schema.graphqls

# GraphQL schema example
#
# https://gqlgen.com/getting-started/
scalar Int64
scalar Map
scalar Any

type Pagination {
  limit: Int64!
  page: Int64!
  offset: Int64!
  total: Int64!
}

type Meta {
  version: String!
  client_id: String!
  is_google_login_enabled: Boolean!
  is_facebook_login_enabled: Boolean!
  is_github_login_enabled: Boolean!
  is_linkedin_login_enabled: Boolean!
  is_apple_login_enabled: Boolean!
  is_discord_login_enabled: Boolean!
  is_twitter_login_enabled: Boolean!
  is_microsoft_login_enabled: Boolean!
  is_twitch_login_enabled: Boolean!
  is_roblox_login_enabled: Boolean!
  is_email_verification_enabled: Boolean!
  is_basic_authentication_enabled: Boolean!
  is_magic_link_login_enabled: Boolean!
  is_sign_up_enabled: Boolean!
  is_strong_password_enabled: Boolean!
  is_multi_factor_auth_enabled: Boolean!
  is_mobile_basic_authentication_enabled: Boolean!
  is_phone_verification_enabled: Boolean!
}

# AdminMeta is admin-only configuration metadata exposed via the _admin_meta
# query — the non-deprecated way for the dashboard to read configured roles
# (the deprecated _env used to carry these).
type AdminMeta {
  roles: [String!]!
  default_roles: [String!]!
  protected_roles: [String!]!
}

type User {
  id: ID!
  # email or phone_number is always present
  email: String
  email_verified: Boolean!
  signup_methods: String!
  given_name: String
  family_name: String
  middle_name: String
  nickname: String
  # defaults to email
  preferred_username: String
  gender: String
  birthdate: String
  phone_number: String
  phone_number_verified: Boolean!
  picture: String
  roles: [String!]!
  created_at: Int64
  updated_at: Int64
  revoked_timestamp: Int64
  is_multi_factor_auth_enabled: Boolean
  app_data: Map
}

type Users {
  pagination: Pagination!
  users: [User!]!
}

type VerificationRequest {
  id: ID!
  identifier: String
  token: String
  email: String
  expires: Int64
  created_at: Int64
  updated_at: Int64
  nonce: String
  redirect_uri: String
}

type VerificationRequests {
  pagination: Pagination!
  verification_requests: [VerificationRequest!]!
}

type Error {
  message: String!
  reason: String!
}

type AuthResponse {
  message: String!
  should_show_email_otp_screen: Boolean
  should_show_mobile_otp_screen: Boolean
  should_show_totp_screen: Boolean
  access_token: String
  id_token: String
  refresh_token: String
  expires_in: Int64
  user: User
  # key for totp login
  # it is a base64 image url
  authenticator_scanner_image: String
  # string which can be used instead of scanner image
  authenticator_secret: String
  # recovery codes for totp login shared with user only once
  authenticator_recovery_codes: [String]
}

type Response {
  message: String!
}

# ---- Fine-grained authorization (FGA) types ----

# FgaTuple is a single relationship: user is related to object via relation.
# Identifiers follow OpenFGA conventions: user "user:alice" (or userset
# "role:admin#assignee"), object "document:1".
type FgaTuple {
  user: String!
  relation: String!
  object: String!
}

# FgaModel describes an authorization model (id + DSL form).
type FgaModel {
  id: String!
  dsl: String!
}

# FgaTuples is a page of tuples plus a continuation token (empty when exhausted).
type FgaTuples {
  tuples: [FgaTuple!]!
  continuation_token: String
}

# PermissionCheckResult is the outcome of one permission check, echoing the
# checked pair so batch results are self-describing (and positionally aligned).
type PermissionCheckResult {
  relation: String!
  object: String!
  allowed: Boolean!
}

# CheckPermissionsResponse carries one result per supplied check, in order.
type CheckPermissionsResponse {
  results: [PermissionCheckResult!]!
}

# Permission is one (object, relation) pair the subject holds: "subject has
# `relation` on `object`".
type Permission {
  object: String!
  relation: String!
}

# ListPermissionsResponse lists what the subject can access. `objects` is the
# distinct fully-qualified object ids; `permissions` carries the (object,
# relation) detail — relevant when no relation filter was supplied. `truncated`
# is true when the result was capped (1000 entries) and more permissions exist.
type ListPermissionsResponse {
  objects: [String!]!
  permissions: [Permission!]!
  truncated: Boolean!
}

