feat: add Network ACL Keys, 3P client access, and XAA connection profile support

package.json

@@ -1057,6 +1057,17 @@
             },
             "default": "./dist/cjs/management/api/resources/keys/resources/encryption/exports.js"
         },
+        "./keys/networkAcls": {
+            "import": {
+                "types": "./dist/esm/management/api/resources/keys/resources/networkAcls/exports.d.mts",
+                "default": "./dist/esm/management/api/resources/keys/resources/networkAcls/exports.mjs"
+            },
+            "require": {
+                "types": "./dist/cjs/management/api/resources/keys/resources/networkAcls/exports.d.ts",
+                "default": "./dist/cjs/management/api/resources/keys/resources/networkAcls/exports.js"
+            },
+            "default": "./dist/cjs/management/api/resources/keys/resources/networkAcls/exports.js"
+        },
         "./keys/signing": {
             "import": {
                 "types": "./dist/esm/management/api/resources/keys/resources/signing/exports.d.mts",

reference.md

@@ -1356,7 +1356,7 @@ For more information, read [Applications in Auth0](https://www.auth0.com/docs/ge
   `jwt_configuration.lifetime_in_seconds`, `jwt_configuration.secret_encoded`,
   `jwt_configuration.scopes`, `jwt_configuration.alg`, `api_type`,
   `logo_uri`, `allowed_clients`, `owners`, `custom_login_page`,
-  `custom_login_page_off`, `sso`, `addons`, `form_template`,
+  `custom_login_page_on`, `sso`, `addons`, `form_template`,
   `custom_login_page_codeview`, `resource_servers`, `client_metadata`,
   `mobile`, `mobile.android`, `mobile.ios`, `allowed_logout_urls`,
   `token_endpoint_auth_method`, `is_first_party`, `oidc_conformant`,
@@ -1697,7 +1697,7 @@ For more information, read [Applications in Auth0](https://www.auth0.com/docs/ge
   `jwt_configuration.lifetime_in_seconds`, `jwt_configuration.secret_encoded`,
   `jwt_configuration.scopes`, `jwt_configuration.alg`, `api_type`,
   `logo_uri`, `allowed_clients`, `owners`, `custom_login_page`,
-  `custom_login_page_off`, `sso`, `addons`, `form_template`,
+  `custom_login_page_on`, `sso`, `addons`, `form_template`,
   `custom_login_page_codeview`, `resource_servers`, `client_metadata`,
   `mobile`, `mobile.android`, `mobile.ios`, `allowed_logout_urls`,
   `token_endpoint_auth_method`, `is_first_party`, `oidc_conformant`,
@@ -2770,7 +2770,7 @@ await client.connections.delete("id");
 
 Update details for a specific [connection](https://auth0.com/docs/authenticate/identity-providers), including option properties for identity provider configuration.
 
-**Note**: If you use the `options` parameter, the entire `options` object is overridden. To avoid partial data or other issues, ensure all parameters are present when using this option.
+**Note**: If you use the `options` parameter, the entire `options` object is overridden. To avoid partial data or other issues, ensure all parameters are present when using this option. If any options are unspecified, the default will be used, even if it differs from the existing value.
 
 </dd>
 </dl>
@@ -23265,6 +23265,193 @@ await client.keys.encryption.createPublicWrappingKey("kid");
 </dl>
 </details>
 
