method: 'POST',
+            headers: headerParameters,
+            query: queryParameters,
+            body: LifecycleRuleRequestToJSON(requestParameters['lifecycleRuleRequest']),
+        };
+    }
+
+    /**
+     */
+    async lifecycleRulesCreateRaw(requestParameters: LifecycleRulesCreateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<LifecycleRule>> {
+        const requestOptions = await this.lifecycleRulesCreateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => LifecycleRuleFromJSON(jsonValue));
+    }
+
+    /**
+     */
+    async lifecycleRulesCreate(requestParameters: LifecycleRulesCreateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<LifecycleRule> {
+        const response = await this.lifecycleRulesCreateRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for lifecycleRulesDestroy without sending the request
+     */
+    async lifecycleRulesDestroyRequestOpts(requestParameters: LifecycleRulesDestroyRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['id'] == null) {
+            throw new runtime.RequiredError(
+                'id',
+                'Required parameter "id" was null or undefined when calling lifecycleRulesDestroy().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/lifecycle/rules/{id}/`;
+        urlPath = urlPath.replace(`{${"id"}}`, encodeURIComponent(String(requestParameters['id'])));
+
+        return {
+            path: urlPath,
+            method: 'DELETE',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     */
+    async lifecycleRulesDestroyRaw(requestParameters: LifecycleRulesDestroyRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>> {
+        const requestOptions = await this.lifecycleRulesDestroyRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.VoidApiResponse(response);
+    }
+
+    /**
+     */
+    async lifecycleRulesDestroy(requestParameters: LifecycleRulesDestroyRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void> {
+        await this.lifecycleRulesDestroyRaw(requestParameters, initOverrides);
+    }
+
+    /**
+     * Creates request options for lifecycleRulesList without sending the request
+     */
+    async lifecycleRulesListRequestOpts(requestParameters: LifecycleRulesListRequest): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        if (requestParameters['contentTypeModel'] != null) {
+            queryParameters['content_type__model'] = requestParameters['contentTypeModel'];
+        }
+
+        if (requestParameters['ordering'] != null) {
+            queryParameters['ordering'] = requestParameters['ordering'];
+        }
+
+        if (requestParameters['page'] != null) {
+            queryParameters['page'] = requestParameters['page'];
+        }
+
+        if (requestParameters['pageSize'] != null) {
+            queryParameters['page_size'] = requestParameters['pageSize'];
+        }
+
+        if (requestParameters['search'] != null) {
+            queryParameters['search'] = requestParameters['search'];
+        }
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/lifecycle/rules/`;
+
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     */
+    async lifecycleRulesListRaw(requestParameters: LifecycleRulesListRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<PaginatedLifecycleRuleList>> {
+        const requestOptions = await this.lifecycleRulesListRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => PaginatedLifecycleRuleListFromJSON(jsonValue));
+    }
+
+    /**
+     */
+    async lifecycleRulesList(requestParameters: LifecycleRulesListRequest = {}, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<PaginatedLifecycleRuleList> {
+        const response = await this.lifecycleRulesListRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for lifecycleRulesPartialUpdate without sending the request
+     */
+    async lifecycleRulesPartialUpdateRequestOpts(requestParameters: LifecycleRulesPartialUpdateRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['id'] == null) {
+            throw new runtime.RequiredError(
+                'id',
+                'Required parameter "id" was null or undefined when calling lifecycleRulesPartialUpdate().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters['Content-Type'] = 'application/json';
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/lifecycle/rules/{id}/`;
+        urlPath = urlPath.replace(`{${"id"}}`, encodeURIComponent(String(requestParameters['id'])));
+
+        return {
+            path: urlPath,
+            method: 'PATCH',
+            headers: headerParameters,
+            query: queryParameters,
+            body: PatchedLifecycleRuleRequestToJSON(requestParameters['patchedLifecycleRuleRequest']),
+        };
+    }
+
+    /**
+     */
+    async lifecycleRulesPartialUpdateRaw(requestParameters: LifecycleRulesPartialUpdateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<LifecycleRule>> {
+        const requestOptions = await this.lifecycleRulesPartialUpdateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => LifecycleRuleFromJSON(jsonValue));
+    }
+
+    /**
+     */
+    async lifecycleRulesPartialUpdate(requestParameters: LifecycleRulesPartialUpdateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<LifecycleRule> {
+        const response = await this.lifecycleRulesPartialUpdateRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for lifecycleRulesRetrieve without sending the request
+     */
+    async lifecycleRulesRetrieveRequestOpts(requestParameters: LifecycleRulesRetrieveRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['id'] == null) {
+            throw new runtime.RequiredError(
+                'id',
+                'Required parameter "id" was null or undefined when calling lifecycleRulesRetrieve().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/lifecycle/rules/{id}/`;
+        urlPath = urlPath.replace(`{${"id"}}`, encodeURIComponent(String(requestParameters['id'])));
+
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     */
+    async lifecycleRulesRetrieveRaw(requestParameters: LifecycleRulesRetrieveRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<LifecycleRule>> {
+        const requestOptions = await this.lifecycleRulesRetrieveRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => LifecycleRuleFromJSON(jsonValue));
+    }
+
+    /**
+     */
+    async lifecycleRulesRetrieve(requestParameters: LifecycleRulesRetrieveRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<LifecycleRule> {
+        const response = await this.lifecycleRulesRetrieveRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for lifecycleRulesUpdate without sending the request
+     */
+    async lifecycleRulesUpdateRequestOpts(requestParameters: LifecycleRulesUpdateRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['id'] == null) {
+            throw new runtime.RequiredError(
+                'id',
+                'Required parameter "id" was null or undefined when calling lifecycleRulesUpdate().'
+            );
+        }
+
+        if (requestParameters['lifecycleRuleRequest'] == null) {
+            throw new runtime.RequiredError(
+                'lifecycleRuleRequest',
+                'Required parameter "lifecycleRuleRequest" was null or undefined when calling lifecycleRulesUpdate().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters['Content-Type'] = 'application/json';
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/lifecycle/rules/{id}/`;
+        urlPath = urlPath.replace(`{${"id"}}`, encodeURIComponent(String(requestParameters['id'])));
+
+        return {
+            path: urlPath,
+            method: 'PUT',
+            headers: headerParameters,
+            query: queryParameters,
+            body: LifecycleRuleRequestToJSON(requestParameters['lifecycleRuleRequest']),
+        };
+    }
+
+    /**
+     */
+    async lifecycleRulesUpdateRaw(requestParameters: LifecycleRulesUpdateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<LifecycleRule>> {
+        const requestOptions = await this.lifecycleRulesUpdateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => LifecycleRuleFromJSON(jsonValue));
+    }
+
+    /**
+     */
+    async lifecycleRulesUpdate(requestParameters: LifecycleRulesUpdateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<LifecycleRule> {
+        const response = await this.lifecycleRulesUpdateRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+}

packages/client-ts/src/apis/ManagedApi.ts

@@ -0,0 +1,589 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+
+import * as runtime from '../runtime';
+import type {
+  BlueprintFile,
+  BlueprintInstance,
+  BlueprintInstanceRequest,
+  GenericError,
+  PaginatedBlueprintInstanceList,
+  PatchedBlueprintInstanceRequest,
+  UsedBy,
+  ValidationError,
+} from '../models/index';
+import {
+    BlueprintFileFromJSON,
+    BlueprintFileToJSON,
+    BlueprintInstanceFromJSON,
+    BlueprintInstanceToJSON,
+    BlueprintInstanceRequestFromJSON,
+    BlueprintInstanceRequestToJSON,
+    GenericErrorFromJSON,
+    GenericErrorToJSON,
+    PaginatedBlueprintInstanceListFromJSON,
+    PaginatedBlueprintInstanceListToJSON,
+    PatchedBlueprintInstanceRequestFromJSON,
+    PatchedBlueprintInstanceRequestToJSON,
+    UsedByFromJSON,
+    UsedByToJSON,
+    ValidationErrorFromJSON,
+    ValidationErrorToJSON,
+} from '../models/index';
+
+export interface ManagedBlueprintsApplyCreateRequest {
+    instanceUuid: string;
+}
+
+export interface ManagedBlueprintsCreateRequest {
+    blueprintInstanceRequest: BlueprintInstanceRequest;
+}
+
+export interface ManagedBlueprintsDestroyRequest {
+    instanceUuid: string;
+}
+
+export interface ManagedBlueprintsListRequest {
+    name?: string;
+    ordering?: string;
+    page?: number;
+    pageSize?: number;
+    path?: string;
+    search?: string;
+}
+
+export interface ManagedBlueprintsPartialUpdateRequest {
+    instanceUuid: string;
+    patchedBlueprintInstanceRequest?: PatchedBlueprintInstanceRequest;
+}
+
+export interface ManagedBlueprintsRetrieveRequest {
+    instanceUuid: string;
+}
+
+export interface ManagedBlueprintsUpdateRequest {
+    instanceUuid: string;
+    blueprintInstanceRequest: BlueprintInstanceRequest;
+}
+
+export interface ManagedBlueprintsUsedByListRequest {
+    instanceUuid: string;
+}
+
+/**
+ * 
+ */
+export class ManagedApi extends runtime.BaseAPI {
+
+    /**
+     * Creates request options for managedBlueprintsApplyCreate without sending the request
+     */
+    async managedBlueprintsApplyCreateRequestOpts(requestParameters: ManagedBlueprintsApplyCreateRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['instanceUuid'] == null) {
+            throw new runtime.RequiredError(
+                'instanceUuid',
+                'Required parameter "instanceUuid" was null or undefined when calling managedBlueprintsApplyCreate().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/managed/blueprints/{instance_uuid}/apply/`;
+        urlPath = urlPath.replace(`{${"instance_uuid"}}`, encodeURIComponent(String(requestParameters['instanceUuid'])));
+
+        return {
+            path: urlPath,
+            method: 'POST',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Apply a blueprint
+     */
+    async managedBlueprintsApplyCreateRaw(requestParameters: ManagedBlueprintsApplyCreateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<BlueprintInstance>> {
+        const requestOptions = await this.managedBlueprintsApplyCreateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => BlueprintInstanceFromJSON(jsonValue));
+    }
+
+    /**
+     * Apply a blueprint
+     */
+    async managedBlueprintsApplyCreate(requestParameters: ManagedBlueprintsApplyCreateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<BlueprintInstance> {
+        const response = await this.managedBlueprintsApplyCreateRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for managedBlueprintsAvailableList without sending the request
+     */
+    async managedBlueprintsAvailableListRequestOpts(): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/managed/blueprints/available/`;
+
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Get blueprints
+     */
+    async managedBlueprintsAvailableListRaw(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<Array<BlueprintFile>>> {
+        const requestOptions = await this.managedBlueprintsAvailableListRequestOpts();
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => jsonValue.map(BlueprintFileFromJSON));
+    }
+
+    /**
+     * Get blueprints
+     */
+    async managedBlueprintsAvailableList(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<Array<BlueprintFile>> {
+        const response = await this.managedBlueprintsAvailableListRaw(initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for managedBlueprintsCreate without sending the request
+     */
+    async managedBlueprintsCreateRequestOpts(requestParameters: ManagedBlueprintsCreateRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['blueprintInstanceRequest'] == null) {
+            throw new runtime.RequiredError(
+                'blueprintInstanceRequest',
+                'Required parameter "blueprintInstanceRequest" was null or undefined when calling managedBlueprintsCreate().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters['Content-Type'] = 'application/json';
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/managed/blueprints/`;
+
+        return {
+            path: urlPath,
+            method: 'POST',
+            headers: headerParameters,
+            query: queryParameters,
+            body: BlueprintInstanceRequestToJSON(requestParameters['blueprintInstanceRequest']),
+        };
+    }
+
+    /**
+     * Blueprint instances
+     */
+    async managedBlueprintsCreateRaw(requestParameters: ManagedBlueprintsCreateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<BlueprintInstance>> {
+        const requestOptions = await this.managedBlueprintsCreateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => BlueprintInstanceFromJSON(jsonValue));
+    }
+
+    /**
+     * Blueprint instances
+     */
+    async managedBlueprintsCreate(requestParameters: ManagedBlueprintsCreateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<BlueprintInstance> {
+        const response = await this.managedBlueprintsCreateRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for managedBlueprintsDestroy without sending the request
+     */
+    async managedBlueprintsDestroyRequestOpts(requestParameters: ManagedBlueprintsDestroyRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['instanceUuid'] == null) {
+            throw new runtime.RequiredError(
+                'instanceUuid',
+                'Required parameter "instanceUuid" was null or undefined when calling managedBlueprintsDestroy().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/managed/blueprints/{instance_uuid}/`;
+        urlPath = urlPath.replace(`{${"instance_uuid"}}`, encodeURIComponent(String(requestParameters['instanceUuid'])));
+
+        return {
+            path: urlPath,
+            method: 'DELETE',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Blueprint instances
+     */
+    async managedBlueprintsDestroyRaw(requestParameters: ManagedBlueprintsDestroyRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>> {
+        const requestOptions = await this.managedBlueprintsDestroyRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.VoidApiResponse(response);
+    }
+
+    /**
+     * Blueprint instances
+     */
+    async managedBlueprintsDestroy(requestParameters: ManagedBlueprintsDestroyRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void> {
+        await this.managedBlueprintsDestroyRaw(requestParameters, initOverrides);
+    }
+
+    /**
+     * Creates request options for managedBlueprintsList without sending the request
+     */
+    async managedBlueprintsListRequestOpts(requestParameters: ManagedBlueprintsListRequest): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        if (requestParameters['name'] != null) {
+            queryParameters['name'] = requestParameters['name'];
+        }
+
+        if (requestParameters['ordering'] != null) {
+            queryParameters['ordering'] = requestParameters['ordering'];
+        }
+
+        if (requestParameters['page'] != null) {
+            queryParameters['page'] = requestParameters['page'];
+        }
+
+        if (requestParameters['pageSize'] != null) {
+            queryParameters['page_size'] = requestParameters['pageSize'];
+        }
+
+        if (requestParameters['path'] != null) {
+            queryParameters['path'] = requestParameters['path'];
+        }
+
+        if (requestParameters['search'] != null) {
+            queryParameters['search'] = requestParameters['search'];
+        }
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/managed/blueprints/`;
+
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Blueprint instances
+     */
+    async managedBlueprintsListRaw(requestParameters: ManagedBlueprintsListRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<PaginatedBlueprintInstanceList>> {
+        const requestOptions = await this.managedBlueprintsListRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => PaginatedBlueprintInstanceListFromJSON(jsonValue));
+    }
+
+    /**
+     * Blueprint instances
+     */
+    async managedBlueprintsList(requestParameters: ManagedBlueprintsListRequest = {}, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<PaginatedBlueprintInstanceList> {
+        const response = await this.managedBlueprintsListRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for managedBlueprintsPartialUpdate without sending the request
+     */
+    async managedBlueprintsPartialUpdateRequestOpts(requestParameters: ManagedBlueprintsPartialUpdateRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['instanceUuid'] == null) {
+            throw new runtime.RequiredError(
+                'instanceUuid',
+                'Required parameter "instanceUuid" was null or undefined when calling managedBlueprintsPartialUpdate().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters['Content-Type'] = 'application/json';
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/managed/blueprints/{instance_uuid}/`;
+        urlPath = urlPath.replace(`{${"instance_uuid"}}`, encodeURIComponent(String(requestParameters['instanceUuid'])));
+
+        return {
+            path: urlPath,
+            method: 'PATCH',
+            headers: headerParameters,
+            query: queryParameters,
+            body: PatchedBlueprintInstanceRequestToJSON(requestParameters['patchedBlueprintInstanceRequest']),
+        };
+    }
+
+    /**
+     * Blueprint instances
+     */
+    async managedBlueprintsPartialUpdateRaw(requestParameters: ManagedBlueprintsPartialUpdateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<BlueprintInstance>> {
+        const requestOptions = await this.managedBlueprintsPartialUpdateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => BlueprintInstanceFromJSON(jsonValue));
+    }
+
+    /**
+     * Blueprint instances
+     */
+    async managedBlueprintsPartialUpdate(requestParameters: ManagedBlueprintsPartialUpdateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<BlueprintInstance> {
+        const response = await this.managedBlueprintsPartialUpdateRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for managedBlueprintsRetrieve without sending the request
+     */
+    async managedBlueprintsRetrieveRequestOpts(requestParameters: ManagedBlueprintsRetrieveRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['instanceUuid'] == null) {
+            throw new runtime.RequiredError(
+                'instanceUuid',
+                'Required parameter "instanceUuid" was null or undefined when calling managedBlueprintsRetrieve().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/managed/blueprints/{instance_uuid}/`;
+        urlPath = urlPath.replace(`{${"instance_uuid"}}`, encodeURIComponent(String(requestParameters['instanceUuid'])));
+
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Blueprint instances
+     */
+    async managedBlueprintsRetrieveRaw(requestParameters: ManagedBlueprintsRetrieveRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<BlueprintInstance>> {
+        const requestOptions = await this.managedBlueprintsRetrieveRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => BlueprintInstanceFromJSON(jsonValue));
+    }
+
+    /**
+     * Blueprint instances
+     */
+    async managedBlueprintsRetrieve(requestParameters: ManagedBlueprintsRetrieveRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<BlueprintInstance> {
+        const response = await this.managedBlueprintsRetrieveRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for managedBlueprintsUpdate without sending the request
+     */
+    async managedBlueprintsUpdateRequestOpts(requestParameters: ManagedBlueprintsUpdateRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['instanceUuid'] == null) {
+            throw new runtime.RequiredError(
+                'instanceUuid',
+                'Required parameter "instanceUuid" was null or undefined when calling managedBlueprintsUpdate().'
+            );
+        }
+
+        if (requestParameters['blueprintInstanceRequest'] == null) {
+            throw new runtime.RequiredError(
+                'blueprintInstanceRequest',
+                'Required parameter "blueprintInstanceRequest" was null or undefined when calling managedBlueprintsUpdate().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters['Content-Type'] = 'application/json';
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/managed/blueprints/{instance_uuid}/`;
+        urlPath = urlPath.replace(`{${"instance_uuid"}}`, encodeURIComponent(String(requestParameters['instanceUuid'])));
+
+        return {
+            path: urlPath,
+            method: 'PUT',
+            headers: headerParameters,
+            query: queryParameters,
+            body: BlueprintInstanceRequestToJSON(requestParameters['blueprintInstanceRequest']),
+        };
+    }
+
+    /**
+     * Blueprint instances
+     */
+    async managedBlueprintsUpdateRaw(requestParameters: ManagedBlueprintsUpdateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<BlueprintInstance>> {
+        const requestOptions = await this.managedBlueprintsUpdateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => BlueprintInstanceFromJSON(jsonValue));
+    }
+
+    /**
+     * Blueprint instances
+     */
+    async managedBlueprintsUpdate(requestParameters: ManagedBlueprintsUpdateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<BlueprintInstance> {
+        const response = await this.managedBlueprintsUpdateRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for managedBlueprintsUsedByList without sending the request
+     */
+    async managedBlueprintsUsedByListRequestOpts(requestParameters: ManagedBlueprintsUsedByListRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['instanceUuid'] == null) {
+            throw new runtime.RequiredError(
+                'instanceUuid',
+                'Required parameter "instanceUuid" was null or undefined when calling managedBlueprintsUsedByList().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/managed/blueprints/{instance_uuid}/used_by/`;
+        urlPath = urlPath.replace(`{${"instance_uuid"}}`, encodeURIComponent(String(requestParameters['instanceUuid'])));
+
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Get a list of all objects that use this object
+     */
+    async managedBlueprintsUsedByListRaw(requestParameters: ManagedBlueprintsUsedByListRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<Array<UsedBy>>> {
+        const requestOptions = await this.managedBlueprintsUsedByListRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => jsonValue.map(UsedByFromJSON));
+    }
+
+    /**
+     * Get a list of all objects that use this object
+     */
+    async managedBlueprintsUsedByList(requestParameters: ManagedBlueprintsUsedByListRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<Array<UsedBy>> {
+        const response = await this.managedBlueprintsUsedByListRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+}

packages/client-ts/src/apis/Oauth2Api.ts

@@ -0,0 +1,792 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+
+import * as runtime from '../runtime';
+import type {
+  ExpiringBaseGrantModel,
+  GenericError,
+  PaginatedExpiringBaseGrantModelList,
+  PaginatedTokenModelList,
+  TokenModel,
+  UsedBy,
+  ValidationError,
+} from '../models/index';
+import {
+    ExpiringBaseGrantModelFromJSON,
+    ExpiringBaseGrantModelToJSON,
+    GenericErrorFromJSON,
+    GenericErrorToJSON,
+    PaginatedExpiringBaseGrantModelListFromJSON,
+    PaginatedExpiringBaseGrantModelListToJSON,
+    PaginatedTokenModelListFromJSON,
+    PaginatedTokenModelListToJSON,
+    TokenModelFromJSON,
+    TokenModelToJSON,
+    UsedByFromJSON,
+    UsedByToJSON,
+    ValidationErrorFromJSON,
+    ValidationErrorToJSON,
+} from '../models/index';
+
+export interface Oauth2AccessTokensDestroyRequest {
+    id: number;
+}
+
+export interface Oauth2AccessTokensListRequest {
+    ordering?: string;
+    page?: number;
+    pageSize?: number;
+    provider?: number;
+    search?: string;
+    user?: number;
+}
+
+export interface Oauth2AccessTokensRetrieveRequest {
+    id: number;
+}
+
+export interface Oauth2AccessTokensUsedByListRequest {
+    id: number;
+}
+
+export interface Oauth2AuthorizationCodesDestroyRequest {
+    id: number;
+}
+
+export interface Oauth2AuthorizationCodesListRequest {
+    ordering?: string;
+    page?: number;
+    pageSize?: number;
+    provider?: number;
+    search?: string;
+    user?: number;
+}
+
+export interface Oauth2AuthorizationCodesRetrieveRequest {
+    id: number;
+}
+
+export interface Oauth2AuthorizationCodesUsedByListRequest {
+    id: number;
+}
+
+export interface Oauth2RefreshTokensDestroyRequest {
+    id: number;
+}
+
+export interface Oauth2RefreshTokensListRequest {
+    ordering?: string;
+    page?: number;
+    pageSize?: number;
+    provider?: number;
+    search?: string;
+    user?: number;
+}
+
+export interface Oauth2RefreshTokensRetrieveRequest {
+    id: number;
+}
+
+export interface Oauth2RefreshTokensUsedByListRequest {
+    id: number;
+}
+
+/**
+ * 
+ */
+export class Oauth2Api extends runtime.BaseAPI {
+
+    /**
+     * Creates request options for oauth2AccessTokensDestroy without sending the request
+     */
+    async oauth2AccessTokensDestroyRequestOpts(requestParameters: Oauth2AccessTokensDestroyRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['id'] == null) {
+            throw new runtime.RequiredError(
+                'id',
+                'Required parameter "id" was null or undefined when calling oauth2AccessTokensDestroy().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/oauth2/access_tokens/{id}/`;
+        urlPath = urlPath.replace(`{${"id"}}`, encodeURIComponent(String(requestParameters['id'])));
+
+        return {
+            path: urlPath,
+            method: 'DELETE',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * AccessToken Viewset
+     */
+    async oauth2AccessTokensDestroyRaw(requestParameters: Oauth2AccessTokensDestroyRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>> {
+        const requestOptions = await this.oauth2AccessTokensDestroyRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.VoidApiResponse(response);
+    }
+
+    /**
+     * AccessToken Viewset
+     */
+    async oauth2AccessTokensDestroy(requestParameters: Oauth2AccessTokensDestroyRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void> {
+        await this.oauth2AccessTokensDestroyRaw(requestParameters, initOverrides);
+    }
+
+    /**
+     * Creates request options for oauth2AccessTokensList without sending the request
+     */
+    async oauth2AccessTokensListRequestOpts(requestParameters: Oauth2AccessTokensListRequest): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        if (requestParameters['ordering'] != null) {
+            queryParameters['ordering'] = requestParameters['ordering'];
+        }
+
+        if (requestParameters['page'] != null) {
+            queryParameters['page'] = requestParameters['page'];
+        }
+
+        if (requestParameters['pageSize'] != null) {
+            queryParameters['page_size'] = requestParameters['pageSize'];
+        }
+
+        if (requestParameters['provider'] != null) {
+            queryParameters['provider'] = requestParameters['provider'];
+        }
+
+        if (requestParameters['search'] != null) {
+            queryParameters['search'] = requestParameters['search'];
+        }
+
+        if (requestParameters['user'] != null) {
+            queryParameters['user'] = requestParameters['user'];
+        }
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/oauth2/access_tokens/`;
+
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * AccessToken Viewset
+     */
+    async oauth2AccessTokensListRaw(requestParameters: Oauth2AccessTokensListRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<PaginatedTokenModelList>> {
+        const requestOptions = await this.oauth2AccessTokensListRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => PaginatedTokenModelListFromJSON(jsonValue));
+    }
+
+    /**
+     * AccessToken Viewset
+     */
+    async oauth2AccessTokensList(requestParameters: Oauth2AccessTokensListRequest = {}, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<PaginatedTokenModelList> {
+        const response = await this.oauth2AccessTokensListRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for oauth2AccessTokensRetrieve without sending the request
+     */
+    async oauth2AccessTokensRetrieveRequestOpts(requestParameters: Oauth2AccessTokensRetrieveRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['id'] == null) {
+            throw new runtime.RequiredError(
+                'id',
+                'Required parameter "id" was null or undefined when calling oauth2AccessTokensRetrieve().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/oauth2/access_tokens/{id}/`;
+        urlPath = urlPath.replace(`{${"id"}}`, encodeURIComponent(String(requestParameters['id'])));
+
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * AccessToken Viewset
+     */
+    async oauth2AccessTokensRetrieveRaw(requestParameters: Oauth2AccessTokensRetrieveRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<TokenModel>> {
+        const requestOptions = await this.oauth2AccessTokensRetrieveRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => TokenModelFromJSON(jsonValue));
+    }
+
+    /**
+     * AccessToken Viewset
+     */
+    async oauth2AccessTokensRetrieve(requestParameters: Oauth2AccessTokensRetrieveRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<TokenModel> {
+        const response = await this.oauth2AccessTokensRetrieveRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for oauth2AccessTokensUsedByList without sending the request
+     */
+    async oauth2AccessTokensUsedByListRequestOpts(requestParameters: Oauth2AccessTokensUsedByListRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['id'] == null) {
+            throw new runtime.RequiredError(
+                'id',
+                'Required parameter "id" was null or undefined when calling oauth2AccessTokensUsedByList().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/oauth2/access_tokens/{id}/used_by/`;
+        urlPath = urlPath.replace(`{${"id"}}`, encodeURIComponent(String(requestParameters['id'])));
+
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Get a list of all objects that use this object
+     */
+    async oauth2AccessTokensUsedByListRaw(requestParameters: Oauth2AccessTokensUsedByListRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<Array<UsedBy>>> {
+        const requestOptions = await this.oauth2AccessTokensUsedByListRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => jsonValue.map(UsedByFromJSON));
+    }
+
+    /**
+     * Get a list of all objects that use this object
+     */
+    async oauth2AccessTokensUsedByList(requestParameters: Oauth2AccessTokensUsedByListRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<Array<UsedBy>> {
+        const response = await this.oauth2AccessTokensUsedByListRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for oauth2AuthorizationCodesDestroy without sending the request
+     */
+    async oauth2AuthorizationCodesDestroyRequestOpts(requestParameters: Oauth2AuthorizationCodesDestroyRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['id'] == null) {
+            throw new runtime.RequiredError(
+                'id',
+                'Required parameter "id" was null or undefined when calling oauth2AuthorizationCodesDestroy().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/oauth2/authorization_codes/{id}/`;
+        urlPath = urlPath.replace(`{${"id"}}`, encodeURIComponent(String(requestParameters['id'])));
+
+        return {
+            path: urlPath,
+            method: 'DELETE',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * AuthorizationCode Viewset
+     */
+    async oauth2AuthorizationCodesDestroyRaw(requestParameters: Oauth2AuthorizationCodesDestroyRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>> {
+        const requestOptions = await this.oauth2AuthorizationCodesDestroyRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.VoidApiResponse(response);
+    }
+
+    /**
+     * AuthorizationCode Viewset
+     */
+    async oauth2AuthorizationCodesDestroy(requestParameters: Oauth2AuthorizationCodesDestroyRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void> {
+        await this.oauth2AuthorizationCodesDestroyRaw(requestParameters, initOverrides);
+    }
+
+    /**
+     * Creates request options for oauth2AuthorizationCodesList without sending the request
+     */
+    async oauth2AuthorizationCodesListRequestOpts(requestParameters: Oauth2AuthorizationCodesListRequest): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        if (requestParameters['ordering'] != null) {
+            queryParameters['ordering'] = requestParameters['ordering'];
+        }
+
+        if (requestParameters['page'] != null) {
+            queryParameters['page'] = requestParameters['page'];
+        }
+
+        if (requestParameters['pageSize'] != null) {
+            queryParameters['page_size'] = requestParameters['pageSize'];
+        }
+
+        if (requestParameters['provider'] != null) {
+            queryParameters['provider'] = requestParameters['provider'];
+        }
+
+        if (requestParameters['search'] != null) {
+            queryParameters['search'] = requestParameters['search'];
+        }
+
+        if (requestParameters['user'] != null) {
+            queryParameters['user'] = requestParameters['user'];
+        }
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/oauth2/authorization_codes/`;
+
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * AuthorizationCode Viewset
+     */
+    async oauth2AuthorizationCodesListRaw(requestParameters: Oauth2AuthorizationCodesListRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<PaginatedExpiringBaseGrantModelList>> {
+        const requestOptions = await this.oauth2AuthorizationCodesListRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => PaginatedExpiringBaseGrantModelListFromJSON(jsonValue));
+    }
+
+    /**
+     * AuthorizationCode Viewset
+     */
+    async oauth2AuthorizationCodesList(requestParameters: Oauth2AuthorizationCodesListRequest = {}, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<PaginatedExpiringBaseGrantModelList> {
+        const response = await this.oauth2AuthorizationCodesListRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for oauth2AuthorizationCodesRetrieve without sending the request
+     */
+    async oauth2AuthorizationCodesRetrieveRequestOpts(requestParameters: Oauth2AuthorizationCodesRetrieveRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['id'] == null) {
+            throw new runtime.RequiredError(
+                'id',
+                'Required parameter "id" was null or undefined when calling oauth2AuthorizationCodesRetrieve().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/oauth2/authorization_codes/{id}/`;
+        urlPath = urlPath.replace(`{${"id"}}`, encodeURIComponent(String(requestParameters['id'])));
+
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * AuthorizationCode Viewset
+     */
+    async oauth2AuthorizationCodesRetrieveRaw(requestParameters: Oauth2AuthorizationCodesRetrieveRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<ExpiringBaseGrantModel>> {
+        const requestOptions = await this.oauth2AuthorizationCodesRetrieveRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => ExpiringBaseGrantModelFromJSON(jsonValue));
+    }
+
+    /**
+     * AuthorizationCode Viewset
+     */
+    async oauth2AuthorizationCodesRetrieve(requestParameters: Oauth2AuthorizationCodesRetrieveRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<ExpiringBaseGrantModel> {
+        const response = await this.oauth2AuthorizationCodesRetrieveRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for oauth2AuthorizationCodesUsedByList without sending the request
+     */
+    async oauth2AuthorizationCodesUsedByListRequestOpts(requestParameters: Oauth2AuthorizationCodesUsedByListRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['id'] == null) {
+            throw new runtime.RequiredError(
+                'id',
+                'Required parameter "id" was null or undefined when calling oauth2AuthorizationCodesUsedByList().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/oauth2/authorization_codes/{id}/used_by/`;
+        urlPath = urlPath.replace(`{${"id"}}`, encodeURIComponent(String(requestParameters['id'])));
+
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Get a list of all objects that use this object
+     */
+    async oauth2AuthorizationCodesUsedByListRaw(requestParameters: Oauth2AuthorizationCodesUsedByListRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<Array<UsedBy>>> {
+        const requestOptions = await this.oauth2AuthorizationCodesUsedByListRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => jsonValue.map(UsedByFromJSON));
+    }
+
+    /**
+     * Get a list of all objects that use this object
+     */
+    async oauth2AuthorizationCodesUsedByList(requestParameters: Oauth2AuthorizationCodesUsedByListRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<Array<UsedBy>> {
+        const response = await this.oauth2AuthorizationCodesUsedByListRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for oauth2RefreshTokensDestroy without sending the request
+     */
+    async oauth2RefreshTokensDestroyRequestOpts(requestParameters: Oauth2RefreshTokensDestroyRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['id'] == null) {
+            throw new runtime.RequiredError(
+                'id',
+                'Required parameter "id" was null or undefined when calling oauth2RefreshTokensDestroy().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/oauth2/refresh_tokens/{id}/`;
+        urlPath = urlPath.replace(`{${"id"}}`, encodeURIComponent(String(requestParameters['id'])));
+
+        return {
+            path: urlPath,
+            method: 'DELETE',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * RefreshToken Viewset
+     */
+    async oauth2RefreshTokensDestroyRaw(requestParameters: Oauth2RefreshTokensDestroyRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>> {
+        const requestOptions = await this.oauth2RefreshTokensDestroyRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.VoidApiResponse(response);
+    }
+
+    /**
+     * RefreshToken Viewset
+     */
+    async oauth2RefreshTokensDestroy(requestParameters: Oauth2RefreshTokensDestroyRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void> {
+        await this.oauth2RefreshTokensDestroyRaw(requestParameters, initOverrides);
+    }
+
+    /**
+     * Creates request options for oauth2RefreshTokensList without sending the request
+     */
+    async oauth2RefreshTokensListRequestOpts(requestParameters: Oauth2RefreshTokensListRequest): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        if (requestParameters['ordering'] != null) {
+            queryParameters['ordering'] = requestParameters['ordering'];
+        }
+
+        if (requestParameters['page'] != null) {
+            queryParameters['page'] = requestParameters['page'];
+        }
+
+        if (requestParameters['pageSize'] != null) {
+            queryParameters['page_size'] = requestParameters['pageSize'];
+        }
+
+        if (requestParameters['provider'] != null) {
+            queryParameters['provider'] = requestParameters['provider'];
+        }
+
+        if (requestParameters['search'] != null) {
+            queryParameters['search'] = requestParameters['search'];
+        }
+
+        if (requestParameters['user'] != null) {
+            queryParameters['user'] = requestParameters['user'];
+        }
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/oauth2/refresh_tokens/`;
+
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * RefreshToken Viewset
+     */
+    async oauth2RefreshTokensListRaw(requestParameters: Oauth2RefreshTokensListRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<PaginatedTokenModelList>> {
+        const requestOptions = await this.oauth2RefreshTokensListRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => PaginatedTokenModelListFromJSON(jsonValue));
+    }
+
+    /**
+     * RefreshToken Viewset
+     */
+    async oauth2RefreshTokensList(requestParameters: Oauth2RefreshTokensListRequest = {}, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<PaginatedTokenModelList> {
+        const response = await this.oauth2RefreshTokensListRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for oauth2RefreshTokensRetrieve without sending the request
+     */
+    async oauth2RefreshTokensRetrieveRequestOpts(requestParameters: Oauth2RefreshTokensRetrieveRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['id'] == null) {
+            throw new runtime.RequiredError(
+                'id',
+                'Required parameter "id" was null or undefined when calling oauth2RefreshTokensRetrieve().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/oauth2/refresh_tokens/{id}/`;
+        urlPath = urlPath.replace(`{${"id"}}`, encodeURIComponent(String(requestParameters['id'])));
+
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * RefreshToken Viewset
+     */
+    async oauth2RefreshTokensRetrieveRaw(requestParameters: Oauth2RefreshTokensRetrieveRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<TokenModel>> {
+        const requestOptions = await this.oauth2RefreshTokensRetrieveRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => TokenModelFromJSON(jsonValue));
+    }
+
+    /**
+     * RefreshToken Viewset
+     */
+    async oauth2RefreshTokensRetrieve(requestParameters: Oauth2RefreshTokensRetrieveRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<TokenModel> {
+        const response = await this.oauth2RefreshTokensRetrieveRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for oauth2RefreshTokensUsedByList without sending the request
+     */
+    async oauth2RefreshTokensUsedByListRequestOpts(requestParameters: Oauth2RefreshTokensUsedByListRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['id'] == null) {
+            throw new runtime.RequiredError(
+                'id',
+                'Required parameter "id" was null or undefined when calling oauth2RefreshTokensUsedByList().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/oauth2/refresh_tokens/{id}/used_by/`;
+        urlPath = urlPath.replace(`{${"id"}}`, encodeURIComponent(String(requestParameters['id'])));
+
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Get a list of all objects that use this object
+     */
+    async oauth2RefreshTokensUsedByListRaw(requestParameters: Oauth2RefreshTokensUsedByListRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<Array<UsedBy>>> {
+        const requestOptions = await this.oauth2RefreshTokensUsedByListRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => jsonValue.map(UsedByFromJSON));
+    }
+
+    /**
+     * Get a list of all objects that use this object
+     */
+    async oauth2RefreshTokensUsedByList(requestParameters: Oauth2RefreshTokensUsedByListRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<Array<UsedBy>> {
+        const response = await this.oauth2RefreshTokensUsedByListRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+}