# FgaListUsersResponse lists fully-qualified user ids (e.g. "user:alice") that
# have the queried relation on an object. Admin-only (reveals the access graph).
type FgaListUsersResponse {
  users: [String!]!
}

# FgaExpandResponse is the OpenFGA relationship/userset tree for a (relation,
# object), serialized as a JSON string. Admin-only (reveals the access graph).
type FgaExpandResponse {
  tree: String!
}

type ForgotPasswordResponse {
  message: String!
  should_show_mobile_otp_screen: Boolean
}

type InviteMembersResponse {
  message: String!
  Users: [User!]!
}

type Env {
  ACCESS_TOKEN_EXPIRY_TIME: String
  ADMIN_SECRET: String
  DATABASE_NAME: String
  DATABASE_URL: String
  DATABASE_TYPE: String
  DATABASE_USERNAME: String
  DATABASE_PASSWORD: String
  DATABASE_HOST: String
  DATABASE_PORT: String
  CLIENT_ID: String!
  CLIENT_SECRET: String!
  CUSTOM_ACCESS_TOKEN_SCRIPT: String
  SMTP_HOST: String
  SMTP_PORT: String
  SMTP_USERNAME: String
  SMTP_PASSWORD: String
  SMTP_LOCAL_NAME: String
  SENDER_EMAIL: String
  SENDER_NAME: String
  JWT_TYPE: String
  JWT_SECRET: String
  JWT_PRIVATE_KEY: String
  JWT_PUBLIC_KEY: String
  ALLOWED_ORIGINS: [String!]
  APP_URL: String
  REDIS_URL: String
  RESET_PASSWORD_URL: String
  DISABLE_EMAIL_VERIFICATION: Boolean!
  DISABLE_BASIC_AUTHENTICATION: Boolean!
  DISABLE_MOBILE_BASIC_AUTHENTICATION: Boolean!
  DISABLE_MAGIC_LINK_LOGIN: Boolean!
  DISABLE_LOGIN_PAGE: Boolean!
  DISABLE_SIGN_UP: Boolean!
  DISABLE_REDIS_FOR_ENV: Boolean!
  DISABLE_STRONG_PASSWORD: Boolean!
  DISABLE_MULTI_FACTOR_AUTHENTICATION: Boolean!
  ENFORCE_MULTI_FACTOR_AUTHENTICATION: Boolean!
  ROLES: [String!]
  PROTECTED_ROLES: [String!]
  DEFAULT_ROLES: [String!]
  JWT_ROLE_CLAIM: String
  GOOGLE_CLIENT_ID: String
  GOOGLE_CLIENT_SECRET: String
  GITHUB_CLIENT_ID: String
  GITHUB_CLIENT_SECRET: String
  FACEBOOK_CLIENT_ID: String
  FACEBOOK_CLIENT_SECRET: String
  LINKEDIN_CLIENT_ID: String
  LINKEDIN_CLIENT_SECRET: String
  APPLE_CLIENT_ID: String
  APPLE_CLIENT_SECRET: String
  DISCORD_CLIENT_ID: String
  DISCORD_CLIENT_SECRET: String
  TWITTER_CLIENT_ID: String
  TWITTER_CLIENT_SECRET: String
  MICROSOFT_CLIENT_ID: String
  MICROSOFT_CLIENT_SECRET: String
  MICROSOFT_ACTIVE_DIRECTORY_TENANT_ID: String
  TWITCH_CLIENT_ID: String
  TWITCH_CLIENT_SECRET: String
  ROBLOX_CLIENT_ID: String
  ROBLOX_CLIENT_SECRET: String
  ORGANIZATION_NAME: String
  ORGANIZATION_LOGO: String
  APP_COOKIE_SECURE: Boolean!
  ADMIN_COOKIE_SECURE: Boolean!
  DEFAULT_AUTHORIZE_RESPONSE_TYPE: String
  DEFAULT_AUTHORIZE_RESPONSE_MODE: String
  DISABLE_PLAYGROUND: Boolean!
  DISABLE_MAIL_OTP_LOGIN: Boolean!
  DISABLE_TOTP_LOGIN: Boolean!
}