+## Keys NetworkAcls
+
+<details><summary><code>client.keys.networkAcls.<a href="/src/management/api/resources/keys/resources/networkAcls/client/Client.ts">list</a>() -> Management.GetAllKeysNetworkAclsResponseContent</code></summary>
+<dl>
+<dd>
+
+#### 📝 Description
+
+<dl>
+<dd>
+
+<dl>
+<dd>
+
+Retrieve all keys used to verify HTTP Message Signatures on Network ACL rules, ordered by creation time descending.
+
+</dd>
+</dl>
+</dd>
+</dl>
+
+#### 🔌 Usage
+
+<dl>
+<dd>
+
+<dl>
+<dd>
+
+```typescript
+await client.keys.networkAcls.list();
+```
+
+</dd>
+</dl>
+</dd>
+</dl>
+
+#### ⚙️ Parameters
+
+<dl>
+<dd>
+
+<dl>
+<dd>
+
+**requestOptions:** `NetworkAclsClient.RequestOptions`
+
+</dd>
+</dl>
+</dd>
+</dl>
+
+</dd>
+</dl>
+</details>
+
+<details><summary><code>client.keys.networkAcls.<a href="/src/management/api/resources/keys/resources/networkAcls/client/Client.ts">create</a>({ ...params }) -> Management.CreateKeysNetworkAclsResponseContent</code></summary>
+<dl>
+<dd>
+
+#### 📝 Description
+
+<dl>
+<dd>
+
+<dl>
+<dd>
+
+Create a new key used to verify HTTP Message Signatures on Network ACL rules.
+
+</dd>
+</dl>
+</dd>
+</dl>
+
+#### 🔌 Usage
+
+<dl>
+<dd>
+
+<dl>
+<dd>
+
+```typescript
+await client.keys.networkAcls.create({
+    name: "name",
+    alg: "hmac-sha256",
+    value: "value",
+});
+```
+
+</dd>
+</dl>
+</dd>
+</dl>
+
+#### ⚙️ Parameters
+
+<dl>
+<dd>
+
+<dl>
+<dd>
+
+**request:** `Management.CreateKeysNetworkAclsRequestContent`
+
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**requestOptions:** `NetworkAclsClient.RequestOptions`
+
+</dd>
+</dl>
+</dd>
+</dl>
+
+</dd>
+</dl>
+</details>
+
+<details><summary><code>client.keys.networkAcls.<a href="/src/management/api/resources/keys/resources/networkAcls/client/Client.ts">get</a>(id) -> Management.NetworkAclKey</code></summary>
+<dl>
+<dd>
+
+#### 📝 Description
+
+<dl>
+<dd>
+
+<dl>
+<dd>
+
+Retrieve a specific key used to verify HTTP Message Signatures on Network ACL rules.
+
+</dd>
+</dl>
+</dd>
+</dl>
+
+#### 🔌 Usage
+
+<dl>
+<dd>
+
+<dl>
+<dd>
+
+```typescript
+await client.keys.networkAcls.get("id");
+```
+
+</dd>
+</dl>
+</dd>
+</dl>
+
+#### ⚙️ Parameters
+
+<dl>
+<dd>
+
+<dl>
+<dd>
+
+**id:** `string` — ID of the Network ACL Key to retrieve.
+
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**requestOptions:** `NetworkAclsClient.RequestOptions`
+
+</dd>
+</dl>
+</dd>
+</dl>
+
+</dd>
+</dl>
+</details>
+
 ## Keys Signing
 
 <details><summary><code>client.keys.signing.<a href="/src/management/api/resources/keys/resources/signing/client/Client.ts">list</a>() -> Management.SigningKeys[]</code></summary>

src/management/api/requests/requests.ts

@@ -527,6 +527,7 @@ export interface CreateConnectionProfileRequestContent {
     enabled_features?: Management.ConnectionProfileEnabledFeatures;
     connection_config?: Management.ConnectionProfileConfig;
     strategy_overrides?: Management.ConnectionProfileStrategyOverrides;
+    cross_app_access_resource_app?: Management.ConnectionProfileCrossAppAccessResourceApp;
 }
 
 /**
@@ -540,6 +541,7 @@ export interface UpdateConnectionProfileRequestContent {
     enabled_features?: Management.ConnectionProfileEnabledFeatures;
     connection_config?: Management.ConnectionProfileConfig;
     strategy_overrides?: Management.ConnectionProfileStrategyOverrides;
+    cross_app_access_resource_app?: Management.ConnectionProfileCrossAppAccessResourceApp;
 }
 