packages/client-ts/src/apis/RacApi.ts

@@ -0,0 +1,883 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+
+import * as runtime from '../runtime';
+import type {
+  ConnectionToken,
+  ConnectionTokenRequest,
+  Endpoint,
+  EndpointRequest,
+  GenericError,
+  PaginatedConnectionTokenList,
+  PaginatedEndpointList,
+  PatchedConnectionTokenRequest,
+  PatchedEndpointRequest,
+  UsedBy,
+  ValidationError,
+} from '../models/index';
+import {
+    ConnectionTokenFromJSON,
+    ConnectionTokenToJSON,
+    ConnectionTokenRequestFromJSON,
+    ConnectionTokenRequestToJSON,
+    EndpointFromJSON,
+    EndpointToJSON,
+    EndpointRequestFromJSON,
+    EndpointRequestToJSON,
+    GenericErrorFromJSON,
+    GenericErrorToJSON,
+    PaginatedConnectionTokenListFromJSON,
+    PaginatedConnectionTokenListToJSON,
+    PaginatedEndpointListFromJSON,
+    PaginatedEndpointListToJSON,
+    PatchedConnectionTokenRequestFromJSON,
+    PatchedConnectionTokenRequestToJSON,
+    PatchedEndpointRequestFromJSON,
+    PatchedEndpointRequestToJSON,
+    UsedByFromJSON,
+    UsedByToJSON,
+    ValidationErrorFromJSON,
+    ValidationErrorToJSON,
+} from '../models/index';
+
+export interface RacConnectionTokensDestroyRequest {
+    connectionTokenUuid: string;
+}
+
+export interface RacConnectionTokensListRequest {
+    endpoint?: string;
+    ordering?: string;
+    page?: number;
+    pageSize?: number;
+    provider?: number;
+    search?: string;
+    sessionUser?: number;
+}
+
+export interface RacConnectionTokensPartialUpdateRequest {
+    connectionTokenUuid: string;
+    patchedConnectionTokenRequest?: PatchedConnectionTokenRequest;
+}
+
+export interface RacConnectionTokensRetrieveRequest {
+    connectionTokenUuid: string;
+}
+
+export interface RacConnectionTokensUpdateRequest {
+    connectionTokenUuid: string;
+    connectionTokenRequest: ConnectionTokenRequest;
+}
+
+export interface RacConnectionTokensUsedByListRequest {
+    connectionTokenUuid: string;
+}
+
+export interface RacEndpointsCreateRequest {
+    endpointRequest: EndpointRequest;
+}
+
+export interface RacEndpointsDestroyRequest {
+    pbmUuid: string;
+}
+
+export interface RacEndpointsListRequest {
+    name?: string;
+    ordering?: string;
+    page?: number;
+    pageSize?: number;
+    provider?: number;
+    search?: string;
+    superuserFullList?: boolean;
+}
+
+export interface RacEndpointsPartialUpdateRequest {
+    pbmUuid: string;
+    patchedEndpointRequest?: PatchedEndpointRequest;
+}
+
+export interface RacEndpointsRetrieveRequest {
+    pbmUuid: string;
+}
+
+export interface RacEndpointsUpdateRequest {
+    pbmUuid: string;
+    endpointRequest: EndpointRequest;
+}
+
+export interface RacEndpointsUsedByListRequest {
+    pbmUuid: string;
+}
+
+/**
+ * 
+ */
+export class RacApi extends runtime.BaseAPI {
+
+    /**
+     * Creates request options for racConnectionTokensDestroy without sending the request
+     */
+    async racConnectionTokensDestroyRequestOpts(requestParameters: RacConnectionTokensDestroyRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['connectionTokenUuid'] == null) {
+            throw new runtime.RequiredError(
+                'connectionTokenUuid',
+                'Required parameter "connectionTokenUuid" was null or undefined when calling racConnectionTokensDestroy().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/rac/connection_tokens/{connection_token_uuid}/`;
+        urlPath = urlPath.replace(`{${"connection_token_uuid"}}`, encodeURIComponent(String(requestParameters['connectionTokenUuid'])));
+
+        return {
+            path: urlPath,
+            method: 'DELETE',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * ConnectionToken Viewset
+     */
+    async racConnectionTokensDestroyRaw(requestParameters: RacConnectionTokensDestroyRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>> {
+        const requestOptions = await this.racConnectionTokensDestroyRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.VoidApiResponse(response);
+    }
+
+    /**
+     * ConnectionToken Viewset
+     */
+    async racConnectionTokensDestroy(requestParameters: RacConnectionTokensDestroyRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void> {
+        await this.racConnectionTokensDestroyRaw(requestParameters, initOverrides);
+    }
+
+    /**
+     * Creates request options for racConnectionTokensList without sending the request
+     */
+    async racConnectionTokensListRequestOpts(requestParameters: RacConnectionTokensListRequest): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        if (requestParameters['endpoint'] != null) {
+            queryParameters['endpoint'] = requestParameters['endpoint'];
+        }
+
+        if (requestParameters['ordering'] != null) {
+            queryParameters['ordering'] = requestParameters['ordering'];
+        }
+
+        if (requestParameters['page'] != null) {
+            queryParameters['page'] = requestParameters['page'];
+        }
+
+        if (requestParameters['pageSize'] != null) {
+            queryParameters['page_size'] = requestParameters['pageSize'];
+        }
+
+        if (requestParameters['provider'] != null) {
+            queryParameters['provider'] = requestParameters['provider'];
+        }
+
+        if (requestParameters['search'] != null) {
+            queryParameters['search'] = requestParameters['search'];
+        }
+
+        if (requestParameters['sessionUser'] != null) {
+            queryParameters['session__user'] = requestParameters['sessionUser'];
+        }
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/rac/connection_tokens/`;
+
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * ConnectionToken Viewset
+     */
+    async racConnectionTokensListRaw(requestParameters: RacConnectionTokensListRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<PaginatedConnectionTokenList>> {
+        const requestOptions = await this.racConnectionTokensListRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => PaginatedConnectionTokenListFromJSON(jsonValue));
+    }
+
+    /**
+     * ConnectionToken Viewset
+     */
+    async racConnectionTokensList(requestParameters: RacConnectionTokensListRequest = {}, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<PaginatedConnectionTokenList> {
+        const response = await this.racConnectionTokensListRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for racConnectionTokensPartialUpdate without sending the request
+     */
+    async racConnectionTokensPartialUpdateRequestOpts(requestParameters: RacConnectionTokensPartialUpdateRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['connectionTokenUuid'] == null) {
+            throw new runtime.RequiredError(
+                'connectionTokenUuid',
+                'Required parameter "connectionTokenUuid" was null or undefined when calling racConnectionTokensPartialUpdate().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters['Content-Type'] = 'application/json';
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/rac/connection_tokens/{connection_token_uuid}/`;
+        urlPath = urlPath.replace(`{${"connection_token_uuid"}}`, encodeURIComponent(String(requestParameters['connectionTokenUuid'])));
+
+        return {
+            path: urlPath,
+            method: 'PATCH',
+            headers: headerParameters,
+            query: queryParameters,
+            body: PatchedConnectionTokenRequestToJSON(requestParameters['patchedConnectionTokenRequest']),
+        };
+    }
+
+    /**
+     * ConnectionToken Viewset
+     */
+    async racConnectionTokensPartialUpdateRaw(requestParameters: RacConnectionTokensPartialUpdateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<ConnectionToken>> {
+        const requestOptions = await this.racConnectionTokensPartialUpdateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => ConnectionTokenFromJSON(jsonValue));
+    }
+
+    /**
+     * ConnectionToken Viewset
+     */
+    async racConnectionTokensPartialUpdate(requestParameters: RacConnectionTokensPartialUpdateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<ConnectionToken> {
+        const response = await this.racConnectionTokensPartialUpdateRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for racConnectionTokensRetrieve without sending the request
+     */
+    async racConnectionTokensRetrieveRequestOpts(requestParameters: RacConnectionTokensRetrieveRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['connectionTokenUuid'] == null) {
+            throw new runtime.RequiredError(
+                'connectionTokenUuid',
+                'Required parameter "connectionTokenUuid" was null or undefined when calling racConnectionTokensRetrieve().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/rac/connection_tokens/{connection_token_uuid}/`;
+        urlPath = urlPath.replace(`{${"connection_token_uuid"}}`, encodeURIComponent(String(requestParameters['connectionTokenUuid'])));
+
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * ConnectionToken Viewset
+     */
+    async racConnectionTokensRetrieveRaw(requestParameters: RacConnectionTokensRetrieveRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<ConnectionToken>> {
+        const requestOptions = await this.racConnectionTokensRetrieveRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => ConnectionTokenFromJSON(jsonValue));
+    }
+
+    /**
+     * ConnectionToken Viewset
+     */
+    async racConnectionTokensRetrieve(requestParameters: RacConnectionTokensRetrieveRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<ConnectionToken> {
+        const response = await this.racConnectionTokensRetrieveRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for racConnectionTokensUpdate without sending the request
+     */
+    async racConnectionTokensUpdateRequestOpts(requestParameters: RacConnectionTokensUpdateRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['connectionTokenUuid'] == null) {
+            throw new runtime.RequiredError(
+                'connectionTokenUuid',
+                'Required parameter "connectionTokenUuid" was null or undefined when calling racConnectionTokensUpdate().'
+            );
+        }
+
+        if (requestParameters['connectionTokenRequest'] == null) {
+            throw new runtime.RequiredError(
+                'connectionTokenRequest',
+                'Required parameter "connectionTokenRequest" was null or undefined when calling racConnectionTokensUpdate().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters['Content-Type'] = 'application/json';
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/rac/connection_tokens/{connection_token_uuid}/`;
+        urlPath = urlPath.replace(`{${"connection_token_uuid"}}`, encodeURIComponent(String(requestParameters['connectionTokenUuid'])));
+
+        return {
+            path: urlPath,
+            method: 'PUT',
+            headers: headerParameters,
+            query: queryParameters,
+            body: ConnectionTokenRequestToJSON(requestParameters['connectionTokenRequest']),
+        };
+    }
+
+    /**
+     * ConnectionToken Viewset
+     */
+    async racConnectionTokensUpdateRaw(requestParameters: RacConnectionTokensUpdateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<ConnectionToken>> {
+        const requestOptions = await this.racConnectionTokensUpdateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => ConnectionTokenFromJSON(jsonValue));
+    }
+
+    /**
+     * ConnectionToken Viewset
+     */
+    async racConnectionTokensUpdate(requestParameters: RacConnectionTokensUpdateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<ConnectionToken> {
+        const response = await this.racConnectionTokensUpdateRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for racConnectionTokensUsedByList without sending the request
+     */
+    async racConnectionTokensUsedByListRequestOpts(requestParameters: RacConnectionTokensUsedByListRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['connectionTokenUuid'] == null) {
+            throw new runtime.RequiredError(
+                'connectionTokenUuid',
+                'Required parameter "connectionTokenUuid" was null or undefined when calling racConnectionTokensUsedByList().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/rac/connection_tokens/{connection_token_uuid}/used_by/`;
+        urlPath = urlPath.replace(`{${"connection_token_uuid"}}`, encodeURIComponent(String(requestParameters['connectionTokenUuid'])));
+
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Get a list of all objects that use this object
+     */
+    async racConnectionTokensUsedByListRaw(requestParameters: RacConnectionTokensUsedByListRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<Array<UsedBy>>> {
+        const requestOptions = await this.racConnectionTokensUsedByListRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => jsonValue.map(UsedByFromJSON));
+    }
+
+    /**
+     * Get a list of all objects that use this object
+     */
+    async racConnectionTokensUsedByList(requestParameters: RacConnectionTokensUsedByListRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<Array<UsedBy>> {
+        const response = await this.racConnectionTokensUsedByListRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for racEndpointsCreate without sending the request
+     */
+    async racEndpointsCreateRequestOpts(requestParameters: RacEndpointsCreateRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['endpointRequest'] == null) {
+            throw new runtime.RequiredError(
+                'endpointRequest',
+                'Required parameter "endpointRequest" was null or undefined when calling racEndpointsCreate().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters['Content-Type'] = 'application/json';
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/rac/endpoints/`;
+
+        return {
+            path: urlPath,
+            method: 'POST',
+            headers: headerParameters,
+            query: queryParameters,
+            body: EndpointRequestToJSON(requestParameters['endpointRequest']),
+        };
+    }
+
+    /**
+     * Endpoint Viewset
+     */
+    async racEndpointsCreateRaw(requestParameters: RacEndpointsCreateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<Endpoint>> {
+        const requestOptions = await this.racEndpointsCreateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => EndpointFromJSON(jsonValue));
+    }
+
+    /**
+     * Endpoint Viewset
+     */
+    async racEndpointsCreate(requestParameters: RacEndpointsCreateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<Endpoint> {
+        const response = await this.racEndpointsCreateRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for racEndpointsDestroy without sending the request
+     */
+    async racEndpointsDestroyRequestOpts(requestParameters: RacEndpointsDestroyRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['pbmUuid'] == null) {
+            throw new runtime.RequiredError(
+                'pbmUuid',
+                'Required parameter "pbmUuid" was null or undefined when calling racEndpointsDestroy().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/rac/endpoints/{pbm_uuid}/`;
+        urlPath = urlPath.replace(`{${"pbm_uuid"}}`, encodeURIComponent(String(requestParameters['pbmUuid'])));
+
+        return {
+            path: urlPath,
+            method: 'DELETE',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Endpoint Viewset
+     */
+    async racEndpointsDestroyRaw(requestParameters: RacEndpointsDestroyRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>> {
+        const requestOptions = await this.racEndpointsDestroyRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.VoidApiResponse(response);
+    }
+
+    /**
+     * Endpoint Viewset
+     */
+    async racEndpointsDestroy(requestParameters: RacEndpointsDestroyRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void> {
+        await this.racEndpointsDestroyRaw(requestParameters, initOverrides);
+    }
+
+    /**
+     * Creates request options for racEndpointsList without sending the request
+     */
+    async racEndpointsListRequestOpts(requestParameters: RacEndpointsListRequest): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        if (requestParameters['name'] != null) {
+            queryParameters['name'] = requestParameters['name'];
+        }
+
+        if (requestParameters['ordering'] != null) {
+            queryParameters['ordering'] = requestParameters['ordering'];
+        }
+
+        if (requestParameters['page'] != null) {
+            queryParameters['page'] = requestParameters['page'];
+        }
+
+        if (requestParameters['pageSize'] != null) {
+            queryParameters['page_size'] = requestParameters['pageSize'];
+        }
+
+        if (requestParameters['provider'] != null) {
+            queryParameters['provider'] = requestParameters['provider'];
+        }
+
+        if (requestParameters['search'] != null) {
+            queryParameters['search'] = requestParameters['search'];
+        }
+
+        if (requestParameters['superuserFullList'] != null) {
+            queryParameters['superuser_full_list'] = requestParameters['superuserFullList'];
+        }
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/rac/endpoints/`;
+
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * List accessible endpoints
+     */
+    async racEndpointsListRaw(requestParameters: RacEndpointsListRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<PaginatedEndpointList>> {
+        const requestOptions = await this.racEndpointsListRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => PaginatedEndpointListFromJSON(jsonValue));
+    }
+
+    /**
+     * List accessible endpoints
+     */
+    async racEndpointsList(requestParameters: RacEndpointsListRequest = {}, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<PaginatedEndpointList> {
+        const response = await this.racEndpointsListRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for racEndpointsPartialUpdate without sending the request
+     */
+    async racEndpointsPartialUpdateRequestOpts(requestParameters: RacEndpointsPartialUpdateRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['pbmUuid'] == null) {
+            throw new runtime.RequiredError(
+                'pbmUuid',
+                'Required parameter "pbmUuid" was null or undefined when calling racEndpointsPartialUpdate().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters['Content-Type'] = 'application/json';
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/rac/endpoints/{pbm_uuid}/`;
+        urlPath = urlPath.replace(`{${"pbm_uuid"}}`, encodeURIComponent(String(requestParameters['pbmUuid'])));
+
+        return {
+            path: urlPath,
+            method: 'PATCH',
+            headers: headerParameters,
+            query: queryParameters,
+            body: PatchedEndpointRequestToJSON(requestParameters['patchedEndpointRequest']),
+        };
+    }
+
+    /**
+     * Endpoint Viewset
+     */
+    async racEndpointsPartialUpdateRaw(requestParameters: RacEndpointsPartialUpdateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<Endpoint>> {
+        const requestOptions = await this.racEndpointsPartialUpdateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => EndpointFromJSON(jsonValue));
+    }
+
+    /**
+     * Endpoint Viewset
+     */
+    async racEndpointsPartialUpdate(requestParameters: RacEndpointsPartialUpdateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<Endpoint> {
+        const response = await this.racEndpointsPartialUpdateRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for racEndpointsRetrieve without sending the request
+     */
+    async racEndpointsRetrieveRequestOpts(requestParameters: RacEndpointsRetrieveRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['pbmUuid'] == null) {
+            throw new runtime.RequiredError(
+                'pbmUuid',
+                'Required parameter "pbmUuid" was null or undefined when calling racEndpointsRetrieve().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/rac/endpoints/{pbm_uuid}/`;
+        urlPath = urlPath.replace(`{${"pbm_uuid"}}`, encodeURIComponent(String(requestParameters['pbmUuid'])));
+
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Endpoint Viewset
+     */
+    async racEndpointsRetrieveRaw(requestParameters: RacEndpointsRetrieveRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<Endpoint>> {
+        const requestOptions = await this.racEndpointsRetrieveRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => EndpointFromJSON(jsonValue));
+    }
+
+    /**
+     * Endpoint Viewset
+     */
+    async racEndpointsRetrieve(requestParameters: RacEndpointsRetrieveRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<Endpoint> {
+        const response = await this.racEndpointsRetrieveRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for racEndpointsUpdate without sending the request
+     */
+    async racEndpointsUpdateRequestOpts(requestParameters: RacEndpointsUpdateRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['pbmUuid'] == null) {
+            throw new runtime.RequiredError(
+                'pbmUuid',
+                'Required parameter "pbmUuid" was null or undefined when calling racEndpointsUpdate().'
+            );
+        }
+
+        if (requestParameters['endpointRequest'] == null) {
+            throw new runtime.RequiredError(
+                'endpointRequest',
+                'Required parameter "endpointRequest" was null or undefined when calling racEndpointsUpdate().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters['Content-Type'] = 'application/json';
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/rac/endpoints/{pbm_uuid}/`;
+        urlPath = urlPath.replace(`{${"pbm_uuid"}}`, encodeURIComponent(String(requestParameters['pbmUuid'])));
+
+        return {
+            path: urlPath,
+            method: 'PUT',
+            headers: headerParameters,
+            query: queryParameters,
+            body: EndpointRequestToJSON(requestParameters['endpointRequest']),
+        };
+    }
+
+    /**
+     * Endpoint Viewset
+     */
+    async racEndpointsUpdateRaw(requestParameters: RacEndpointsUpdateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<Endpoint>> {
+        const requestOptions = await this.racEndpointsUpdateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => EndpointFromJSON(jsonValue));
+    }
+
+    /**
+     * Endpoint Viewset
+     */
+    async racEndpointsUpdate(requestParameters: RacEndpointsUpdateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<Endpoint> {
+        const response = await this.racEndpointsUpdateRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for racEndpointsUsedByList without sending the request
+     */
+    async racEndpointsUsedByListRequestOpts(requestParameters: RacEndpointsUsedByListRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['pbmUuid'] == null) {
+            throw new runtime.RequiredError(
+                'pbmUuid',
+                'Required parameter "pbmUuid" was null or undefined when calling racEndpointsUsedByList().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/rac/endpoints/{pbm_uuid}/used_by/`;
+        urlPath = urlPath.replace(`{${"pbm_uuid"}}`, encodeURIComponent(String(requestParameters['pbmUuid'])));
+
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Get a list of all objects that use this object
+     */
+    async racEndpointsUsedByListRaw(requestParameters: RacEndpointsUsedByListRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<Array<UsedBy>>> {
+        const requestOptions = await this.racEndpointsUsedByListRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => jsonValue.map(UsedByFromJSON));
+    }
+
+    /**
+     * Get a list of all objects that use this object
+     */
+    async racEndpointsUsedByList(requestParameters: RacEndpointsUsedByListRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<Array<UsedBy>> {
+        const response = await this.racEndpointsUsedByListRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+}

packages/client-ts/src/apis/ReportsApi.ts

@@ -0,0 +1,214 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+
+import * as runtime from '../runtime';
+import type {
+  DataExport,
+  GenericError,
+  PaginatedDataExportList,
+  ValidationError,
+} from '../models/index';
+import {
+    DataExportFromJSON,
+    DataExportToJSON,
+    GenericErrorFromJSON,
+    GenericErrorToJSON,
+    PaginatedDataExportListFromJSON,
+    PaginatedDataExportListToJSON,
+    ValidationErrorFromJSON,
+    ValidationErrorToJSON,
+} from '../models/index';
+
+export interface ReportsExportsDestroyRequest {
+    id: string;
+}
+
+export interface ReportsExportsListRequest {
+    ordering?: string;
+    page?: number;
+    pageSize?: number;
+    search?: string;
+}
+
+export interface ReportsExportsRetrieveRequest {
+    id: string;
+}
+
+/**
+ * 
+ */
+export class ReportsApi extends runtime.BaseAPI {
+
+    /**
+     * Creates request options for reportsExportsDestroy without sending the request
+     */
+    async reportsExportsDestroyRequestOpts(requestParameters: ReportsExportsDestroyRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['id'] == null) {
+            throw new runtime.RequiredError(
+                'id',
+                'Required parameter "id" was null or undefined when calling reportsExportsDestroy().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/reports/exports/{id}/`;
+        urlPath = urlPath.replace(`{${"id"}}`, encodeURIComponent(String(requestParameters['id'])));
+
+        return {
+            path: urlPath,
+            method: 'DELETE',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     */
+    async reportsExportsDestroyRaw(requestParameters: ReportsExportsDestroyRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>> {
+        const requestOptions = await this.reportsExportsDestroyRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.VoidApiResponse(response);
+    }
+
+    /**
+     */
+    async reportsExportsDestroy(requestParameters: ReportsExportsDestroyRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void> {
+        await this.reportsExportsDestroyRaw(requestParameters, initOverrides);
+    }
+
+    /**
+     * Creates request options for reportsExportsList without sending the request
+     */
+    async reportsExportsListRequestOpts(requestParameters: ReportsExportsListRequest): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        if (requestParameters['ordering'] != null) {
+            queryParameters['ordering'] = requestParameters['ordering'];
+        }
+
+        if (requestParameters['page'] != null) {
+            queryParameters['page'] = requestParameters['page'];
+        }
+
+        if (requestParameters['pageSize'] != null) {
+            queryParameters['page_size'] = requestParameters['pageSize'];
+        }
+
+        if (requestParameters['search'] != null) {
+            queryParameters['search'] = requestParameters['search'];
+        }
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/reports/exports/`;
+
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     */
+    async reportsExportsListRaw(requestParameters: ReportsExportsListRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<PaginatedDataExportList>> {
+        const requestOptions = await this.reportsExportsListRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => PaginatedDataExportListFromJSON(jsonValue));
+    }
+
+    /**
+     */
+    async reportsExportsList(requestParameters: ReportsExportsListRequest = {}, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<PaginatedDataExportList> {
+        const response = await this.reportsExportsListRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for reportsExportsRetrieve without sending the request
+     */
+    async reportsExportsRetrieveRequestOpts(requestParameters: ReportsExportsRetrieveRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['id'] == null) {
+            throw new runtime.RequiredError(
+                'id',
+                'Required parameter "id" was null or undefined when calling reportsExportsRetrieve().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/reports/exports/{id}/`;
+        urlPath = urlPath.replace(`{${"id"}}`, encodeURIComponent(String(requestParameters['id'])));
+
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     */
+    async reportsExportsRetrieveRaw(requestParameters: ReportsExportsRetrieveRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<DataExport>> {
+        const requestOptions = await this.reportsExportsRetrieveRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => DataExportFromJSON(jsonValue));
+    }
+
+    /**
+     */
+    async reportsExportsRetrieve(requestParameters: ReportsExportsRetrieveRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<DataExport> {
+        const response = await this.reportsExportsRetrieveRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+}

packages/client-ts/src/apis/RootApi.ts

@@ -0,0 +1,81 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+
+import * as runtime from '../runtime';
+import type {
+  Config,
+  GenericError,
+  ValidationError,
+} from '../models/index';
+import {
+    ConfigFromJSON,
+    ConfigToJSON,
+    GenericErrorFromJSON,
+    GenericErrorToJSON,
+    ValidationErrorFromJSON,
+    ValidationErrorToJSON,
+} from '../models/index';
+
+/**
+ * 
+ */
+export class RootApi extends runtime.BaseAPI {
+
+    /**
+     * Creates request options for rootConfigRetrieve without sending the request
+     */
+    async rootConfigRetrieveRequestOpts(): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/root/config/`;
+
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Retrieve public configuration options
+     */
+    async rootConfigRetrieveRaw(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<Config>> {
+        const requestOptions = await this.rootConfigRetrieveRequestOpts();
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => ConfigFromJSON(jsonValue));
+    }
+
+    /**
+     * Retrieve public configuration options
+     */
+    async rootConfigRetrieve(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<Config> {
+        const response = await this.rootConfigRetrieveRaw(initOverrides);
+        return await response.value();
+    }
+
+}

packages/client-ts/src/apis/SchemaApi.ts

@@ -0,0 +1,207 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+
+import * as runtime from '../runtime';
+import type {
+  GenericError,
+  ValidationError,
+} from '../models/index';
+import {
+    GenericErrorFromJSON,
+    GenericErrorToJSON,
+    ValidationErrorFromJSON,
+    ValidationErrorToJSON,
+} from '../models/index';
+
+export interface SchemaRetrieveRequest {
+    format?: SchemaRetrieveFormatEnum;
+    lang?: SchemaRetrieveLangEnum;
+}
+
+/**
+ * 
+ */
+export class SchemaApi extends runtime.BaseAPI {
+
+    /**
+     * Creates request options for schemaRetrieve without sending the request
+     */
+    async schemaRetrieveRequestOpts(requestParameters: SchemaRetrieveRequest): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        if (requestParameters['format'] != null) {
+            queryParameters['format'] = requestParameters['format'];
+        }
+
+        if (requestParameters['lang'] != null) {
+            queryParameters['lang'] = requestParameters['lang'];
+        }
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/schema/`;
+
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * OpenApi3 schema for this API. Format can be selected via content negotiation.  - YAML: application/vnd.oai.openapi - JSON: application/vnd.oai.openapi+json
+     */
+    async schemaRetrieveRaw(requestParameters: SchemaRetrieveRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<{ [key: string]: any; }>> {
+        const requestOptions = await this.schemaRetrieveRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse<any>(response);
+    }
+
+    /**
+     * OpenApi3 schema for this API. Format can be selected via content negotiation.  - YAML: application/vnd.oai.openapi - JSON: application/vnd.oai.openapi+json
+     */
+    async schemaRetrieve(requestParameters: SchemaRetrieveRequest = {}, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<{ [key: string]: any; }> {
+        const response = await this.schemaRetrieveRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+}
+
+/**
+ * @export
+ */
+export const SchemaRetrieveFormatEnum = {
+    Json: 'json',
+    Yaml: 'yaml',
+    UnknownDefaultOpenApi: '11184809'
+} as const;
+export type SchemaRetrieveFormatEnum = typeof SchemaRetrieveFormatEnum[keyof typeof SchemaRetrieveFormatEnum];
+/**
+ * @export
+ */
+export const SchemaRetrieveLangEnum = {
+    Af: 'af',
+    Ar: 'ar',
+    ArDz: 'ar-dz',
+    Ast: 'ast',
+    Az: 'az',
+    Be: 'be',
+    Bg: 'bg',
+    Bn: 'bn',
+    Br: 'br',
+    Bs: 'bs',
+    Ca: 'ca',
+    Ckb: 'ckb',
+    Cs: 'cs',
+    Cy: 'cy',
+    Da: 'da',
+    De: 'de',
+    Dsb: 'dsb',
+    El: 'el',
+    En: 'en',
+    EnAu: 'en-au',
+    EnGb: 'en-gb',
+    Eo: 'eo',
+    Es: 'es',
+    EsAr: 'es-ar',
+    EsCo: 'es-co',
+    EsMx: 'es-mx',
+    EsNi: 'es-ni',
+    EsVe: 'es-ve',
+    Et: 'et',
+    Eu: 'eu',
+    Fa: 'fa',
+    Fi: 'fi',
+    Fr: 'fr',
+    Fy: 'fy',
+    Ga: 'ga',
+    Gd: 'gd',
+    Gl: 'gl',
+    He: 'he',
+    Hi: 'hi',
+    Hr: 'hr',
+    Hsb: 'hsb',
+    Hu: 'hu',
+    Hy: 'hy',
+    Ia: 'ia',
+    Id: 'id',
+    Ig: 'ig',
+    Io: 'io',
+    Is: 'is',
+    It: 'it',
+    Ja: 'ja',
+    Ka: 'ka',
+    Kab: 'kab',
+    Kk: 'kk',
+    Km: 'km',
+    Kn: 'kn',
+    Ko: 'ko',
+    Ky: 'ky',
+    Lb: 'lb',
+    Lt: 'lt',
+    Lv: 'lv',
+    Mk: 'mk',
+    Ml: 'ml',
+    Mn: 'mn',
+    Mr: 'mr',
+    Ms: 'ms',
+    My: 'my',
+    Nb: 'nb',
+    Ne: 'ne',
+    Nl: 'nl',
+    Nn: 'nn',
+    Os: 'os',
+    Pa: 'pa',
+    Pl: 'pl',
+    Pt: 'pt',
+    PtBr: 'pt-br',
+    Ro: 'ro',
+    Ru: 'ru',
+    Sk: 'sk',
+    Sl: 'sl',
+    Sq: 'sq',
+    Sr: 'sr',
+    SrLatn: 'sr-latn',
+    Sv: 'sv',
+    Sw: 'sw',
+    Ta: 'ta',
+    Te: 'te',
+    Tg: 'tg',
+    Th: 'th',
+    Tk: 'tk',
+    Tr: 'tr',
+    Tt: 'tt',
+    Udm: 'udm',
+    Ug: 'ug',
+    Uk: 'uk',
+    Ur: 'ur',
+    Uz: 'uz',
+    Vi: 'vi',
+    ZhHans: 'zh-hans',
+    ZhHant: 'zh-hant',
+    UnknownDefaultOpenApi: '11184809'
+} as const;
+export type SchemaRetrieveLangEnum = typeof SchemaRetrieveLangEnum[keyof typeof SchemaRetrieveLangEnum];

packages/client-ts/src/apis/SsfApi.ts

@@ -0,0 +1,189 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+
+import * as runtime from '../runtime';
+import type {
+  GenericError,
+  PaginatedSSFStreamList,
+  SSFStream,
+  ValidationError,
+} from '../models/index';
+import {
+    GenericErrorFromJSON,
+    GenericErrorToJSON,
+    PaginatedSSFStreamListFromJSON,
+    PaginatedSSFStreamListToJSON,
+    SSFStreamFromJSON,
+    SSFStreamToJSON,
+    ValidationErrorFromJSON,
+    ValidationErrorToJSON,
+} from '../models/index';
+
+export interface SsfStreamsListRequest {
+    deliveryMethod?: SsfStreamsListDeliveryMethodEnum;
+    endpointUrl?: string;
+    ordering?: string;
+    page?: number;
+    pageSize?: number;
+    provider?: number;
+    search?: string;
+}
+
+export interface SsfStreamsRetrieveRequest {
+    uuid: string;
+}
+
+/**
+ * 
+ */
+export class SsfApi extends runtime.BaseAPI {
+
+    /**
+     * Creates request options for ssfStreamsList without sending the request
+     */
+    async ssfStreamsListRequestOpts(requestParameters: SsfStreamsListRequest): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        if (requestParameters['deliveryMethod'] != null) {
+            queryParameters['delivery_method'] = requestParameters['deliveryMethod'];
+        }
+
+        if (requestParameters['endpointUrl'] != null) {
+            queryParameters['endpoint_url'] = requestParameters['endpointUrl'];
+        }
+
+        if (requestParameters['ordering'] != null) {
+            queryParameters['ordering'] = requestParameters['ordering'];
+        }
+
+        if (requestParameters['page'] != null) {
+            queryParameters['page'] = requestParameters['page'];
+        }
+
+        if (requestParameters['pageSize'] != null) {
+            queryParameters['page_size'] = requestParameters['pageSize'];
+        }
+
+        if (requestParameters['provider'] != null) {
+            queryParameters['provider'] = requestParameters['provider'];
+        }
+
+        if (requestParameters['search'] != null) {
+            queryParameters['search'] = requestParameters['search'];
+        }
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/ssf/streams/`;
+
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * SSFStream Viewset
+     */
+    async ssfStreamsListRaw(requestParameters: SsfStreamsListRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<PaginatedSSFStreamList>> {
+        const requestOptions = await this.ssfStreamsListRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => PaginatedSSFStreamListFromJSON(jsonValue));
+    }
+
+    /**
+     * SSFStream Viewset
+     */
+    async ssfStreamsList(requestParameters: SsfStreamsListRequest = {}, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<PaginatedSSFStreamList> {
+        const response = await this.ssfStreamsListRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for ssfStreamsRetrieve without sending the request
+     */
+    async ssfStreamsRetrieveRequestOpts(requestParameters: SsfStreamsRetrieveRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['uuid'] == null) {
+            throw new runtime.RequiredError(
+                'uuid',
+                'Required parameter "uuid" was null or undefined when calling ssfStreamsRetrieve().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/ssf/streams/{uuid}/`;
+        urlPath = urlPath.replace(`{${"uuid"}}`, encodeURIComponent(String(requestParameters['uuid'])));
+
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * SSFStream Viewset
+     */
+    async ssfStreamsRetrieveRaw(requestParameters: SsfStreamsRetrieveRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<SSFStream>> {
+        const requestOptions = await this.ssfStreamsRetrieveRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => SSFStreamFromJSON(jsonValue));
+    }
+
+    /**
+     * SSFStream Viewset
+     */
+    async ssfStreamsRetrieve(requestParameters: SsfStreamsRetrieveRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<SSFStream> {
+        const response = await this.ssfStreamsRetrieveRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+}
+
+/**
+ * @export
+ */
+export const SsfStreamsListDeliveryMethodEnum = {
+    HttpsSchemasOpenidNetSeceventRiscDeliveryMethodPoll: 'https://schemas.openid.net/secevent/risc/delivery-method/poll',
+    HttpsSchemasOpenidNetSeceventRiscDeliveryMethodPush: 'https://schemas.openid.net/secevent/risc/delivery-method/push',
+    UnknownDefaultOpenApi: '11184809'
+} as const;
+export type SsfStreamsListDeliveryMethodEnum = typeof SsfStreamsListDeliveryMethodEnum[keyof typeof SsfStreamsListDeliveryMethodEnum];

packages/client-ts/src/apis/TasksApi.ts

@@ -0,0 +1,728 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+
+import * as runtime from '../runtime';
+import type {
+  GenericError,
+  GlobalTaskStatus,
+  PaginatedScheduleList,
+  PaginatedTaskList,
+  PatchedScheduleRequest,
+  Schedule,
+  ScheduleRequest,
+  Task,
+  ValidationError,
+  Worker,
+} from '../models/index';
+import {
+    GenericErrorFromJSON,
+    GenericErrorToJSON,
+    GlobalTaskStatusFromJSON,
+    GlobalTaskStatusToJSON,
+    PaginatedScheduleListFromJSON,
+    PaginatedScheduleListToJSON,
+    PaginatedTaskListFromJSON,
+    PaginatedTaskListToJSON,
+    PatchedScheduleRequestFromJSON,
+    PatchedScheduleRequestToJSON,
+    ScheduleFromJSON,
+    ScheduleToJSON,
+    ScheduleRequestFromJSON,
+    ScheduleRequestToJSON,
+    TaskFromJSON,
+    TaskToJSON,
+    ValidationErrorFromJSON,
+    ValidationErrorToJSON,
+    WorkerFromJSON,
+    WorkerToJSON,
+} from '../models/index';
+
+export interface TasksSchedulesListRequest {
+    actorName?: string;
+    ordering?: string;
+    page?: number;
+    pageSize?: number;
+    paused?: boolean;
+    relObjContentTypeAppLabel?: string;
+    relObjContentTypeModel?: string;
+    relObjId?: string;
+    relObjIdIsnull?: boolean;
+    search?: string;
+}
+
+export interface TasksSchedulesPartialUpdateRequest {
+    id: string;
+    patchedScheduleRequest?: PatchedScheduleRequest;
+}
+
+export interface TasksSchedulesRetrieveRequest {
+    id: string;
+}
+
+export interface TasksSchedulesSendCreateRequest {
+    id: string;
+}
+
+export interface TasksSchedulesUpdateRequest {
+    id: string;
+    scheduleRequest: ScheduleRequest;
+}
+
+export interface TasksTasksListRequest {
+    actorName?: string;
+    aggregatedStatus?: Array<TasksTasksListAggregatedStatusEnum>;
+    ordering?: string;
+    page?: number;
+    pageSize?: number;
+    queueName?: string;
+    relObjContentTypeAppLabel?: string;
+    relObjContentTypeModel?: string;
+    relObjId?: string;
+    relObjIdIsnull?: boolean;
+    search?: string;
+    state?: TasksTasksListStateEnum;
+}
+
+export interface TasksTasksRetrieveRequest {
+    messageId: string;
+}
+
+export interface TasksTasksRetryCreateRequest {
+    messageId: string;
+}
+
+/**
+ * 
+ */
+export class TasksApi extends runtime.BaseAPI {
+
+    /**
+     * Creates request options for tasksSchedulesList without sending the request
+     */
+    async tasksSchedulesListRequestOpts(requestParameters: TasksSchedulesListRequest): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        if (requestParameters['actorName'] != null) {
+            queryParameters['actor_name'] = requestParameters['actorName'];
+        }
+
+        if (requestParameters['ordering'] != null) {
+            queryParameters['ordering'] = requestParameters['ordering'];
+        }
+
+        if (requestParameters['page'] != null) {
+            queryParameters['page'] = requestParameters['page'];
+        }
+
+        if (requestParameters['pageSize'] != null) {
+            queryParameters['page_size'] = requestParameters['pageSize'];
+        }
+
+        if (requestParameters['paused'] != null) {
+            queryParameters['paused'] = requestParameters['paused'];
+        }
+
+        if (requestParameters['relObjContentTypeAppLabel'] != null) {
+            queryParameters['rel_obj_content_type__app_label'] = requestParameters['relObjContentTypeAppLabel'];
+        }
+
+        if (requestParameters['relObjContentTypeModel'] != null) {
+            queryParameters['rel_obj_content_type__model'] = requestParameters['relObjContentTypeModel'];
+        }
+
+        if (requestParameters['relObjId'] != null) {
+            queryParameters['rel_obj_id'] = requestParameters['relObjId'];
+        }
+
+        if (requestParameters['relObjIdIsnull'] != null) {
+            queryParameters['rel_obj_id__isnull'] = requestParameters['relObjIdIsnull'];
+        }
+
+        if (requestParameters['search'] != null) {
+            queryParameters['search'] = requestParameters['search'];
+        }
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/tasks/schedules/`;
+
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     */
+    async tasksSchedulesListRaw(requestParameters: TasksSchedulesListRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<PaginatedScheduleList>> {
+        const requestOptions = await this.tasksSchedulesListRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => PaginatedScheduleListFromJSON(jsonValue));
+    }
+
+    /**
+     */
+    async tasksSchedulesList(requestParameters: TasksSchedulesListRequest = {}, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<PaginatedScheduleList> {
+        const response = await this.tasksSchedulesListRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for tasksSchedulesPartialUpdate without sending the request
+     */
+    async tasksSchedulesPartialUpdateRequestOpts(requestParameters: TasksSchedulesPartialUpdateRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['id'] == null) {
+            throw new runtime.RequiredError(
+                'id',
+                'Required parameter "id" was null or undefined when calling tasksSchedulesPartialUpdate().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters['Content-Type'] = 'application/json';
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/tasks/schedules/{id}/`;
+        urlPath = urlPath.replace(`{${"id"}}`, encodeURIComponent(String(requestParameters['id'])));
+
+        return {
+            path: urlPath,
+            method: 'PATCH',
+            headers: headerParameters,
+            query: queryParameters,
+            body: PatchedScheduleRequestToJSON(requestParameters['patchedScheduleRequest']),
+        };
+    }
+
+    /**
+     */
+    async tasksSchedulesPartialUpdateRaw(requestParameters: TasksSchedulesPartialUpdateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<Schedule>> {
+        const requestOptions = await this.tasksSchedulesPartialUpdateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => ScheduleFromJSON(jsonValue));
+    }
+
+    /**
+     */
+    async tasksSchedulesPartialUpdate(requestParameters: TasksSchedulesPartialUpdateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<Schedule> {
+        const response = await this.tasksSchedulesPartialUpdateRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for tasksSchedulesRetrieve without sending the request
+     */
+    async tasksSchedulesRetrieveRequestOpts(requestParameters: TasksSchedulesRetrieveRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['id'] == null) {
+            throw new runtime.RequiredError(
+                'id',
+                'Required parameter "id" was null or undefined when calling tasksSchedulesRetrieve().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/tasks/schedules/{id}/`;
+        urlPath = urlPath.replace(`{${"id"}}`, encodeURIComponent(String(requestParameters['id'])));
+
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     */
+    async tasksSchedulesRetrieveRaw(requestParameters: TasksSchedulesRetrieveRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<Schedule>> {
+        const requestOptions = await this.tasksSchedulesRetrieveRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => ScheduleFromJSON(jsonValue));
+    }
+
+    /**
+     */
+    async tasksSchedulesRetrieve(requestParameters: TasksSchedulesRetrieveRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<Schedule> {
+        const response = await this.tasksSchedulesRetrieveRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for tasksSchedulesSendCreate without sending the request
+     */
+    async tasksSchedulesSendCreateRequestOpts(requestParameters: TasksSchedulesSendCreateRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['id'] == null) {
+            throw new runtime.RequiredError(
+                'id',
+                'Required parameter "id" was null or undefined when calling tasksSchedulesSendCreate().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/tasks/schedules/{id}/send/`;
+        urlPath = urlPath.replace(`{${"id"}}`, encodeURIComponent(String(requestParameters['id'])));
+
+        return {
+            path: urlPath,
+            method: 'POST',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Trigger this schedule now
+     */
+    async tasksSchedulesSendCreateRaw(requestParameters: TasksSchedulesSendCreateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>> {
+        const requestOptions = await this.tasksSchedulesSendCreateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.VoidApiResponse(response);
+    }
+
+    /**
+     * Trigger this schedule now
+     */
+    async tasksSchedulesSendCreate(requestParameters: TasksSchedulesSendCreateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void> {
+        await this.tasksSchedulesSendCreateRaw(requestParameters, initOverrides);
+    }
+
+    /**
+     * Creates request options for tasksSchedulesUpdate without sending the request
+     */
+    async tasksSchedulesUpdateRequestOpts(requestParameters: TasksSchedulesUpdateRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['id'] == null) {
+            throw new runtime.RequiredError(
+                'id',
+                'Required parameter "id" was null or undefined when calling tasksSchedulesUpdate().'
+            );
+        }
+
+        if (requestParameters['scheduleRequest'] == null) {
+            throw new runtime.RequiredError(
+                'scheduleRequest',
+                'Required parameter "scheduleRequest" was null or undefined when calling tasksSchedulesUpdate().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters['Content-Type'] = 'application/json';
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/tasks/schedules/{id}/`;
+        urlPath = urlPath.replace(`{${"id"}}`, encodeURIComponent(String(requestParameters['id'])));
+
+        return {
+            path: urlPath,
+            method: 'PUT',
+            headers: headerParameters,
+            query: queryParameters,
+            body: ScheduleRequestToJSON(requestParameters['scheduleRequest']),
+        };
+    }
+
+    /**
+     */
+    async tasksSchedulesUpdateRaw(requestParameters: TasksSchedulesUpdateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<Schedule>> {
+        const requestOptions = await this.tasksSchedulesUpdateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => ScheduleFromJSON(jsonValue));
+    }
+
+    /**
+     */
+    async tasksSchedulesUpdate(requestParameters: TasksSchedulesUpdateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<Schedule> {
+        const response = await this.tasksSchedulesUpdateRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for tasksTasksList without sending the request
+     */
+    async tasksTasksListRequestOpts(requestParameters: TasksTasksListRequest): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        if (requestParameters['actorName'] != null) {
+            queryParameters['actor_name'] = requestParameters['actorName'];
+        }
+
+        if (requestParameters['aggregatedStatus'] != null) {
+            queryParameters['aggregated_status'] = requestParameters['aggregatedStatus'];
+        }
+
+        if (requestParameters['ordering'] != null) {
+            queryParameters['ordering'] = requestParameters['ordering'];
+        }
+
+        if (requestParameters['page'] != null) {
+            queryParameters['page'] = requestParameters['page'];
+        }
+
+        if (requestParameters['pageSize'] != null) {
+            queryParameters['page_size'] = requestParameters['pageSize'];
+        }
+
+        if (requestParameters['queueName'] != null) {
+            queryParameters['queue_name'] = requestParameters['queueName'];
+        }
+
+        if (requestParameters['relObjContentTypeAppLabel'] != null) {
+            queryParameters['rel_obj_content_type__app_label'] = requestParameters['relObjContentTypeAppLabel'];
+        }
+
+        if (requestParameters['relObjContentTypeModel'] != null) {
+            queryParameters['rel_obj_content_type__model'] = requestParameters['relObjContentTypeModel'];
+        }
+
+        if (requestParameters['relObjId'] != null) {
+            queryParameters['rel_obj_id'] = requestParameters['relObjId'];
+        }
+
+        if (requestParameters['relObjIdIsnull'] != null) {
+            queryParameters['rel_obj_id__isnull'] = requestParameters['relObjIdIsnull'];
+        }
+
+        if (requestParameters['search'] != null) {
+            queryParameters['search'] = requestParameters['search'];
+        }
+
+        if (requestParameters['state'] != null) {
+            queryParameters['state'] = requestParameters['state'];
+        }
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/tasks/tasks/`;
+
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     */
+    async tasksTasksListRaw(requestParameters: TasksTasksListRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<PaginatedTaskList>> {
+        const requestOptions = await this.tasksTasksListRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => PaginatedTaskListFromJSON(jsonValue));
+    }
+
+    /**
+     */
+    async tasksTasksList(requestParameters: TasksTasksListRequest = {}, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<PaginatedTaskList> {
+        const response = await this.tasksTasksListRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for tasksTasksRetrieve without sending the request
+     */
+    async tasksTasksRetrieveRequestOpts(requestParameters: TasksTasksRetrieveRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['messageId'] == null) {
+            throw new runtime.RequiredError(
+                'messageId',
+                'Required parameter "messageId" was null or undefined when calling tasksTasksRetrieve().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/tasks/tasks/{message_id}/`;
+        urlPath = urlPath.replace(`{${"message_id"}}`, encodeURIComponent(String(requestParameters['messageId'])));
+
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     */
+    async tasksTasksRetrieveRaw(requestParameters: TasksTasksRetrieveRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<Task>> {
+        const requestOptions = await this.tasksTasksRetrieveRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => TaskFromJSON(jsonValue));
+    }
+
+    /**
+     */
+    async tasksTasksRetrieve(requestParameters: TasksTasksRetrieveRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<Task> {
+        const response = await this.tasksTasksRetrieveRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for tasksTasksRetryCreate without sending the request
+     */
+    async tasksTasksRetryCreateRequestOpts(requestParameters: TasksTasksRetryCreateRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['messageId'] == null) {
+            throw new runtime.RequiredError(
+                'messageId',
+                'Required parameter "messageId" was null or undefined when calling tasksTasksRetryCreate().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/tasks/tasks/{message_id}/retry/`;
+        urlPath = urlPath.replace(`{${"message_id"}}`, encodeURIComponent(String(requestParameters['messageId'])));
+
+        return {
+            path: urlPath,
+            method: 'POST',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Retry task
+     */
+    async tasksTasksRetryCreateRaw(requestParameters: TasksTasksRetryCreateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>> {
+        const requestOptions = await this.tasksTasksRetryCreateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.VoidApiResponse(response);
+    }
+
+    /**
+     * Retry task
+     */
+    async tasksTasksRetryCreate(requestParameters: TasksTasksRetryCreateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void> {
+        await this.tasksTasksRetryCreateRaw(requestParameters, initOverrides);
+    }
+
+    /**
+     * Creates request options for tasksTasksStatusRetrieve without sending the request
+     */
+    async tasksTasksStatusRetrieveRequestOpts(): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/tasks/tasks/status/`;
+
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Global status summary for all tasks
+     */
+    async tasksTasksStatusRetrieveRaw(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<GlobalTaskStatus>> {
+        const requestOptions = await this.tasksTasksStatusRetrieveRequestOpts();
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => GlobalTaskStatusFromJSON(jsonValue));
+    }
+
+    /**
+     * Global status summary for all tasks
+     */
+    async tasksTasksStatusRetrieve(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<GlobalTaskStatus> {
+        const response = await this.tasksTasksStatusRetrieveRaw(initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for tasksWorkersList without sending the request
+     */
+    async tasksWorkersListRequestOpts(): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("authentik", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/tasks/workers/`;
+
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Get currently connected worker count.
+     */
+    async tasksWorkersListRaw(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<Array<Worker>>> {
+        const requestOptions = await this.tasksWorkersListRequestOpts();
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => jsonValue.map(WorkerFromJSON));
+    }
+
+    /**
+     * Get currently connected worker count.
+     */
+    async tasksWorkersList(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<Array<Worker>> {
+        const response = await this.tasksWorkersListRaw(initOverrides);
+        return await response.value();
+    }
+
+}
+
+/**
+ * @export
+ */
+export const TasksTasksListAggregatedStatusEnum = {
+    Consumed: 'consumed',
+    Done: 'done',
+    Error: 'error',
+    Info: 'info',
+    Postprocess: 'postprocess',
+    Preprocess: 'preprocess',
+    Queued: 'queued',
+    Rejected: 'rejected',
+    Running: 'running',
+    Warning: 'warning',
+    UnknownDefaultOpenApi: '11184809'
+} as const;
+export type TasksTasksListAggregatedStatusEnum = typeof TasksTasksListAggregatedStatusEnum[keyof typeof TasksTasksListAggregatedStatusEnum];
+/**
+ * @export
+ */
+export const TasksTasksListStateEnum = {
+    Consumed: 'consumed',
+    Done: 'done',
+    Postprocess: 'postprocess',
+    Preprocess: 'preprocess',
+    Queued: 'queued',
+    Rejected: 'rejected',
+    Running: 'running',
+    UnknownDefaultOpenApi: '11184809'
+} as const;
+export type TasksTasksListStateEnum = typeof TasksTasksListStateEnum[keyof typeof TasksTasksListStateEnum];

packages/client-ts/src/apis/TenantsApi.ts

@@ -0,0 +1,827 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+
+import * as runtime from '../runtime';
+import type {
+  Domain,
+  DomainRequest,
+  GenericError,
+  PaginatedDomainList,
+  PaginatedTenantList,
+  PatchedDomainRequest,
+  PatchedTenantRequest,
+  Tenant,
+  TenantAdminGroupRequestRequest,
+  TenantRecoveryKeyRequestRequest,
+  TenantRecoveryKeyResponse,
+  TenantRequest,
+  ValidationError,
+} from '../models/index';
+import {
+    DomainFromJSON,
+    DomainToJSON,
+    DomainRequestFromJSON,
+    DomainRequestToJSON,
+    GenericErrorFromJSON,
+    GenericErrorToJSON,
+    PaginatedDomainListFromJSON,
+    PaginatedDomainListToJSON,
+    PaginatedTenantListFromJSON,
+    PaginatedTenantListToJSON,
+    PatchedDomainRequestFromJSON,
+    PatchedDomainRequestToJSON,
+    PatchedTenantRequestFromJSON,
+    PatchedTenantRequestToJSON,
+    TenantFromJSON,
+    TenantToJSON,
+    TenantAdminGroupRequestRequestFromJSON,
+    TenantAdminGroupRequestRequestToJSON,
+    TenantRecoveryKeyRequestRequestFromJSON,
+    TenantRecoveryKeyRequestRequestToJSON,
+    TenantRecoveryKeyResponseFromJSON,
+    TenantRecoveryKeyResponseToJSON,
+    TenantRequestFromJSON,
+    TenantRequestToJSON,
+    ValidationErrorFromJSON,
+    ValidationErrorToJSON,
+} from '../models/index';
+
+export interface TenantsDomainsCreateRequest {
+    domainRequest: DomainRequest;
+}
+
+export interface TenantsDomainsDestroyRequest {
+    id: number;
+}
+
+export interface TenantsDomainsListRequest {
+    ordering?: string;
+    page?: number;
+    pageSize?: number;
+    search?: string;
+}
+
+export interface TenantsDomainsPartialUpdateRequest {
+    id: number;
+    patchedDomainRequest?: PatchedDomainRequest;
+}
+
+export interface TenantsDomainsRetrieveRequest {
+    id: number;
+}
+
+export interface TenantsDomainsUpdateRequest {
+    id: number;
+    domainRequest: DomainRequest;
+}
+
+export interface TenantsTenantsCreateRequest {
+    tenantRequest: TenantRequest;
+}
+
+export interface TenantsTenantsCreateAdminGroupCreateRequest {
+    tenantUuid: string;
+    tenantAdminGroupRequestRequest: TenantAdminGroupRequestRequest;
+}
+
+export interface TenantsTenantsCreateRecoveryKeyCreateRequest {
+    tenantUuid: string;
+    tenantRecoveryKeyRequestRequest: TenantRecoveryKeyRequestRequest;
+}
+
+export interface TenantsTenantsDestroyRequest {
+    tenantUuid: string;
+}
+
+export interface TenantsTenantsListRequest {
+    ordering?: string;
+    page?: number;
+    pageSize?: number;
+    search?: string;
+}
+
+export interface TenantsTenantsPartialUpdateRequest {
+    tenantUuid: string;
+    patchedTenantRequest?: PatchedTenantRequest;
+}
+
+export interface TenantsTenantsRetrieveRequest {
+    tenantUuid: string;
+}
+
+export interface TenantsTenantsUpdateRequest {
+    tenantUuid: string;
+    tenantRequest: TenantRequest;
+}
+
+/**
+ * 
+ */
+export class TenantsApi extends runtime.BaseAPI {
+
+    /**
+     * Creates request options for tenantsDomainsCreate without sending the request
+     */
+    async tenantsDomainsCreateRequestOpts(requestParameters: TenantsDomainsCreateRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['domainRequest'] == null) {
+            throw new runtime.RequiredError(
+                'domainRequest',
+                'Required parameter "domainRequest" was null or undefined when calling tenantsDomainsCreate().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters['Content-Type'] = 'application/json';
+
+
+        let urlPath = `/tenants/domains/`;
+
+        return {
+            path: urlPath,
+            method: 'POST',
+            headers: headerParameters,
+            query: queryParameters,
+            body: DomainRequestToJSON(requestParameters['domainRequest']),
+        };
+    }
+
+    /**
+     * Domain ViewSet
+     */
+    async tenantsDomainsCreateRaw(requestParameters: TenantsDomainsCreateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<Domain>> {
+        const requestOptions = await this.tenantsDomainsCreateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => DomainFromJSON(jsonValue));
+    }
+
+    /**
+     * Domain ViewSet
+     */
+    async tenantsDomainsCreate(requestParameters: TenantsDomainsCreateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<Domain> {
+        const response = await this.tenantsDomainsCreateRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for tenantsDomainsDestroy without sending the request
+     */
+    async tenantsDomainsDestroyRequestOpts(requestParameters: TenantsDomainsDestroyRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['id'] == null) {
+            throw new runtime.RequiredError(
+                'id',
+                'Required parameter "id" was null or undefined when calling tenantsDomainsDestroy().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+
+        let urlPath = `/tenants/domains/{id}/`;
+        urlPath = urlPath.replace(`{${"id"}}`, encodeURIComponent(String(requestParameters['id'])));
+
+        return {
+            path: urlPath,
+            method: 'DELETE',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Domain ViewSet
+     */
+    async tenantsDomainsDestroyRaw(requestParameters: TenantsDomainsDestroyRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>> {
+        const requestOptions = await this.tenantsDomainsDestroyRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.VoidApiResponse(response);
+    }
+
+    /**
+     * Domain ViewSet
+     */
+    async tenantsDomainsDestroy(requestParameters: TenantsDomainsDestroyRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void> {
+        await this.tenantsDomainsDestroyRaw(requestParameters, initOverrides);
+    }
+
+    /**
+     * Creates request options for tenantsDomainsList without sending the request
+     */
+    async tenantsDomainsListRequestOpts(requestParameters: TenantsDomainsListRequest): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        if (requestParameters['ordering'] != null) {
+            queryParameters['ordering'] = requestParameters['ordering'];
+        }
+
+        if (requestParameters['page'] != null) {
+            queryParameters['page'] = requestParameters['page'];
+        }
+
+        if (requestParameters['pageSize'] != null) {
+            queryParameters['page_size'] = requestParameters['pageSize'];
+        }
+
+        if (requestParameters['search'] != null) {
+            queryParameters['search'] = requestParameters['search'];
+        }
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+
+        let urlPath = `/tenants/domains/`;
+
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Domain ViewSet
+     */
+    async tenantsDomainsListRaw(requestParameters: TenantsDomainsListRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<PaginatedDomainList>> {
+        const requestOptions = await this.tenantsDomainsListRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => PaginatedDomainListFromJSON(jsonValue));
+    }
+
+    /**
+     * Domain ViewSet
+     */
+    async tenantsDomainsList(requestParameters: TenantsDomainsListRequest = {}, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<PaginatedDomainList> {
+        const response = await this.tenantsDomainsListRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for tenantsDomainsPartialUpdate without sending the request
+     */
+    async tenantsDomainsPartialUpdateRequestOpts(requestParameters: TenantsDomainsPartialUpdateRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['id'] == null) {
+            throw new runtime.RequiredError(
+                'id',
+                'Required parameter "id" was null or undefined when calling tenantsDomainsPartialUpdate().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters['Content-Type'] = 'application/json';
+
+
+        let urlPath = `/tenants/domains/{id}/`;
+        urlPath = urlPath.replace(`{${"id"}}`, encodeURIComponent(String(requestParameters['id'])));
+
+        return {
+            path: urlPath,
+            method: 'PATCH',
+            headers: headerParameters,
+            query: queryParameters,
+            body: PatchedDomainRequestToJSON(requestParameters['patchedDomainRequest']),
+        };
+    }
+
+    /**
+     * Domain ViewSet
+     */
+    async tenantsDomainsPartialUpdateRaw(requestParameters: TenantsDomainsPartialUpdateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<Domain>> {
+        const requestOptions = await this.tenantsDomainsPartialUpdateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => DomainFromJSON(jsonValue));
+    }
+
+    /**
+     * Domain ViewSet
+     */
+    async tenantsDomainsPartialUpdate(requestParameters: TenantsDomainsPartialUpdateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<Domain> {
+        const response = await this.tenantsDomainsPartialUpdateRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for tenantsDomainsRetrieve without sending the request
+     */
+    async tenantsDomainsRetrieveRequestOpts(requestParameters: TenantsDomainsRetrieveRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['id'] == null) {
+            throw new runtime.RequiredError(
+                'id',
+                'Required parameter "id" was null or undefined when calling tenantsDomainsRetrieve().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+
+        let urlPath = `/tenants/domains/{id}/`;
+        urlPath = urlPath.replace(`{${"id"}}`, encodeURIComponent(String(requestParameters['id'])));
+
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Domain ViewSet
+     */
+    async tenantsDomainsRetrieveRaw(requestParameters: TenantsDomainsRetrieveRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<Domain>> {
+        const requestOptions = await this.tenantsDomainsRetrieveRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => DomainFromJSON(jsonValue));
+    }
+
+    /**
+     * Domain ViewSet
+     */
+    async tenantsDomainsRetrieve(requestParameters: TenantsDomainsRetrieveRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<Domain> {
+        const response = await this.tenantsDomainsRetrieveRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for tenantsDomainsUpdate without sending the request
+     */
+    async tenantsDomainsUpdateRequestOpts(requestParameters: TenantsDomainsUpdateRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['id'] == null) {
+            throw new runtime.RequiredError(
+                'id',
+                'Required parameter "id" was null or undefined when calling tenantsDomainsUpdate().'
+            );
+        }
+
+        if (requestParameters['domainRequest'] == null) {
+            throw new runtime.RequiredError(
+                'domainRequest',
+                'Required parameter "domainRequest" was null or undefined when calling tenantsDomainsUpdate().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters['Content-Type'] = 'application/json';
+
+
+        let urlPath = `/tenants/domains/{id}/`;
+        urlPath = urlPath.replace(`{${"id"}}`, encodeURIComponent(String(requestParameters['id'])));
+
+        return {
+            path: urlPath,
+            method: 'PUT',
+            headers: headerParameters,
+            query: queryParameters,
+            body: DomainRequestToJSON(requestParameters['domainRequest']),
+        };
+    }
+
+    /**
+     * Domain ViewSet
+     */
+    async tenantsDomainsUpdateRaw(requestParameters: TenantsDomainsUpdateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<Domain>> {
+        const requestOptions = await this.tenantsDomainsUpdateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => DomainFromJSON(jsonValue));
+    }
+
+    /**
+     * Domain ViewSet
+     */
+    async tenantsDomainsUpdate(requestParameters: TenantsDomainsUpdateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<Domain> {
+        const response = await this.tenantsDomainsUpdateRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for tenantsTenantsCreate without sending the request
+     */
+    async tenantsTenantsCreateRequestOpts(requestParameters: TenantsTenantsCreateRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['tenantRequest'] == null) {
+            throw new runtime.RequiredError(
+                'tenantRequest',
+                'Required parameter "tenantRequest" was null or undefined when calling tenantsTenantsCreate().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters['Content-Type'] = 'application/json';
+
+
+        let urlPath = `/tenants/tenants/`;
+
+        return {
+            path: urlPath,
+            method: 'POST',
+            headers: headerParameters,
+            query: queryParameters,
+            body: TenantRequestToJSON(requestParameters['tenantRequest']),
+        };
+    }
+
+    /**
+     * Tenant Viewset
+     */
+    async tenantsTenantsCreateRaw(requestParameters: TenantsTenantsCreateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<Tenant>> {
+        const requestOptions = await this.tenantsTenantsCreateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => TenantFromJSON(jsonValue));
+    }
+
+    /**
+     * Tenant Viewset
+     */
+    async tenantsTenantsCreate(requestParameters: TenantsTenantsCreateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<Tenant> {
+        const response = await this.tenantsTenantsCreateRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for tenantsTenantsCreateAdminGroupCreate without sending the request
+     */
+    async tenantsTenantsCreateAdminGroupCreateRequestOpts(requestParameters: TenantsTenantsCreateAdminGroupCreateRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['tenantUuid'] == null) {
+            throw new runtime.RequiredError(
+                'tenantUuid',
+                'Required parameter "tenantUuid" was null or undefined when calling tenantsTenantsCreateAdminGroupCreate().'
+            );
+        }
+
+        if (requestParameters['tenantAdminGroupRequestRequest'] == null) {
+            throw new runtime.RequiredError(
+                'tenantAdminGroupRequestRequest',
+                'Required parameter "tenantAdminGroupRequestRequest" was null or undefined when calling tenantsTenantsCreateAdminGroupCreate().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters['Content-Type'] = 'application/json';
+
+
+        let urlPath = `/tenants/tenants/{tenant_uuid}/create_admin_group/`;
+        urlPath = urlPath.replace(`{${"tenant_uuid"}}`, encodeURIComponent(String(requestParameters['tenantUuid'])));
+
+        return {
+            path: urlPath,
+            method: 'POST',
+            headers: headerParameters,
+            query: queryParameters,
+            body: TenantAdminGroupRequestRequestToJSON(requestParameters['tenantAdminGroupRequestRequest']),
+        };
+    }
+
+    /**
+     * Create admin group and add user to it.
+     */
+    async tenantsTenantsCreateAdminGroupCreateRaw(requestParameters: TenantsTenantsCreateAdminGroupCreateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>> {
+        const requestOptions = await this.tenantsTenantsCreateAdminGroupCreateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.VoidApiResponse(response);
+    }
+
+    /**
+     * Create admin group and add user to it.
+     */
+    async tenantsTenantsCreateAdminGroupCreate(requestParameters: TenantsTenantsCreateAdminGroupCreateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void> {
+        await this.tenantsTenantsCreateAdminGroupCreateRaw(requestParameters, initOverrides);
+    }
+
+    /**
+     * Creates request options for tenantsTenantsCreateRecoveryKeyCreate without sending the request
+     */
+    async tenantsTenantsCreateRecoveryKeyCreateRequestOpts(requestParameters: TenantsTenantsCreateRecoveryKeyCreateRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['tenantUuid'] == null) {
+            throw new runtime.RequiredError(
+                'tenantUuid',
+                'Required parameter "tenantUuid" was null or undefined when calling tenantsTenantsCreateRecoveryKeyCreate().'
+            );
+        }
+
+        if (requestParameters['tenantRecoveryKeyRequestRequest'] == null) {
+            throw new runtime.RequiredError(
+                'tenantRecoveryKeyRequestRequest',
+                'Required parameter "tenantRecoveryKeyRequestRequest" was null or undefined when calling tenantsTenantsCreateRecoveryKeyCreate().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters['Content-Type'] = 'application/json';
+
+
+        let urlPath = `/tenants/tenants/{tenant_uuid}/create_recovery_key/`;
+        urlPath = urlPath.replace(`{${"tenant_uuid"}}`, encodeURIComponent(String(requestParameters['tenantUuid'])));
+
+        return {
+            path: urlPath,
+            method: 'POST',
+            headers: headerParameters,
+            query: queryParameters,
+            body: TenantRecoveryKeyRequestRequestToJSON(requestParameters['tenantRecoveryKeyRequestRequest']),
+        };
+    }
+
+    /**
+     * Create recovery key for user.
+     */
+    async tenantsTenantsCreateRecoveryKeyCreateRaw(requestParameters: TenantsTenantsCreateRecoveryKeyCreateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<TenantRecoveryKeyResponse>> {
+        const requestOptions = await this.tenantsTenantsCreateRecoveryKeyCreateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => TenantRecoveryKeyResponseFromJSON(jsonValue));
+    }
+
+    /**
+     * Create recovery key for user.
+     */
+    async tenantsTenantsCreateRecoveryKeyCreate(requestParameters: TenantsTenantsCreateRecoveryKeyCreateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<TenantRecoveryKeyResponse> {
+        const response = await this.tenantsTenantsCreateRecoveryKeyCreateRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for tenantsTenantsDestroy without sending the request
+     */
+    async tenantsTenantsDestroyRequestOpts(requestParameters: TenantsTenantsDestroyRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['tenantUuid'] == null) {
+            throw new runtime.RequiredError(
+                'tenantUuid',
+                'Required parameter "tenantUuid" was null or undefined when calling tenantsTenantsDestroy().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+
+        let urlPath = `/tenants/tenants/{tenant_uuid}/`;
+        urlPath = urlPath.replace(`{${"tenant_uuid"}}`, encodeURIComponent(String(requestParameters['tenantUuid'])));
+
+        return {
+            path: urlPath,
+            method: 'DELETE',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Tenant Viewset
+     */
+    async tenantsTenantsDestroyRaw(requestParameters: TenantsTenantsDestroyRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>> {
+        const requestOptions = await this.tenantsTenantsDestroyRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.VoidApiResponse(response);
+    }
+
+    /**
+     * Tenant Viewset
+     */
+    async tenantsTenantsDestroy(requestParameters: TenantsTenantsDestroyRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void> {
+        await this.tenantsTenantsDestroyRaw(requestParameters, initOverrides);
+    }
+
+    /**
+     * Creates request options for tenantsTenantsList without sending the request
+     */
+    async tenantsTenantsListRequestOpts(requestParameters: TenantsTenantsListRequest): Promise<runtime.RequestOpts> {
+        const queryParameters: any = {};
+
+        if (requestParameters['ordering'] != null) {
+            queryParameters['ordering'] = requestParameters['ordering'];
+        }
+
+        if (requestParameters['page'] != null) {
+            queryParameters['page'] = requestParameters['page'];
+        }
+
+        if (requestParameters['pageSize'] != null) {
+            queryParameters['page_size'] = requestParameters['pageSize'];
+        }
+
+        if (requestParameters['search'] != null) {
+            queryParameters['search'] = requestParameters['search'];
+        }
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+
+        let urlPath = `/tenants/tenants/`;
+
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Tenant Viewset
+     */
+    async tenantsTenantsListRaw(requestParameters: TenantsTenantsListRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<PaginatedTenantList>> {
+        const requestOptions = await this.tenantsTenantsListRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => PaginatedTenantListFromJSON(jsonValue));
+    }
+
+    /**
+     * Tenant Viewset
+     */
+    async tenantsTenantsList(requestParameters: TenantsTenantsListRequest = {}, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<PaginatedTenantList> {
+        const response = await this.tenantsTenantsListRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for tenantsTenantsPartialUpdate without sending the request
+     */
+    async tenantsTenantsPartialUpdateRequestOpts(requestParameters: TenantsTenantsPartialUpdateRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['tenantUuid'] == null) {
+            throw new runtime.RequiredError(
+                'tenantUuid',
+                'Required parameter "tenantUuid" was null or undefined when calling tenantsTenantsPartialUpdate().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters['Content-Type'] = 'application/json';
+
+
+        let urlPath = `/tenants/tenants/{tenant_uuid}/`;
+        urlPath = urlPath.replace(`{${"tenant_uuid"}}`, encodeURIComponent(String(requestParameters['tenantUuid'])));
+
+        return {
+            path: urlPath,
+            method: 'PATCH',
+            headers: headerParameters,
+            query: queryParameters,
+            body: PatchedTenantRequestToJSON(requestParameters['patchedTenantRequest']),
+        };
+    }
+
+    /**
+     * Tenant Viewset
+     */
+    async tenantsTenantsPartialUpdateRaw(requestParameters: TenantsTenantsPartialUpdateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<Tenant>> {
+        const requestOptions = await this.tenantsTenantsPartialUpdateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => TenantFromJSON(jsonValue));
+    }
+
+    /**
+     * Tenant Viewset
+     */
+    async tenantsTenantsPartialUpdate(requestParameters: TenantsTenantsPartialUpdateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<Tenant> {
+        const response = await this.tenantsTenantsPartialUpdateRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for tenantsTenantsRetrieve without sending the request
+     */
+    async tenantsTenantsRetrieveRequestOpts(requestParameters: TenantsTenantsRetrieveRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['tenantUuid'] == null) {
+            throw new runtime.RequiredError(
+                'tenantUuid',
+                'Required parameter "tenantUuid" was null or undefined when calling tenantsTenantsRetrieve().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+
+        let urlPath = `/tenants/tenants/{tenant_uuid}/`;
+        urlPath = urlPath.replace(`{${"tenant_uuid"}}`, encodeURIComponent(String(requestParameters['tenantUuid'])));
+
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+
+    /**
+     * Tenant Viewset
+     */
+    async tenantsTenantsRetrieveRaw(requestParameters: TenantsTenantsRetrieveRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<Tenant>> {
+        const requestOptions = await this.tenantsTenantsRetrieveRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => TenantFromJSON(jsonValue));
+    }
+
+    /**
+     * Tenant Viewset
+     */
+    async tenantsTenantsRetrieve(requestParameters: TenantsTenantsRetrieveRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<Tenant> {
+        const response = await this.tenantsTenantsRetrieveRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for tenantsTenantsUpdate without sending the request
+     */
+    async tenantsTenantsUpdateRequestOpts(requestParameters: TenantsTenantsUpdateRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['tenantUuid'] == null) {
+            throw new runtime.RequiredError(
+                'tenantUuid',
+                'Required parameter "tenantUuid" was null or undefined when calling tenantsTenantsUpdate().'
+            );
+        }
+
+        if (requestParameters['tenantRequest'] == null) {
+            throw new runtime.RequiredError(
+                'tenantRequest',
+                'Required parameter "tenantRequest" was null or undefined when calling tenantsTenantsUpdate().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters['Content-Type'] = 'application/json';
+
+
+        let urlPath = `/tenants/tenants/{tenant_uuid}/`;
+        urlPath = urlPath.replace(`{${"tenant_uuid"}}`, encodeURIComponent(String(requestParameters['tenantUuid'])));
+
+        return {
+            path: urlPath,
+            method: 'PUT',
+            headers: headerParameters,
+            query: queryParameters,
+            body: TenantRequestToJSON(requestParameters['tenantRequest']),
+        };
+    }
+
+    /**
+     * Tenant Viewset
+     */
+    async tenantsTenantsUpdateRaw(requestParameters: TenantsTenantsUpdateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<Tenant>> {
+        const requestOptions = await this.tenantsTenantsUpdateRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => TenantFromJSON(jsonValue));
+    }
+
+    /**
+     * Tenant Viewset
+     */
+    async tenantsTenantsUpdate(requestParameters: TenantsTenantsUpdateRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<Tenant> {
+        const response = await this.tenantsTenantsUpdateRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+}

packages/client-ts/src/apis/index.ts

@@ -0,0 +1,27 @@
+/* tslint:disable */
+/* eslint-disable */
+export * from './AdminApi';
+export * from './AuthenticatorsApi';
+export * from './CoreApi';
+export * from './CryptoApi';
+export * from './EndpointsApi';
+export * from './EnterpriseApi';
+export * from './EventsApi';
+export * from './FlowsApi';
+export * from './LifecycleApi';
+export * from './ManagedApi';
+export * from './Oauth2Api';
+export * from './OutpostsApi';
+export * from './PoliciesApi';
+export * from './PropertymappingsApi';
+export * from './ProvidersApi';
+export * from './RacApi';
+export * from './RbacApi';
+export * from './ReportsApi';
+export * from './RootApi';
+export * from './SchemaApi';
+export * from './SourcesApi';
+export * from './SsfApi';
+export * from './StagesApi';
+export * from './TasksApi';
+export * from './TenantsApi';

packages/client-ts/src/index.ts

@@ -0,0 +1,5 @@
+/* tslint:disable */
+/* eslint-disable */
+export * from './runtime';
+export * from './apis/index';
+export * from './models/index';