type ValidateJWTTokenResponse {
  is_valid: Boolean!
  claims: Map
}

type ValidateSessionResponse {
  is_valid: Boolean!
  user: User!
}

type GenerateJWTKeysResponse {
  secret: String
  public_key: String
  private_key: String
}

type Webhook {
  id: ID!
  event_name: String # this is unique string
  event_description: String
  endpoint: String
  enabled: Boolean
  headers: Map
  created_at: Int64
  updated_at: Int64
}

type Webhooks {
  pagination: Pagination!
  webhooks: [Webhook!]!
}

type ServiceAccount {
  id: ID!
  name: String!
  description: String
  allowed_scopes: [String!]!
  is_active: Boolean!
  created_at: Int64
  updated_at: Int64
  # client_secret is NEVER returned here. It is returned exactly once in
  # CreateServiceAccountResponse (creation and rotation) and never again.
}

type CreateServiceAccountResponse {
  service_account: ServiceAccount!
  # client_secret is returned ONCE at creation and ONCE at rotation. Store it
  # securely; it can never be retrieved again.
  client_secret: String!
}

type ServiceAccounts {
  pagination: Pagination!
  service_accounts: [ServiceAccount!]!
}

type TrustedIssuer {
  id: ID!
  service_account_id: String!
  name: String!
  issuer_url: String!
  key_source_type: String!
  jwks_url: String
  expected_aud: String!
  subject_claim: String!
  issuer_type: String!
  is_active: Boolean!
  spiffe_refresh_hint_seconds: Int64
  created_at: Int64
  updated_at: Int64
}

type TrustedIssuers {
  pagination: Pagination!
  trusted_issuers: [TrustedIssuer!]!
}

type WebhookLog {
  id: ID!
  http_status: Int64
  response: String
  request: String
  webhook_id: ID
  created_at: Int64
  updated_at: Int64
}

type TestEndpointResponse {
  http_status: Int64
  response: String
}

type WebhookLogs {
  pagination: Pagination!
  webhook_logs: [WebhookLog!]!
}

type AuditLog {
  id: ID!
  actor_id: String
  actor_type: String
  actor_email: String
  action: String
  resource_type: String
  resource_id: String
  ip_address: String
  user_agent: String
  metadata: String
  created_at: Int64
}

type AuditLogs {
  pagination: Pagination!
  audit_logs: [AuditLog!]!
}

type EmailTemplate {
  id: ID!
  event_name: String!
  template: String!
  design: String!
  subject: String!
  created_at: Int64
  updated_at: Int64
}

type EmailTemplates {
  pagination: Pagination!
  email_templates: [EmailTemplate!]!
}

input UpdateEnvRequest {
  ACCESS_TOKEN_EXPIRY_TIME: String
  ADMIN_SECRET: String
  CUSTOM_ACCESS_TOKEN_SCRIPT: String
  OLD_ADMIN_SECRET: String
  SMTP_HOST: String
  SMTP_PORT: String
  SMTP_USERNAME: String
  SMTP_PASSWORD: String
  SMTP_LOCAL_NAME: String
  SENDER_EMAIL: String
  SENDER_NAME: String
  JWT_TYPE: String
  JWT_SECRET: String
  JWT_PRIVATE_KEY: String
  JWT_PUBLIC_KEY: String
  ALLOWED_ORIGINS: [String!]
  APP_URL: String
  RESET_PASSWORD_URL: String
  APP_COOKIE_SECURE: Boolean
  ADMIN_COOKIE_SECURE: Boolean
  DISABLE_EMAIL_VERIFICATION: Boolean
  DISABLE_BASIC_AUTHENTICATION: Boolean
  DISABLE_MOBILE_BASIC_AUTHENTICATION: Boolean
  DISABLE_MAGIC_LINK_LOGIN: Boolean
  DISABLE_LOGIN_PAGE: Boolean
  DISABLE_SIGN_UP: Boolean
  DISABLE_REDIS_FOR_ENV: Boolean
  DISABLE_STRONG_PASSWORD: Boolean
  DISABLE_MULTI_FACTOR_AUTHENTICATION: Boolean
  ENFORCE_MULTI_FACTOR_AUTHENTICATION: Boolean
  ROLES: [String!]
  PROTECTED_ROLES: [String!]
  DEFAULT_ROLES: [String!]
  JWT_ROLE_CLAIM: String
  GOOGLE_CLIENT_ID: String
  GOOGLE_CLIENT_SECRET: String
  GITHUB_CLIENT_ID: String
  GITHUB_CLIENT_SECRET: String
  FACEBOOK_CLIENT_ID: String
  FACEBOOK_CLIENT_SECRET: String
  LINKEDIN_CLIENT_ID: String
  LINKEDIN_CLIENT_SECRET: String
  APPLE_CLIENT_ID: String
  APPLE_CLIENT_SECRET: String
  DISCORD_CLIENT_ID: String
  DISCORD_CLIENT_SECRET: String
  TWITTER_CLIENT_ID: String
  TWITTER_CLIENT_SECRET: String
  MICROSOFT_CLIENT_ID: String
  MICROSOFT_CLIENT_SECRET: String
  MICROSOFT_ACTIVE_DIRECTORY_TENANT_ID: String
  TWITCH_CLIENT_ID: String
  TWITCH_CLIENT_SECRET: String
  ROBLOX_CLIENT_ID: String
  ROBLOX_CLIENT_SECRET: String
  ORGANIZATION_NAME: String
  ORGANIZATION_LOGO: String
  DEFAULT_AUTHORIZE_RESPONSE_TYPE: String
  DEFAULT_AUTHORIZE_RESPONSE_MODE: String
  DISABLE_PLAYGROUND: Boolean
  DISABLE_MAIL_OTP_LOGIN: Boolean
  DISABLE_TOTP_LOGIN: Boolean
}

input AdminLoginRequest {
  admin_secret: String!
}

input AdminSignupRequest {
  admin_secret: String!
}

# Deprecated from v1.2.0
input MobileSignUpRequest {
  email: String
  given_name: String
  family_name: String
  middle_name: String
  nickname: String
  gender: String
  birthdate: String
  phone_number: String!
  picture: String
  password: String!
  confirm_password: String!
  roles: [String!]
  scope: [String!]
  redirect_uri: String
  is_multi_factor_auth_enabled: Boolean
  # state is used for authorization code grant flow
  # it is used to get code for an on-going auth process during login
  # and use that code for setting `c_hash` in id_token
  state: String
  app_data: Map
}

input SignUpRequest {
  email: String
  given_name: String
  family_name: String
  middle_name: String
  nickname: String
  gender: String
  birthdate: String
  phone_number: String
  picture: String
  password: String!
  confirm_password: String!
  roles: [String!]
  scope: [String!]
  redirect_uri: String
  is_multi_factor_auth_enabled: Boolean
  # state is used for authorization code grant flow
  # it is used to get code for an on-going auth process during login
  # and use that code for setting `c_hash` in id_token
  state: String
  app_data: Map
}

input LoginRequest {
  email: String
  phone_number: String
  password: String!
  roles: [String!]
  scope: [String!]
  # state is used for authorization code grant flow
  # it is used to get code for an on-going auth process during login
  # and use that code for setting `c_hash` in id_token
  state: String
}

# Deprecated from v1.2.0
input MobileLoginRequest {
  phone_number: String!
  password: String!
  roles: [String!]
  scope: [String!]
  # state is used for authorization code grant flow
  # it is used to get code for an on-going auth process during login
  # and use that code for setting `c_hash` in id_token
  state: String
}

input VerifyEmailRequest {
  token: String!
  # state is used for authorization code grant flow
  # it is used to get code for an on-going auth process during login
  # and use that code for setting `c_hash` in id_token
  state: String
}

input ResendVerifyEmailRequest {
  email: String!
  identifier: String!
  # state is used for authorization code grant flow
  # it is used to get code for an on-going auth process during login
  # and use that code for setting `c_hash` in id_token
  state: String
}

input UpdateProfileRequest {
  old_password: String
  new_password: String
  confirm_new_password: String
  email: String
  given_name: String
  family_name: String
  middle_name: String
  nickname: String
  gender: String
  birthdate: String
  phone_number: String
  picture: String
  is_multi_factor_auth_enabled: Boolean
  app_data: Map
}

input UpdateUserRequest {
  id: ID!
  email: String
  email_verified: Boolean
  given_name: String
  family_name: String
  middle_name: String
  nickname: String
  gender: String
  birthdate: String
  phone_number: String
  phone_number_verified: Boolean
  picture: String
  roles: [String]
  is_multi_factor_auth_enabled: Boolean
  app_data: Map
}

input ForgotPasswordRequest {
  email: String
  phone_number: String
  state: String
  redirect_uri: String
}

input ResetPasswordRequest {
  token: String
  otp: String
  phone_number: String
  password: String!
  confirm_password: String!
}

input DeleteUserRequest {
  email: String!
}

input MagicLinkLoginRequest {
  email: String!
  roles: [String!]
  scope: [String!]
  state: String
  redirect_uri: String
}

input SessionQueryRequest {
  roles: [String!]
  scope: [String!]
  # state is used for authorization code grant flow
  # when a session already exists and the login UI auto-detects it,
  # passing state ensures the authorization code state is properly stored
  state: String
  # required_relations gates the session on fine-grained authorization.
  # Each (relation, object) is checked against the authenticated caller with
  # AND semantics, fail-closed. Requires fine-grained authorization enabled (--fga-store).
  required_relations: [FgaRelationInput!]
}

input PaginationRequest {
  limit: Int64
  page: Int64
}

input PaginatedRequest {
  pagination: PaginationRequest
}

input OAuthRevokeRequest {
  refresh_token: String!
}

input InviteMemberRequest {
  emails: [String!]!
  redirect_uri: String
}

input UpdateAccessRequest {
  user_id: String!
}

input ValidateJWTTokenRequest {
  token_type: String!
  token: String!
  roles: [String!]
  # required_relations gates validation on fine-grained authorization.
  # AND semantics, fail-closed. Requires fine-grained authorization enabled (--fga-store).
  required_relations: [FgaRelationInput!]
}

input ValidateSessionRequest {
  cookie: String!
  roles: [String!]
  # required_relations gates validation on fine-grained authorization.
  # AND semantics, fail-closed. Requires fine-grained authorization enabled (--fga-store).
  required_relations: [FgaRelationInput!]
}

input GenerateJWTKeysRequest {
  type: String!
}

input ListWebhookLogRequest {
  pagination: PaginationRequest
  webhook_id: String
}

input ListAuditLogRequest {
  pagination: PaginationRequest
  action: String
  actor_id: String
  resource_type: String
  resource_id: String
  from_timestamp: Int64
  to_timestamp: Int64
}

input AddWebhookRequest {
  event_name: String!
  event_description: String
  endpoint: String!
  enabled: Boolean!
  headers: Map
}

input UpdateWebhookRequest {
  id: ID!
  event_name: String
  event_description: String
  endpoint: String
  enabled: Boolean
  headers: Map
}

input WebhookRequest {
  id: ID!
}

input CreateServiceAccountRequest {
  name: String!
  description: String
  # allowed_scopes MUST contain at least one non-empty scope after trimming.
  allowed_scopes: [String!]!
}

input UpdateServiceAccountRequest {
  id: ID!
  name: String
  description: String
  allowed_scopes: [String!]
  is_active: Boolean
}

input ServiceAccountRequest {
  id: ID!
}

input ListServiceAccountsRequest {
  pagination: PaginatedRequest
}

input AddTrustedIssuerRequest {
  service_account_id: String!
  name: String!
  issuer_url: String!
  # key_source_type: "oidc_discovery" | "static_jwks_url" | "spiffe_bundle_endpoint"
  key_source_type: String!
  jwks_url: String
  expected_aud: String!
  # subject_claim defaults to "sub" if omitted
  subject_claim: String
  # issuer_type: "kubernetes_sa" | "spiffe_jwt" | "oidc" | "cloud_oidc"
  issuer_type: String!
  spiffe_refresh_hint_seconds: Int64
}

input UpdateTrustedIssuerRequest {
  id: ID!
  name: String
  jwks_url: String
  expected_aud: String
  is_active: Boolean
  spiffe_refresh_hint_seconds: Int64
}

input TrustedIssuerRequest {
  id: ID!
}

input ListTrustedIssuersRequest {
  service_account_id: String
  pagination: PaginatedRequest
}

input TestEndpointRequest {
  endpoint: String!
  event_name: String!
  event_description: String
  headers: Map
}

input AddEmailTemplateRequest {
  event_name: String!
  subject: String!
  template: String!
  # Design value is set when editor is used
  # If raw HTML is used design value is set to null
  design: String
}

input UpdateEmailTemplateRequest {
  id: ID!
  event_name: String
  template: String
  subject: String
  # Design value is set when editor is used
  # If raw HTML is used design value is set to null
  design: String
}

input DeleteEmailTemplateRequest {
  id: ID!
}

input VerifyOTPRequest {
  # either email, phone_number or totp_token is required
  email: String
  phone_number: String
  otp: String!
  is_totp: Boolean
  # state is used for authorization code grant flow
  # it is used to get code for an on-going auth process during login
  # and use that code for setting `c_hash` in id_token
  state: String
}

input ResendOTPRequest {
  email: String
  phone_number: String
  # state is used for authorization code grant flow
  # it is used to get code for an on-going auth process during login
  # and use that code for setting `c_hash` in id_token
  state: String
}

input GetUserRequest {
  id: String
  email: String
}

# ---- Fine-grained authorization (FGA) inputs ----

# FgaTupleInput is a single relationship tuple supplied by an admin for write /
# delete / read operations.
input FgaTupleInput {
  user: String!
  relation: String!
  object: String!
}

# FgaWriteModelInput installs a new authorization model from its DSL form.
input FgaWriteModelInput {
  dsl: String!
}

# FgaWriteTuplesInput is used for both writing and deleting tuples.
input FgaWriteTuplesInput {
  tuples: [FgaTupleInput!]!
}

# FgaReadTuplesInput is a paginated, optionally-filtered tuple read. Any empty
# field acts as a wildcard for that position.
input FgaReadTuplesInput {
  user: String
  relation: String
  object: String
  page_size: Int64
  continuation_token: String
}

# PermissionCheckInput is one permission to evaluate: "does the subject have
# <relation> on <object>?". Contextual tuples are evaluated for this check only
# and never persisted.
input PermissionCheckInput {
  relation: String!
  object: String!
  contextual_tuples: [FgaTupleInput!]
}

# CheckPermissionsInput evaluates one or more permission checks in a single
# call. The subject defaults to the authenticated caller (JWT / session
# cookie). The optional `user` ("type:id", or a bare id treated as
# "user:<id>") is honored only when the caller is a super-admin OR it equals
# the caller's own token subject; anything else is rejected — never silently
# ignored.
input CheckPermissionsInput {
  checks: [PermissionCheckInput!]!
  user: String
}

# ListPermissionsInput enumerates what the subject can access. With both
# `relation` and `object_type` set it answers "which <object_type>s can I
# <relation>?". Either or both filters may be omitted: every matching
# (type, relation) pair of the active model is then enumerated, so an empty
# input returns ALL permissions the subject holds. Subject resolution follows
# the same rules as CheckPermissionsInput.user.
input ListPermissionsInput {
  relation: String
  object_type: String
  user: String
}

# FgaListUsersInput asks "which users of user_type have relation on object?".
# Admin-only (reveals the access graph).
input FgaListUsersInput {
  object: String!
  relation: String!
  user_type: String!
}

# FgaExpandInput asks for the relationship/userset tree of (relation, object).
# Admin-only (reveals the access graph).
input FgaExpandInput {
  relation: String!
  object: String!
}

# FgaRelationInput is a (relation, object) requirement evaluated against the
# authenticated caller during session/validate. AND semantics, fail-closed.
input FgaRelationInput {
  relation: String!
  object: String!
}

type Mutation {
  signup(params: SignUpRequest!): AuthResponse!
  # Deprecated from v1.2.0
  mobile_signup(params: MobileSignUpRequest): AuthResponse!
  login(params: LoginRequest!): AuthResponse!
  # Deprecated from v1.2.0
  mobile_login(params: MobileLoginRequest!): AuthResponse!
  magic_link_login(params: MagicLinkLoginRequest!): Response!
  logout: Response!
  update_profile(params: UpdateProfileRequest!): Response!
  verify_email(params: VerifyEmailRequest!): AuthResponse!
  resend_verify_email(params: ResendVerifyEmailRequest!): Response!
  forgot_password(params: ForgotPasswordRequest!): ForgotPasswordResponse!
  reset_password(params: ResetPasswordRequest!): Response!
  revoke(params: OAuthRevokeRequest!): Response!
  verify_otp(params: VerifyOTPRequest!): AuthResponse!
  resend_otp(params: ResendOTPRequest!): Response!
  deactivate_account: Response!
  # admin only apis
  _delete_user(params: DeleteUserRequest!): Response!
  _update_user(params: UpdateUserRequest!): User!
  # deprecated from v2.0.0
  _admin_signup(params: AdminSignupRequest!): Response!
  _admin_login(params: AdminLoginRequest!): Response!
  _admin_logout: Response!
  # Deprecated from v2.0.0
  _update_env(params: UpdateEnvRequest!): Response!
  _invite_members(params: InviteMemberRequest!): InviteMembersResponse!
  _revoke_access(param: UpdateAccessRequest!): Response!
  _enable_access(param: UpdateAccessRequest!): Response!
  # Deprecated from v2.0.0
  _generate_jwt_keys(params: GenerateJWTKeysRequest!): GenerateJWTKeysResponse!
  _add_webhook(params: AddWebhookRequest!): Response!
  _update_webhook(params: UpdateWebhookRequest!): Response!
  _delete_webhook(params: WebhookRequest!): Response!
  # Service accounts (machine/workload identity)
  _create_service_account(params: CreateServiceAccountRequest!): CreateServiceAccountResponse!
  _update_service_account(params: UpdateServiceAccountRequest!): ServiceAccount!
  _delete_service_account(params: ServiceAccountRequest!): Response!
  _rotate_service_account_secret(params: ServiceAccountRequest!): CreateServiceAccountResponse!
  # Trusted issuers (external JWT issuers bound to a service account)
  _add_trusted_issuer(params: AddTrustedIssuerRequest!): TrustedIssuer!
  _update_trusted_issuer(params: UpdateTrustedIssuerRequest!): TrustedIssuer!
  _delete_trusted_issuer(params: TrustedIssuerRequest!): Response!
  _test_endpoint(params: TestEndpointRequest!): TestEndpointResponse!
  _add_email_template(params: AddEmailTemplateRequest!): Response!
  _update_email_template(params: UpdateEmailTemplateRequest!): Response!
  _delete_email_template(params: DeleteEmailTemplateRequest!): Response!
  # FGA admin mutations (super-admin only)
  _fga_write_model(params: FgaWriteModelInput!): FgaModel!
  _fga_write_tuples(params: FgaWriteTuplesInput!): Response!
  _fga_delete_tuples(params: FgaWriteTuplesInput!): Response!
  _fga_reset: Response!
}

type Query {
  meta: Meta!
  session(params: SessionQueryRequest): AuthResponse!
  profile: User!
  validate_jwt_token(params: ValidateJWTTokenRequest!): ValidateJWTTokenResponse!
  validate_session(params: ValidateSessionRequest): ValidateSessionResponse!
  # admin only apis
  _users(params: PaginatedRequest): Users!
  _user(params: GetUserRequest!): User!
  _verification_requests(params: PaginatedRequest): VerificationRequests!
  _admin_session: Response!
  # Admin-only configuration metadata (e.g. configured roles). Non-deprecated
  # replacement for the bits of _env the dashboard needs.
  _admin_meta: AdminMeta!
  # Deprecated from v2.0.0
  _env: Env!
  _webhook(params: WebhookRequest!): Webhook!
  _webhooks(params: PaginatedRequest): Webhooks!
  _webhook_logs(params: ListWebhookLogRequest): WebhookLogs!
  # Service accounts (machine/workload identity)
  _service_account(params: ServiceAccountRequest!): ServiceAccount!
  _service_accounts(params: ListServiceAccountsRequest): ServiceAccounts!
  # Trusted issuers
  _trusted_issuer(params: TrustedIssuerRequest!): TrustedIssuer!
  _trusted_issuers(params: ListTrustedIssuersRequest): TrustedIssuers!
  _email_templates(params: PaginatedRequest): EmailTemplates!
  _audit_logs(params: ListAuditLogRequest): AuditLogs!
  # FGA admin queries (super-admin only)
  _fga_get_model: FgaModel!
  _fga_read_tuples(params: FgaReadTuplesInput!): FgaTuples!
  _fga_list_users(params: FgaListUsersInput!): FgaListUsersResponse!
  _fga_expand(params: FgaExpandInput!): FgaExpandResponse!
  # FGA runtime queries (authenticated caller; principal pinned server-side)
  check_permissions(params: CheckPermissionsInput!): CheckPermissionsResponse!
  list_permissions(params: ListPermissionsInput!): ListPermissionsResponse!
}