 /**
@@ -670,7 +672,7 @@ export interface CreateCustomDomainRequestContent {
     type: Management.CustomDomainProvisioningTypeEnum;
     verification_method?: Management.CustomDomainVerificationMethodEnum;
     tls_policy?: Management.CustomDomainTlsPolicyEnum;
-    custom_client_ip_header?: Management.CustomDomainCustomClientIpHeader | undefined;
+    custom_client_ip_header?: (Management.CustomDomainCustomClientIpHeader | undefined) | null;
     domain_metadata?: Management.DomainMetadata;
     /** Relying Party ID (rpId) to be used for Passkeys on this custom domain. If not provided, the full domain will be used. */
     relying_party_identifier?: string;
@@ -694,7 +696,7 @@ export interface SetDefaultCustomDomainRequestContent {
 export interface UpdateCustomDomainRequestContent {
     /** recommended includes TLS 1.2 */
     tls_policy?: Management.CustomDomainTlsPolicyEnum;
-    custom_client_ip_header?: Management.CustomDomainCustomClientIpHeader | undefined;
+    custom_client_ip_header?: (Management.CustomDomainCustomClientIpHeader | undefined) | null;
     domain_metadata?: Management.DomainMetadata;
     /** Relying Party ID (rpId) to be used for Passkeys on this custom domain. Set to null to remove the rpId and fall back to using the full domain. */
     relying_party_identifier?: string | null;
@@ -1002,13 +1004,13 @@ export interface GetFormRequestParameters {
  */
 export interface UpdateFormRequestContent {
     name?: string;
-    messages?: Management.FormMessagesNullable | undefined;
-    languages?: Management.FormLanguagesNullable | undefined;
-    translations?: Management.FormTranslationsNullable | undefined;
-    nodes?: Management.FormNodeListNullable | undefined;
-    start?: Management.FormStartNodeNullable | undefined;
-    ending?: Management.FormEndingNodeNullable | undefined;
-    style?: Management.FormStyleNullable | undefined;
+    messages?: (Management.FormMessagesNullable | undefined) | null;
+    languages?: (Management.FormLanguagesNullable | undefined) | null;
+    translations?: (Management.FormTranslationsNullable | undefined) | null;
+    nodes?: (Management.FormNodeListNullable | undefined) | null;
+    start?: (Management.FormStartNodeNullable | undefined) | null;
+    ending?: (Management.FormEndingNodeNullable | undefined) | null;
+    style?: (Management.FormStyleNullable | undefined) | null;
 }
 
 /**
@@ -1737,7 +1739,7 @@ export interface UpdateSelfServiceProfileRequestContent {
     /** The name of the self-service Profile. */
     name?: string;
     description?: (Management.SelfServiceProfileDescription | undefined) | null;
-    branding?: Management.SelfServiceProfileBranding | undefined;
+    branding?: (Management.SelfServiceProfileBranding | undefined) | null;
     /** List of IdP strategies that will be shown to users during the Self-Service Enterprise Configuration flow. Possible values: [`oidc`, `samlp`, `waad`, `google-apps`, `adfs`, `okta`, `auth0-samlp`, `okta-samlp`, `keycloak-samlp`, `pingfederate`] */
     allowed_strategies?: Management.SelfServiceProfileAllowedStrategyEnum[];
     user_attributes?: (Management.SelfServiceProfileUserAttributes | undefined) | null;
@@ -1911,7 +1913,7 @@ export interface CreateUserAttributeProfileRequestContent {
  */
 export interface UpdateUserAttributeProfileRequestContent {
     name?: Management.UserAttributeProfileName;
-    user_id?: Management.UserAttributeProfilePatchUserId | undefined;
+    user_id?: (Management.UserAttributeProfilePatchUserId | undefined) | null;
     user_attributes?: Management.UserAttributeProfileUserAttributes;
 }
 
@@ -3344,6 +3346,22 @@ export interface ImportEncryptionKeyRequestContent {
     wrapped_key: string;
 }
 