packages/client-ts/src/models/AccessDeniedChallenge.ts

@@ -0,0 +1,122 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import { mapValues } from '../runtime';
+import type { ErrorDetail } from './ErrorDetail';
+import {
+    ErrorDetailFromJSON,
+    ErrorDetailFromJSONTyped,
+    ErrorDetailToJSON,
+    ErrorDetailToJSONTyped,
+} from './ErrorDetail';
+import type { ContextualFlowInfo } from './ContextualFlowInfo';
+import {
+    ContextualFlowInfoFromJSON,
+    ContextualFlowInfoFromJSONTyped,
+    ContextualFlowInfoToJSON,
+    ContextualFlowInfoToJSONTyped,
+} from './ContextualFlowInfo';
+
+/**
+ * Challenge when a flow's active stage calls `stage_invalid()`.
+ * @export
+ * @interface AccessDeniedChallenge
+ */
+export interface AccessDeniedChallenge {
+    /**
+     * 
+     * @type {ContextualFlowInfo}
+     * @memberof AccessDeniedChallenge
+     */
+    flowInfo?: ContextualFlowInfo;
+    /**
+     * 
+     * @type {string}
+     * @memberof AccessDeniedChallenge
+     */
+    component?: string;
+    /**
+     * 
+     * @type {{ [key: string]: Array<ErrorDetail>; }}
+     * @memberof AccessDeniedChallenge
+     */
+    responseErrors?: { [key: string]: Array<ErrorDetail>; };
+    /**
+     * 
+     * @type {string}
+     * @memberof AccessDeniedChallenge
+     */
+    pendingUser: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AccessDeniedChallenge
+     */
+    pendingUserAvatar: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AccessDeniedChallenge
+     */
+    errorMessage?: string;
+}
+
+/**
+ * Check if a given object implements the AccessDeniedChallenge interface.
+ */
+export function instanceOfAccessDeniedChallenge(value: object): value is AccessDeniedChallenge {
+    if (!('pendingUser' in value) || value['pendingUser'] === undefined) return false;
+    if (!('pendingUserAvatar' in value) || value['pendingUserAvatar'] === undefined) return false;
+    return true;
+}
+
+export function AccessDeniedChallengeFromJSON(json: any): AccessDeniedChallenge {
+    return AccessDeniedChallengeFromJSONTyped(json, false);
+}
+
+export function AccessDeniedChallengeFromJSONTyped(json: any, ignoreDiscriminator: boolean): AccessDeniedChallenge {
+    if (json == null) {
+        return json;
+    }
+    return {
+        
+        'flowInfo': json['flow_info'] == null ? undefined : ContextualFlowInfoFromJSON(json['flow_info']),
+        'component': json['component'] == null ? undefined : json['component'],
+        'responseErrors': json['response_errors'] == null ? undefined : json['response_errors'],
+        'pendingUser': json['pending_user'],
+        'pendingUserAvatar': json['pending_user_avatar'],
+        'errorMessage': json['error_message'] == null ? undefined : json['error_message'],
+    };
+}
+
+export function AccessDeniedChallengeToJSON(json: any): AccessDeniedChallenge {
+    return AccessDeniedChallengeToJSONTyped(json, false);
+}
+
+export function AccessDeniedChallengeToJSONTyped(value?: AccessDeniedChallenge | null, ignoreDiscriminator: boolean = false): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        
+        'flow_info': ContextualFlowInfoToJSON(value['flowInfo']),
+        'component': value['component'],
+        'response_errors': value['responseErrors'],
+        'pending_user': value['pendingUser'],
+        'pending_user_avatar': value['pendingUserAvatar'],
+        'error_message': value['errorMessage'],
+    };
+}
+

packages/client-ts/src/models/AgentAuthenticationResponse.ts

@@ -0,0 +1,66 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import { mapValues } from '../runtime';
+/**
+ * Base serializer class which doesn't implement create/update methods
+ * @export
+ * @interface AgentAuthenticationResponse
+ */
+export interface AgentAuthenticationResponse {
+    /**
+     * 
+     * @type {string}
+     * @memberof AgentAuthenticationResponse
+     */
+    url: string;
+}
+
+/**
+ * Check if a given object implements the AgentAuthenticationResponse interface.
+ */
+export function instanceOfAgentAuthenticationResponse(value: object): value is AgentAuthenticationResponse {
+    if (!('url' in value) || value['url'] === undefined) return false;
+    return true;
+}
+
+export function AgentAuthenticationResponseFromJSON(json: any): AgentAuthenticationResponse {
+    return AgentAuthenticationResponseFromJSONTyped(json, false);
+}
+
+export function AgentAuthenticationResponseFromJSONTyped(json: any, ignoreDiscriminator: boolean): AgentAuthenticationResponse {
+    if (json == null) {
+        return json;
+    }
+    return {
+        
+        'url': json['url'],
+    };
+}
+
+export function AgentAuthenticationResponseToJSON(json: any): AgentAuthenticationResponse {
+    return AgentAuthenticationResponseToJSONTyped(json, false);
+}
+
+export function AgentAuthenticationResponseToJSONTyped(value?: AgentAuthenticationResponse | null, ignoreDiscriminator: boolean = false): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        
+        'url': value['url'],
+    };
+}
+

packages/client-ts/src/models/AgentConfig.ts

@@ -0,0 +1,157 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import { mapValues } from '../runtime';
+import type { LicenseStatusEnum } from './LicenseStatusEnum';
+import {
+    LicenseStatusEnumFromJSON,
+    LicenseStatusEnumFromJSONTyped,
+    LicenseStatusEnumToJSON,
+    LicenseStatusEnumToJSONTyped,
+} from './LicenseStatusEnum';
+import type { Config } from './Config';
+import {
+    ConfigFromJSON,
+    ConfigFromJSONTyped,
+    ConfigToJSON,
+    ConfigToJSONTyped,
+} from './Config';
+
+/**
+ * Base serializer class which doesn't implement create/update methods
+ * @export
+ * @interface AgentConfig
+ */
+export interface AgentConfig {
+    /**
+     * 
+     * @type {string}
+     * @memberof AgentConfig
+     */
+    readonly deviceId: string;
+    /**
+     * 
+     * @type {number}
+     * @memberof AgentConfig
+     */
+    readonly refreshInterval: number;
+    /**
+     * 
+     * @type {string}
+     * @memberof AgentConfig
+     */
+    readonly authorizationFlow: string | null;
+    /**
+     * 
+     * @type {{ [key: string]: any; }}
+     * @memberof AgentConfig
+     */
+    readonly jwksAuth: { [key: string]: any; };
+    /**
+     * 
+     * @type {{ [key: string]: any; }}
+     * @memberof AgentConfig
+     */
+    readonly jwksChallenge: { [key: string]: any; } | null;
+    /**
+     * 
+     * @type {number}
+     * @memberof AgentConfig
+     */
+    nssUidOffset: number;
+    /**
+     * 
+     * @type {number}
+     * @memberof AgentConfig
+     */
+    nssGidOffset: number;
+    /**
+     * 
+     * @type {boolean}
+     * @memberof AgentConfig
+     */
+    authTerminateSessionOnExpiry: boolean;
+    /**
+     * 
+     * @type {Config}
+     * @memberof AgentConfig
+     */
+    readonly systemConfig: Config;
+    /**
+     * 
+     * @type {LicenseStatusEnum}
+     * @memberof AgentConfig
+     */
+    readonly licenseStatus: LicenseStatusEnum | null;
+}
+
+
+
+/**
+ * Check if a given object implements the AgentConfig interface.
+ */
+export function instanceOfAgentConfig(value: object): value is AgentConfig {
+    if (!('deviceId' in value) || value['deviceId'] === undefined) return false;
+    if (!('refreshInterval' in value) || value['refreshInterval'] === undefined) return false;
+    if (!('authorizationFlow' in value) || value['authorizationFlow'] === undefined) return false;
+    if (!('jwksAuth' in value) || value['jwksAuth'] === undefined) return false;
+    if (!('jwksChallenge' in value) || value['jwksChallenge'] === undefined) return false;
+    if (!('nssUidOffset' in value) || value['nssUidOffset'] === undefined) return false;
+    if (!('nssGidOffset' in value) || value['nssGidOffset'] === undefined) return false;
+    if (!('authTerminateSessionOnExpiry' in value) || value['authTerminateSessionOnExpiry'] === undefined) return false;
+    if (!('systemConfig' in value) || value['systemConfig'] === undefined) return false;
+    if (!('licenseStatus' in value) || value['licenseStatus'] === undefined) return false;
+    return true;
+}
+
+export function AgentConfigFromJSON(json: any): AgentConfig {
+    return AgentConfigFromJSONTyped(json, false);
+}
+
+export function AgentConfigFromJSONTyped(json: any, ignoreDiscriminator: boolean): AgentConfig {
+    if (json == null) {
+        return json;
+    }
+    return {
+        
+        'deviceId': json['device_id'],
+        'refreshInterval': json['refresh_interval'],
+        'authorizationFlow': json['authorization_flow'],
+        'jwksAuth': json['jwks_auth'],
+        'jwksChallenge': json['jwks_challenge'],
+        'nssUidOffset': json['nss_uid_offset'],
+        'nssGidOffset': json['nss_gid_offset'],
+        'authTerminateSessionOnExpiry': json['auth_terminate_session_on_expiry'],
+        'systemConfig': ConfigFromJSON(json['system_config']),
+        'licenseStatus': LicenseStatusEnumFromJSON(json['license_status']),
+    };
+}
+
+export function AgentConfigToJSON(json: any): AgentConfig {
+    return AgentConfigToJSONTyped(json, false);
+}
+
+export function AgentConfigToJSONTyped(value?: Omit<AgentConfig, 'device_id'|'refresh_interval'|'authorization_flow'|'jwks_auth'|'jwks_challenge'|'system_config'|'license_status'> | null, ignoreDiscriminator: boolean = false): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        
+        'nss_uid_offset': value['nssUidOffset'],
+        'nss_gid_offset': value['nssGidOffset'],
+        'auth_terminate_session_on_expiry': value['authTerminateSessionOnExpiry'],
+    };
+}
+

packages/client-ts/src/models/AgentConnector.ts

@@ -0,0 +1,202 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import { mapValues } from '../runtime';
+/**
+ * 
+ * @export
+ * @interface AgentConnector
+ */
+export interface AgentConnector {
+    /**
+     * 
+     * @type {string}
+     * @memberof AgentConnector
+     */
+    connectorUuid?: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AgentConnector
+     */
+    name: string;
+    /**
+     * 
+     * @type {boolean}
+     * @memberof AgentConnector
+     */
+    enabled?: boolean;
+    /**
+     * Get object component so that we know how to edit the object
+     * @type {string}
+     * @memberof AgentConnector
+     */
+    readonly component: string;
+    /**
+     * Return object's verbose_name
+     * @type {string}
+     * @memberof AgentConnector
+     */
+    readonly verboseName: string;
+    /**
+     * Return object's plural verbose_name
+     * @type {string}
+     * @memberof AgentConnector
+     */
+    readonly verboseNamePlural: string;
+    /**
+     * Return internal model name
+     * @type {string}
+     * @memberof AgentConnector
+     */
+    readonly metaModelName: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AgentConnector
+     */
+    snapshotExpiry?: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AgentConnector
+     */
+    authSessionDuration?: string;
+    /**
+     * 
+     * @type {boolean}
+     * @memberof AgentConnector
+     */
+    authTerminateSessionOnExpiry?: boolean;
+    /**
+     * 
+     * @type {string}
+     * @memberof AgentConnector
+     */
+    refreshInterval?: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AgentConnector
+     */
+    authorizationFlow?: string | null;
+    /**
+     * 
+     * @type {number}
+     * @memberof AgentConnector
+     */
+    nssUidOffset?: number;
+    /**
+     * 
+     * @type {number}
+     * @memberof AgentConnector
+     */
+    nssGidOffset?: number;
+    /**
+     * 
+     * @type {string}
+     * @memberof AgentConnector
+     */
+    challengeKey?: string | null;
+    /**
+     * 
+     * @type {string}
+     * @memberof AgentConnector
+     */
+    challengeIdleTimeout?: string;
+    /**
+     * 
+     * @type {boolean}
+     * @memberof AgentConnector
+     */
+    challengeTriggerCheckIn?: boolean;
+    /**
+     * 
+     * @type {Array<number>}
+     * @memberof AgentConnector
+     */
+    jwtFederationProviders?: Array<number>;
+}
+
+/**
+ * Check if a given object implements the AgentConnector interface.
+ */
+export function instanceOfAgentConnector(value: object): value is AgentConnector {
+    if (!('name' in value) || value['name'] === undefined) return false;
+    if (!('component' in value) || value['component'] === undefined) return false;
+    if (!('verboseName' in value) || value['verboseName'] === undefined) return false;
+    if (!('verboseNamePlural' in value) || value['verboseNamePlural'] === undefined) return false;
+    if (!('metaModelName' in value) || value['metaModelName'] === undefined) return false;
+    return true;
+}
+
+export function AgentConnectorFromJSON(json: any): AgentConnector {
+    return AgentConnectorFromJSONTyped(json, false);
+}
+
+export function AgentConnectorFromJSONTyped(json: any, ignoreDiscriminator: boolean): AgentConnector {
+    if (json == null) {
+        return json;
+    }
+    return {
+        
+        'connectorUuid': json['connector_uuid'] == null ? undefined : json['connector_uuid'],
+        'name': json['name'],
+        'enabled': json['enabled'] == null ? undefined : json['enabled'],
+        'component': json['component'],
+        'verboseName': json['verbose_name'],
+        'verboseNamePlural': json['verbose_name_plural'],
+        'metaModelName': json['meta_model_name'],
+        'snapshotExpiry': json['snapshot_expiry'] == null ? undefined : json['snapshot_expiry'],
+        'authSessionDuration': json['auth_session_duration'] == null ? undefined : json['auth_session_duration'],
+        'authTerminateSessionOnExpiry': json['auth_terminate_session_on_expiry'] == null ? undefined : json['auth_terminate_session_on_expiry'],
+        'refreshInterval': json['refresh_interval'] == null ? undefined : json['refresh_interval'],
+        'authorizationFlow': json['authorization_flow'] == null ? undefined : json['authorization_flow'],
+        'nssUidOffset': json['nss_uid_offset'] == null ? undefined : json['nss_uid_offset'],
+        'nssGidOffset': json['nss_gid_offset'] == null ? undefined : json['nss_gid_offset'],
+        'challengeKey': json['challenge_key'] == null ? undefined : json['challenge_key'],
+        'challengeIdleTimeout': json['challenge_idle_timeout'] == null ? undefined : json['challenge_idle_timeout'],
+        'challengeTriggerCheckIn': json['challenge_trigger_check_in'] == null ? undefined : json['challenge_trigger_check_in'],
+        'jwtFederationProviders': json['jwt_federation_providers'] == null ? undefined : json['jwt_federation_providers'],
+    };
+}
+
+export function AgentConnectorToJSON(json: any): AgentConnector {
+    return AgentConnectorToJSONTyped(json, false);
+}
+
+export function AgentConnectorToJSONTyped(value?: Omit<AgentConnector, 'component'|'verbose_name'|'verbose_name_plural'|'meta_model_name'> | null, ignoreDiscriminator: boolean = false): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        
+        'connector_uuid': value['connectorUuid'],
+        'name': value['name'],
+        'enabled': value['enabled'],
+        'snapshot_expiry': value['snapshotExpiry'],
+        'auth_session_duration': value['authSessionDuration'],
+        'auth_terminate_session_on_expiry': value['authTerminateSessionOnExpiry'],
+        'refresh_interval': value['refreshInterval'],
+        'authorization_flow': value['authorizationFlow'],
+        'nss_uid_offset': value['nssUidOffset'],
+        'nss_gid_offset': value['nssGidOffset'],
+        'challenge_key': value['challengeKey'],
+        'challenge_idle_timeout': value['challengeIdleTimeout'],
+        'challenge_trigger_check_in': value['challengeTriggerCheckIn'],
+        'jwt_federation_providers': value['jwtFederationProviders'],
+    };
+}
+

packages/client-ts/src/models/AgentConnectorRequest.ts

@@ -0,0 +1,170 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import { mapValues } from '../runtime';
+/**
+ * 
+ * @export
+ * @interface AgentConnectorRequest
+ */
+export interface AgentConnectorRequest {
+    /**
+     * 
+     * @type {string}
+     * @memberof AgentConnectorRequest
+     */
+    connectorUuid?: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AgentConnectorRequest
+     */
+    name: string;
+    /**
+     * 
+     * @type {boolean}
+     * @memberof AgentConnectorRequest
+     */
+    enabled?: boolean;
+    /**
+     * 
+     * @type {string}
+     * @memberof AgentConnectorRequest
+     */
+    snapshotExpiry?: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AgentConnectorRequest
+     */
+    authSessionDuration?: string;
+    /**
+     * 
+     * @type {boolean}
+     * @memberof AgentConnectorRequest
+     */
+    authTerminateSessionOnExpiry?: boolean;
+    /**
+     * 
+     * @type {string}
+     * @memberof AgentConnectorRequest
+     */
+    refreshInterval?: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AgentConnectorRequest
+     */
+    authorizationFlow?: string | null;
+    /**
+     * 
+     * @type {number}
+     * @memberof AgentConnectorRequest
+     */
+    nssUidOffset?: number;
+    /**
+     * 
+     * @type {number}
+     * @memberof AgentConnectorRequest
+     */
+    nssGidOffset?: number;
+    /**
+     * 
+     * @type {string}
+     * @memberof AgentConnectorRequest
+     */
+    challengeKey?: string | null;
+    /**
+     * 
+     * @type {string}
+     * @memberof AgentConnectorRequest
+     */
+    challengeIdleTimeout?: string;
+    /**
+     * 
+     * @type {boolean}
+     * @memberof AgentConnectorRequest
+     */
+    challengeTriggerCheckIn?: boolean;
+    /**
+     * 
+     * @type {Array<number>}
+     * @memberof AgentConnectorRequest
+     */
+    jwtFederationProviders?: Array<number>;
+}
+
+/**
+ * Check if a given object implements the AgentConnectorRequest interface.
+ */
+export function instanceOfAgentConnectorRequest(value: object): value is AgentConnectorRequest {
+    if (!('name' in value) || value['name'] === undefined) return false;
+    return true;
+}
+
+export function AgentConnectorRequestFromJSON(json: any): AgentConnectorRequest {
+    return AgentConnectorRequestFromJSONTyped(json, false);
+}
+
+export function AgentConnectorRequestFromJSONTyped(json: any, ignoreDiscriminator: boolean): AgentConnectorRequest {
+    if (json == null) {
+        return json;
+    }
+    return {
+        
+        'connectorUuid': json['connector_uuid'] == null ? undefined : json['connector_uuid'],
+        'name': json['name'],
+        'enabled': json['enabled'] == null ? undefined : json['enabled'],
+        'snapshotExpiry': json['snapshot_expiry'] == null ? undefined : json['snapshot_expiry'],
+        'authSessionDuration': json['auth_session_duration'] == null ? undefined : json['auth_session_duration'],
+        'authTerminateSessionOnExpiry': json['auth_terminate_session_on_expiry'] == null ? undefined : json['auth_terminate_session_on_expiry'],
+        'refreshInterval': json['refresh_interval'] == null ? undefined : json['refresh_interval'],
+        'authorizationFlow': json['authorization_flow'] == null ? undefined : json['authorization_flow'],
+        'nssUidOffset': json['nss_uid_offset'] == null ? undefined : json['nss_uid_offset'],
+        'nssGidOffset': json['nss_gid_offset'] == null ? undefined : json['nss_gid_offset'],
+        'challengeKey': json['challenge_key'] == null ? undefined : json['challenge_key'],
+        'challengeIdleTimeout': json['challenge_idle_timeout'] == null ? undefined : json['challenge_idle_timeout'],
+        'challengeTriggerCheckIn': json['challenge_trigger_check_in'] == null ? undefined : json['challenge_trigger_check_in'],
+        'jwtFederationProviders': json['jwt_federation_providers'] == null ? undefined : json['jwt_federation_providers'],
+    };
+}
+
+export function AgentConnectorRequestToJSON(json: any): AgentConnectorRequest {
+    return AgentConnectorRequestToJSONTyped(json, false);
+}
+
+export function AgentConnectorRequestToJSONTyped(value?: AgentConnectorRequest | null, ignoreDiscriminator: boolean = false): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        
+        'connector_uuid': value['connectorUuid'],
+        'name': value['name'],
+        'enabled': value['enabled'],
+        'snapshot_expiry': value['snapshotExpiry'],
+        'auth_session_duration': value['authSessionDuration'],
+        'auth_terminate_session_on_expiry': value['authTerminateSessionOnExpiry'],
+        'refresh_interval': value['refreshInterval'],
+        'authorization_flow': value['authorizationFlow'],
+        'nss_uid_offset': value['nssUidOffset'],
+        'nss_gid_offset': value['nssGidOffset'],
+        'challenge_key': value['challengeKey'],
+        'challenge_idle_timeout': value['challengeIdleTimeout'],
+        'challenge_trigger_check_in': value['challengeTriggerCheckIn'],
+        'jwt_federation_providers': value['jwtFederationProviders'],
+    };
+}
+

packages/client-ts/src/models/AgentPSSODeviceRegistrationRequest.ts

@@ -0,0 +1,93 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import { mapValues } from '../runtime';
+/**
+ * Register Apple device via Platform SSO
+ * @export
+ * @interface AgentPSSODeviceRegistrationRequest
+ */
+export interface AgentPSSODeviceRegistrationRequest {
+    /**
+     * 
+     * @type {string}
+     * @memberof AgentPSSODeviceRegistrationRequest
+     */
+    deviceSigningKey: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AgentPSSODeviceRegistrationRequest
+     */
+    deviceEncryptionKey: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AgentPSSODeviceRegistrationRequest
+     */
+    signKeyId: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AgentPSSODeviceRegistrationRequest
+     */
+    encKeyId: string;
+}
+
+/**
+ * Check if a given object implements the AgentPSSODeviceRegistrationRequest interface.
+ */
+export function instanceOfAgentPSSODeviceRegistrationRequest(value: object): value is AgentPSSODeviceRegistrationRequest {
+    if (!('deviceSigningKey' in value) || value['deviceSigningKey'] === undefined) return false;
+    if (!('deviceEncryptionKey' in value) || value['deviceEncryptionKey'] === undefined) return false;
+    if (!('signKeyId' in value) || value['signKeyId'] === undefined) return false;
+    if (!('encKeyId' in value) || value['encKeyId'] === undefined) return false;
+    return true;
+}
+
+export function AgentPSSODeviceRegistrationRequestFromJSON(json: any): AgentPSSODeviceRegistrationRequest {
+    return AgentPSSODeviceRegistrationRequestFromJSONTyped(json, false);
+}
+
+export function AgentPSSODeviceRegistrationRequestFromJSONTyped(json: any, ignoreDiscriminator: boolean): AgentPSSODeviceRegistrationRequest {
+    if (json == null) {
+        return json;
+    }
+    return {
+        
+        'deviceSigningKey': json['device_signing_key'],
+        'deviceEncryptionKey': json['device_encryption_key'],
+        'signKeyId': json['sign_key_id'],
+        'encKeyId': json['enc_key_id'],
+    };
+}
+
+export function AgentPSSODeviceRegistrationRequestToJSON(json: any): AgentPSSODeviceRegistrationRequest {
+    return AgentPSSODeviceRegistrationRequestToJSONTyped(json, false);
+}
+
+export function AgentPSSODeviceRegistrationRequestToJSONTyped(value?: AgentPSSODeviceRegistrationRequest | null, ignoreDiscriminator: boolean = false): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        
+        'device_signing_key': value['deviceSigningKey'],
+        'device_encryption_key': value['deviceEncryptionKey'],
+        'sign_key_id': value['signKeyId'],
+        'enc_key_id': value['encKeyId'],
+    };
+}
+

packages/client-ts/src/models/AgentPSSODeviceRegistrationResponse.ts

@@ -0,0 +1,111 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import { mapValues } from '../runtime';
+/**
+ * authentik settings for Platform SSO tokens
+ * @export
+ * @interface AgentPSSODeviceRegistrationResponse
+ */
+export interface AgentPSSODeviceRegistrationResponse {
+    /**
+     * 
+     * @type {string}
+     * @memberof AgentPSSODeviceRegistrationResponse
+     */
+    clientId: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AgentPSSODeviceRegistrationResponse
+     */
+    issuer: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AgentPSSODeviceRegistrationResponse
+     */
+    tokenEndpoint: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AgentPSSODeviceRegistrationResponse
+     */
+    jwksEndpoint: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AgentPSSODeviceRegistrationResponse
+     */
+    audience: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AgentPSSODeviceRegistrationResponse
+     */
+    nonceEndpoint: string;
+}
+
+/**
+ * Check if a given object implements the AgentPSSODeviceRegistrationResponse interface.
+ */
+export function instanceOfAgentPSSODeviceRegistrationResponse(value: object): value is AgentPSSODeviceRegistrationResponse {
+    if (!('clientId' in value) || value['clientId'] === undefined) return false;
+    if (!('issuer' in value) || value['issuer'] === undefined) return false;
+    if (!('tokenEndpoint' in value) || value['tokenEndpoint'] === undefined) return false;
+    if (!('jwksEndpoint' in value) || value['jwksEndpoint'] === undefined) return false;
+    if (!('audience' in value) || value['audience'] === undefined) return false;
+    if (!('nonceEndpoint' in value) || value['nonceEndpoint'] === undefined) return false;
+    return true;
+}
+
+export function AgentPSSODeviceRegistrationResponseFromJSON(json: any): AgentPSSODeviceRegistrationResponse {
+    return AgentPSSODeviceRegistrationResponseFromJSONTyped(json, false);
+}
+
+export function AgentPSSODeviceRegistrationResponseFromJSONTyped(json: any, ignoreDiscriminator: boolean): AgentPSSODeviceRegistrationResponse {
+    if (json == null) {
+        return json;
+    }
+    return {
+        
+        'clientId': json['client_id'],
+        'issuer': json['issuer'],
+        'tokenEndpoint': json['token_endpoint'],
+        'jwksEndpoint': json['jwks_endpoint'],
+        'audience': json['audience'],
+        'nonceEndpoint': json['nonce_endpoint'],
+    };
+}
+
+export function AgentPSSODeviceRegistrationResponseToJSON(json: any): AgentPSSODeviceRegistrationResponse {
+    return AgentPSSODeviceRegistrationResponseToJSONTyped(json, false);
+}
+
+export function AgentPSSODeviceRegistrationResponseToJSONTyped(value?: AgentPSSODeviceRegistrationResponse | null, ignoreDiscriminator: boolean = false): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        
+        'client_id': value['clientId'],
+        'issuer': value['issuer'],
+        'token_endpoint': value['tokenEndpoint'],
+        'jwks_endpoint': value['jwksEndpoint'],
+        'audience': value['audience'],
+        'nonce_endpoint': value['nonceEndpoint'],
+    };
+}
+

packages/client-ts/src/models/AgentPSSOUserRegistrationRequest.ts

@@ -0,0 +1,84 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import { mapValues } from '../runtime';
+/**
+ * Register Apple device user via Platform SSO
+ * @export
+ * @interface AgentPSSOUserRegistrationRequest
+ */
+export interface AgentPSSOUserRegistrationRequest {
+    /**
+     * 
+     * @type {string}
+     * @memberof AgentPSSOUserRegistrationRequest
+     */
+    userAuth: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AgentPSSOUserRegistrationRequest
+     */
+    userSecureEnclaveKey: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AgentPSSOUserRegistrationRequest
+     */
+    enclaveKeyId: string;
+}
+
+/**
+ * Check if a given object implements the AgentPSSOUserRegistrationRequest interface.
+ */
+export function instanceOfAgentPSSOUserRegistrationRequest(value: object): value is AgentPSSOUserRegistrationRequest {
+    if (!('userAuth' in value) || value['userAuth'] === undefined) return false;
+    if (!('userSecureEnclaveKey' in value) || value['userSecureEnclaveKey'] === undefined) return false;
+    if (!('enclaveKeyId' in value) || value['enclaveKeyId'] === undefined) return false;
+    return true;
+}
+
+export function AgentPSSOUserRegistrationRequestFromJSON(json: any): AgentPSSOUserRegistrationRequest {
+    return AgentPSSOUserRegistrationRequestFromJSONTyped(json, false);
+}
+
+export function AgentPSSOUserRegistrationRequestFromJSONTyped(json: any, ignoreDiscriminator: boolean): AgentPSSOUserRegistrationRequest {
+    if (json == null) {
+        return json;
+    }
+    return {
+        
+        'userAuth': json['user_auth'],
+        'userSecureEnclaveKey': json['user_secure_enclave_key'],
+        'enclaveKeyId': json['enclave_key_id'],
+    };
+}
+
+export function AgentPSSOUserRegistrationRequestToJSON(json: any): AgentPSSOUserRegistrationRequest {
+    return AgentPSSOUserRegistrationRequestToJSONTyped(json, false);
+}
+
+export function AgentPSSOUserRegistrationRequestToJSONTyped(value?: AgentPSSOUserRegistrationRequest | null, ignoreDiscriminator: boolean = false): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        
+        'user_auth': value['userAuth'],
+        'user_secure_enclave_key': value['userSecureEnclaveKey'],
+        'enclave_key_id': value['enclaveKeyId'],
+    };
+}
+

packages/client-ts/src/models/AgentTokenResponse.ts

@@ -0,0 +1,74 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import { mapValues } from '../runtime';
+/**
+ * Base serializer class which doesn't implement create/update methods
+ * @export
+ * @interface AgentTokenResponse
+ */
+export interface AgentTokenResponse {
+    /**
+     * 
+     * @type {string}
+     * @memberof AgentTokenResponse
+     */
+    token: string;
+    /**
+     * 
+     * @type {number}
+     * @memberof AgentTokenResponse
+     */
+    expiresIn?: number;
+}
+
+/**
+ * Check if a given object implements the AgentTokenResponse interface.
+ */
+export function instanceOfAgentTokenResponse(value: object): value is AgentTokenResponse {
+    if (!('token' in value) || value['token'] === undefined) return false;
+    return true;
+}
+
+export function AgentTokenResponseFromJSON(json: any): AgentTokenResponse {
+    return AgentTokenResponseFromJSONTyped(json, false);
+}
+
+export function AgentTokenResponseFromJSONTyped(json: any, ignoreDiscriminator: boolean): AgentTokenResponse {
+    if (json == null) {
+        return json;
+    }
+    return {
+        
+        'token': json['token'],
+        'expiresIn': json['expires_in'] == null ? undefined : json['expires_in'],
+    };
+}
+
+export function AgentTokenResponseToJSON(json: any): AgentTokenResponse {
+    return AgentTokenResponseToJSONTyped(json, false);
+}
+
+export function AgentTokenResponseToJSONTyped(value?: AgentTokenResponse | null, ignoreDiscriminator: boolean = false): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        
+        'token': value['token'],
+        'expires_in': value['expiresIn'],
+    };
+}
+

packages/client-ts/src/models/AlgEnum.ts

@@ -0,0 +1,56 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+
+/**
+ * 
+ * @export
+ */
+export const AlgEnum = {
+    Rsa: 'rsa',
+    Ecdsa: 'ecdsa',
+    Ed25519: 'ed25519',
+    Ed448: 'ed448',
+    UnknownDefaultOpenApi: '11184809'
+} as const;
+export type AlgEnum = typeof AlgEnum[keyof typeof AlgEnum];
+
+
+export function instanceOfAlgEnum(value: any): boolean {
+    for (const key in AlgEnum) {
+        if (Object.prototype.hasOwnProperty.call(AlgEnum, key)) {
+            if (AlgEnum[key as keyof typeof AlgEnum] === value) {
+                return true;
+            }
+        }
+    }
+    return false;
+}
+
+export function AlgEnumFromJSON(json: any): AlgEnum {
+    return AlgEnumFromJSONTyped(json, false);
+}
+
+export function AlgEnumFromJSONTyped(json: any, ignoreDiscriminator: boolean): AlgEnum {
+    return json as AlgEnum;
+}
+
+export function AlgEnumToJSON(value?: AlgEnum | null): any {
+    return value as any;
+}
+
+export function AlgEnumToJSONTyped(value: any, ignoreDiscriminator: boolean): AlgEnum {
+    return value as AlgEnum;
+}
+

packages/client-ts/src/models/App.ts

@@ -0,0 +1,75 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import { mapValues } from '../runtime';
+/**
+ * Serialize Application info
+ * @export
+ * @interface App
+ */
+export interface App {
+    /**
+     * 
+     * @type {string}
+     * @memberof App
+     */
+    name: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof App
+     */
+    label: string;
+}
+
+/**
+ * Check if a given object implements the App interface.
+ */
+export function instanceOfApp(value: object): value is App {
+    if (!('name' in value) || value['name'] === undefined) return false;
+    if (!('label' in value) || value['label'] === undefined) return false;
+    return true;
+}
+
+export function AppFromJSON(json: any): App {
+    return AppFromJSONTyped(json, false);
+}
+
+export function AppFromJSONTyped(json: any, ignoreDiscriminator: boolean): App {
+    if (json == null) {
+        return json;
+    }
+    return {
+        
+        'name': json['name'],
+        'label': json['label'],
+    };
+}
+
+export function AppToJSON(json: any): App {
+    return AppToJSONTyped(json, false);
+}
+
+export function AppToJSONTyped(value?: App | null, ignoreDiscriminator: boolean = false): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        
+        'name': value['name'],
+        'label': value['label'],
+    };
+}
+

packages/client-ts/src/models/AppEnum.ts

@@ -0,0 +1,132 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+
+/**
+ * 
+ * @export
+ */
+export const AppEnum = {
+    AuthentikCommands: 'authentik.commands',
+    AuthentikTenants: 'authentik.tenants',
+    AuthentikTasks: 'authentik.tasks',
+    AuthentikAdmin: 'authentik.admin',
+    AuthentikApi: 'authentik.api',
+    AuthentikCore: 'authentik.core',
+    AuthentikCrypto: 'authentik.crypto',
+    AuthentikEndpoints: 'authentik.endpoints',
+    AuthentikEndpointsConnectorsAgent: 'authentik.endpoints.connectors.agent',
+    AuthentikEnterprise: 'authentik.enterprise',
+    AuthentikEvents: 'authentik.events',
+    AuthentikAdminFiles: 'authentik.admin.files',
+    AuthentikFlows: 'authentik.flows',
+    AuthentikOutposts: 'authentik.outposts',
+    AuthentikPoliciesDummy: 'authentik.policies.dummy',
+    AuthentikPoliciesEventMatcher: 'authentik.policies.event_matcher',
+    AuthentikPoliciesExpiry: 'authentik.policies.expiry',
+    AuthentikPoliciesExpression: 'authentik.policies.expression',
+    AuthentikPoliciesGeoip: 'authentik.policies.geoip',
+    AuthentikPoliciesPassword: 'authentik.policies.password',
+    AuthentikPoliciesReputation: 'authentik.policies.reputation',
+    AuthentikPolicies: 'authentik.policies',
+    AuthentikProvidersLdap: 'authentik.providers.ldap',
+    AuthentikProvidersOauth2: 'authentik.providers.oauth2',
+    AuthentikProvidersProxy: 'authentik.providers.proxy',
+    AuthentikProvidersRac: 'authentik.providers.rac',
+    AuthentikProvidersRadius: 'authentik.providers.radius',
+    AuthentikProvidersSaml: 'authentik.providers.saml',
+    AuthentikProvidersScim: 'authentik.providers.scim',
+    AuthentikRbac: 'authentik.rbac',
+    AuthentikRecovery: 'authentik.recovery',
+    AuthentikSourcesKerberos: 'authentik.sources.kerberos',
+    AuthentikSourcesLdap: 'authentik.sources.ldap',
+    AuthentikSourcesOauth: 'authentik.sources.oauth',
+    AuthentikSourcesPlex: 'authentik.sources.plex',
+    AuthentikSourcesSaml: 'authentik.sources.saml',
+    AuthentikSourcesScim: 'authentik.sources.scim',
+    AuthentikSourcesTelegram: 'authentik.sources.telegram',
+    AuthentikStagesAuthenticator: 'authentik.stages.authenticator',
+    AuthentikStagesAuthenticatorDuo: 'authentik.stages.authenticator_duo',
+    AuthentikStagesAuthenticatorEmail: 'authentik.stages.authenticator_email',
+    AuthentikStagesAuthenticatorSms: 'authentik.stages.authenticator_sms',
+    AuthentikStagesAuthenticatorStatic: 'authentik.stages.authenticator_static',
+    AuthentikStagesAuthenticatorTotp: 'authentik.stages.authenticator_totp',
+    AuthentikStagesAuthenticatorValidate: 'authentik.stages.authenticator_validate',
+    AuthentikStagesAuthenticatorWebauthn: 'authentik.stages.authenticator_webauthn',
+    AuthentikStagesCaptcha: 'authentik.stages.captcha',
+    AuthentikStagesConsent: 'authentik.stages.consent',
+    AuthentikStagesDeny: 'authentik.stages.deny',
+    AuthentikStagesDummy: 'authentik.stages.dummy',
+    AuthentikStagesEmail: 'authentik.stages.email',
+    AuthentikStagesIdentification: 'authentik.stages.identification',
+    AuthentikStagesInvitation: 'authentik.stages.invitation',
+    AuthentikStagesPassword: 'authentik.stages.password',
+    AuthentikStagesPrompt: 'authentik.stages.prompt',
+    AuthentikStagesRedirect: 'authentik.stages.redirect',
+    AuthentikStagesUserDelete: 'authentik.stages.user_delete',
+    AuthentikStagesUserLogin: 'authentik.stages.user_login',
+    AuthentikStagesUserLogout: 'authentik.stages.user_logout',
+    AuthentikStagesUserWrite: 'authentik.stages.user_write',
+    AuthentikTasksSchedules: 'authentik.tasks.schedules',
+    AuthentikBrands: 'authentik.brands',
+    AuthentikBlueprints: 'authentik.blueprints',
+    AuthentikEnterpriseAudit: 'authentik.enterprise.audit',
+    AuthentikEnterpriseEndpointsConnectorsAgent: 'authentik.enterprise.endpoints.connectors.agent',
+    AuthentikEnterpriseEndpointsConnectorsFleet: 'authentik.enterprise.endpoints.connectors.fleet',
+    AuthentikEnterpriseEndpointsConnectorsGoogleChrome: 'authentik.enterprise.endpoints.connectors.google_chrome',
+    AuthentikEnterpriseLifecycle: 'authentik.enterprise.lifecycle',
+    AuthentikEnterprisePoliciesUniquePassword: 'authentik.enterprise.policies.unique_password',
+    AuthentikEnterpriseProvidersGoogleWorkspace: 'authentik.enterprise.providers.google_workspace',
+    AuthentikEnterpriseProvidersMicrosoftEntra: 'authentik.enterprise.providers.microsoft_entra',
+    AuthentikEnterpriseProvidersRadius: 'authentik.enterprise.providers.radius',
+    AuthentikEnterpriseProvidersScim: 'authentik.enterprise.providers.scim',
+    AuthentikEnterpriseProvidersSsf: 'authentik.enterprise.providers.ssf',
+    AuthentikEnterpriseProvidersWsFederation: 'authentik.enterprise.providers.ws_federation',
+    AuthentikEnterpriseReports: 'authentik.enterprise.reports',
+    AuthentikEnterpriseSearch: 'authentik.enterprise.search',
+    AuthentikEnterpriseStagesAuthenticatorEndpointGdtc: 'authentik.enterprise.stages.authenticator_endpoint_gdtc',
+    AuthentikEnterpriseStagesMtls: 'authentik.enterprise.stages.mtls',
+    AuthentikEnterpriseStagesSource: 'authentik.enterprise.stages.source',
+    UnknownDefaultOpenApi: '11184809'
+} as const;
+export type AppEnum = typeof AppEnum[keyof typeof AppEnum];
+
+
+export function instanceOfAppEnum(value: any): boolean {
+    for (const key in AppEnum) {
+        if (Object.prototype.hasOwnProperty.call(AppEnum, key)) {
+            if (AppEnum[key as keyof typeof AppEnum] === value) {
+                return true;
+            }
+        }
+    }
+    return false;
+}
+
+export function AppEnumFromJSON(json: any): AppEnum {
+    return AppEnumFromJSONTyped(json, false);
+}
+
+export function AppEnumFromJSONTyped(json: any, ignoreDiscriminator: boolean): AppEnum {
+    return json as AppEnum;
+}
+
+export function AppEnumToJSON(value?: AppEnum | null): any {
+    return value as any;
+}
+
+export function AppEnumToJSONTyped(value: any, ignoreDiscriminator: boolean): AppEnum {
+    return value as AppEnum;
+}
+

packages/client-ts/src/models/AppleChallengeResponseRequest.ts

@@ -0,0 +1,65 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import { mapValues } from '../runtime';
+/**
+ * Pseudo class for apple response
+ * @export
+ * @interface AppleChallengeResponseRequest
+ */
+export interface AppleChallengeResponseRequest {
+    /**
+     * 
+     * @type {string}
+     * @memberof AppleChallengeResponseRequest
+     */
+    component?: string;
+}
+
+/**
+ * Check if a given object implements the AppleChallengeResponseRequest interface.
+ */
+export function instanceOfAppleChallengeResponseRequest(value: object): value is AppleChallengeResponseRequest {
+    return true;
+}
+
+export function AppleChallengeResponseRequestFromJSON(json: any): AppleChallengeResponseRequest {
+    return AppleChallengeResponseRequestFromJSONTyped(json, false);
+}
+
+export function AppleChallengeResponseRequestFromJSONTyped(json: any, ignoreDiscriminator: boolean): AppleChallengeResponseRequest {
+    if (json == null) {
+        return json;
+    }
+    return {
+        
+        'component': json['component'] == null ? undefined : json['component'],
+    };
+}
+
+export function AppleChallengeResponseRequestToJSON(json: any): AppleChallengeResponseRequest {
+    return AppleChallengeResponseRequestToJSONTyped(json, false);
+}
+
+export function AppleChallengeResponseRequestToJSONTyped(value?: AppleChallengeResponseRequest | null, ignoreDiscriminator: boolean = false): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        
+        'component': value['component'],
+    };
+}
+

packages/client-ts/src/models/AppleLoginChallenge.ts

@@ -0,0 +1,132 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import { mapValues } from '../runtime';
+import type { ErrorDetail } from './ErrorDetail';
+import {
+    ErrorDetailFromJSON,
+    ErrorDetailFromJSONTyped,
+    ErrorDetailToJSON,
+    ErrorDetailToJSONTyped,
+} from './ErrorDetail';
+import type { ContextualFlowInfo } from './ContextualFlowInfo';
+import {
+    ContextualFlowInfoFromJSON,
+    ContextualFlowInfoFromJSONTyped,
+    ContextualFlowInfoToJSON,
+    ContextualFlowInfoToJSONTyped,
+} from './ContextualFlowInfo';
+
+/**
+ * Special challenge for apple-native authentication flow, which happens on the client.
+ * @export
+ * @interface AppleLoginChallenge
+ */
+export interface AppleLoginChallenge {
+    /**
+     * 
+     * @type {ContextualFlowInfo}
+     * @memberof AppleLoginChallenge
+     */
+    flowInfo?: ContextualFlowInfo;
+    /**
+     * 
+     * @type {string}
+     * @memberof AppleLoginChallenge
+     */
+    component?: string;
+    /**
+     * 
+     * @type {{ [key: string]: Array<ErrorDetail>; }}
+     * @memberof AppleLoginChallenge
+     */
+    responseErrors?: { [key: string]: Array<ErrorDetail>; };
+    /**
+     * 
+     * @type {string}
+     * @memberof AppleLoginChallenge
+     */
+    clientId: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AppleLoginChallenge
+     */
+    scope: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AppleLoginChallenge
+     */
+    redirectUri: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AppleLoginChallenge
+     */
+    state: string;
+}
+
+/**
+ * Check if a given object implements the AppleLoginChallenge interface.
+ */
+export function instanceOfAppleLoginChallenge(value: object): value is AppleLoginChallenge {
+    if (!('clientId' in value) || value['clientId'] === undefined) return false;
+    if (!('scope' in value) || value['scope'] === undefined) return false;
+    if (!('redirectUri' in value) || value['redirectUri'] === undefined) return false;
+    if (!('state' in value) || value['state'] === undefined) return false;
+    return true;
+}
+
+export function AppleLoginChallengeFromJSON(json: any): AppleLoginChallenge {
+    return AppleLoginChallengeFromJSONTyped(json, false);
+}
+
+export function AppleLoginChallengeFromJSONTyped(json: any, ignoreDiscriminator: boolean): AppleLoginChallenge {
+    if (json == null) {
+        return json;
+    }
+    return {
+        
+        'flowInfo': json['flow_info'] == null ? undefined : ContextualFlowInfoFromJSON(json['flow_info']),
+        'component': json['component'] == null ? undefined : json['component'],
+        'responseErrors': json['response_errors'] == null ? undefined : json['response_errors'],
+        'clientId': json['client_id'],
+        'scope': json['scope'],
+        'redirectUri': json['redirect_uri'],
+        'state': json['state'],
+    };
+}
+
+export function AppleLoginChallengeToJSON(json: any): AppleLoginChallenge {
+    return AppleLoginChallengeToJSONTyped(json, false);
+}
+
+export function AppleLoginChallengeToJSONTyped(value?: AppleLoginChallenge | null, ignoreDiscriminator: boolean = false): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        
+        'flow_info': ContextualFlowInfoToJSON(value['flowInfo']),
+        'component': value['component'],
+        'response_errors': value['responseErrors'],
+        'client_id': value['clientId'],
+        'scope': value['scope'],
+        'redirect_uri': value['redirectUri'],
+        'state': value['state'],
+    };
+}
+

packages/client-ts/src/models/Application.ts

@@ -0,0 +1,219 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import { mapValues } from '../runtime';
+import type { PolicyEngineMode } from './PolicyEngineMode';
+import {
+    PolicyEngineModeFromJSON,
+    PolicyEngineModeFromJSONTyped,
+    PolicyEngineModeToJSON,
+    PolicyEngineModeToJSONTyped,
+} from './PolicyEngineMode';
+import type { ThemedUrls } from './ThemedUrls';
+import {
+    ThemedUrlsFromJSON,
+    ThemedUrlsFromJSONTyped,
+    ThemedUrlsToJSON,
+    ThemedUrlsToJSONTyped,
+} from './ThemedUrls';
+import type { Provider } from './Provider';
+import {
+    ProviderFromJSON,
+    ProviderFromJSONTyped,
+    ProviderToJSON,
+    ProviderToJSONTyped,
+} from './Provider';
+
+/**
+ * Application Serializer
+ * @export
+ * @interface Application
+ */
+export interface Application {
+    /**
+     * 
+     * @type {string}
+     * @memberof Application
+     */
+    readonly pk: string;
+    /**
+     * Application's display Name.
+     * @type {string}
+     * @memberof Application
+     */
+    name: string;
+    /**
+     * Internal application name, used in URLs.
+     * @type {string}
+     * @memberof Application
+     */
+    slug: string;
+    /**
+     * 
+     * @type {number}
+     * @memberof Application
+     */
+    provider?: number | null;
+    /**
+     * 
+     * @type {Provider}
+     * @memberof Application
+     */
+    readonly providerObj: Provider;
+    /**
+     * 
+     * @type {Array<number>}
+     * @memberof Application
+     */
+    backchannelProviders?: Array<number>;
+    /**
+     * 
+     * @type {Array<Provider>}
+     * @memberof Application
+     */
+    readonly backchannelProvidersObj: Array<Provider>;
+    /**
+     * Allow formatting of launch URL
+     * @type {string}
+     * @memberof Application
+     */
+    readonly launchUrl: string | null;
+    /**
+     * Open launch URL in a new browser tab or window.
+     * @type {boolean}
+     * @memberof Application
+     */
+    openInNewTab?: boolean;
+    /**
+     * 
+     * @type {string}
+     * @memberof Application
+     */
+    metaLaunchUrl?: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof Application
+     */
+    metaIcon?: string;
+    /**
+     * Get the URL to the App Icon image
+     * @type {string}
+     * @memberof Application
+     */
+    readonly metaIconUrl: string | null;
+    /**
+     * 
+     * @type {ThemedUrls}
+     * @memberof Application
+     */
+    readonly metaIconThemedUrls: ThemedUrls | null;
+    /**
+     * 
+     * @type {string}
+     * @memberof Application
+     */
+    metaDescription?: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof Application
+     */
+    metaPublisher?: string;
+    /**
+     * 
+     * @type {PolicyEngineMode}
+     * @memberof Application
+     */
+    policyEngineMode?: PolicyEngineMode;
+    /**
+     * 
+     * @type {string}
+     * @memberof Application
+     */
+    group?: string;
+}
+
+
+
+/**
+ * Check if a given object implements the Application interface.
+ */
+export function instanceOfApplication(value: object): value is Application {
+    if (!('pk' in value) || value['pk'] === undefined) return false;
+    if (!('name' in value) || value['name'] === undefined) return false;
+    if (!('slug' in value) || value['slug'] === undefined) return false;
+    if (!('providerObj' in value) || value['providerObj'] === undefined) return false;
+    if (!('backchannelProvidersObj' in value) || value['backchannelProvidersObj'] === undefined) return false;
+    if (!('launchUrl' in value) || value['launchUrl'] === undefined) return false;
+    if (!('metaIconUrl' in value) || value['metaIconUrl'] === undefined) return false;
+    if (!('metaIconThemedUrls' in value) || value['metaIconThemedUrls'] === undefined) return false;
+    return true;
+}
+
+export function ApplicationFromJSON(json: any): Application {
+    return ApplicationFromJSONTyped(json, false);
+}
+
+export function ApplicationFromJSONTyped(json: any, ignoreDiscriminator: boolean): Application {
+    if (json == null) {
+        return json;
+    }
+    return {
+        
+        'pk': json['pk'],
+        'name': json['name'],
+        'slug': json['slug'],
+        'provider': json['provider'] == null ? undefined : json['provider'],
+        'providerObj': ProviderFromJSON(json['provider_obj']),
+        'backchannelProviders': json['backchannel_providers'] == null ? undefined : json['backchannel_providers'],
+        'backchannelProvidersObj': ((json['backchannel_providers_obj'] as Array<any>).map(ProviderFromJSON)),
+        'launchUrl': json['launch_url'],
+        'openInNewTab': json['open_in_new_tab'] == null ? undefined : json['open_in_new_tab'],
+        'metaLaunchUrl': json['meta_launch_url'] == null ? undefined : json['meta_launch_url'],
+        'metaIcon': json['meta_icon'] == null ? undefined : json['meta_icon'],
+        'metaIconUrl': json['meta_icon_url'],
+        'metaIconThemedUrls': ThemedUrlsFromJSON(json['meta_icon_themed_urls']),
+        'metaDescription': json['meta_description'] == null ? undefined : json['meta_description'],
+        'metaPublisher': json['meta_publisher'] == null ? undefined : json['meta_publisher'],
+        'policyEngineMode': json['policy_engine_mode'] == null ? undefined : PolicyEngineModeFromJSON(json['policy_engine_mode']),
+        'group': json['group'] == null ? undefined : json['group'],
+    };
+}
+
+export function ApplicationToJSON(json: any): Application {
+    return ApplicationToJSONTyped(json, false);
+}
+
+export function ApplicationToJSONTyped(value?: Omit<Application, 'pk'|'provider_obj'|'backchannel_providers_obj'|'launch_url'|'meta_icon_url'|'meta_icon_themed_urls'> | null, ignoreDiscriminator: boolean = false): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        
+        'name': value['name'],
+        'slug': value['slug'],
+        'provider': value['provider'],
+        'backchannel_providers': value['backchannelProviders'],
+        'open_in_new_tab': value['openInNewTab'],
+        'meta_launch_url': value['metaLaunchUrl'],
+        'meta_icon': value['metaIcon'],
+        'meta_description': value['metaDescription'],
+        'meta_publisher': value['metaPublisher'],
+        'policy_engine_mode': PolicyEngineModeToJSON(value['policyEngineMode']),
+        'group': value['group'],
+    };
+}
+

packages/client-ts/src/models/ApplicationEntitlement.ts

@@ -0,0 +1,91 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import { mapValues } from '../runtime';
+/**
+ * ApplicationEntitlement Serializer
+ * @export
+ * @interface ApplicationEntitlement
+ */
+export interface ApplicationEntitlement {
+    /**
+     * 
+     * @type {string}
+     * @memberof ApplicationEntitlement
+     */
+    readonly pbmUuid: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof ApplicationEntitlement
+     */
+    name: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof ApplicationEntitlement
+     */
+    app: string;
+    /**
+     * 
+     * @type {{ [key: string]: any; }}
+     * @memberof ApplicationEntitlement
+     */
+    attributes?: { [key: string]: any; };
+}
+
+/**
+ * Check if a given object implements the ApplicationEntitlement interface.
+ */
+export function instanceOfApplicationEntitlement(value: object): value is ApplicationEntitlement {
+    if (!('pbmUuid' in value) || value['pbmUuid'] === undefined) return false;
+    if (!('name' in value) || value['name'] === undefined) return false;
+    if (!('app' in value) || value['app'] === undefined) return false;
+    return true;
+}
+
+export function ApplicationEntitlementFromJSON(json: any): ApplicationEntitlement {
+    return ApplicationEntitlementFromJSONTyped(json, false);
+}
+
+export function ApplicationEntitlementFromJSONTyped(json: any, ignoreDiscriminator: boolean): ApplicationEntitlement {
+    if (json == null) {
+        return json;
+    }
+    return {
+        
+        'pbmUuid': json['pbm_uuid'],
+        'name': json['name'],
+        'app': json['app'],
+        'attributes': json['attributes'] == null ? undefined : json['attributes'],
+    };
+}
+
+export function ApplicationEntitlementToJSON(json: any): ApplicationEntitlement {
+    return ApplicationEntitlementToJSONTyped(json, false);
+}
+
+export function ApplicationEntitlementToJSONTyped(value?: Omit<ApplicationEntitlement, 'pbm_uuid'> | null, ignoreDiscriminator: boolean = false): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        
+        'name': value['name'],
+        'app': value['app'],
+        'attributes': value['attributes'],
+    };
+}
+

packages/client-ts/src/models/ApplicationEntitlementRequest.ts

@@ -0,0 +1,83 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import { mapValues } from '../runtime';
+/**
+ * ApplicationEntitlement Serializer
+ * @export
+ * @interface ApplicationEntitlementRequest
+ */
+export interface ApplicationEntitlementRequest {
+    /**
+     * 
+     * @type {string}
+     * @memberof ApplicationEntitlementRequest
+     */
+    name: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof ApplicationEntitlementRequest
+     */
+    app: string;
+    /**
+     * 
+     * @type {{ [key: string]: any; }}
+     * @memberof ApplicationEntitlementRequest
+     */
+    attributes?: { [key: string]: any; };
+}
+
+/**
+ * Check if a given object implements the ApplicationEntitlementRequest interface.
+ */
+export function instanceOfApplicationEntitlementRequest(value: object): value is ApplicationEntitlementRequest {
+    if (!('name' in value) || value['name'] === undefined) return false;
+    if (!('app' in value) || value['app'] === undefined) return false;
+    return true;
+}
+
+export function ApplicationEntitlementRequestFromJSON(json: any): ApplicationEntitlementRequest {
+    return ApplicationEntitlementRequestFromJSONTyped(json, false);
+}
+
+export function ApplicationEntitlementRequestFromJSONTyped(json: any, ignoreDiscriminator: boolean): ApplicationEntitlementRequest {
+    if (json == null) {
+        return json;
+    }
+    return {
+        
+        'name': json['name'],
+        'app': json['app'],
+        'attributes': json['attributes'] == null ? undefined : json['attributes'],
+    };
+}
+
+export function ApplicationEntitlementRequestToJSON(json: any): ApplicationEntitlementRequest {
+    return ApplicationEntitlementRequestToJSONTyped(json, false);
+}
+
+export function ApplicationEntitlementRequestToJSONTyped(value?: ApplicationEntitlementRequest | null, ignoreDiscriminator: boolean = false): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        
+        'name': value['name'],
+        'app': value['app'],
+        'attributes': value['attributes'],
+    };
+}
+

packages/client-ts/src/models/ApplicationRequest.ts

@@ -0,0 +1,157 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import { mapValues } from '../runtime';
+import type { PolicyEngineMode } from './PolicyEngineMode';
+import {
+    PolicyEngineModeFromJSON,
+    PolicyEngineModeFromJSONTyped,
+    PolicyEngineModeToJSON,
+    PolicyEngineModeToJSONTyped,
+} from './PolicyEngineMode';
+
+/**
+ * Application Serializer
+ * @export
+ * @interface ApplicationRequest
+ */
+export interface ApplicationRequest {
+    /**
+     * Application's display Name.
+     * @type {string}
+     * @memberof ApplicationRequest
+     */
+    name: string;
+    /**
+     * Internal application name, used in URLs.
+     * @type {string}
+     * @memberof ApplicationRequest
+     */
+    slug: string;
+    /**
+     * 
+     * @type {number}
+     * @memberof ApplicationRequest
+     */
+    provider?: number | null;
+    /**
+     * 
+     * @type {Array<number>}
+     * @memberof ApplicationRequest
+     */
+    backchannelProviders?: Array<number>;
+    /**
+     * Open launch URL in a new browser tab or window.
+     * @type {boolean}
+     * @memberof ApplicationRequest
+     */
+    openInNewTab?: boolean;
+    /**
+     * 
+     * @type {string}
+     * @memberof ApplicationRequest
+     */
+    metaLaunchUrl?: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof ApplicationRequest
+     */
+    metaIcon?: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof ApplicationRequest
+     */
+    metaDescription?: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof ApplicationRequest
+     */
+    metaPublisher?: string;
+    /**
+     * 
+     * @type {PolicyEngineMode}
+     * @memberof ApplicationRequest
+     */
+    policyEngineMode?: PolicyEngineMode;
+    /**
+     * 
+     * @type {string}
+     * @memberof ApplicationRequest
+     */
+    group?: string;
+}
+
+
+
+/**
+ * Check if a given object implements the ApplicationRequest interface.
+ */
+export function instanceOfApplicationRequest(value: object): value is ApplicationRequest {
+    if (!('name' in value) || value['name'] === undefined) return false;
+    if (!('slug' in value) || value['slug'] === undefined) return false;
+    return true;
+}
+
+export function ApplicationRequestFromJSON(json: any): ApplicationRequest {
+    return ApplicationRequestFromJSONTyped(json, false);
+}
+
+export function ApplicationRequestFromJSONTyped(json: any, ignoreDiscriminator: boolean): ApplicationRequest {
+    if (json == null) {
+        return json;
+    }
+    return {
+        
+        'name': json['name'],
+        'slug': json['slug'],
+        'provider': json['provider'] == null ? undefined : json['provider'],
+        'backchannelProviders': json['backchannel_providers'] == null ? undefined : json['backchannel_providers'],
+        'openInNewTab': json['open_in_new_tab'] == null ? undefined : json['open_in_new_tab'],
+        'metaLaunchUrl': json['meta_launch_url'] == null ? undefined : json['meta_launch_url'],
+        'metaIcon': json['meta_icon'] == null ? undefined : json['meta_icon'],
+        'metaDescription': json['meta_description'] == null ? undefined : json['meta_description'],
+        'metaPublisher': json['meta_publisher'] == null ? undefined : json['meta_publisher'],
+        'policyEngineMode': json['policy_engine_mode'] == null ? undefined : PolicyEngineModeFromJSON(json['policy_engine_mode']),
+        'group': json['group'] == null ? undefined : json['group'],
+    };
+}
+
+export function ApplicationRequestToJSON(json: any): ApplicationRequest {
+    return ApplicationRequestToJSONTyped(json, false);
+}
+
+export function ApplicationRequestToJSONTyped(value?: ApplicationRequest | null, ignoreDiscriminator: boolean = false): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        
+        'name': value['name'],
+        'slug': value['slug'],
+        'provider': value['provider'],
+        'backchannel_providers': value['backchannelProviders'],
+        'open_in_new_tab': value['openInNewTab'],
+        'meta_launch_url': value['metaLaunchUrl'],
+        'meta_icon': value['metaIcon'],
+        'meta_description': value['metaDescription'],
+        'meta_publisher': value['metaPublisher'],
+        'policy_engine_mode': PolicyEngineModeToJSON(value['policyEngineMode']),
+        'group': value['group'],
+    };
+}
+

packages/client-ts/src/models/AuthTypeEnum.ts

@@ -0,0 +1,54 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+
+/**
+ * 
+ * @export
+ */
+export const AuthTypeEnum = {
+    Basic: 'basic',
+    Bearer: 'bearer',
+    UnknownDefaultOpenApi: '11184809'
+} as const;
+export type AuthTypeEnum = typeof AuthTypeEnum[keyof typeof AuthTypeEnum];
+
+
+export function instanceOfAuthTypeEnum(value: any): boolean {
+    for (const key in AuthTypeEnum) {
+        if (Object.prototype.hasOwnProperty.call(AuthTypeEnum, key)) {
+            if (AuthTypeEnum[key as keyof typeof AuthTypeEnum] === value) {
+                return true;
+            }
+        }
+    }
+    return false;
+}
+
+export function AuthTypeEnumFromJSON(json: any): AuthTypeEnum {
+    return AuthTypeEnumFromJSONTyped(json, false);
+}
+
+export function AuthTypeEnumFromJSONTyped(json: any, ignoreDiscriminator: boolean): AuthTypeEnum {
+    return json as AuthTypeEnum;
+}
+
+export function AuthTypeEnumToJSON(value?: AuthTypeEnum | null): any {
+    return value as any;
+}
+
+export function AuthTypeEnumToJSONTyped(value: any, ignoreDiscriminator: boolean): AuthTypeEnum {
+    return value as AuthTypeEnum;
+}
+

packages/client-ts/src/models/AuthenticatedSession.ts

@@ -0,0 +1,163 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import { mapValues } from '../runtime';
+import type { AuthenticatedSessionGeoIp } from './AuthenticatedSessionGeoIp';
+import {
+    AuthenticatedSessionGeoIpFromJSON,
+    AuthenticatedSessionGeoIpFromJSONTyped,
+    AuthenticatedSessionGeoIpToJSON,
+    AuthenticatedSessionGeoIpToJSONTyped,
+} from './AuthenticatedSessionGeoIp';
+import type { AuthenticatedSessionAsn } from './AuthenticatedSessionAsn';
+import {
+    AuthenticatedSessionAsnFromJSON,
+    AuthenticatedSessionAsnFromJSONTyped,
+    AuthenticatedSessionAsnToJSON,
+    AuthenticatedSessionAsnToJSONTyped,
+} from './AuthenticatedSessionAsn';
+import type { AuthenticatedSessionUserAgent } from './AuthenticatedSessionUserAgent';
+import {
+    AuthenticatedSessionUserAgentFromJSON,
+    AuthenticatedSessionUserAgentFromJSONTyped,
+    AuthenticatedSessionUserAgentToJSON,
+    AuthenticatedSessionUserAgentToJSONTyped,
+} from './AuthenticatedSessionUserAgent';
+
+/**
+ * AuthenticatedSession Serializer
+ * @export
+ * @interface AuthenticatedSession
+ */
+export interface AuthenticatedSession {
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatedSession
+     */
+    uuid?: string;
+    /**
+     * Check if session is currently active session
+     * @type {boolean}
+     * @memberof AuthenticatedSession
+     */
+    readonly current: boolean;
+    /**
+     * 
+     * @type {AuthenticatedSessionUserAgent}
+     * @memberof AuthenticatedSession
+     */
+    userAgent: AuthenticatedSessionUserAgent;
+    /**
+     * 
+     * @type {AuthenticatedSessionGeoIp}
+     * @memberof AuthenticatedSession
+     */
+    geoIp: AuthenticatedSessionGeoIp | null;
+    /**
+     * 
+     * @type {AuthenticatedSessionAsn}
+     * @memberof AuthenticatedSession
+     */
+    asn: AuthenticatedSessionAsn | null;
+    /**
+     * 
+     * @type {number}
+     * @memberof AuthenticatedSession
+     */
+    user: number;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatedSession
+     */
+    readonly lastIp: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatedSession
+     */
+    readonly lastUserAgent: string;
+    /**
+     * 
+     * @type {Date}
+     * @memberof AuthenticatedSession
+     */
+    readonly lastUsed: Date;
+    /**
+     * 
+     * @type {Date}
+     * @memberof AuthenticatedSession
+     */
+    readonly expires: Date;
+}
+
+/**
+ * Check if a given object implements the AuthenticatedSession interface.
+ */
+export function instanceOfAuthenticatedSession(value: object): value is AuthenticatedSession {
+    if (!('current' in value) || value['current'] === undefined) return false;
+    if (!('userAgent' in value) || value['userAgent'] === undefined) return false;
+    if (!('geoIp' in value) || value['geoIp'] === undefined) return false;
+    if (!('asn' in value) || value['asn'] === undefined) return false;
+    if (!('user' in value) || value['user'] === undefined) return false;
+    if (!('lastIp' in value) || value['lastIp'] === undefined) return false;
+    if (!('lastUserAgent' in value) || value['lastUserAgent'] === undefined) return false;
+    if (!('lastUsed' in value) || value['lastUsed'] === undefined) return false;
+    if (!('expires' in value) || value['expires'] === undefined) return false;
+    return true;
+}
+
+export function AuthenticatedSessionFromJSON(json: any): AuthenticatedSession {
+    return AuthenticatedSessionFromJSONTyped(json, false);
+}
+
+export function AuthenticatedSessionFromJSONTyped(json: any, ignoreDiscriminator: boolean): AuthenticatedSession {
+    if (json == null) {
+        return json;
+    }
+    return {
+        
+        'uuid': json['uuid'] == null ? undefined : json['uuid'],
+        'current': json['current'],
+        'userAgent': AuthenticatedSessionUserAgentFromJSON(json['user_agent']),
+        'geoIp': AuthenticatedSessionGeoIpFromJSON(json['geo_ip']),
+        'asn': AuthenticatedSessionAsnFromJSON(json['asn']),
+        'user': json['user'],
+        'lastIp': json['last_ip'],
+        'lastUserAgent': json['last_user_agent'],
+        'lastUsed': (new Date(json['last_used'])),
+        'expires': (new Date(json['expires'])),
+    };
+}
+
+export function AuthenticatedSessionToJSON(json: any): AuthenticatedSession {
+    return AuthenticatedSessionToJSONTyped(json, false);
+}
+
+export function AuthenticatedSessionToJSONTyped(value?: Omit<AuthenticatedSession, 'current'|'last_ip'|'last_user_agent'|'last_used'|'expires'> | null, ignoreDiscriminator: boolean = false): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        
+        'uuid': value['uuid'],
+        'user_agent': AuthenticatedSessionUserAgentToJSON(value['userAgent']),
+        'geo_ip': AuthenticatedSessionGeoIpToJSON(value['geoIp']),
+        'asn': AuthenticatedSessionAsnToJSON(value['asn']),
+        'user': value['user'],
+    };
+}
+

packages/client-ts/src/models/AuthenticatedSessionAsn.ts

@@ -0,0 +1,84 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import { mapValues } from '../runtime';
+/**
+ * Get ASN Data
+ * @export
+ * @interface AuthenticatedSessionAsn
+ */
+export interface AuthenticatedSessionAsn {
+    /**
+     * 
+     * @type {number}
+     * @memberof AuthenticatedSessionAsn
+     */
+    asn: number | null;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatedSessionAsn
+     */
+    asOrg: string | null;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatedSessionAsn
+     */
+    network: string | null;
+}
+
+/**
+ * Check if a given object implements the AuthenticatedSessionAsn interface.
+ */
+export function instanceOfAuthenticatedSessionAsn(value: object): value is AuthenticatedSessionAsn {
+    if (!('asn' in value) || value['asn'] === undefined) return false;
+    if (!('asOrg' in value) || value['asOrg'] === undefined) return false;
+    if (!('network' in value) || value['network'] === undefined) return false;
+    return true;
+}
+
+export function AuthenticatedSessionAsnFromJSON(json: any): AuthenticatedSessionAsn {
+    return AuthenticatedSessionAsnFromJSONTyped(json, false);
+}
+
+export function AuthenticatedSessionAsnFromJSONTyped(json: any, ignoreDiscriminator: boolean): AuthenticatedSessionAsn {
+    if (json == null) {
+        return json;
+    }
+    return {
+        
+        'asn': json['asn'],
+        'asOrg': json['as_org'],
+        'network': json['network'],
+    };
+}
+
+export function AuthenticatedSessionAsnToJSON(json: any): AuthenticatedSessionAsn {
+    return AuthenticatedSessionAsnToJSONTyped(json, false);
+}
+
+export function AuthenticatedSessionAsnToJSONTyped(value?: AuthenticatedSessionAsn | null, ignoreDiscriminator: boolean = false): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        
+        'asn': value['asn'],
+        'as_org': value['asOrg'],
+        'network': value['network'],
+    };
+}
+

packages/client-ts/src/models/AuthenticatedSessionGeoIp.ts

@@ -0,0 +1,102 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import { mapValues } from '../runtime';
+/**
+ * Get GeoIP Data
+ * @export
+ * @interface AuthenticatedSessionGeoIp
+ */
+export interface AuthenticatedSessionGeoIp {
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatedSessionGeoIp
+     */
+    continent: string | null;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatedSessionGeoIp
+     */
+    country: string | null;
+    /**
+     * 
+     * @type {number}
+     * @memberof AuthenticatedSessionGeoIp
+     */
+    lat: number | null;
+    /**
+     * 
+     * @type {number}
+     * @memberof AuthenticatedSessionGeoIp
+     */
+    _long: number | null;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatedSessionGeoIp
+     */
+    city: string;
+}
+
+/**
+ * Check if a given object implements the AuthenticatedSessionGeoIp interface.
+ */
+export function instanceOfAuthenticatedSessionGeoIp(value: object): value is AuthenticatedSessionGeoIp {
+    if (!('continent' in value) || value['continent'] === undefined) return false;
+    if (!('country' in value) || value['country'] === undefined) return false;
+    if (!('lat' in value) || value['lat'] === undefined) return false;
+    if (!('_long' in value) || value['_long'] === undefined) return false;
+    if (!('city' in value) || value['city'] === undefined) return false;
+    return true;
+}
+
+export function AuthenticatedSessionGeoIpFromJSON(json: any): AuthenticatedSessionGeoIp {
+    return AuthenticatedSessionGeoIpFromJSONTyped(json, false);
+}
+
+export function AuthenticatedSessionGeoIpFromJSONTyped(json: any, ignoreDiscriminator: boolean): AuthenticatedSessionGeoIp {
+    if (json == null) {
+        return json;
+    }
+    return {
+        
+        'continent': json['continent'],
+        'country': json['country'],
+        'lat': json['lat'],
+        '_long': json['long'],
+        'city': json['city'],
+    };
+}
+
+export function AuthenticatedSessionGeoIpToJSON(json: any): AuthenticatedSessionGeoIp {
+    return AuthenticatedSessionGeoIpToJSONTyped(json, false);
+}
+
+export function AuthenticatedSessionGeoIpToJSONTyped(value?: AuthenticatedSessionGeoIp | null, ignoreDiscriminator: boolean = false): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        
+        'continent': value['continent'],
+        'country': value['country'],
+        'lat': value['lat'],
+        'long': value['_long'],
+        'city': value['city'],
+    };
+}
+

packages/client-ts/src/models/AuthenticatedSessionUserAgent.ts

@@ -0,0 +1,115 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import { mapValues } from '../runtime';
+import type { AuthenticatedSessionUserAgentDevice } from './AuthenticatedSessionUserAgentDevice';
+import {
+    AuthenticatedSessionUserAgentDeviceFromJSON,
+    AuthenticatedSessionUserAgentDeviceFromJSONTyped,
+    AuthenticatedSessionUserAgentDeviceToJSON,
+    AuthenticatedSessionUserAgentDeviceToJSONTyped,
+} from './AuthenticatedSessionUserAgentDevice';
+import type { AuthenticatedSessionUserAgentUserAgent } from './AuthenticatedSessionUserAgentUserAgent';
+import {
+    AuthenticatedSessionUserAgentUserAgentFromJSON,
+    AuthenticatedSessionUserAgentUserAgentFromJSONTyped,
+    AuthenticatedSessionUserAgentUserAgentToJSON,
+    AuthenticatedSessionUserAgentUserAgentToJSONTyped,
+} from './AuthenticatedSessionUserAgentUserAgent';
+import type { AuthenticatedSessionUserAgentOs } from './AuthenticatedSessionUserAgentOs';
+import {
+    AuthenticatedSessionUserAgentOsFromJSON,
+    AuthenticatedSessionUserAgentOsFromJSONTyped,
+    AuthenticatedSessionUserAgentOsToJSON,
+    AuthenticatedSessionUserAgentOsToJSONTyped,
+} from './AuthenticatedSessionUserAgentOs';
+
+/**
+ * Get parsed user agent
+ * @export
+ * @interface AuthenticatedSessionUserAgent
+ */
+export interface AuthenticatedSessionUserAgent {
+    /**
+     * 
+     * @type {AuthenticatedSessionUserAgentDevice}
+     * @memberof AuthenticatedSessionUserAgent
+     */
+    device: AuthenticatedSessionUserAgentDevice;
+    /**
+     * 
+     * @type {AuthenticatedSessionUserAgentOs}
+     * @memberof AuthenticatedSessionUserAgent
+     */
+    os: AuthenticatedSessionUserAgentOs;
+    /**
+     * 
+     * @type {AuthenticatedSessionUserAgentUserAgent}
+     * @memberof AuthenticatedSessionUserAgent
+     */
+    userAgent: AuthenticatedSessionUserAgentUserAgent;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatedSessionUserAgent
+     */
+    string: string;
+}
+
+/**
+ * Check if a given object implements the AuthenticatedSessionUserAgent interface.
+ */
+export function instanceOfAuthenticatedSessionUserAgent(value: object): value is AuthenticatedSessionUserAgent {
+    if (!('device' in value) || value['device'] === undefined) return false;
+    if (!('os' in value) || value['os'] === undefined) return false;
+    if (!('userAgent' in value) || value['userAgent'] === undefined) return false;
+    if (!('string' in value) || value['string'] === undefined) return false;
+    return true;
+}
+
+export function AuthenticatedSessionUserAgentFromJSON(json: any): AuthenticatedSessionUserAgent {
+    return AuthenticatedSessionUserAgentFromJSONTyped(json, false);
+}
+
+export function AuthenticatedSessionUserAgentFromJSONTyped(json: any, ignoreDiscriminator: boolean): AuthenticatedSessionUserAgent {
+    if (json == null) {
+        return json;
+    }
+    return {
+        
+        'device': AuthenticatedSessionUserAgentDeviceFromJSON(json['device']),
+        'os': AuthenticatedSessionUserAgentOsFromJSON(json['os']),
+        'userAgent': AuthenticatedSessionUserAgentUserAgentFromJSON(json['user_agent']),
+        'string': json['string'],
+    };
+}
+
+export function AuthenticatedSessionUserAgentToJSON(json: any): AuthenticatedSessionUserAgent {
+    return AuthenticatedSessionUserAgentToJSONTyped(json, false);
+}
+
+export function AuthenticatedSessionUserAgentToJSONTyped(value?: AuthenticatedSessionUserAgent | null, ignoreDiscriminator: boolean = false): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        
+        'device': AuthenticatedSessionUserAgentDeviceToJSON(value['device']),
+        'os': AuthenticatedSessionUserAgentOsToJSON(value['os']),
+        'user_agent': AuthenticatedSessionUserAgentUserAgentToJSON(value['userAgent']),
+        'string': value['string'],
+    };
+}
+

packages/client-ts/src/models/AuthenticatedSessionUserAgentDevice.ts

@@ -0,0 +1,84 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import { mapValues } from '../runtime';
+/**
+ * User agent device
+ * @export
+ * @interface AuthenticatedSessionUserAgentDevice
+ */
+export interface AuthenticatedSessionUserAgentDevice {
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatedSessionUserAgentDevice
+     */
+    brand: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatedSessionUserAgentDevice
+     */
+    family: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatedSessionUserAgentDevice
+     */
+    model: string;
+}
+
+/**
+ * Check if a given object implements the AuthenticatedSessionUserAgentDevice interface.
+ */
+export function instanceOfAuthenticatedSessionUserAgentDevice(value: object): value is AuthenticatedSessionUserAgentDevice {
+    if (!('brand' in value) || value['brand'] === undefined) return false;
+    if (!('family' in value) || value['family'] === undefined) return false;
+    if (!('model' in value) || value['model'] === undefined) return false;
+    return true;
+}
+
+export function AuthenticatedSessionUserAgentDeviceFromJSON(json: any): AuthenticatedSessionUserAgentDevice {
+    return AuthenticatedSessionUserAgentDeviceFromJSONTyped(json, false);
+}
+
+export function AuthenticatedSessionUserAgentDeviceFromJSONTyped(json: any, ignoreDiscriminator: boolean): AuthenticatedSessionUserAgentDevice {
+    if (json == null) {
+        return json;
+    }
+    return {
+        
+        'brand': json['brand'],
+        'family': json['family'],
+        'model': json['model'],
+    };
+}
+
+export function AuthenticatedSessionUserAgentDeviceToJSON(json: any): AuthenticatedSessionUserAgentDevice {
+    return AuthenticatedSessionUserAgentDeviceToJSONTyped(json, false);
+}
+
+export function AuthenticatedSessionUserAgentDeviceToJSONTyped(value?: AuthenticatedSessionUserAgentDevice | null, ignoreDiscriminator: boolean = false): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        
+        'brand': value['brand'],
+        'family': value['family'],
+        'model': value['model'],
+    };
+}
+

packages/client-ts/src/models/AuthenticatedSessionUserAgentOs.ts

@@ -0,0 +1,102 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import { mapValues } from '../runtime';
+/**
+ * User agent os
+ * @export
+ * @interface AuthenticatedSessionUserAgentOs
+ */
+export interface AuthenticatedSessionUserAgentOs {
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatedSessionUserAgentOs
+     */
+    family: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatedSessionUserAgentOs
+     */
+    major: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatedSessionUserAgentOs
+     */
+    minor: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatedSessionUserAgentOs
+     */
+    patch: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatedSessionUserAgentOs
+     */
+    patchMinor: string;
+}
+
+/**
+ * Check if a given object implements the AuthenticatedSessionUserAgentOs interface.
+ */
+export function instanceOfAuthenticatedSessionUserAgentOs(value: object): value is AuthenticatedSessionUserAgentOs {
+    if (!('family' in value) || value['family'] === undefined) return false;
+    if (!('major' in value) || value['major'] === undefined) return false;
+    if (!('minor' in value) || value['minor'] === undefined) return false;
+    if (!('patch' in value) || value['patch'] === undefined) return false;
+    if (!('patchMinor' in value) || value['patchMinor'] === undefined) return false;
+    return true;
+}
+
+export function AuthenticatedSessionUserAgentOsFromJSON(json: any): AuthenticatedSessionUserAgentOs {
+    return AuthenticatedSessionUserAgentOsFromJSONTyped(json, false);
+}
+
+export function AuthenticatedSessionUserAgentOsFromJSONTyped(json: any, ignoreDiscriminator: boolean): AuthenticatedSessionUserAgentOs {
+    if (json == null) {
+        return json;
+    }
+    return {
+        
+        'family': json['family'],
+        'major': json['major'],
+        'minor': json['minor'],
+        'patch': json['patch'],
+        'patchMinor': json['patch_minor'],
+    };
+}
+
+export function AuthenticatedSessionUserAgentOsToJSON(json: any): AuthenticatedSessionUserAgentOs {
+    return AuthenticatedSessionUserAgentOsToJSONTyped(json, false);
+}
+
+export function AuthenticatedSessionUserAgentOsToJSONTyped(value?: AuthenticatedSessionUserAgentOs | null, ignoreDiscriminator: boolean = false): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        
+        'family': value['family'],
+        'major': value['major'],
+        'minor': value['minor'],
+        'patch': value['patch'],
+        'patch_minor': value['patchMinor'],
+    };
+}
+

packages/client-ts/src/models/AuthenticatedSessionUserAgentUserAgent.ts

@@ -0,0 +1,93 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import { mapValues } from '../runtime';
+/**
+ * User agent browser
+ * @export
+ * @interface AuthenticatedSessionUserAgentUserAgent
+ */
+export interface AuthenticatedSessionUserAgentUserAgent {
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatedSessionUserAgentUserAgent
+     */
+    family: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatedSessionUserAgentUserAgent
+     */
+    major: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatedSessionUserAgentUserAgent
+     */
+    minor: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatedSessionUserAgentUserAgent
+     */
+    patch: string;
+}
+
+/**
+ * Check if a given object implements the AuthenticatedSessionUserAgentUserAgent interface.
+ */
+export function instanceOfAuthenticatedSessionUserAgentUserAgent(value: object): value is AuthenticatedSessionUserAgentUserAgent {
+    if (!('family' in value) || value['family'] === undefined) return false;
+    if (!('major' in value) || value['major'] === undefined) return false;
+    if (!('minor' in value) || value['minor'] === undefined) return false;
+    if (!('patch' in value) || value['patch'] === undefined) return false;
+    return true;
+}
+
+export function AuthenticatedSessionUserAgentUserAgentFromJSON(json: any): AuthenticatedSessionUserAgentUserAgent {
+    return AuthenticatedSessionUserAgentUserAgentFromJSONTyped(json, false);
+}
+
+export function AuthenticatedSessionUserAgentUserAgentFromJSONTyped(json: any, ignoreDiscriminator: boolean): AuthenticatedSessionUserAgentUserAgent {
+    if (json == null) {
+        return json;
+    }
+    return {
+        
+        'family': json['family'],
+        'major': json['major'],
+        'minor': json['minor'],
+        'patch': json['patch'],
+    };
+}
+
+export function AuthenticatedSessionUserAgentUserAgentToJSON(json: any): AuthenticatedSessionUserAgentUserAgent {
+    return AuthenticatedSessionUserAgentUserAgentToJSONTyped(json, false);
+}
+
+export function AuthenticatedSessionUserAgentUserAgentToJSONTyped(value?: AuthenticatedSessionUserAgentUserAgent | null, ignoreDiscriminator: boolean = false): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        
+        'family': value['family'],
+        'major': value['major'],
+        'minor': value['minor'],
+        'patch': value['patch'],
+    };
+}
+

packages/client-ts/src/models/AuthenticationEnum.ts

@@ -0,0 +1,58 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+
+/**
+ * 
+ * @export
+ */
+export const AuthenticationEnum = {
+    None: 'none',
+    RequireAuthenticated: 'require_authenticated',
+    RequireUnauthenticated: 'require_unauthenticated',
+    RequireSuperuser: 'require_superuser',
+    RequireRedirect: 'require_redirect',
+    RequireOutpost: 'require_outpost',
+    UnknownDefaultOpenApi: '11184809'
+} as const;
+export type AuthenticationEnum = typeof AuthenticationEnum[keyof typeof AuthenticationEnum];
+
+
+export function instanceOfAuthenticationEnum(value: any): boolean {
+    for (const key in AuthenticationEnum) {
+        if (Object.prototype.hasOwnProperty.call(AuthenticationEnum, key)) {
+            if (AuthenticationEnum[key as keyof typeof AuthenticationEnum] === value) {
+                return true;
+            }
+        }
+    }
+    return false;
+}
+
+export function AuthenticationEnumFromJSON(json: any): AuthenticationEnum {
+    return AuthenticationEnumFromJSONTyped(json, false);
+}
+
+export function AuthenticationEnumFromJSONTyped(json: any, ignoreDiscriminator: boolean): AuthenticationEnum {
+    return json as AuthenticationEnum;
+}
+
+export function AuthenticationEnumToJSON(value?: AuthenticationEnum | null): any {
+    return value as any;
+}
+
+export function AuthenticationEnumToJSONTyped(value: any, ignoreDiscriminator: boolean): AuthenticationEnum {
+    return value as AuthenticationEnum;
+}
+

packages/client-ts/src/models/AuthenticatorAttachmentEnum.ts

@@ -0,0 +1,54 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+
+/**
+ * 
+ * @export
+ */
+export const AuthenticatorAttachmentEnum = {
+    Platform: 'platform',
+    CrossPlatform: 'cross-platform',
+    UnknownDefaultOpenApi: '11184809'
+} as const;
+export type AuthenticatorAttachmentEnum = typeof AuthenticatorAttachmentEnum[keyof typeof AuthenticatorAttachmentEnum];
+
+
+export function instanceOfAuthenticatorAttachmentEnum(value: any): boolean {
+    for (const key in AuthenticatorAttachmentEnum) {
+        if (Object.prototype.hasOwnProperty.call(AuthenticatorAttachmentEnum, key)) {
+            if (AuthenticatorAttachmentEnum[key as keyof typeof AuthenticatorAttachmentEnum] === value) {
+                return true;
+            }
+        }
+    }
+    return false;
+}
+
+export function AuthenticatorAttachmentEnumFromJSON(json: any): AuthenticatorAttachmentEnum {
+    return AuthenticatorAttachmentEnumFromJSONTyped(json, false);
+}
+
+export function AuthenticatorAttachmentEnumFromJSONTyped(json: any, ignoreDiscriminator: boolean): AuthenticatorAttachmentEnum {
+    return json as AuthenticatorAttachmentEnum;
+}
+
+export function AuthenticatorAttachmentEnumToJSON(value?: AuthenticatorAttachmentEnum | null): any {
+    return value as any;
+}
+
+export function AuthenticatorAttachmentEnumToJSONTyped(value: any, ignoreDiscriminator: boolean): AuthenticatorAttachmentEnum {
+    return value as AuthenticatorAttachmentEnum;
+}
+

packages/client-ts/src/models/AuthenticatorDuoChallenge.ts

@@ -0,0 +1,141 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import { mapValues } from '../runtime';
+import type { ErrorDetail } from './ErrorDetail';
+import {
+    ErrorDetailFromJSON,
+    ErrorDetailFromJSONTyped,
+    ErrorDetailToJSON,
+    ErrorDetailToJSONTyped,
+} from './ErrorDetail';
+import type { ContextualFlowInfo } from './ContextualFlowInfo';
+import {
+    ContextualFlowInfoFromJSON,
+    ContextualFlowInfoFromJSONTyped,
+    ContextualFlowInfoToJSON,
+    ContextualFlowInfoToJSONTyped,
+} from './ContextualFlowInfo';
+
+/**
+ * Duo Challenge
+ * @export
+ * @interface AuthenticatorDuoChallenge
+ */
+export interface AuthenticatorDuoChallenge {
+    /**
+     * 
+     * @type {ContextualFlowInfo}
+     * @memberof AuthenticatorDuoChallenge
+     */
+    flowInfo?: ContextualFlowInfo;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorDuoChallenge
+     */
+    component?: string;
+    /**
+     * 
+     * @type {{ [key: string]: Array<ErrorDetail>; }}
+     * @memberof AuthenticatorDuoChallenge
+     */
+    responseErrors?: { [key: string]: Array<ErrorDetail>; };
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorDuoChallenge
+     */
+    pendingUser: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorDuoChallenge
+     */
+    pendingUserAvatar: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorDuoChallenge
+     */
+    activationBarcode: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorDuoChallenge
+     */
+    activationCode: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorDuoChallenge
+     */
+    stageUuid: string;
+}
+
+/**
+ * Check if a given object implements the AuthenticatorDuoChallenge interface.
+ */
+export function instanceOfAuthenticatorDuoChallenge(value: object): value is AuthenticatorDuoChallenge {
+    if (!('pendingUser' in value) || value['pendingUser'] === undefined) return false;
+    if (!('pendingUserAvatar' in value) || value['pendingUserAvatar'] === undefined) return false;
+    if (!('activationBarcode' in value) || value['activationBarcode'] === undefined) return false;
+    if (!('activationCode' in value) || value['activationCode'] === undefined) return false;
+    if (!('stageUuid' in value) || value['stageUuid'] === undefined) return false;
+    return true;
+}
+
+export function AuthenticatorDuoChallengeFromJSON(json: any): AuthenticatorDuoChallenge {
+    return AuthenticatorDuoChallengeFromJSONTyped(json, false);
+}
+
+export function AuthenticatorDuoChallengeFromJSONTyped(json: any, ignoreDiscriminator: boolean): AuthenticatorDuoChallenge {
+    if (json == null) {
+        return json;
+    }
+    return {
+        
+        'flowInfo': json['flow_info'] == null ? undefined : ContextualFlowInfoFromJSON(json['flow_info']),
+        'component': json['component'] == null ? undefined : json['component'],
+        'responseErrors': json['response_errors'] == null ? undefined : json['response_errors'],
+        'pendingUser': json['pending_user'],
+        'pendingUserAvatar': json['pending_user_avatar'],
+        'activationBarcode': json['activation_barcode'],
+        'activationCode': json['activation_code'],
+        'stageUuid': json['stage_uuid'],
+    };
+}
+
+export function AuthenticatorDuoChallengeToJSON(json: any): AuthenticatorDuoChallenge {
+    return AuthenticatorDuoChallengeToJSONTyped(json, false);
+}
+
+export function AuthenticatorDuoChallengeToJSONTyped(value?: AuthenticatorDuoChallenge | null, ignoreDiscriminator: boolean = false): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        
+        'flow_info': ContextualFlowInfoToJSON(value['flowInfo']),
+        'component': value['component'],
+        'response_errors': value['responseErrors'],
+        'pending_user': value['pendingUser'],
+        'pending_user_avatar': value['pendingUserAvatar'],
+        'activation_barcode': value['activationBarcode'],
+        'activation_code': value['activationCode'],
+        'stage_uuid': value['stageUuid'],
+    };
+}
+

packages/client-ts/src/models/AuthenticatorDuoChallengeResponseRequest.ts

@@ -0,0 +1,65 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import { mapValues } from '../runtime';
+/**
+ * Pseudo class for duo response
+ * @export
+ * @interface AuthenticatorDuoChallengeResponseRequest
+ */
+export interface AuthenticatorDuoChallengeResponseRequest {
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorDuoChallengeResponseRequest
+     */
+    component?: string;
+}
+
+/**
+ * Check if a given object implements the AuthenticatorDuoChallengeResponseRequest interface.
+ */
+export function instanceOfAuthenticatorDuoChallengeResponseRequest(value: object): value is AuthenticatorDuoChallengeResponseRequest {
+    return true;
+}
+
+export function AuthenticatorDuoChallengeResponseRequestFromJSON(json: any): AuthenticatorDuoChallengeResponseRequest {
+    return AuthenticatorDuoChallengeResponseRequestFromJSONTyped(json, false);
+}
+
+export function AuthenticatorDuoChallengeResponseRequestFromJSONTyped(json: any, ignoreDiscriminator: boolean): AuthenticatorDuoChallengeResponseRequest {
+    if (json == null) {
+        return json;
+    }
+    return {
+        
+        'component': json['component'] == null ? undefined : json['component'],
+    };
+}
+
+export function AuthenticatorDuoChallengeResponseRequestToJSON(json: any): AuthenticatorDuoChallengeResponseRequest {
+    return AuthenticatorDuoChallengeResponseRequestToJSONTyped(json, false);
+}
+
+export function AuthenticatorDuoChallengeResponseRequestToJSONTyped(value?: AuthenticatorDuoChallengeResponseRequest | null, ignoreDiscriminator: boolean = false): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        
+        'component': value['component'],
+    };
+}
+

packages/client-ts/src/models/AuthenticatorDuoStage.ts

@@ -0,0 +1,164 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import { mapValues } from '../runtime';
+import type { FlowSet } from './FlowSet';
+import {
+    FlowSetFromJSON,
+    FlowSetFromJSONTyped,
+    FlowSetToJSON,
+    FlowSetToJSONTyped,
+} from './FlowSet';
+
+/**
+ * AuthenticatorDuoStage Serializer
+ * @export
+ * @interface AuthenticatorDuoStage
+ */
+export interface AuthenticatorDuoStage {
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorDuoStage
+     */
+    readonly pk: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorDuoStage
+     */
+    name: string;
+    /**
+     * Get object type so that we know how to edit the object
+     * @type {string}
+     * @memberof AuthenticatorDuoStage
+     */
+    readonly component: string;
+    /**
+     * Return object's verbose_name
+     * @type {string}
+     * @memberof AuthenticatorDuoStage
+     */
+    readonly verboseName: string;
+    /**
+     * Return object's plural verbose_name
+     * @type {string}
+     * @memberof AuthenticatorDuoStage
+     */
+    readonly verboseNamePlural: string;
+    /**
+     * Return internal model name
+     * @type {string}
+     * @memberof AuthenticatorDuoStage
+     */
+    readonly metaModelName: string;
+    /**
+     * 
+     * @type {Array<FlowSet>}
+     * @memberof AuthenticatorDuoStage
+     */
+    readonly flowSet: Array<FlowSet>;
+    /**
+     * Flow used by an authenticated user to configure this Stage. If empty, user will not be able to configure this stage.
+     * @type {string}
+     * @memberof AuthenticatorDuoStage
+     */
+    configureFlow?: string | null;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorDuoStage
+     */
+    friendlyName?: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorDuoStage
+     */
+    clientId: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorDuoStage
+     */
+    apiHostname: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorDuoStage
+     */
+    adminIntegrationKey?: string;
+}
+
+/**
+ * Check if a given object implements the AuthenticatorDuoStage interface.
+ */
+export function instanceOfAuthenticatorDuoStage(value: object): value is AuthenticatorDuoStage {
+    if (!('pk' in value) || value['pk'] === undefined) return false;
+    if (!('name' in value) || value['name'] === undefined) return false;
+    if (!('component' in value) || value['component'] === undefined) return false;
+    if (!('verboseName' in value) || value['verboseName'] === undefined) return false;
+    if (!('verboseNamePlural' in value) || value['verboseNamePlural'] === undefined) return false;
+    if (!('metaModelName' in value) || value['metaModelName'] === undefined) return false;
+    if (!('flowSet' in value) || value['flowSet'] === undefined) return false;
+    if (!('clientId' in value) || value['clientId'] === undefined) return false;
+    if (!('apiHostname' in value) || value['apiHostname'] === undefined) return false;
+    return true;
+}
+
+export function AuthenticatorDuoStageFromJSON(json: any): AuthenticatorDuoStage {
+    return AuthenticatorDuoStageFromJSONTyped(json, false);
+}
+
+export function AuthenticatorDuoStageFromJSONTyped(json: any, ignoreDiscriminator: boolean): AuthenticatorDuoStage {
+    if (json == null) {
+        return json;
+    }
+    return {
+        
+        'pk': json['pk'],
+        'name': json['name'],
+        'component': json['component'],
+        'verboseName': json['verbose_name'],
+        'verboseNamePlural': json['verbose_name_plural'],
+        'metaModelName': json['meta_model_name'],
+        'flowSet': ((json['flow_set'] as Array<any>).map(FlowSetFromJSON)),
+        'configureFlow': json['configure_flow'] == null ? undefined : json['configure_flow'],
+        'friendlyName': json['friendly_name'] == null ? undefined : json['friendly_name'],
+        'clientId': json['client_id'],
+        'apiHostname': json['api_hostname'],
+        'adminIntegrationKey': json['admin_integration_key'] == null ? undefined : json['admin_integration_key'],
+    };
+}
+
+export function AuthenticatorDuoStageToJSON(json: any): AuthenticatorDuoStage {
+    return AuthenticatorDuoStageToJSONTyped(json, false);
+}
+
+export function AuthenticatorDuoStageToJSONTyped(value?: Omit<AuthenticatorDuoStage, 'pk'|'component'|'verbose_name'|'verbose_name_plural'|'meta_model_name'|'flow_set'> | null, ignoreDiscriminator: boolean = false): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        
+        'name': value['name'],
+        'configure_flow': value['configureFlow'],
+        'friendly_name': value['friendlyName'],
+        'client_id': value['clientId'],
+        'api_hostname': value['apiHostname'],
+        'admin_integration_key': value['adminIntegrationKey'],
+    };
+}
+

packages/client-ts/src/models/AuthenticatorDuoStageDeviceImportResponse.ts

@@ -0,0 +1,73 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import { mapValues } from '../runtime';
+/**
+ * 
+ * @export
+ * @interface AuthenticatorDuoStageDeviceImportResponse
+ */
+export interface AuthenticatorDuoStageDeviceImportResponse {
+    /**
+     * 
+     * @type {number}
+     * @memberof AuthenticatorDuoStageDeviceImportResponse
+     */
+    readonly count: number;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorDuoStageDeviceImportResponse
+     */
+    readonly error: string;
+}
+
+/**
+ * Check if a given object implements the AuthenticatorDuoStageDeviceImportResponse interface.
+ */
+export function instanceOfAuthenticatorDuoStageDeviceImportResponse(value: object): value is AuthenticatorDuoStageDeviceImportResponse {
+    if (!('count' in value) || value['count'] === undefined) return false;
+    if (!('error' in value) || value['error'] === undefined) return false;
+    return true;
+}
+
+export function AuthenticatorDuoStageDeviceImportResponseFromJSON(json: any): AuthenticatorDuoStageDeviceImportResponse {
+    return AuthenticatorDuoStageDeviceImportResponseFromJSONTyped(json, false);
+}
+
+export function AuthenticatorDuoStageDeviceImportResponseFromJSONTyped(json: any, ignoreDiscriminator: boolean): AuthenticatorDuoStageDeviceImportResponse {
+    if (json == null) {
+        return json;
+    }
+    return {
+        
+        'count': json['count'],
+        'error': json['error'],
+    };
+}
+
+export function AuthenticatorDuoStageDeviceImportResponseToJSON(json: any): AuthenticatorDuoStageDeviceImportResponse {
+    return AuthenticatorDuoStageDeviceImportResponseToJSONTyped(json, false);
+}
+
+export function AuthenticatorDuoStageDeviceImportResponseToJSONTyped(value?: Omit<AuthenticatorDuoStageDeviceImportResponse, 'count'|'error'> | null, ignoreDiscriminator: boolean = false): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        
+    };
+}
+

packages/client-ts/src/models/AuthenticatorDuoStageManualDeviceImportRequest.ts

@@ -0,0 +1,75 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import { mapValues } from '../runtime';
+/**
+ * 
+ * @export
+ * @interface AuthenticatorDuoStageManualDeviceImportRequest
+ */
+export interface AuthenticatorDuoStageManualDeviceImportRequest {
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorDuoStageManualDeviceImportRequest
+     */
+    duoUserId: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorDuoStageManualDeviceImportRequest
+     */
+    username: string;
+}
+
+/**
+ * Check if a given object implements the AuthenticatorDuoStageManualDeviceImportRequest interface.
+ */
+export function instanceOfAuthenticatorDuoStageManualDeviceImportRequest(value: object): value is AuthenticatorDuoStageManualDeviceImportRequest {
+    if (!('duoUserId' in value) || value['duoUserId'] === undefined) return false;
+    if (!('username' in value) || value['username'] === undefined) return false;
+    return true;
+}
+
+export function AuthenticatorDuoStageManualDeviceImportRequestFromJSON(json: any): AuthenticatorDuoStageManualDeviceImportRequest {
+    return AuthenticatorDuoStageManualDeviceImportRequestFromJSONTyped(json, false);
+}
+
+export function AuthenticatorDuoStageManualDeviceImportRequestFromJSONTyped(json: any, ignoreDiscriminator: boolean): AuthenticatorDuoStageManualDeviceImportRequest {
+    if (json == null) {
+        return json;
+    }
+    return {
+        
+        'duoUserId': json['duo_user_id'],
+        'username': json['username'],
+    };
+}
+
+export function AuthenticatorDuoStageManualDeviceImportRequestToJSON(json: any): AuthenticatorDuoStageManualDeviceImportRequest {
+    return AuthenticatorDuoStageManualDeviceImportRequestToJSONTyped(json, false);
+}
+
+export function AuthenticatorDuoStageManualDeviceImportRequestToJSONTyped(value?: AuthenticatorDuoStageManualDeviceImportRequest | null, ignoreDiscriminator: boolean = false): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        
+        'duo_user_id': value['duoUserId'],
+        'username': value['username'],
+    };
+}
+

packages/client-ts/src/models/AuthenticatorDuoStageRequest.ts

@@ -0,0 +1,125 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import { mapValues } from '../runtime';
+/**
+ * AuthenticatorDuoStage Serializer
+ * @export
+ * @interface AuthenticatorDuoStageRequest
+ */
+export interface AuthenticatorDuoStageRequest {
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorDuoStageRequest
+     */
+    name: string;
+    /**
+     * Flow used by an authenticated user to configure this Stage. If empty, user will not be able to configure this stage.
+     * @type {string}
+     * @memberof AuthenticatorDuoStageRequest
+     */
+    configureFlow?: string | null;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorDuoStageRequest
+     */
+    friendlyName?: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorDuoStageRequest
+     */
+    clientId: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorDuoStageRequest
+     */
+    clientSecret: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorDuoStageRequest
+     */
+    apiHostname: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorDuoStageRequest
+     */
+    adminIntegrationKey?: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorDuoStageRequest
+     */
+    adminSecretKey?: string;
+}
+
+/**
+ * Check if a given object implements the AuthenticatorDuoStageRequest interface.
+ */
+export function instanceOfAuthenticatorDuoStageRequest(value: object): value is AuthenticatorDuoStageRequest {
+    if (!('name' in value) || value['name'] === undefined) return false;
+    if (!('clientId' in value) || value['clientId'] === undefined) return false;
+    if (!('clientSecret' in value) || value['clientSecret'] === undefined) return false;
+    if (!('apiHostname' in value) || value['apiHostname'] === undefined) return false;
+    return true;
+}
+
+export function AuthenticatorDuoStageRequestFromJSON(json: any): AuthenticatorDuoStageRequest {
+    return AuthenticatorDuoStageRequestFromJSONTyped(json, false);
+}
+
+export function AuthenticatorDuoStageRequestFromJSONTyped(json: any, ignoreDiscriminator: boolean): AuthenticatorDuoStageRequest {
+    if (json == null) {
+        return json;
+    }
+    return {
+        
+        'name': json['name'],
+        'configureFlow': json['configure_flow'] == null ? undefined : json['configure_flow'],
+        'friendlyName': json['friendly_name'] == null ? undefined : json['friendly_name'],
+        'clientId': json['client_id'],
+        'clientSecret': json['client_secret'],
+        'apiHostname': json['api_hostname'],
+        'adminIntegrationKey': json['admin_integration_key'] == null ? undefined : json['admin_integration_key'],
+        'adminSecretKey': json['admin_secret_key'] == null ? undefined : json['admin_secret_key'],
+    };
+}
+
+export function AuthenticatorDuoStageRequestToJSON(json: any): AuthenticatorDuoStageRequest {
+    return AuthenticatorDuoStageRequestToJSONTyped(json, false);
+}
+
+export function AuthenticatorDuoStageRequestToJSONTyped(value?: AuthenticatorDuoStageRequest | null, ignoreDiscriminator: boolean = false): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        
+        'name': value['name'],
+        'configure_flow': value['configureFlow'],
+        'friendly_name': value['friendlyName'],
+        'client_id': value['clientId'],
+        'client_secret': value['clientSecret'],
+        'api_hostname': value['apiHostname'],
+        'admin_integration_key': value['adminIntegrationKey'],
+        'admin_secret_key': value['adminSecretKey'],
+    };
+}
+

packages/client-ts/src/models/AuthenticatorEmailChallenge.ts

@@ -0,0 +1,130 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import { mapValues } from '../runtime';
+import type { ErrorDetail } from './ErrorDetail';
+import {
+    ErrorDetailFromJSON,
+    ErrorDetailFromJSONTyped,
+    ErrorDetailToJSON,
+    ErrorDetailToJSONTyped,
+} from './ErrorDetail';
+import type { ContextualFlowInfo } from './ContextualFlowInfo';
+import {
+    ContextualFlowInfoFromJSON,
+    ContextualFlowInfoFromJSONTyped,
+    ContextualFlowInfoToJSON,
+    ContextualFlowInfoToJSONTyped,
+} from './ContextualFlowInfo';
+
+/**
+ * Authenticator Email Setup challenge
+ * @export
+ * @interface AuthenticatorEmailChallenge
+ */
+export interface AuthenticatorEmailChallenge {
+    /**
+     * 
+     * @type {ContextualFlowInfo}
+     * @memberof AuthenticatorEmailChallenge
+     */
+    flowInfo?: ContextualFlowInfo;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorEmailChallenge
+     */
+    component?: string;
+    /**
+     * 
+     * @type {{ [key: string]: Array<ErrorDetail>; }}
+     * @memberof AuthenticatorEmailChallenge
+     */
+    responseErrors?: { [key: string]: Array<ErrorDetail>; };
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorEmailChallenge
+     */
+    pendingUser: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorEmailChallenge
+     */
+    pendingUserAvatar: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorEmailChallenge
+     */
+    email?: string | null;
+    /**
+     * 
+     * @type {boolean}
+     * @memberof AuthenticatorEmailChallenge
+     */
+    emailRequired?: boolean;
+}
+
+/**
+ * Check if a given object implements the AuthenticatorEmailChallenge interface.
+ */
+export function instanceOfAuthenticatorEmailChallenge(value: object): value is AuthenticatorEmailChallenge {
+    if (!('pendingUser' in value) || value['pendingUser'] === undefined) return false;
+    if (!('pendingUserAvatar' in value) || value['pendingUserAvatar'] === undefined) return false;
+    return true;
+}
+
+export function AuthenticatorEmailChallengeFromJSON(json: any): AuthenticatorEmailChallenge {
+    return AuthenticatorEmailChallengeFromJSONTyped(json, false);
+}
+
+export function AuthenticatorEmailChallengeFromJSONTyped(json: any, ignoreDiscriminator: boolean): AuthenticatorEmailChallenge {
+    if (json == null) {
+        return json;
+    }
+    return {
+        
+        'flowInfo': json['flow_info'] == null ? undefined : ContextualFlowInfoFromJSON(json['flow_info']),
+        'component': json['component'] == null ? undefined : json['component'],
+        'responseErrors': json['response_errors'] == null ? undefined : json['response_errors'],
+        'pendingUser': json['pending_user'],
+        'pendingUserAvatar': json['pending_user_avatar'],
+        'email': json['email'] == null ? undefined : json['email'],
+        'emailRequired': json['email_required'] == null ? undefined : json['email_required'],
+    };
+}
+
+export function AuthenticatorEmailChallengeToJSON(json: any): AuthenticatorEmailChallenge {
+    return AuthenticatorEmailChallengeToJSONTyped(json, false);
+}
+
+export function AuthenticatorEmailChallengeToJSONTyped(value?: AuthenticatorEmailChallenge | null, ignoreDiscriminator: boolean = false): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        
+        'flow_info': ContextualFlowInfoToJSON(value['flowInfo']),
+        'component': value['component'],
+        'response_errors': value['responseErrors'],
+        'pending_user': value['pendingUser'],
+        'pending_user_avatar': value['pendingUserAvatar'],
+        'email': value['email'],
+        'email_required': value['emailRequired'],
+    };
+}
+

packages/client-ts/src/models/AuthenticatorEmailChallengeResponseRequest.ts

@@ -0,0 +1,81 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import { mapValues } from '../runtime';
+/**
+ * Authenticator Email Challenge response, device is set by get_response_instance
+ * @export
+ * @interface AuthenticatorEmailChallengeResponseRequest
+ */
+export interface AuthenticatorEmailChallengeResponseRequest {
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorEmailChallengeResponseRequest
+     */
+    component?: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorEmailChallengeResponseRequest
+     */
+    code?: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorEmailChallengeResponseRequest
+     */
+    email?: string;
+}
+
+/**
+ * Check if a given object implements the AuthenticatorEmailChallengeResponseRequest interface.
+ */
+export function instanceOfAuthenticatorEmailChallengeResponseRequest(value: object): value is AuthenticatorEmailChallengeResponseRequest {
+    return true;
+}
+
+export function AuthenticatorEmailChallengeResponseRequestFromJSON(json: any): AuthenticatorEmailChallengeResponseRequest {
+    return AuthenticatorEmailChallengeResponseRequestFromJSONTyped(json, false);
+}
+
+export function AuthenticatorEmailChallengeResponseRequestFromJSONTyped(json: any, ignoreDiscriminator: boolean): AuthenticatorEmailChallengeResponseRequest {
+    if (json == null) {
+        return json;
+    }
+    return {
+        
+        'component': json['component'] == null ? undefined : json['component'],
+        'code': json['code'] == null ? undefined : json['code'],
+        'email': json['email'] == null ? undefined : json['email'],
+    };
+}
+
+export function AuthenticatorEmailChallengeResponseRequestToJSON(json: any): AuthenticatorEmailChallengeResponseRequest {
+    return AuthenticatorEmailChallengeResponseRequestToJSONTyped(json, false);
+}
+
+export function AuthenticatorEmailChallengeResponseRequestToJSONTyped(value?: AuthenticatorEmailChallengeResponseRequest | null, ignoreDiscriminator: boolean = false): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        
+        'component': value['component'],
+        'code': value['code'],
+        'email': value['email'],
+    };
+}
+

packages/client-ts/src/models/AuthenticatorEmailStage.ts

@@ -0,0 +1,234 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import { mapValues } from '../runtime';
+import type { FlowSet } from './FlowSet';
+import {
+    FlowSetFromJSON,
+    FlowSetFromJSONTyped,
+    FlowSetToJSON,
+    FlowSetToJSONTyped,
+} from './FlowSet';
+
+/**
+ * AuthenticatorEmailStage Serializer
+ * @export
+ * @interface AuthenticatorEmailStage
+ */
+export interface AuthenticatorEmailStage {
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorEmailStage
+     */
+    readonly pk: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorEmailStage
+     */
+    name: string;
+    /**
+     * Get object type so that we know how to edit the object
+     * @type {string}
+     * @memberof AuthenticatorEmailStage
+     */
+    readonly component: string;
+    /**
+     * Return object's verbose_name
+     * @type {string}
+     * @memberof AuthenticatorEmailStage
+     */
+    readonly verboseName: string;
+    /**
+     * Return object's plural verbose_name
+     * @type {string}
+     * @memberof AuthenticatorEmailStage
+     */
+    readonly verboseNamePlural: string;
+    /**
+     * Return internal model name
+     * @type {string}
+     * @memberof AuthenticatorEmailStage
+     */
+    readonly metaModelName: string;
+    /**
+     * 
+     * @type {Array<FlowSet>}
+     * @memberof AuthenticatorEmailStage
+     */
+    readonly flowSet: Array<FlowSet>;
+    /**
+     * Flow used by an authenticated user to configure this Stage. If empty, user will not be able to configure this stage.
+     * @type {string}
+     * @memberof AuthenticatorEmailStage
+     */
+    configureFlow?: string | null;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorEmailStage
+     */
+    friendlyName?: string;
+    /**
+     * When enabled, global Email connection settings will be used and connection settings below will be ignored.
+     * @type {boolean}
+     * @memberof AuthenticatorEmailStage
+     */
+    useGlobalSettings?: boolean;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorEmailStage
+     */
+    host?: string;
+    /**
+     * 
+     * @type {number}
+     * @memberof AuthenticatorEmailStage
+     */
+    port?: number;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorEmailStage
+     */
+    username?: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorEmailStage
+     */
+    password?: string;
+    /**
+     * 
+     * @type {boolean}
+     * @memberof AuthenticatorEmailStage
+     */
+    useTls?: boolean;
+    /**
+     * 
+     * @type {boolean}
+     * @memberof AuthenticatorEmailStage
+     */
+    useSsl?: boolean;
+    /**
+     * 
+     * @type {number}
+     * @memberof AuthenticatorEmailStage
+     */
+    timeout?: number;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorEmailStage
+     */
+    fromAddress?: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorEmailStage
+     */
+    subject?: string;
+    /**
+     * Time the token sent is valid (Format: hours=3,minutes=17,seconds=300).
+     * @type {string}
+     * @memberof AuthenticatorEmailStage
+     */
+    tokenExpiry?: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorEmailStage
+     */
+    template?: string;
+}
+
+/**
+ * Check if a given object implements the AuthenticatorEmailStage interface.
+ */
+export function instanceOfAuthenticatorEmailStage(value: object): value is AuthenticatorEmailStage {
+    if (!('pk' in value) || value['pk'] === undefined) return false;
+    if (!('name' in value) || value['name'] === undefined) return false;
+    if (!('component' in value) || value['component'] === undefined) return false;
+    if (!('verboseName' in value) || value['verboseName'] === undefined) return false;
+    if (!('verboseNamePlural' in value) || value['verboseNamePlural'] === undefined) return false;
+    if (!('metaModelName' in value) || value['metaModelName'] === undefined) return false;
+    if (!('flowSet' in value) || value['flowSet'] === undefined) return false;
+    return true;
+}
+
+export function AuthenticatorEmailStageFromJSON(json: any): AuthenticatorEmailStage {
+    return AuthenticatorEmailStageFromJSONTyped(json, false);
+}
+
+export function AuthenticatorEmailStageFromJSONTyped(json: any, ignoreDiscriminator: boolean): AuthenticatorEmailStage {
+    if (json == null) {
+        return json;
+    }
+    return {
+        
+        'pk': json['pk'],
+        'name': json['name'],
+        'component': json['component'],
+        'verboseName': json['verbose_name'],
+        'verboseNamePlural': json['verbose_name_plural'],
+        'metaModelName': json['meta_model_name'],
+        'flowSet': ((json['flow_set'] as Array<any>).map(FlowSetFromJSON)),
+        'configureFlow': json['configure_flow'] == null ? undefined : json['configure_flow'],
+        'friendlyName': json['friendly_name'] == null ? undefined : json['friendly_name'],
+        'useGlobalSettings': json['use_global_settings'] == null ? undefined : json['use_global_settings'],
+        'host': json['host'] == null ? undefined : json['host'],
+        'port': json['port'] == null ? undefined : json['port'],
+        'username': json['username'] == null ? undefined : json['username'],
+        'password': json['password'] == null ? undefined : json['password'],
+        'useTls': json['use_tls'] == null ? undefined : json['use_tls'],
+        'useSsl': json['use_ssl'] == null ? undefined : json['use_ssl'],
+        'timeout': json['timeout'] == null ? undefined : json['timeout'],
+        'fromAddress': json['from_address'] == null ? undefined : json['from_address'],
+        'subject': json['subject'] == null ? undefined : json['subject'],
+        'tokenExpiry': json['token_expiry'] == null ? undefined : json['token_expiry'],
+        'template': json['template'] == null ? undefined : json['template'],
+    };
+}
+
+export function AuthenticatorEmailStageToJSON(json: any): AuthenticatorEmailStage {
+    return AuthenticatorEmailStageToJSONTyped(json, false);
+}
+
+export function AuthenticatorEmailStageToJSONTyped(value?: Omit<AuthenticatorEmailStage, 'pk'|'component'|'verbose_name'|'verbose_name_plural'|'meta_model_name'|'flow_set'> | null, ignoreDiscriminator: boolean = false): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        
+        'name': value['name'],
+        'configure_flow': value['configureFlow'],
+        'friendly_name': value['friendlyName'],
+        'use_global_settings': value['useGlobalSettings'],
+        'host': value['host'],
+        'port': value['port'],
+        'username': value['username'],
+        'password': value['password'],
+        'use_tls': value['useTls'],
+        'use_ssl': value['useSsl'],
+        'timeout': value['timeout'],
+        'from_address': value['fromAddress'],
+        'subject': value['subject'],
+        'token_expiry': value['tokenExpiry'],
+        'template': value['template'],
+    };
+}
+

packages/client-ts/src/models/AuthenticatorEmailStageRequest.ts

@@ -0,0 +1,178 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import { mapValues } from '../runtime';
+/**
+ * AuthenticatorEmailStage Serializer
+ * @export
+ * @interface AuthenticatorEmailStageRequest
+ */
+export interface AuthenticatorEmailStageRequest {
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorEmailStageRequest
+     */
+    name: string;
+    /**
+     * Flow used by an authenticated user to configure this Stage. If empty, user will not be able to configure this stage.
+     * @type {string}
+     * @memberof AuthenticatorEmailStageRequest
+     */
+    configureFlow?: string | null;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorEmailStageRequest
+     */
+    friendlyName?: string;
+    /**
+     * When enabled, global Email connection settings will be used and connection settings below will be ignored.
+     * @type {boolean}
+     * @memberof AuthenticatorEmailStageRequest
+     */
+    useGlobalSettings?: boolean;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorEmailStageRequest
+     */
+    host?: string;
+    /**
+     * 
+     * @type {number}
+     * @memberof AuthenticatorEmailStageRequest
+     */
+    port?: number;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorEmailStageRequest
+     */
+    username?: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorEmailStageRequest
+     */
+    password?: string;
+    /**
+     * 
+     * @type {boolean}
+     * @memberof AuthenticatorEmailStageRequest
+     */
+    useTls?: boolean;
+    /**
+     * 
+     * @type {boolean}
+     * @memberof AuthenticatorEmailStageRequest
+     */
+    useSsl?: boolean;
+    /**
+     * 
+     * @type {number}
+     * @memberof AuthenticatorEmailStageRequest
+     */
+    timeout?: number;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorEmailStageRequest
+     */
+    fromAddress?: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorEmailStageRequest
+     */
+    subject?: string;
+    /**
+     * Time the token sent is valid (Format: hours=3,minutes=17,seconds=300).
+     * @type {string}
+     * @memberof AuthenticatorEmailStageRequest
+     */
+    tokenExpiry?: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorEmailStageRequest
+     */
+    template?: string;
+}
+
+/**
+ * Check if a given object implements the AuthenticatorEmailStageRequest interface.
+ */
+export function instanceOfAuthenticatorEmailStageRequest(value: object): value is AuthenticatorEmailStageRequest {
+    if (!('name' in value) || value['name'] === undefined) return false;
+    return true;
+}
+
+export function AuthenticatorEmailStageRequestFromJSON(json: any): AuthenticatorEmailStageRequest {
+    return AuthenticatorEmailStageRequestFromJSONTyped(json, false);
+}
+
+export function AuthenticatorEmailStageRequestFromJSONTyped(json: any, ignoreDiscriminator: boolean): AuthenticatorEmailStageRequest {
+    if (json == null) {
+        return json;
+    }
+    return {
+        
+        'name': json['name'],
+        'configureFlow': json['configure_flow'] == null ? undefined : json['configure_flow'],
+        'friendlyName': json['friendly_name'] == null ? undefined : json['friendly_name'],
+        'useGlobalSettings': json['use_global_settings'] == null ? undefined : json['use_global_settings'],
+        'host': json['host'] == null ? undefined : json['host'],
+        'port': json['port'] == null ? undefined : json['port'],
+        'username': json['username'] == null ? undefined : json['username'],
+        'password': json['password'] == null ? undefined : json['password'],
+        'useTls': json['use_tls'] == null ? undefined : json['use_tls'],
+        'useSsl': json['use_ssl'] == null ? undefined : json['use_ssl'],
+        'timeout': json['timeout'] == null ? undefined : json['timeout'],
+        'fromAddress': json['from_address'] == null ? undefined : json['from_address'],
+        'subject': json['subject'] == null ? undefined : json['subject'],
+        'tokenExpiry': json['token_expiry'] == null ? undefined : json['token_expiry'],
+        'template': json['template'] == null ? undefined : json['template'],
+    };
+}
+
+export function AuthenticatorEmailStageRequestToJSON(json: any): AuthenticatorEmailStageRequest {
+    return AuthenticatorEmailStageRequestToJSONTyped(json, false);
+}
+
+export function AuthenticatorEmailStageRequestToJSONTyped(value?: AuthenticatorEmailStageRequest | null, ignoreDiscriminator: boolean = false): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        
+        'name': value['name'],
+        'configure_flow': value['configureFlow'],
+        'friendly_name': value['friendlyName'],
+        'use_global_settings': value['useGlobalSettings'],
+        'host': value['host'],
+        'port': value['port'],
+        'username': value['username'],
+        'password': value['password'],
+        'use_tls': value['useTls'],
+        'use_ssl': value['useSsl'],
+        'timeout': value['timeout'],
+        'from_address': value['fromAddress'],
+        'subject': value['subject'],
+        'token_expiry': value['tokenExpiry'],
+        'template': value['template'],
+    };
+}
+

packages/client-ts/src/models/AuthenticatorEndpointGDTCStage.ts

@@ -0,0 +1,147 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import { mapValues } from '../runtime';
+import type { FlowSet } from './FlowSet';
+import {
+    FlowSetFromJSON,
+    FlowSetFromJSONTyped,
+    FlowSetToJSON,
+    FlowSetToJSONTyped,
+} from './FlowSet';
+
+/**
+ * AuthenticatorEndpointGDTCStage Serializer
+ * @export
+ * @interface AuthenticatorEndpointGDTCStage
+ */
+export interface AuthenticatorEndpointGDTCStage {
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorEndpointGDTCStage
+     */
+    readonly pk: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorEndpointGDTCStage
+     */
+    name: string;
+    /**
+     * Get object type so that we know how to edit the object
+     * @type {string}
+     * @memberof AuthenticatorEndpointGDTCStage
+     */
+    readonly component: string;
+    /**
+     * Return object's verbose_name
+     * @type {string}
+     * @memberof AuthenticatorEndpointGDTCStage
+     */
+    readonly verboseName: string;
+    /**
+     * Return object's plural verbose_name
+     * @type {string}
+     * @memberof AuthenticatorEndpointGDTCStage
+     */
+    readonly verboseNamePlural: string;
+    /**
+     * Return internal model name
+     * @type {string}
+     * @memberof AuthenticatorEndpointGDTCStage
+     */
+    readonly metaModelName: string;
+    /**
+     * 
+     * @type {Array<FlowSet>}
+     * @memberof AuthenticatorEndpointGDTCStage
+     */
+    readonly flowSet: Array<FlowSet>;
+    /**
+     * Flow used by an authenticated user to configure this Stage. If empty, user will not be able to configure this stage.
+     * @type {string}
+     * @memberof AuthenticatorEndpointGDTCStage
+     */
+    configureFlow?: string | null;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorEndpointGDTCStage
+     */
+    friendlyName?: string;
+    /**
+     * 
+     * @type {{ [key: string]: any; }}
+     * @memberof AuthenticatorEndpointGDTCStage
+     */
+    credentials: { [key: string]: any; };
+}
+
+/**
+ * Check if a given object implements the AuthenticatorEndpointGDTCStage interface.
+ */
+export function instanceOfAuthenticatorEndpointGDTCStage(value: object): value is AuthenticatorEndpointGDTCStage {
+    if (!('pk' in value) || value['pk'] === undefined) return false;
+    if (!('name' in value) || value['name'] === undefined) return false;
+    if (!('component' in value) || value['component'] === undefined) return false;
+    if (!('verboseName' in value) || value['verboseName'] === undefined) return false;
+    if (!('verboseNamePlural' in value) || value['verboseNamePlural'] === undefined) return false;
+    if (!('metaModelName' in value) || value['metaModelName'] === undefined) return false;
+    if (!('flowSet' in value) || value['flowSet'] === undefined) return false;
+    if (!('credentials' in value) || value['credentials'] === undefined) return false;
+    return true;
+}
+
+export function AuthenticatorEndpointGDTCStageFromJSON(json: any): AuthenticatorEndpointGDTCStage {
+    return AuthenticatorEndpointGDTCStageFromJSONTyped(json, false);
+}
+
+export function AuthenticatorEndpointGDTCStageFromJSONTyped(json: any, ignoreDiscriminator: boolean): AuthenticatorEndpointGDTCStage {
+    if (json == null) {
+        return json;
+    }
+    return {
+        
+        'pk': json['pk'],
+        'name': json['name'],
+        'component': json['component'],
+        'verboseName': json['verbose_name'],
+        'verboseNamePlural': json['verbose_name_plural'],
+        'metaModelName': json['meta_model_name'],
+        'flowSet': ((json['flow_set'] as Array<any>).map(FlowSetFromJSON)),
+        'configureFlow': json['configure_flow'] == null ? undefined : json['configure_flow'],
+        'friendlyName': json['friendly_name'] == null ? undefined : json['friendly_name'],
+        'credentials': json['credentials'],
+    };
+}
+
+export function AuthenticatorEndpointGDTCStageToJSON(json: any): AuthenticatorEndpointGDTCStage {
+    return AuthenticatorEndpointGDTCStageToJSONTyped(json, false);
+}
+
+export function AuthenticatorEndpointGDTCStageToJSONTyped(value?: Omit<AuthenticatorEndpointGDTCStage, 'pk'|'component'|'verbose_name'|'verbose_name_plural'|'meta_model_name'|'flow_set'> | null, ignoreDiscriminator: boolean = false): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        
+        'name': value['name'],
+        'configure_flow': value['configureFlow'],
+        'friendly_name': value['friendlyName'],
+        'credentials': value['credentials'],
+    };
+}
+

packages/client-ts/src/models/AuthenticatorEndpointGDTCStageRequest.ts

@@ -0,0 +1,91 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import { mapValues } from '../runtime';
+/**
+ * AuthenticatorEndpointGDTCStage Serializer
+ * @export
+ * @interface AuthenticatorEndpointGDTCStageRequest
+ */
+export interface AuthenticatorEndpointGDTCStageRequest {
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorEndpointGDTCStageRequest
+     */
+    name: string;
+    /**
+     * Flow used by an authenticated user to configure this Stage. If empty, user will not be able to configure this stage.
+     * @type {string}
+     * @memberof AuthenticatorEndpointGDTCStageRequest
+     */
+    configureFlow?: string | null;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorEndpointGDTCStageRequest
+     */
+    friendlyName?: string;
+    /**
+     * 
+     * @type {{ [key: string]: any; }}
+     * @memberof AuthenticatorEndpointGDTCStageRequest
+     */
+    credentials: { [key: string]: any; };
+}
+
+/**
+ * Check if a given object implements the AuthenticatorEndpointGDTCStageRequest interface.
+ */
+export function instanceOfAuthenticatorEndpointGDTCStageRequest(value: object): value is AuthenticatorEndpointGDTCStageRequest {
+    if (!('name' in value) || value['name'] === undefined) return false;
+    if (!('credentials' in value) || value['credentials'] === undefined) return false;
+    return true;
+}
+
+export function AuthenticatorEndpointGDTCStageRequestFromJSON(json: any): AuthenticatorEndpointGDTCStageRequest {
+    return AuthenticatorEndpointGDTCStageRequestFromJSONTyped(json, false);
+}
+
+export function AuthenticatorEndpointGDTCStageRequestFromJSONTyped(json: any, ignoreDiscriminator: boolean): AuthenticatorEndpointGDTCStageRequest {
+    if (json == null) {
+        return json;
+    }
+    return {
+        
+        'name': json['name'],
+        'configureFlow': json['configure_flow'] == null ? undefined : json['configure_flow'],
+        'friendlyName': json['friendly_name'] == null ? undefined : json['friendly_name'],
+        'credentials': json['credentials'],
+    };
+}
+
+export function AuthenticatorEndpointGDTCStageRequestToJSON(json: any): AuthenticatorEndpointGDTCStageRequest {
+    return AuthenticatorEndpointGDTCStageRequestToJSONTyped(json, false);
+}
+
+export function AuthenticatorEndpointGDTCStageRequestToJSONTyped(value?: AuthenticatorEndpointGDTCStageRequest | null, ignoreDiscriminator: boolean = false): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        
+        'name': value['name'],
+        'configure_flow': value['configureFlow'],
+        'friendly_name': value['friendlyName'],
+        'credentials': value['credentials'],
+    };
+}
+

packages/client-ts/src/models/AuthenticatorSMSChallenge.ts

@@ -0,0 +1,122 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import { mapValues } from '../runtime';
+import type { ErrorDetail } from './ErrorDetail';
+import {
+    ErrorDetailFromJSON,
+    ErrorDetailFromJSONTyped,
+    ErrorDetailToJSON,
+    ErrorDetailToJSONTyped,
+} from './ErrorDetail';
+import type { ContextualFlowInfo } from './ContextualFlowInfo';
+import {
+    ContextualFlowInfoFromJSON,
+    ContextualFlowInfoFromJSONTyped,
+    ContextualFlowInfoToJSON,
+    ContextualFlowInfoToJSONTyped,
+} from './ContextualFlowInfo';
+
+/**
+ * SMS Setup challenge
+ * @export
+ * @interface AuthenticatorSMSChallenge
+ */
+export interface AuthenticatorSMSChallenge {
+    /**
+     * 
+     * @type {ContextualFlowInfo}
+     * @memberof AuthenticatorSMSChallenge
+     */
+    flowInfo?: ContextualFlowInfo;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorSMSChallenge
+     */
+    component?: string;
+    /**
+     * 
+     * @type {{ [key: string]: Array<ErrorDetail>; }}
+     * @memberof AuthenticatorSMSChallenge
+     */
+    responseErrors?: { [key: string]: Array<ErrorDetail>; };
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorSMSChallenge
+     */
+    pendingUser: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorSMSChallenge
+     */
+    pendingUserAvatar: string;
+    /**
+     * 
+     * @type {boolean}
+     * @memberof AuthenticatorSMSChallenge
+     */
+    phoneNumberRequired?: boolean;
+}
+
+/**
+ * Check if a given object implements the AuthenticatorSMSChallenge interface.
+ */
+export function instanceOfAuthenticatorSMSChallenge(value: object): value is AuthenticatorSMSChallenge {
+    if (!('pendingUser' in value) || value['pendingUser'] === undefined) return false;
+    if (!('pendingUserAvatar' in value) || value['pendingUserAvatar'] === undefined) return false;
+    return true;
+}
+
+export function AuthenticatorSMSChallengeFromJSON(json: any): AuthenticatorSMSChallenge {
+    return AuthenticatorSMSChallengeFromJSONTyped(json, false);
+}
+
+export function AuthenticatorSMSChallengeFromJSONTyped(json: any, ignoreDiscriminator: boolean): AuthenticatorSMSChallenge {
+    if (json == null) {
+        return json;
+    }
+    return {
+        
+        'flowInfo': json['flow_info'] == null ? undefined : ContextualFlowInfoFromJSON(json['flow_info']),
+        'component': json['component'] == null ? undefined : json['component'],
+        'responseErrors': json['response_errors'] == null ? undefined : json['response_errors'],
+        'pendingUser': json['pending_user'],
+        'pendingUserAvatar': json['pending_user_avatar'],
+        'phoneNumberRequired': json['phone_number_required'] == null ? undefined : json['phone_number_required'],
+    };
+}
+
+export function AuthenticatorSMSChallengeToJSON(json: any): AuthenticatorSMSChallenge {
+    return AuthenticatorSMSChallengeToJSONTyped(json, false);
+}
+
+export function AuthenticatorSMSChallengeToJSONTyped(value?: AuthenticatorSMSChallenge | null, ignoreDiscriminator: boolean = false): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        
+        'flow_info': ContextualFlowInfoToJSON(value['flowInfo']),
+        'component': value['component'],
+        'response_errors': value['responseErrors'],
+        'pending_user': value['pendingUser'],
+        'pending_user_avatar': value['pendingUserAvatar'],
+        'phone_number_required': value['phoneNumberRequired'],
+    };
+}
+

packages/client-ts/src/models/AuthenticatorSMSChallengeResponseRequest.ts

@@ -0,0 +1,81 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import { mapValues } from '../runtime';
+/**
+ * SMS Challenge response, device is set by get_response_instance
+ * @export
+ * @interface AuthenticatorSMSChallengeResponseRequest
+ */
+export interface AuthenticatorSMSChallengeResponseRequest {
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorSMSChallengeResponseRequest
+     */
+    component?: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorSMSChallengeResponseRequest
+     */
+    code?: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorSMSChallengeResponseRequest
+     */
+    phoneNumber?: string;
+}
+
+/**
+ * Check if a given object implements the AuthenticatorSMSChallengeResponseRequest interface.
+ */
+export function instanceOfAuthenticatorSMSChallengeResponseRequest(value: object): value is AuthenticatorSMSChallengeResponseRequest {
+    return true;
+}
+
+export function AuthenticatorSMSChallengeResponseRequestFromJSON(json: any): AuthenticatorSMSChallengeResponseRequest {
+    return AuthenticatorSMSChallengeResponseRequestFromJSONTyped(json, false);
+}
+
+export function AuthenticatorSMSChallengeResponseRequestFromJSONTyped(json: any, ignoreDiscriminator: boolean): AuthenticatorSMSChallengeResponseRequest {
+    if (json == null) {
+        return json;
+    }
+    return {
+        
+        'component': json['component'] == null ? undefined : json['component'],
+        'code': json['code'] == null ? undefined : json['code'],
+        'phoneNumber': json['phone_number'] == null ? undefined : json['phone_number'],
+    };
+}
+
+export function AuthenticatorSMSChallengeResponseRequestToJSON(json: any): AuthenticatorSMSChallengeResponseRequest {
+    return AuthenticatorSMSChallengeResponseRequestToJSONTyped(json, false);
+}
+
+export function AuthenticatorSMSChallengeResponseRequestToJSONTyped(value?: AuthenticatorSMSChallengeResponseRequest | null, ignoreDiscriminator: boolean = false): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        
+        'component': value['component'],
+        'code': value['code'],
+        'phone_number': value['phoneNumber'],
+    };
+}
+

packages/client-ts/src/models/AuthenticatorSMSStage.ts

@@ -0,0 +1,222 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import { mapValues } from '../runtime';
+import type { FlowSet } from './FlowSet';
+import {
+    FlowSetFromJSON,
+    FlowSetFromJSONTyped,
+    FlowSetToJSON,
+    FlowSetToJSONTyped,
+} from './FlowSet';
+import type { ProviderEnum } from './ProviderEnum';
+import {
+    ProviderEnumFromJSON,
+    ProviderEnumFromJSONTyped,
+    ProviderEnumToJSON,
+    ProviderEnumToJSONTyped,
+} from './ProviderEnum';
+import type { AuthTypeEnum } from './AuthTypeEnum';
+import {
+    AuthTypeEnumFromJSON,
+    AuthTypeEnumFromJSONTyped,
+    AuthTypeEnumToJSON,
+    AuthTypeEnumToJSONTyped,
+} from './AuthTypeEnum';
+
+/**
+ * AuthenticatorSMSStage Serializer
+ * @export
+ * @interface AuthenticatorSMSStage
+ */
+export interface AuthenticatorSMSStage {
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorSMSStage
+     */
+    readonly pk: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorSMSStage
+     */
+    name: string;
+    /**
+     * Get object type so that we know how to edit the object
+     * @type {string}
+     * @memberof AuthenticatorSMSStage
+     */
+    readonly component: string;
+    /**
+     * Return object's verbose_name
+     * @type {string}
+     * @memberof AuthenticatorSMSStage
+     */
+    readonly verboseName: string;
+    /**
+     * Return object's plural verbose_name
+     * @type {string}
+     * @memberof AuthenticatorSMSStage
+     */
+    readonly verboseNamePlural: string;
+    /**
+     * Return internal model name
+     * @type {string}
+     * @memberof AuthenticatorSMSStage
+     */
+    readonly metaModelName: string;
+    /**
+     * 
+     * @type {Array<FlowSet>}
+     * @memberof AuthenticatorSMSStage
+     */
+    readonly flowSet: Array<FlowSet>;
+    /**
+     * Flow used by an authenticated user to configure this Stage. If empty, user will not be able to configure this stage.
+     * @type {string}
+     * @memberof AuthenticatorSMSStage
+     */
+    configureFlow?: string | null;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorSMSStage
+     */
+    friendlyName?: string;
+    /**
+     * 
+     * @type {ProviderEnum}
+     * @memberof AuthenticatorSMSStage
+     */
+    provider: ProviderEnum;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorSMSStage
+     */
+    fromNumber: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorSMSStage
+     */
+    accountSid: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorSMSStage
+     */
+    auth: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorSMSStage
+     */
+    authPassword?: string;
+    /**
+     * 
+     * @type {AuthTypeEnum}
+     * @memberof AuthenticatorSMSStage
+     */
+    authType?: AuthTypeEnum;
+    /**
+     * When enabled, the Phone number is only used during enrollment to verify the users authenticity. Only a hash of the phone number is saved to ensure it is not reused in the future.
+     * @type {boolean}
+     * @memberof AuthenticatorSMSStage
+     */
+    verifyOnly?: boolean;
+    /**
+     * Optionally modify the payload being sent to custom providers.
+     * @type {string}
+     * @memberof AuthenticatorSMSStage
+     */
+    mapping?: string | null;
+}
+
+
+
+/**
+ * Check if a given object implements the AuthenticatorSMSStage interface.
+ */
+export function instanceOfAuthenticatorSMSStage(value: object): value is AuthenticatorSMSStage {
+    if (!('pk' in value) || value['pk'] === undefined) return false;
+    if (!('name' in value) || value['name'] === undefined) return false;
+    if (!('component' in value) || value['component'] === undefined) return false;
+    if (!('verboseName' in value) || value['verboseName'] === undefined) return false;
+    if (!('verboseNamePlural' in value) || value['verboseNamePlural'] === undefined) return false;
+    if (!('metaModelName' in value) || value['metaModelName'] === undefined) return false;
+    if (!('flowSet' in value) || value['flowSet'] === undefined) return false;
+    if (!('provider' in value) || value['provider'] === undefined) return false;
+    if (!('fromNumber' in value) || value['fromNumber'] === undefined) return false;
+    if (!('accountSid' in value) || value['accountSid'] === undefined) return false;
+    if (!('auth' in value) || value['auth'] === undefined) return false;
+    return true;
+}
+
+export function AuthenticatorSMSStageFromJSON(json: any): AuthenticatorSMSStage {
+    return AuthenticatorSMSStageFromJSONTyped(json, false);
+}
+
+export function AuthenticatorSMSStageFromJSONTyped(json: any, ignoreDiscriminator: boolean): AuthenticatorSMSStage {
+    if (json == null) {
+        return json;
+    }
+    return {
+        
+        'pk': json['pk'],
+        'name': json['name'],
+        'component': json['component'],
+        'verboseName': json['verbose_name'],
+        'verboseNamePlural': json['verbose_name_plural'],
+        'metaModelName': json['meta_model_name'],
+        'flowSet': ((json['flow_set'] as Array<any>).map(FlowSetFromJSON)),
+        'configureFlow': json['configure_flow'] == null ? undefined : json['configure_flow'],
+        'friendlyName': json['friendly_name'] == null ? undefined : json['friendly_name'],
+        'provider': ProviderEnumFromJSON(json['provider']),
+        'fromNumber': json['from_number'],
+        'accountSid': json['account_sid'],
+        'auth': json['auth'],
+        'authPassword': json['auth_password'] == null ? undefined : json['auth_password'],
+        'authType': json['auth_type'] == null ? undefined : AuthTypeEnumFromJSON(json['auth_type']),
+        'verifyOnly': json['verify_only'] == null ? undefined : json['verify_only'],
+        'mapping': json['mapping'] == null ? undefined : json['mapping'],
+    };
+}
+
+export function AuthenticatorSMSStageToJSON(json: any): AuthenticatorSMSStage {
+    return AuthenticatorSMSStageToJSONTyped(json, false);
+}
+
+export function AuthenticatorSMSStageToJSONTyped(value?: Omit<AuthenticatorSMSStage, 'pk'|'component'|'verbose_name'|'verbose_name_plural'|'meta_model_name'|'flow_set'> | null, ignoreDiscriminator: boolean = false): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        
+        'name': value['name'],
+        'configure_flow': value['configureFlow'],
+        'friendly_name': value['friendlyName'],
+        'provider': ProviderEnumToJSON(value['provider']),
+        'from_number': value['fromNumber'],
+        'account_sid': value['accountSid'],
+        'auth': value['auth'],
+        'auth_password': value['authPassword'],
+        'auth_type': AuthTypeEnumToJSON(value['authType']),
+        'verify_only': value['verifyOnly'],
+        'mapping': value['mapping'],
+    };
+}
+

packages/client-ts/src/models/AuthenticatorSMSStageRequest.ts

@@ -0,0 +1,167 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import { mapValues } from '../runtime';
+import type { ProviderEnum } from './ProviderEnum';
+import {
+    ProviderEnumFromJSON,
+    ProviderEnumFromJSONTyped,
+    ProviderEnumToJSON,
+    ProviderEnumToJSONTyped,
+} from './ProviderEnum';
+import type { AuthTypeEnum } from './AuthTypeEnum';
+import {
+    AuthTypeEnumFromJSON,
+    AuthTypeEnumFromJSONTyped,
+    AuthTypeEnumToJSON,
+    AuthTypeEnumToJSONTyped,
+} from './AuthTypeEnum';
+
+/**
+ * AuthenticatorSMSStage Serializer
+ * @export
+ * @interface AuthenticatorSMSStageRequest
+ */
+export interface AuthenticatorSMSStageRequest {
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorSMSStageRequest
+     */
+    name: string;
+    /**
+     * Flow used by an authenticated user to configure this Stage. If empty, user will not be able to configure this stage.
+     * @type {string}
+     * @memberof AuthenticatorSMSStageRequest
+     */
+    configureFlow?: string | null;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorSMSStageRequest
+     */
+    friendlyName?: string;
+    /**
+     * 
+     * @type {ProviderEnum}
+     * @memberof AuthenticatorSMSStageRequest
+     */
+    provider: ProviderEnum;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorSMSStageRequest
+     */
+    fromNumber: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorSMSStageRequest
+     */
+    accountSid: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorSMSStageRequest
+     */
+    auth: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorSMSStageRequest
+     */
+    authPassword?: string;
+    /**
+     * 
+     * @type {AuthTypeEnum}
+     * @memberof AuthenticatorSMSStageRequest
+     */
+    authType?: AuthTypeEnum;
+    /**
+     * When enabled, the Phone number is only used during enrollment to verify the users authenticity. Only a hash of the phone number is saved to ensure it is not reused in the future.
+     * @type {boolean}
+     * @memberof AuthenticatorSMSStageRequest
+     */
+    verifyOnly?: boolean;
+    /**
+     * Optionally modify the payload being sent to custom providers.
+     * @type {string}
+     * @memberof AuthenticatorSMSStageRequest
+     */
+    mapping?: string | null;
+}
+
+
+
+/**
+ * Check if a given object implements the AuthenticatorSMSStageRequest interface.
+ */
+export function instanceOfAuthenticatorSMSStageRequest(value: object): value is AuthenticatorSMSStageRequest {
+    if (!('name' in value) || value['name'] === undefined) return false;
+    if (!('provider' in value) || value['provider'] === undefined) return false;
+    if (!('fromNumber' in value) || value['fromNumber'] === undefined) return false;
+    if (!('accountSid' in value) || value['accountSid'] === undefined) return false;
+    if (!('auth' in value) || value['auth'] === undefined) return false;
+    return true;
+}
+
+export function AuthenticatorSMSStageRequestFromJSON(json: any): AuthenticatorSMSStageRequest {
+    return AuthenticatorSMSStageRequestFromJSONTyped(json, false);
+}
+
+export function AuthenticatorSMSStageRequestFromJSONTyped(json: any, ignoreDiscriminator: boolean): AuthenticatorSMSStageRequest {
+    if (json == null) {
+        return json;
+    }
+    return {
+        
+        'name': json['name'],
+        'configureFlow': json['configure_flow'] == null ? undefined : json['configure_flow'],
+        'friendlyName': json['friendly_name'] == null ? undefined : json['friendly_name'],
+        'provider': ProviderEnumFromJSON(json['provider']),
+        'fromNumber': json['from_number'],
+        'accountSid': json['account_sid'],
+        'auth': json['auth'],
+        'authPassword': json['auth_password'] == null ? undefined : json['auth_password'],
+        'authType': json['auth_type'] == null ? undefined : AuthTypeEnumFromJSON(json['auth_type']),
+        'verifyOnly': json['verify_only'] == null ? undefined : json['verify_only'],
+        'mapping': json['mapping'] == null ? undefined : json['mapping'],
+    };
+}
+
+export function AuthenticatorSMSStageRequestToJSON(json: any): AuthenticatorSMSStageRequest {
+    return AuthenticatorSMSStageRequestToJSONTyped(json, false);
+}
+
+export function AuthenticatorSMSStageRequestToJSONTyped(value?: AuthenticatorSMSStageRequest | null, ignoreDiscriminator: boolean = false): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        
+        'name': value['name'],
+        'configure_flow': value['configureFlow'],
+        'friendly_name': value['friendlyName'],
+        'provider': ProviderEnumToJSON(value['provider']),
+        'from_number': value['fromNumber'],
+        'account_sid': value['accountSid'],
+        'auth': value['auth'],
+        'auth_password': value['authPassword'],
+        'auth_type': AuthTypeEnumToJSON(value['authType']),
+        'verify_only': value['verifyOnly'],
+        'mapping': value['mapping'],
+    };
+}
+

packages/client-ts/src/models/AuthenticatorStaticChallenge.ts

@@ -0,0 +1,123 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import { mapValues } from '../runtime';
+import type { ErrorDetail } from './ErrorDetail';
+import {
+    ErrorDetailFromJSON,
+    ErrorDetailFromJSONTyped,
+    ErrorDetailToJSON,
+    ErrorDetailToJSONTyped,
+} from './ErrorDetail';
+import type { ContextualFlowInfo } from './ContextualFlowInfo';
+import {
+    ContextualFlowInfoFromJSON,
+    ContextualFlowInfoFromJSONTyped,
+    ContextualFlowInfoToJSON,
+    ContextualFlowInfoToJSONTyped,
+} from './ContextualFlowInfo';
+
+/**
+ * Static authenticator challenge
+ * @export
+ * @interface AuthenticatorStaticChallenge
+ */
+export interface AuthenticatorStaticChallenge {
+    /**
+     * 
+     * @type {ContextualFlowInfo}
+     * @memberof AuthenticatorStaticChallenge
+     */
+    flowInfo?: ContextualFlowInfo;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorStaticChallenge
+     */
+    component?: string;
+    /**
+     * 
+     * @type {{ [key: string]: Array<ErrorDetail>; }}
+     * @memberof AuthenticatorStaticChallenge
+     */
+    responseErrors?: { [key: string]: Array<ErrorDetail>; };
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorStaticChallenge
+     */
+    pendingUser: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorStaticChallenge
+     */
+    pendingUserAvatar: string;
+    /**
+     * 
+     * @type {Array<string>}
+     * @memberof AuthenticatorStaticChallenge
+     */
+    codes: Array<string>;
+}
+
+/**
+ * Check if a given object implements the AuthenticatorStaticChallenge interface.
+ */
+export function instanceOfAuthenticatorStaticChallenge(value: object): value is AuthenticatorStaticChallenge {
+    if (!('pendingUser' in value) || value['pendingUser'] === undefined) return false;
+    if (!('pendingUserAvatar' in value) || value['pendingUserAvatar'] === undefined) return false;
+    if (!('codes' in value) || value['codes'] === undefined) return false;
+    return true;
+}
+
+export function AuthenticatorStaticChallengeFromJSON(json: any): AuthenticatorStaticChallenge {
+    return AuthenticatorStaticChallengeFromJSONTyped(json, false);
+}
+
+export function AuthenticatorStaticChallengeFromJSONTyped(json: any, ignoreDiscriminator: boolean): AuthenticatorStaticChallenge {
+    if (json == null) {
+        return json;
+    }
+    return {
+        
+        'flowInfo': json['flow_info'] == null ? undefined : ContextualFlowInfoFromJSON(json['flow_info']),
+        'component': json['component'] == null ? undefined : json['component'],
+        'responseErrors': json['response_errors'] == null ? undefined : json['response_errors'],
+        'pendingUser': json['pending_user'],
+        'pendingUserAvatar': json['pending_user_avatar'],
+        'codes': json['codes'],
+    };
+}
+
+export function AuthenticatorStaticChallengeToJSON(json: any): AuthenticatorStaticChallenge {
+    return AuthenticatorStaticChallengeToJSONTyped(json, false);
+}
+
+export function AuthenticatorStaticChallengeToJSONTyped(value?: AuthenticatorStaticChallenge | null, ignoreDiscriminator: boolean = false): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        
+        'flow_info': ContextualFlowInfoToJSON(value['flowInfo']),
+        'component': value['component'],
+        'response_errors': value['responseErrors'],
+        'pending_user': value['pendingUser'],
+        'pending_user_avatar': value['pendingUserAvatar'],
+        'codes': value['codes'],
+    };
+}
+

packages/client-ts/src/models/AuthenticatorStaticChallengeResponseRequest.ts

@@ -0,0 +1,65 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import { mapValues } from '../runtime';
+/**
+ * Pseudo class for static response
+ * @export
+ * @interface AuthenticatorStaticChallengeResponseRequest
+ */
+export interface AuthenticatorStaticChallengeResponseRequest {
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorStaticChallengeResponseRequest
+     */
+    component?: string;
+}
+
+/**
+ * Check if a given object implements the AuthenticatorStaticChallengeResponseRequest interface.
+ */
+export function instanceOfAuthenticatorStaticChallengeResponseRequest(value: object): value is AuthenticatorStaticChallengeResponseRequest {
+    return true;
+}
+
+export function AuthenticatorStaticChallengeResponseRequestFromJSON(json: any): AuthenticatorStaticChallengeResponseRequest {
+    return AuthenticatorStaticChallengeResponseRequestFromJSONTyped(json, false);
+}
+
+export function AuthenticatorStaticChallengeResponseRequestFromJSONTyped(json: any, ignoreDiscriminator: boolean): AuthenticatorStaticChallengeResponseRequest {
+    if (json == null) {
+        return json;
+    }
+    return {
+        
+        'component': json['component'] == null ? undefined : json['component'],
+    };
+}
+
+export function AuthenticatorStaticChallengeResponseRequestToJSON(json: any): AuthenticatorStaticChallengeResponseRequest {
+    return AuthenticatorStaticChallengeResponseRequestToJSONTyped(json, false);
+}
+
+export function AuthenticatorStaticChallengeResponseRequestToJSONTyped(value?: AuthenticatorStaticChallengeResponseRequest | null, ignoreDiscriminator: boolean = false): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        
+        'component': value['component'],
+    };
+}
+

packages/client-ts/src/models/AuthenticatorStaticStage.ts

@@ -0,0 +1,154 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import { mapValues } from '../runtime';
+import type { FlowSet } from './FlowSet';
+import {
+    FlowSetFromJSON,
+    FlowSetFromJSONTyped,
+    FlowSetToJSON,
+    FlowSetToJSONTyped,
+} from './FlowSet';
+
+/**
+ * AuthenticatorStaticStage Serializer
+ * @export
+ * @interface AuthenticatorStaticStage
+ */
+export interface AuthenticatorStaticStage {
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorStaticStage
+     */
+    readonly pk: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorStaticStage
+     */
+    name: string;
+    /**
+     * Get object type so that we know how to edit the object
+     * @type {string}
+     * @memberof AuthenticatorStaticStage
+     */
+    readonly component: string;
+    /**
+     * Return object's verbose_name
+     * @type {string}
+     * @memberof AuthenticatorStaticStage
+     */
+    readonly verboseName: string;
+    /**
+     * Return object's plural verbose_name
+     * @type {string}
+     * @memberof AuthenticatorStaticStage
+     */
+    readonly verboseNamePlural: string;
+    /**
+     * Return internal model name
+     * @type {string}
+     * @memberof AuthenticatorStaticStage
+     */
+    readonly metaModelName: string;
+    /**
+     * 
+     * @type {Array<FlowSet>}
+     * @memberof AuthenticatorStaticStage
+     */
+    readonly flowSet: Array<FlowSet>;
+    /**
+     * Flow used by an authenticated user to configure this Stage. If empty, user will not be able to configure this stage.
+     * @type {string}
+     * @memberof AuthenticatorStaticStage
+     */
+    configureFlow?: string | null;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorStaticStage
+     */
+    friendlyName?: string;
+    /**
+     * 
+     * @type {number}
+     * @memberof AuthenticatorStaticStage
+     */
+    tokenCount?: number;
+    /**
+     * 
+     * @type {number}
+     * @memberof AuthenticatorStaticStage
+     */
+    tokenLength?: number;
+}
+
+/**
+ * Check if a given object implements the AuthenticatorStaticStage interface.
+ */
+export function instanceOfAuthenticatorStaticStage(value: object): value is AuthenticatorStaticStage {
+    if (!('pk' in value) || value['pk'] === undefined) return false;
+    if (!('name' in value) || value['name'] === undefined) return false;
+    if (!('component' in value) || value['component'] === undefined) return false;
+    if (!('verboseName' in value) || value['verboseName'] === undefined) return false;
+    if (!('verboseNamePlural' in value) || value['verboseNamePlural'] === undefined) return false;
+    if (!('metaModelName' in value) || value['metaModelName'] === undefined) return false;
+    if (!('flowSet' in value) || value['flowSet'] === undefined) return false;
+    return true;
+}
+
+export function AuthenticatorStaticStageFromJSON(json: any): AuthenticatorStaticStage {
+    return AuthenticatorStaticStageFromJSONTyped(json, false);
+}
+
+export function AuthenticatorStaticStageFromJSONTyped(json: any, ignoreDiscriminator: boolean): AuthenticatorStaticStage {
+    if (json == null) {
+        return json;
+    }
+    return {
+        
+        'pk': json['pk'],
+        'name': json['name'],
+        'component': json['component'],
+        'verboseName': json['verbose_name'],
+        'verboseNamePlural': json['verbose_name_plural'],
+        'metaModelName': json['meta_model_name'],
+        'flowSet': ((json['flow_set'] as Array<any>).map(FlowSetFromJSON)),
+        'configureFlow': json['configure_flow'] == null ? undefined : json['configure_flow'],
+        'friendlyName': json['friendly_name'] == null ? undefined : json['friendly_name'],
+        'tokenCount': json['token_count'] == null ? undefined : json['token_count'],
+        'tokenLength': json['token_length'] == null ? undefined : json['token_length'],
+    };
+}
+
+export function AuthenticatorStaticStageToJSON(json: any): AuthenticatorStaticStage {
+    return AuthenticatorStaticStageToJSONTyped(json, false);
+}
+
+export function AuthenticatorStaticStageToJSONTyped(value?: Omit<AuthenticatorStaticStage, 'pk'|'component'|'verbose_name'|'verbose_name_plural'|'meta_model_name'|'flow_set'> | null, ignoreDiscriminator: boolean = false): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        
+        'name': value['name'],
+        'configure_flow': value['configureFlow'],
+        'friendly_name': value['friendlyName'],
+        'token_count': value['tokenCount'],
+        'token_length': value['tokenLength'],
+    };
+}
+

packages/client-ts/src/models/AuthenticatorStaticStageRequest.ts

@@ -0,0 +1,98 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import { mapValues } from '../runtime';
+/**
+ * AuthenticatorStaticStage Serializer
+ * @export
+ * @interface AuthenticatorStaticStageRequest
+ */
+export interface AuthenticatorStaticStageRequest {
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorStaticStageRequest
+     */
+    name: string;
+    /**
+     * Flow used by an authenticated user to configure this Stage. If empty, user will not be able to configure this stage.
+     * @type {string}
+     * @memberof AuthenticatorStaticStageRequest
+     */
+    configureFlow?: string | null;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorStaticStageRequest
+     */
+    friendlyName?: string;
+    /**
+     * 
+     * @type {number}
+     * @memberof AuthenticatorStaticStageRequest
+     */
+    tokenCount?: number;
+    /**
+     * 
+     * @type {number}
+     * @memberof AuthenticatorStaticStageRequest
+     */
+    tokenLength?: number;
+}
+
+/**
+ * Check if a given object implements the AuthenticatorStaticStageRequest interface.
+ */
+export function instanceOfAuthenticatorStaticStageRequest(value: object): value is AuthenticatorStaticStageRequest {
+    if (!('name' in value) || value['name'] === undefined) return false;
+    return true;
+}
+
+export function AuthenticatorStaticStageRequestFromJSON(json: any): AuthenticatorStaticStageRequest {
+    return AuthenticatorStaticStageRequestFromJSONTyped(json, false);
+}
+
+export function AuthenticatorStaticStageRequestFromJSONTyped(json: any, ignoreDiscriminator: boolean): AuthenticatorStaticStageRequest {
+    if (json == null) {
+        return json;
+    }
+    return {
+        
+        'name': json['name'],
+        'configureFlow': json['configure_flow'] == null ? undefined : json['configure_flow'],
+        'friendlyName': json['friendly_name'] == null ? undefined : json['friendly_name'],
+        'tokenCount': json['token_count'] == null ? undefined : json['token_count'],
+        'tokenLength': json['token_length'] == null ? undefined : json['token_length'],
+    };
+}
+
+export function AuthenticatorStaticStageRequestToJSON(json: any): AuthenticatorStaticStageRequest {
+    return AuthenticatorStaticStageRequestToJSONTyped(json, false);
+}
+
+export function AuthenticatorStaticStageRequestToJSONTyped(value?: AuthenticatorStaticStageRequest | null, ignoreDiscriminator: boolean = false): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        
+        'name': value['name'],
+        'configure_flow': value['configureFlow'],
+        'friendly_name': value['friendlyName'],
+        'token_count': value['tokenCount'],
+        'token_length': value['tokenLength'],
+    };
+}
+

packages/client-ts/src/models/AuthenticatorTOTPChallenge.ts

@@ -0,0 +1,123 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import { mapValues } from '../runtime';
+import type { ErrorDetail } from './ErrorDetail';
+import {
+    ErrorDetailFromJSON,
+    ErrorDetailFromJSONTyped,
+    ErrorDetailToJSON,
+    ErrorDetailToJSONTyped,
+} from './ErrorDetail';
+import type { ContextualFlowInfo } from './ContextualFlowInfo';
+import {
+    ContextualFlowInfoFromJSON,
+    ContextualFlowInfoFromJSONTyped,
+    ContextualFlowInfoToJSON,
+    ContextualFlowInfoToJSONTyped,
+} from './ContextualFlowInfo';
+
+/**
+ * TOTP Setup challenge
+ * @export
+ * @interface AuthenticatorTOTPChallenge
+ */
+export interface AuthenticatorTOTPChallenge {
+    /**
+     * 
+     * @type {ContextualFlowInfo}
+     * @memberof AuthenticatorTOTPChallenge
+     */
+    flowInfo?: ContextualFlowInfo;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorTOTPChallenge
+     */
+    component?: string;
+    /**
+     * 
+     * @type {{ [key: string]: Array<ErrorDetail>; }}
+     * @memberof AuthenticatorTOTPChallenge
+     */
+    responseErrors?: { [key: string]: Array<ErrorDetail>; };
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorTOTPChallenge
+     */
+    pendingUser: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorTOTPChallenge
+     */
+    pendingUserAvatar: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorTOTPChallenge
+     */
+    configUrl: string;
+}
+
+/**
+ * Check if a given object implements the AuthenticatorTOTPChallenge interface.
+ */
+export function instanceOfAuthenticatorTOTPChallenge(value: object): value is AuthenticatorTOTPChallenge {
+    if (!('pendingUser' in value) || value['pendingUser'] === undefined) return false;
+    if (!('pendingUserAvatar' in value) || value['pendingUserAvatar'] === undefined) return false;
+    if (!('configUrl' in value) || value['configUrl'] === undefined) return false;
+    return true;
+}
+
+export function AuthenticatorTOTPChallengeFromJSON(json: any): AuthenticatorTOTPChallenge {
+    return AuthenticatorTOTPChallengeFromJSONTyped(json, false);
+}
+
+export function AuthenticatorTOTPChallengeFromJSONTyped(json: any, ignoreDiscriminator: boolean): AuthenticatorTOTPChallenge {
+    if (json == null) {
+        return json;
+    }
+    return {
+        
+        'flowInfo': json['flow_info'] == null ? undefined : ContextualFlowInfoFromJSON(json['flow_info']),
+        'component': json['component'] == null ? undefined : json['component'],
+        'responseErrors': json['response_errors'] == null ? undefined : json['response_errors'],
+        'pendingUser': json['pending_user'],
+        'pendingUserAvatar': json['pending_user_avatar'],
+        'configUrl': json['config_url'],
+    };
+}
+
+export function AuthenticatorTOTPChallengeToJSON(json: any): AuthenticatorTOTPChallenge {
+    return AuthenticatorTOTPChallengeToJSONTyped(json, false);
+}
+
+export function AuthenticatorTOTPChallengeToJSONTyped(value?: AuthenticatorTOTPChallenge | null, ignoreDiscriminator: boolean = false): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        
+        'flow_info': ContextualFlowInfoToJSON(value['flowInfo']),
+        'component': value['component'],
+        'response_errors': value['responseErrors'],
+        'pending_user': value['pendingUser'],
+        'pending_user_avatar': value['pendingUserAvatar'],
+        'config_url': value['configUrl'],
+    };
+}
+

packages/client-ts/src/models/AuthenticatorTOTPChallengeResponseRequest.ts

@@ -0,0 +1,74 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import { mapValues } from '../runtime';
+/**
+ * TOTP Challenge response, device is set by get_response_instance
+ * @export
+ * @interface AuthenticatorTOTPChallengeResponseRequest
+ */
+export interface AuthenticatorTOTPChallengeResponseRequest {
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorTOTPChallengeResponseRequest
+     */
+    component?: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorTOTPChallengeResponseRequest
+     */
+    code: string;
+}
+
+/**
+ * Check if a given object implements the AuthenticatorTOTPChallengeResponseRequest interface.
+ */
+export function instanceOfAuthenticatorTOTPChallengeResponseRequest(value: object): value is AuthenticatorTOTPChallengeResponseRequest {
+    if (!('code' in value) || value['code'] === undefined) return false;
+    return true;
+}
+
+export function AuthenticatorTOTPChallengeResponseRequestFromJSON(json: any): AuthenticatorTOTPChallengeResponseRequest {
+    return AuthenticatorTOTPChallengeResponseRequestFromJSONTyped(json, false);
+}
+
+export function AuthenticatorTOTPChallengeResponseRequestFromJSONTyped(json: any, ignoreDiscriminator: boolean): AuthenticatorTOTPChallengeResponseRequest {
+    if (json == null) {
+        return json;
+    }
+    return {
+        
+        'component': json['component'] == null ? undefined : json['component'],
+        'code': json['code'],
+    };
+}
+
+export function AuthenticatorTOTPChallengeResponseRequestToJSON(json: any): AuthenticatorTOTPChallengeResponseRequest {
+    return AuthenticatorTOTPChallengeResponseRequestToJSONTyped(json, false);
+}
+
+export function AuthenticatorTOTPChallengeResponseRequestToJSONTyped(value?: AuthenticatorTOTPChallengeResponseRequest | null, ignoreDiscriminator: boolean = false): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        
+        'component': value['component'],
+        'code': value['code'],
+    };
+}
+

packages/client-ts/src/models/AuthenticatorTOTPStage.ts

@@ -0,0 +1,156 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import { mapValues } from '../runtime';
+import type { DigitsEnum } from './DigitsEnum';
+import {
+    DigitsEnumFromJSON,
+    DigitsEnumFromJSONTyped,
+    DigitsEnumToJSON,
+    DigitsEnumToJSONTyped,
+} from './DigitsEnum';
+import type { FlowSet } from './FlowSet';
+import {
+    FlowSetFromJSON,
+    FlowSetFromJSONTyped,
+    FlowSetToJSON,
+    FlowSetToJSONTyped,
+} from './FlowSet';
+
+/**
+ * AuthenticatorTOTPStage Serializer
+ * @export
+ * @interface AuthenticatorTOTPStage
+ */
+export interface AuthenticatorTOTPStage {
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorTOTPStage
+     */
+    readonly pk: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorTOTPStage
+     */
+    name: string;
+    /**
+     * Get object type so that we know how to edit the object
+     * @type {string}
+     * @memberof AuthenticatorTOTPStage
+     */
+    readonly component: string;
+    /**
+     * Return object's verbose_name
+     * @type {string}
+     * @memberof AuthenticatorTOTPStage
+     */
+    readonly verboseName: string;
+    /**
+     * Return object's plural verbose_name
+     * @type {string}
+     * @memberof AuthenticatorTOTPStage
+     */
+    readonly verboseNamePlural: string;
+    /**
+     * Return internal model name
+     * @type {string}
+     * @memberof AuthenticatorTOTPStage
+     */
+    readonly metaModelName: string;
+    /**
+     * 
+     * @type {Array<FlowSet>}
+     * @memberof AuthenticatorTOTPStage
+     */
+    readonly flowSet: Array<FlowSet>;
+    /**
+     * Flow used by an authenticated user to configure this Stage. If empty, user will not be able to configure this stage.
+     * @type {string}
+     * @memberof AuthenticatorTOTPStage
+     */
+    configureFlow?: string | null;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorTOTPStage
+     */
+    friendlyName?: string;
+    /**
+     * 
+     * @type {DigitsEnum}
+     * @memberof AuthenticatorTOTPStage
+     */
+    digits: DigitsEnum;
+}
+
+
+
+/**
+ * Check if a given object implements the AuthenticatorTOTPStage interface.
+ */
+export function instanceOfAuthenticatorTOTPStage(value: object): value is AuthenticatorTOTPStage {
+    if (!('pk' in value) || value['pk'] === undefined) return false;
+    if (!('name' in value) || value['name'] === undefined) return false;
+    if (!('component' in value) || value['component'] === undefined) return false;
+    if (!('verboseName' in value) || value['verboseName'] === undefined) return false;
+    if (!('verboseNamePlural' in value) || value['verboseNamePlural'] === undefined) return false;
+    if (!('metaModelName' in value) || value['metaModelName'] === undefined) return false;
+    if (!('flowSet' in value) || value['flowSet'] === undefined) return false;
+    if (!('digits' in value) || value['digits'] === undefined) return false;
+    return true;
+}
+
+export function AuthenticatorTOTPStageFromJSON(json: any): AuthenticatorTOTPStage {
+    return AuthenticatorTOTPStageFromJSONTyped(json, false);
+}
+
+export function AuthenticatorTOTPStageFromJSONTyped(json: any, ignoreDiscriminator: boolean): AuthenticatorTOTPStage {
+    if (json == null) {
+        return json;
+    }
+    return {
+        
+        'pk': json['pk'],
+        'name': json['name'],
+        'component': json['component'],
+        'verboseName': json['verbose_name'],
+        'verboseNamePlural': json['verbose_name_plural'],
+        'metaModelName': json['meta_model_name'],
+        'flowSet': ((json['flow_set'] as Array<any>).map(FlowSetFromJSON)),
+        'configureFlow': json['configure_flow'] == null ? undefined : json['configure_flow'],
+        'friendlyName': json['friendly_name'] == null ? undefined : json['friendly_name'],
+        'digits': DigitsEnumFromJSON(json['digits']),
+    };
+}
+
+export function AuthenticatorTOTPStageToJSON(json: any): AuthenticatorTOTPStage {
+    return AuthenticatorTOTPStageToJSONTyped(json, false);
+}
+
+export function AuthenticatorTOTPStageToJSONTyped(value?: Omit<AuthenticatorTOTPStage, 'pk'|'component'|'verbose_name'|'verbose_name_plural'|'meta_model_name'|'flow_set'> | null, ignoreDiscriminator: boolean = false): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        
+        'name': value['name'],
+        'configure_flow': value['configureFlow'],
+        'friendly_name': value['friendlyName'],
+        'digits': DigitsEnumToJSON(value['digits']),
+    };
+}
+

packages/client-ts/src/models/AuthenticatorTOTPStageRequest.ts

@@ -0,0 +1,101 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import { mapValues } from '../runtime';
+import type { DigitsEnum } from './DigitsEnum';
+import {
+    DigitsEnumFromJSON,
+    DigitsEnumFromJSONTyped,
+    DigitsEnumToJSON,
+    DigitsEnumToJSONTyped,
+} from './DigitsEnum';
+
+/**
+ * AuthenticatorTOTPStage Serializer
+ * @export
+ * @interface AuthenticatorTOTPStageRequest
+ */
+export interface AuthenticatorTOTPStageRequest {
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorTOTPStageRequest
+     */
+    name: string;
+    /**
+     * Flow used by an authenticated user to configure this Stage. If empty, user will not be able to configure this stage.
+     * @type {string}
+     * @memberof AuthenticatorTOTPStageRequest
+     */
+    configureFlow?: string | null;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorTOTPStageRequest
+     */
+    friendlyName?: string;
+    /**
+     * 
+     * @type {DigitsEnum}
+     * @memberof AuthenticatorTOTPStageRequest
+     */
+    digits: DigitsEnum;
+}
+
+
+
+/**
+ * Check if a given object implements the AuthenticatorTOTPStageRequest interface.
+ */
+export function instanceOfAuthenticatorTOTPStageRequest(value: object): value is AuthenticatorTOTPStageRequest {
+    if (!('name' in value) || value['name'] === undefined) return false;
+    if (!('digits' in value) || value['digits'] === undefined) return false;
+    return true;
+}
+
+export function AuthenticatorTOTPStageRequestFromJSON(json: any): AuthenticatorTOTPStageRequest {
+    return AuthenticatorTOTPStageRequestFromJSONTyped(json, false);
+}
+
+export function AuthenticatorTOTPStageRequestFromJSONTyped(json: any, ignoreDiscriminator: boolean): AuthenticatorTOTPStageRequest {
+    if (json == null) {
+        return json;
+    }
+    return {
+        
+        'name': json['name'],
+        'configureFlow': json['configure_flow'] == null ? undefined : json['configure_flow'],
+        'friendlyName': json['friendly_name'] == null ? undefined : json['friendly_name'],
+        'digits': DigitsEnumFromJSON(json['digits']),
+    };
+}
+
+export function AuthenticatorTOTPStageRequestToJSON(json: any): AuthenticatorTOTPStageRequest {
+    return AuthenticatorTOTPStageRequestToJSONTyped(json, false);
+}
+
+export function AuthenticatorTOTPStageRequestToJSONTyped(value?: AuthenticatorTOTPStageRequest | null, ignoreDiscriminator: boolean = false): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        
+        'name': value['name'],
+        'configure_flow': value['configureFlow'],
+        'friendly_name': value['friendlyName'],
+        'digits': DigitsEnumToJSON(value['digits']),
+    };
+}
+

packages/client-ts/src/models/AuthenticatorValidateStage.ts

@@ -0,0 +1,223 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import { mapValues } from '../runtime';
+import type { WebAuthnHintEnum } from './WebAuthnHintEnum';
+import {
+    WebAuthnHintEnumFromJSON,
+    WebAuthnHintEnumFromJSONTyped,
+    WebAuthnHintEnumToJSON,
+    WebAuthnHintEnumToJSONTyped,
+} from './WebAuthnHintEnum';
+import type { WebAuthnDeviceType } from './WebAuthnDeviceType';
+import {
+    WebAuthnDeviceTypeFromJSON,
+    WebAuthnDeviceTypeFromJSONTyped,
+    WebAuthnDeviceTypeToJSON,
+    WebAuthnDeviceTypeToJSONTyped,
+} from './WebAuthnDeviceType';
+import type { UserVerificationEnum } from './UserVerificationEnum';
+import {
+    UserVerificationEnumFromJSON,
+    UserVerificationEnumFromJSONTyped,
+    UserVerificationEnumToJSON,
+    UserVerificationEnumToJSONTyped,
+} from './UserVerificationEnum';
+import type { NotConfiguredActionEnum } from './NotConfiguredActionEnum';
+import {
+    NotConfiguredActionEnumFromJSON,
+    NotConfiguredActionEnumFromJSONTyped,
+    NotConfiguredActionEnumToJSON,
+    NotConfiguredActionEnumToJSONTyped,
+} from './NotConfiguredActionEnum';
+import type { FlowSet } from './FlowSet';
+import {
+    FlowSetFromJSON,
+    FlowSetFromJSONTyped,
+    FlowSetToJSON,
+    FlowSetToJSONTyped,
+} from './FlowSet';
+import type { DeviceClassesEnum } from './DeviceClassesEnum';
+import {
+    DeviceClassesEnumFromJSON,
+    DeviceClassesEnumFromJSONTyped,
+    DeviceClassesEnumToJSON,
+    DeviceClassesEnumToJSONTyped,
+} from './DeviceClassesEnum';
+
+/**
+ * AuthenticatorValidateStage Serializer
+ * @export
+ * @interface AuthenticatorValidateStage
+ */
+export interface AuthenticatorValidateStage {
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorValidateStage
+     */
+    readonly pk: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorValidateStage
+     */
+    name: string;
+    /**
+     * Get object type so that we know how to edit the object
+     * @type {string}
+     * @memberof AuthenticatorValidateStage
+     */
+    readonly component: string;
+    /**
+     * Return object's verbose_name
+     * @type {string}
+     * @memberof AuthenticatorValidateStage
+     */
+    readonly verboseName: string;
+    /**
+     * Return object's plural verbose_name
+     * @type {string}
+     * @memberof AuthenticatorValidateStage
+     */
+    readonly verboseNamePlural: string;
+    /**
+     * Return internal model name
+     * @type {string}
+     * @memberof AuthenticatorValidateStage
+     */
+    readonly metaModelName: string;
+    /**
+     * 
+     * @type {Array<FlowSet>}
+     * @memberof AuthenticatorValidateStage
+     */
+    readonly flowSet: Array<FlowSet>;
+    /**
+     * 
+     * @type {NotConfiguredActionEnum}
+     * @memberof AuthenticatorValidateStage
+     */
+    notConfiguredAction?: NotConfiguredActionEnum;
+    /**
+     * Device classes which can be used to authenticate
+     * @type {Array<DeviceClassesEnum>}
+     * @memberof AuthenticatorValidateStage
+     */
+    deviceClasses?: Array<DeviceClassesEnum>;
+    /**
+     * Stages used to configure Authenticator when user doesn't have any compatible devices. After this configuration Stage passes, the user is not prompted again.
+     * @type {Array<string>}
+     * @memberof AuthenticatorValidateStage
+     */
+    configurationStages?: Array<string>;
+    /**
+     * If any of the user's device has been used within this threshold, this stage will be skipped
+     * @type {string}
+     * @memberof AuthenticatorValidateStage
+     */
+    lastAuthThreshold?: string;
+    /**
+     * Enforce user verification for WebAuthn devices.
+     * @type {UserVerificationEnum}
+     * @memberof AuthenticatorValidateStage
+     */
+    webauthnUserVerification?: UserVerificationEnum;
+    /**
+     * 
+     * @type {Array<WebAuthnHintEnum>}
+     * @memberof AuthenticatorValidateStage
+     */
+    webauthnHints?: Array<WebAuthnHintEnum>;
+    /**
+     * 
+     * @type {Array<string>}
+     * @memberof AuthenticatorValidateStage
+     */
+    webauthnAllowedDeviceTypes?: Array<string>;
+    /**
+     * 
+     * @type {Array<WebAuthnDeviceType>}
+     * @memberof AuthenticatorValidateStage
+     */
+    readonly webauthnAllowedDeviceTypesObj: Array<WebAuthnDeviceType>;
+}
+
+
+
+/**
+ * Check if a given object implements the AuthenticatorValidateStage interface.
+ */
+export function instanceOfAuthenticatorValidateStage(value: object): value is AuthenticatorValidateStage {
+    if (!('pk' in value) || value['pk'] === undefined) return false;
+    if (!('name' in value) || value['name'] === undefined) return false;
+    if (!('component' in value) || value['component'] === undefined) return false;
+    if (!('verboseName' in value) || value['verboseName'] === undefined) return false;
+    if (!('verboseNamePlural' in value) || value['verboseNamePlural'] === undefined) return false;
+    if (!('metaModelName' in value) || value['metaModelName'] === undefined) return false;
+    if (!('flowSet' in value) || value['flowSet'] === undefined) return false;
+    if (!('webauthnAllowedDeviceTypesObj' in value) || value['webauthnAllowedDeviceTypesObj'] === undefined) return false;
+    return true;
+}
+
+export function AuthenticatorValidateStageFromJSON(json: any): AuthenticatorValidateStage {
+    return AuthenticatorValidateStageFromJSONTyped(json, false);
+}
+
+export function AuthenticatorValidateStageFromJSONTyped(json: any, ignoreDiscriminator: boolean): AuthenticatorValidateStage {
+    if (json == null) {
+        return json;
+    }
+    return {
+        
+        'pk': json['pk'],
+        'name': json['name'],
+        'component': json['component'],
+        'verboseName': json['verbose_name'],
+        'verboseNamePlural': json['verbose_name_plural'],
+        'metaModelName': json['meta_model_name'],
+        'flowSet': ((json['flow_set'] as Array<any>).map(FlowSetFromJSON)),
+        'notConfiguredAction': json['not_configured_action'] == null ? undefined : NotConfiguredActionEnumFromJSON(json['not_configured_action']),
+        'deviceClasses': json['device_classes'] == null ? undefined : ((json['device_classes'] as Array<any>).map(DeviceClassesEnumFromJSON)),
+        'configurationStages': json['configuration_stages'] == null ? undefined : json['configuration_stages'],
+        'lastAuthThreshold': json['last_auth_threshold'] == null ? undefined : json['last_auth_threshold'],
+        'webauthnUserVerification': json['webauthn_user_verification'] == null ? undefined : UserVerificationEnumFromJSON(json['webauthn_user_verification']),
+        'webauthnHints': json['webauthn_hints'] == null ? undefined : ((json['webauthn_hints'] as Array<any>).map(WebAuthnHintEnumFromJSON)),
+        'webauthnAllowedDeviceTypes': json['webauthn_allowed_device_types'] == null ? undefined : json['webauthn_allowed_device_types'],
+        'webauthnAllowedDeviceTypesObj': ((json['webauthn_allowed_device_types_obj'] as Array<any>).map(WebAuthnDeviceTypeFromJSON)),
+    };
+}
+
+export function AuthenticatorValidateStageToJSON(json: any): AuthenticatorValidateStage {
+    return AuthenticatorValidateStageToJSONTyped(json, false);
+}
+
+export function AuthenticatorValidateStageToJSONTyped(value?: Omit<AuthenticatorValidateStage, 'pk'|'component'|'verbose_name'|'verbose_name_plural'|'meta_model_name'|'flow_set'|'webauthn_allowed_device_types_obj'> | null, ignoreDiscriminator: boolean = false): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        
+        'name': value['name'],
+        'not_configured_action': NotConfiguredActionEnumToJSON(value['notConfiguredAction']),
+        'device_classes': value['deviceClasses'] == null ? undefined : ((value['deviceClasses'] as Array<any>).map(DeviceClassesEnumToJSON)),
+        'configuration_stages': value['configurationStages'],
+        'last_auth_threshold': value['lastAuthThreshold'],
+        'webauthn_user_verification': UserVerificationEnumToJSON(value['webauthnUserVerification']),
+        'webauthn_hints': value['webauthnHints'] == null ? undefined : ((value['webauthnHints'] as Array<any>).map(WebAuthnHintEnumToJSON)),
+        'webauthn_allowed_device_types': value['webauthnAllowedDeviceTypes'],
+    };
+}
+

packages/client-ts/src/models/AuthenticatorValidateStageRequest.ts

@@ -0,0 +1,153 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import { mapValues } from '../runtime';
+import type { WebAuthnHintEnum } from './WebAuthnHintEnum';
+import {
+    WebAuthnHintEnumFromJSON,
+    WebAuthnHintEnumFromJSONTyped,
+    WebAuthnHintEnumToJSON,
+    WebAuthnHintEnumToJSONTyped,
+} from './WebAuthnHintEnum';
+import type { UserVerificationEnum } from './UserVerificationEnum';
+import {
+    UserVerificationEnumFromJSON,
+    UserVerificationEnumFromJSONTyped,
+    UserVerificationEnumToJSON,
+    UserVerificationEnumToJSONTyped,
+} from './UserVerificationEnum';
+import type { NotConfiguredActionEnum } from './NotConfiguredActionEnum';
+import {
+    NotConfiguredActionEnumFromJSON,
+    NotConfiguredActionEnumFromJSONTyped,
+    NotConfiguredActionEnumToJSON,
+    NotConfiguredActionEnumToJSONTyped,
+} from './NotConfiguredActionEnum';
+import type { DeviceClassesEnum } from './DeviceClassesEnum';
+import {
+    DeviceClassesEnumFromJSON,
+    DeviceClassesEnumFromJSONTyped,
+    DeviceClassesEnumToJSON,
+    DeviceClassesEnumToJSONTyped,
+} from './DeviceClassesEnum';
+
+/**
+ * AuthenticatorValidateStage Serializer
+ * @export
+ * @interface AuthenticatorValidateStageRequest
+ */
+export interface AuthenticatorValidateStageRequest {
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorValidateStageRequest
+     */
+    name: string;
+    /**
+     * 
+     * @type {NotConfiguredActionEnum}
+     * @memberof AuthenticatorValidateStageRequest
+     */
+    notConfiguredAction?: NotConfiguredActionEnum;
+    /**
+     * Device classes which can be used to authenticate
+     * @type {Array<DeviceClassesEnum>}
+     * @memberof AuthenticatorValidateStageRequest
+     */
+    deviceClasses?: Array<DeviceClassesEnum>;
+    /**
+     * Stages used to configure Authenticator when user doesn't have any compatible devices. After this configuration Stage passes, the user is not prompted again.
+     * @type {Array<string>}
+     * @memberof AuthenticatorValidateStageRequest
+     */
+    configurationStages?: Array<string>;
+    /**
+     * If any of the user's device has been used within this threshold, this stage will be skipped
+     * @type {string}
+     * @memberof AuthenticatorValidateStageRequest
+     */
+    lastAuthThreshold?: string;
+    /**
+     * Enforce user verification for WebAuthn devices.
+     * @type {UserVerificationEnum}
+     * @memberof AuthenticatorValidateStageRequest
+     */
+    webauthnUserVerification?: UserVerificationEnum;
+    /**
+     * 
+     * @type {Array<WebAuthnHintEnum>}
+     * @memberof AuthenticatorValidateStageRequest
+     */
+    webauthnHints?: Array<WebAuthnHintEnum>;
+    /**
+     * 
+     * @type {Array<string>}
+     * @memberof AuthenticatorValidateStageRequest
+     */
+    webauthnAllowedDeviceTypes?: Array<string>;
+}
+
+
+
+/**
+ * Check if a given object implements the AuthenticatorValidateStageRequest interface.
+ */
+export function instanceOfAuthenticatorValidateStageRequest(value: object): value is AuthenticatorValidateStageRequest {
+    if (!('name' in value) || value['name'] === undefined) return false;
+    return true;
+}
+
+export function AuthenticatorValidateStageRequestFromJSON(json: any): AuthenticatorValidateStageRequest {
+    return AuthenticatorValidateStageRequestFromJSONTyped(json, false);
+}
+
+export function AuthenticatorValidateStageRequestFromJSONTyped(json: any, ignoreDiscriminator: boolean): AuthenticatorValidateStageRequest {
+    if (json == null) {
+        return json;
+    }
+    return {
+        
+        'name': json['name'],
+        'notConfiguredAction': json['not_configured_action'] == null ? undefined : NotConfiguredActionEnumFromJSON(json['not_configured_action']),
+        'deviceClasses': json['device_classes'] == null ? undefined : ((json['device_classes'] as Array<any>).map(DeviceClassesEnumFromJSON)),
+        'configurationStages': json['configuration_stages'] == null ? undefined : json['configuration_stages'],
+        'lastAuthThreshold': json['last_auth_threshold'] == null ? undefined : json['last_auth_threshold'],
+        'webauthnUserVerification': json['webauthn_user_verification'] == null ? undefined : UserVerificationEnumFromJSON(json['webauthn_user_verification']),
+        'webauthnHints': json['webauthn_hints'] == null ? undefined : ((json['webauthn_hints'] as Array<any>).map(WebAuthnHintEnumFromJSON)),
+        'webauthnAllowedDeviceTypes': json['webauthn_allowed_device_types'] == null ? undefined : json['webauthn_allowed_device_types'],
+    };
+}
+
+export function AuthenticatorValidateStageRequestToJSON(json: any): AuthenticatorValidateStageRequest {
+    return AuthenticatorValidateStageRequestToJSONTyped(json, false);
+}
+
+export function AuthenticatorValidateStageRequestToJSONTyped(value?: AuthenticatorValidateStageRequest | null, ignoreDiscriminator: boolean = false): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        
+        'name': value['name'],
+        'not_configured_action': NotConfiguredActionEnumToJSON(value['notConfiguredAction']),
+        'device_classes': value['deviceClasses'] == null ? undefined : ((value['deviceClasses'] as Array<any>).map(DeviceClassesEnumToJSON)),
+        'configuration_stages': value['configurationStages'],
+        'last_auth_threshold': value['lastAuthThreshold'],
+        'webauthn_user_verification': UserVerificationEnumToJSON(value['webauthnUserVerification']),
+        'webauthn_hints': value['webauthnHints'] == null ? undefined : ((value['webauthnHints'] as Array<any>).map(WebAuthnHintEnumToJSON)),
+        'webauthn_allowed_device_types': value['webauthnAllowedDeviceTypes'],
+    };
+}
+

packages/client-ts/src/models/AuthenticatorValidationChallenge.ts

@@ -0,0 +1,146 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * authentik
+ * Making authentication simple.
+ *
+ * The version of the OpenAPI document: 2026.5.0-rc1
+ * Contact: hello@goauthentik.io
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import { mapValues } from '../runtime';
+import type { ErrorDetail } from './ErrorDetail';
+import {
+    ErrorDetailFromJSON,
+    ErrorDetailFromJSONTyped,
+    ErrorDetailToJSON,
+    ErrorDetailToJSONTyped,
+} from './ErrorDetail';
+import type { ContextualFlowInfo } from './ContextualFlowInfo';
+import {
+    ContextualFlowInfoFromJSON,
+    ContextualFlowInfoFromJSONTyped,
+    ContextualFlowInfoToJSON,
+    ContextualFlowInfoToJSONTyped,
+} from './ContextualFlowInfo';
+import type { SelectableStage } from './SelectableStage';
+import {
+    SelectableStageFromJSON,
+    SelectableStageFromJSONTyped,
+    SelectableStageToJSON,
+    SelectableStageToJSONTyped,
+} from './SelectableStage';
+import type { DeviceChallenge } from './DeviceChallenge';
+import {
+    DeviceChallengeFromJSON,
+    DeviceChallengeFromJSONTyped,
+    DeviceChallengeToJSON,
+    DeviceChallengeToJSONTyped,
+} from './DeviceChallenge';
+
+/**
+ * Authenticator challenge
+ * @export
+ * @interface AuthenticatorValidationChallenge
+ */
+export interface AuthenticatorValidationChallenge {
+    /**
+     * 
+     * @type {ContextualFlowInfo}
+     * @memberof AuthenticatorValidationChallenge
+     */
+    flowInfo?: ContextualFlowInfo;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorValidationChallenge
+     */
+    component?: string;
+    /**
+     * 
+     * @type {{ [key: string]: Array<ErrorDetail>; }}
+     * @memberof AuthenticatorValidationChallenge
+     */
+    responseErrors?: { [key: string]: Array<ErrorDetail>; };
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorValidationChallenge
+     */
+    pendingUser: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof AuthenticatorValidationChallenge
+     */
+    pendingUserAvatar: string;
+    /**
+     * 
+     * @type {Array<DeviceChallenge>}
+     * @memberof AuthenticatorValidationChallenge
+     */
+    deviceChallenges: Array<DeviceChallenge>;
+    /**
+     * 
+     * @type {Array<SelectableStage>}
+     * @memberof AuthenticatorValidationChallenge
+     */
+    configurationStages: Array<SelectableStage>;
+}
+
+/**
+ * Check if a given object implements the AuthenticatorValidationChallenge interface.
+ */
+export function instanceOfAuthenticatorValidationChallenge(value: object): value is AuthenticatorValidationChallenge {
+    if (!('pendingUser' in value) || value['pendingUser'] === undefined) return false;
+    if (!('pendingUserAvatar' in value) || value['pendingUserAvatar'] === undefined) return false;
+    if (!('deviceChallenges' in value) || value['deviceChallenges'] === undefined) return false;
+    if (!('configurationStages' in value) || value['configurationStages'] === undefined) return false;
+    return true;
+}
+
+export function AuthenticatorValidationChallengeFromJSON(json: any): AuthenticatorValidationChallenge {
+    return AuthenticatorValidationChallengeFromJSONTyped(json, false);
+}
+
+export function AuthenticatorValidationChallengeFromJSONTyped(json: any, ignoreDiscriminator: boolean): AuthenticatorValidationChallenge {
+    if (json == null) {
+        return json;
+    }
+    return {
+        
+        'flowInfo': json['flow_info'] == null ? undefined : ContextualFlowInfoFromJSON(json['flow_info']),
+        'component': json['component'] == null ? undefined : json['component'],
+        'responseErrors': json['response_errors'] == null ? undefined : json['response_errors'],
+        'pendingUser': json['pending_user'],
+        'pendingUserAvatar': json['pending_user_avatar'],
+        'deviceChallenges': ((json['device_challenges'] as Array<any>).map(DeviceChallengeFromJSON)),
+        'configurationStages': ((json['configuration_stages'] as Array<any>).map(SelectableStageFromJSON)),
+    };
+}
+
+export function AuthenticatorValidationChallengeToJSON(json: any): AuthenticatorValidationChallenge {
+    return AuthenticatorValidationChallengeToJSONTyped(json, false);
+}
+
+export function AuthenticatorValidationChallengeToJSONTyped(value?: AuthenticatorValidationChallenge | null, ignoreDiscriminator: boolean = false): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        
+        'flow_info': ContextualFlowInfoToJSON(value['flowInfo']),
+        'component': value['component'],
+        'response_errors': value['responseErrors'],
+        'pending_user': value['pendingUser'],
+        'pending_user_avatar': value['pendingUserAvatar'],
+        'device_challenges': ((value['deviceChallenges'] as Array<any>).map(DeviceChallengeToJSON)),
+        'configuration_stages': ((value['configurationStages'] as Array<any>).map(SelectableStageToJSON)),
+    };
+}
+