+/**
+ * @example
+ *     {
+ *         name: "name",
+ *         alg: "hmac-sha256",
+ *         value: "value"
+ *     }
+ */
+export interface CreateKeysNetworkAclsRequestContent {
+    /** Customer-supplied label with no cryptographic meaning. Must be unique across all Network ACL keys for the tenant. */
+    name: string;
+    alg: Management.NetworkAclKeyAlgorithmEnum;
+    /** Base64-encoded raw key material. Constraints on the decoded value depend on the algorithm specified. Currently only HMAC-SHA256 is supported. */
+    value: string;
+}
+
 /**
  * @example
  *     {

src/management/api/resources/clients/client/Client.ts

@@ -48,7 +48,7 @@ export class ClientsClient {
      *     `jwt_configuration.lifetime_in_seconds`, `jwt_configuration.secret_encoded`,
      *     `jwt_configuration.scopes`, `jwt_configuration.alg`, `api_type`,
      *     `logo_uri`, `allowed_clients`, `owners`, `custom_login_page`,
-     *     `custom_login_page_off`, `sso`, `addons`, `form_template`,
+     *     `custom_login_page_on`, `sso`, `addons`, `form_template`,
      *     `custom_login_page_codeview`, `resource_servers`, `client_metadata`,
      *     `mobile`, `mobile.android`, `mobile.ios`, `allowed_logout_urls`,
      *     `token_endpoint_auth_method`, `is_first_party`, `oidc_conformant`,
@@ -489,7 +489,7 @@ export class ClientsClient {
      *     `jwt_configuration.lifetime_in_seconds`, `jwt_configuration.secret_encoded`,
      *     `jwt_configuration.scopes`, `jwt_configuration.alg`, `api_type`,
      *     `logo_uri`, `allowed_clients`, `owners`, `custom_login_page`,
-     *     `custom_login_page_off`, `sso`, `addons`, `form_template`,
+     *     `custom_login_page_on`, `sso`, `addons`, `form_template`,
      *     `custom_login_page_codeview`, `resource_servers`, `client_metadata`,
      *     `mobile`, `mobile.android`, `mobile.ios`, `allowed_logout_urls`,
      *     `token_endpoint_auth_method`, `is_first_party`, `oidc_conformant`,

src/management/api/resources/connections/client/Client.ts

@@ -454,7 +454,7 @@ export class ConnectionsClient {
     /**
      * Update details for a specific [connection](https://auth0.com/docs/authenticate/identity-providers), including option properties for identity provider configuration.
      *
-     * **Note**: If you use the `options` parameter, the entire `options` object is overridden. To avoid partial data or other issues, ensure all parameters are present when using this option.
+     * **Note**: If you use the `options` parameter, the entire `options` object is overridden. To avoid partial data or other issues, ensure all parameters are present when using this option. If any options are unspecified, the default will be used, even if it differs from the existing value.
      *
      * @param {string} id - The id of the connection to update
      * @param {Management.UpdateConnectionRequestContent} request

src/management/api/resources/flows/client/Client.ts

@@ -327,6 +327,7 @@ export class FlowsClient {
      * @throws {@link Management.UnauthorizedError}
      * @throws {@link Management.ForbiddenError}
      * @throws {@link Management.NotFoundError}
+     * @throws {@link Management.ConflictError}
      * @throws {@link Management.TooManyRequestsError}
      *
      * @example
@@ -376,6 +377,8 @@ export class FlowsClient {
                     throw new Management.ForbiddenError(_response.error.body as unknown, _response.rawResponse);
                 case 404:
                     throw new Management.NotFoundError(_response.error.body as unknown, _response.rawResponse);
+                case 409:
+                    throw new Management.ConflictError(_response.error.body as unknown, _response.rawResponse);
                 case 429:
                     throw new Management.TooManyRequestsError(_response.error.body as unknown, _response.rawResponse);
                 default:
@@ -395,6 +398,7 @@ export class FlowsClient {
      * @param {Management.UpdateFlowRequestContent} request
      * @param {FlowsClient.RequestOptions} requestOptions - Request-specific configuration.
      *
+     * @throws {@link Management.BadRequestError}
      * @throws {@link Management.UnauthorizedError}
      * @throws {@link Management.ForbiddenError}
      * @throws {@link Management.NotFoundError}
@@ -447,6 +451,8 @@ export class FlowsClient {
 
         if (_response.error.reason === "status-code") {
             switch (_response.error.statusCode) {
+                case 400:
+                    throw new Management.BadRequestError(_response.error.body as unknown, _response.rawResponse);
                 case 401:
                     throw new Management.UnauthorizedError(_response.error.body as unknown, _response.rawResponse);
                 case 403: