nominal-api 0.1239.0

use conjure_http::endpoint;
/// Authorization service manages the permissions for a user
/// to access resources.
#[conjure_http::conjure_endpoints(
    name = "AuthorizationService",
    use_legacy_error_serialization
)]
pub trait AuthorizationService {
    /// Given a set of resources, returns the set of resources that the
    /// user is authorized to access.
    #[endpoint(
        method = POST,
        path = "/authorization/v1/authorize",
        name = "authorize",
        produces = conjure_http::server::conjure::CollectionResponseSerializer
    )]
    fn authorize(
        &self,
        #[auth]
        auth_: conjure_object::BearerToken,
        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
        request: super::super::super::objects::authorization::AuthorizationRequest,
    ) -> Result<
        std::collections::BTreeSet<conjure_object::ResourceIdentifier>,
        conjure_http::private::Error,
    >;
    /// Given a set of resources, returns the workspace that each resource belongs to. If a user
    /// is not authorized on the resource, will omit the resource from the response.
    #[endpoint(
        method = POST,
        path = "/authorization/v1/batch-get-workspace-for-resource",
        name = "batchGetWorkspaceForResource",
        produces = conjure_http::server::conjure::CollectionResponseSerializer
    )]
    fn batch_get_workspace_for_resource(
        &self,
        #[auth]
        auth_: conjure_object::BearerToken,
        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
        request: std::collections::BTreeSet<conjure_object::ResourceIdentifier>,
    ) -> Result<
        std::collections::BTreeMap<
            conjure_object::ResourceIdentifier,
            super::super::super::objects::api::rids::WorkspaceRid,
        >,
        conjure_http::private::Error,
    >;
    /// Marks a set of resources as belonging to a workspace. Either all resources are
    /// registered or none are.
    /// If the user is not in the workspace, this will throw.
    /// If a resource already belongs to a different workspace, this will throw.
    /// If a resource already belongs to this workspace, this is a no-op.
    #[endpoint(
        method = POST,
        path = "/authorization/v1/register-in-workspace",
        name = "registerInWorkspace"
    )]
    fn register_in_workspace(
        &self,
        #[auth]
        auth_: conjure_object::BearerToken,
        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
        request: super::super::super::objects::authorization::RegisterInWorkspaceRequest,
    ) -> Result<(), conjure_http::private::Error>;
    /// Given an authenticated session, this endpoint returns a HTTP 204 if the
    /// authenticated user is an admin and HTTP 403 otherwise.
    #[endpoint(method = GET, path = "/authorization/v1/checkAdmin", name = "checkAdmin")]
    fn check_admin(
        &self,
        #[auth]
        auth_: conjure_object::BearerToken,
    ) -> Result<(), conjure_http::private::Error>;
    /// Checks if the email is allowed to register.
    #[endpoint(
        method = POST,
        path = "/authorization/v1/is-email-allowed",
        name = "isEmailAllowed",
        produces = conjure_http::server::StdResponseSerializer
    )]
    fn is_email_allowed(
        &self,
        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
        request: super::super::super::objects::authorization::IsEmailAllowedRequest,
    ) -> Result<
        super::super::super::objects::authorization::IsEmailAllowedResponse,
        conjure_http::private::Error,
    >;
    /// Checks if the email is allowed to register, following Okta "registration inline hook" API.
    #[endpoint(
        method = POST,
        path = "/authorization/v1/is-email-allowed-okta",
        name = "isEmailAllowedOkta",
        produces = conjure_http::server::StdResponseSerializer
    )]
    fn is_email_allowed_okta(
        &self,
        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
        request: super::super::super::objects::authorization::OktaRegistrationRequest,
    ) -> Result<
        super::super::super::objects::authorization::OktaRegistrationResponse,
        conjure_http::private::Error,
    >;
    /// Provides an OIDC ID token to get the orgs that the user is a member of. Throws NotAuthorized if the ID token
    /// is invalid or if the OIDC provider is not known.
    #[endpoint(
        method = POST,
        path = "/authorization/v1/user-orgs",
        name = "getUserOrgs",
        produces = conjure_http::server::StdResponseSerializer
    )]
    fn get_user_orgs(
        &self,
        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
        request: super::super::super::objects::authorization::GetUserOrgsRequest,
    ) -> Result<
        super::super::super::objects::authorization::GetUserOrgsResponse,
        conjure_http::private::Error,
    >;
    /// Provide an OIDC ID token to get a Nominal access token suitable for making API requests.
    /// Its expiry will match that of the input ID token, capped at 24h. TODO(MGMT-933): reduce this duration.
    /// Throws NotAuthorized if the ID token is invalid or if the OIDC provider is not known.
    #[endpoint(
        method = POST,
        path = "/authorization/v1/access-token",
        name = "getAccessToken",
        produces = conjure_http::server::StdResponseSerializer
    )]
    fn get_access_token(
        &self,
        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
        request: super::super::super::objects::authorization::GetAccessTokenRequest,
    ) -> Result<
        super::super::super::objects::authorization::GetAccessTokenResponse,
        conjure_http::private::Error,
    >;
    /// Given an authenticated session, provide an OIDC access token to get a Nominal access token suitable
    /// for making API requests. Its expiry will match that of the input access token, capped at 24h. TODO(MGMT-933):
    /// reduce this duration. Throws NotAuthorized if the access token is invalid or if the OIDC provider is not
    /// known.
    #[endpoint(
        method = POST,
        path = "/authorization/v1/refresh-access-token",
        name = "refreshAccessToken",
        produces = conjure_http::server::StdResponseSerializer
    )]
    fn refresh_access_token(
        &self,
        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
        request: super::super::super::objects::authorization::RefreshAccessTokenRequest,
    ) -> Result<
        super::super::super::objects::authorization::RefreshAccessTokenResponse,
        conjure_http::private::Error,
    >;
    /// Given an IDP issued id token, return the end session endpoint, accessed through the
    /// .well-known/openid-configuration endpoint.
    #[endpoint(
        method = POST,
        path = "/authorization/v1/get-idp-end-session-endpoint",
        name = "getIdpEndSessionEndpoint",
        produces = conjure_http::server::StdResponseSerializer
    )]
    fn get_idp_end_session_endpoint(
        &self,
        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
        request: super::super::super::objects::authorization::GetIdpEndSessionEndpointRequest,
    ) -> Result<
        super::super::super::objects::authorization::GetIdpEndSessionEndpointResponse,
        conjure_http::private::Error,
    >;
    /// Provide a long-lived API key for making API requests.
    /// The API key is irretrievable after initial creation.
    #[endpoint(
        method = POST,
        path = "/authorization/v1/api-key",
        name = "createApiKey",
        produces = conjure_http::server::StdResponseSerializer
    )]
    fn create_api_key(
        &self,
        #[auth]
        auth_: conjure_object::BearerToken,
        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
        request: super::super::super::objects::authorization::CreateApiKeyRequest,
    ) -> Result<
        super::super::super::objects::authorization::CreateApiKeyResponse,
        conjure_http::private::Error,
    >;
    /// List all API keys in the organization.
    #[endpoint(
        method = POST,
        path = "/authorization/v1/api-keys/org",
        name = "listApiKeysInOrg",
        produces = conjure_http::server::StdResponseSerializer
    )]
    fn list_api_keys_in_org(
        &self,
        #[auth]
        auth_: conjure_object::BearerToken,
        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
        request: super::super::super::objects::authorization::ListApiKeyRequest,
    ) -> Result<
        super::super::super::objects::authorization::ListApiKeyResponse,
        conjure_http::private::Error,
    >;
    /// List all API keys for the user.
    #[endpoint(
        method = POST,
        path = "/authorization/v1/api-keys/user",
        name = "listUserApiKeys",
        produces = conjure_http::server::StdResponseSerializer
    )]
    fn list_user_api_keys(
        &self,
        #[auth]
        auth_: conjure_object::BearerToken,
        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
        request: super::super::super::objects::authorization::ListApiKeyRequest,
    ) -> Result<
        super::super::super::objects::authorization::ListApiKeyResponse,
        conjure_http::private::Error,
    >;
    /// Delete an API key.
    #[endpoint(
        method = PUT,
        path = "/authorization/v1/api-key/{rid}/delete",
        name = "revokeApiKey"
    )]
    fn revoke_api_key(
        &self,
        #[auth]
        auth_: conjure_object::BearerToken,
        #[path(
            name = "rid",
            decoder = conjure_http::server::conjure::FromPlainDecoder,
            safe
        )]
        rid: super::super::super::objects::authorization::ApiKeyRid,
    ) -> Result<(), conjure_http::private::Error>;
}
/// Authorization service manages the permissions for a user
/// to access resources.
#[conjure_http::conjure_endpoints(
    name = "AuthorizationService",
    use_legacy_error_serialization
)]
pub trait AsyncAuthorizationService {
    /// Given a set of resources, returns the set of resources that the
    /// user is authorized to access.
    #[endpoint(
        method = POST,
        path = "/authorization/v1/authorize",
        name = "authorize",
        produces = conjure_http::server::conjure::CollectionResponseSerializer
    )]
    async fn authorize(
        &self,
        #[auth]
        auth_: conjure_object::BearerToken,
        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
        request: super::super::super::objects::authorization::AuthorizationRequest,
    ) -> Result<
        std::collections::BTreeSet<conjure_object::ResourceIdentifier>,
        conjure_http::private::Error,
    >;
    /// Given a set of resources, returns the workspace that each resource belongs to. If a user
    /// is not authorized on the resource, will omit the resource from the response.
    #[endpoint(
        method = POST,
        path = "/authorization/v1/batch-get-workspace-for-resource",
        name = "batchGetWorkspaceForResource",
        produces = conjure_http::server::conjure::CollectionResponseSerializer
    )]
    async fn batch_get_workspace_for_resource(
        &self,
        #[auth]
        auth_: conjure_object::BearerToken,
        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
        request: std::collections::BTreeSet<conjure_object::ResourceIdentifier>,
    ) -> Result<
        std::collections::BTreeMap<
            conjure_object::ResourceIdentifier,
            super::super::super::objects::api::rids::WorkspaceRid,
        >,
        conjure_http::private::Error,
    >;
    /// Marks a set of resources as belonging to a workspace. Either all resources are
    /// registered or none are.
    /// If the user is not in the workspace, this will throw.
    /// If a resource already belongs to a different workspace, this will throw.
    /// If a resource already belongs to this workspace, this is a no-op.
    #[endpoint(
        method = POST,
        path = "/authorization/v1/register-in-workspace",
        name = "registerInWorkspace"
    )]
    async fn register_in_workspace(
        &self,
        #[auth]
        auth_: conjure_object::BearerToken,
        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
        request: super::super::super::objects::authorization::RegisterInWorkspaceRequest,
    ) -> Result<(), conjure_http::private::Error>;
    /// Given an authenticated session, this endpoint returns a HTTP 204 if the
    /// authenticated user is an admin and HTTP 403 otherwise.
    #[endpoint(method = GET, path = "/authorization/v1/checkAdmin", name = "checkAdmin")]
    async fn check_admin(
        &self,
        #[auth]
        auth_: conjure_object::BearerToken,
    ) -> Result<(), conjure_http::private::Error>;
    /// Checks if the email is allowed to register.
    #[endpoint(
        method = POST,
        path = "/authorization/v1/is-email-allowed",
        name = "isEmailAllowed",
        produces = conjure_http::server::StdResponseSerializer
    )]
    async fn is_email_allowed(
        &self,
        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
        request: super::super::super::objects::authorization::IsEmailAllowedRequest,
    ) -> Result<
        super::super::super::objects::authorization::IsEmailAllowedResponse,
        conjure_http::private::Error,
    >;
    /// Checks if the email is allowed to register, following Okta "registration inline hook" API.
    #[endpoint(
        method = POST,
        path = "/authorization/v1/is-email-allowed-okta",
        name = "isEmailAllowedOkta",
        produces = conjure_http::server::StdResponseSerializer
    )]
    async fn is_email_allowed_okta(
        &self,
        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
        request: super::super::super::objects::authorization::OktaRegistrationRequest,
    ) -> Result<
        super::super::super::objects::authorization::OktaRegistrationResponse,
        conjure_http::private::Error,
    >;
    /// Provides an OIDC ID token to get the orgs that the user is a member of. Throws NotAuthorized if the ID token
    /// is invalid or if the OIDC provider is not known.
    #[endpoint(
        method = POST,
        path = "/authorization/v1/user-orgs",
        name = "getUserOrgs",
        produces = conjure_http::server::StdResponseSerializer
    )]
    async fn get_user_orgs(
        &self,
        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
        request: super::super::super::objects::authorization::GetUserOrgsRequest,
    ) -> Result<
        super::super::super::objects::authorization::GetUserOrgsResponse,
        conjure_http::private::Error,
    >;
    /// Provide an OIDC ID token to get a Nominal access token suitable for making API requests.
    /// Its expiry will match that of the input ID token, capped at 24h. TODO(MGMT-933): reduce this duration.
    /// Throws NotAuthorized if the ID token is invalid or if the OIDC provider is not known.
    #[endpoint(
        method = POST,
        path = "/authorization/v1/access-token",
        name = "getAccessToken",
        produces = conjure_http::server::StdResponseSerializer
    )]
    async fn get_access_token(
        &self,
        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
        request: super::super::super::objects::authorization::GetAccessTokenRequest,
    ) -> Result<
        super::super::super::objects::authorization::GetAccessTokenResponse,
        conjure_http::private::Error,
    >;
    /// Given an authenticated session, provide an OIDC access token to get a Nominal access token suitable
    /// for making API requests. Its expiry will match that of the input access token, capped at 24h. TODO(MGMT-933):
    /// reduce this duration. Throws NotAuthorized if the access token is invalid or if the OIDC provider is not
    /// known.
    #[endpoint(
        method = POST,
        path = "/authorization/v1/refresh-access-token",
        name = "refreshAccessToken",
        produces = conjure_http::server::StdResponseSerializer
    )]
    async fn refresh_access_token(
        &self,
        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
        request: super::super::super::objects::authorization::RefreshAccessTokenRequest,
    ) -> Result<
        super::super::super::objects::authorization::RefreshAccessTokenResponse,
        conjure_http::private::Error,
    >;
    /// Given an IDP issued id token, return the end session endpoint, accessed through the
    /// .well-known/openid-configuration endpoint.
    #[endpoint(
        method = POST,
        path = "/authorization/v1/get-idp-end-session-endpoint",
        name = "getIdpEndSessionEndpoint",
        produces = conjure_http::server::StdResponseSerializer
    )]
    async fn get_idp_end_session_endpoint(
        &self,
        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
        request: super::super::super::objects::authorization::GetIdpEndSessionEndpointRequest,
    ) -> Result<
        super::super::super::objects::authorization::GetIdpEndSessionEndpointResponse,
        conjure_http::private::Error,
    >;
    /// Provide a long-lived API key for making API requests.
    /// The API key is irretrievable after initial creation.
    #[endpoint(
        method = POST,
        path = "/authorization/v1/api-key",
        name = "createApiKey",
        produces = conjure_http::server::StdResponseSerializer
    )]
    async fn create_api_key(
        &self,
        #[auth]
        auth_: conjure_object::BearerToken,
        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
        request: super::super::super::objects::authorization::CreateApiKeyRequest,
    ) -> Result<
        super::super::super::objects::authorization::CreateApiKeyResponse,
        conjure_http::private::Error,
    >;
    /// List all API keys in the organization.
    #[endpoint(
        method = POST,
        path = "/authorization/v1/api-keys/org",
        name = "listApiKeysInOrg",
        produces = conjure_http::server::StdResponseSerializer
    )]
    async fn list_api_keys_in_org(
        &self,
        #[auth]
        auth_: conjure_object::BearerToken,
        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
        request: super::super::super::objects::authorization::ListApiKeyRequest,
    ) -> Result<
        super::super::super::objects::authorization::ListApiKeyResponse,
        conjure_http::private::Error,
    >;
    /// List all API keys for the user.
    #[endpoint(
        method = POST,
        path = "/authorization/v1/api-keys/user",
        name = "listUserApiKeys",
        produces = conjure_http::server::StdResponseSerializer
    )]
    async fn list_user_api_keys(
        &self,
        #[auth]
        auth_: conjure_object::BearerToken,
        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
        request: super::super::super::objects::authorization::ListApiKeyRequest,
    ) -> Result<
        super::super::super::objects::authorization::ListApiKeyResponse,
        conjure_http::private::Error,
    >;
    /// Delete an API key.
    #[endpoint(
        method = PUT,
        path = "/authorization/v1/api-key/{rid}/delete",
        name = "revokeApiKey"
    )]
    async fn revoke_api_key(
        &self,
        #[auth]
        auth_: conjure_object::BearerToken,
        #[path(
            name = "rid",
            decoder = conjure_http::server::conjure::FromPlainDecoder,
            safe
        )]
        rid: super::super::super::objects::authorization::ApiKeyRid,
    ) -> Result<(), conjure_http::private::Error>;
}
/// Authorization service manages the permissions for a user
/// to access resources.
#[conjure_http::conjure_endpoints(
    name = "AuthorizationService",
    use_legacy_error_serialization,
    local
)]
pub trait LocalAsyncAuthorizationService {
    /// Given a set of resources, returns the set of resources that the
    /// user is authorized to access.
    #[endpoint(
        method = POST,
        path = "/authorization/v1/authorize",
        name = "authorize",
        produces = conjure_http::server::conjure::CollectionResponseSerializer
    )]
    async fn authorize(
        &self,
        #[auth]
        auth_: conjure_object::BearerToken,
        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
        request: super::super::super::objects::authorization::AuthorizationRequest,
    ) -> Result<
        std::collections::BTreeSet<conjure_object::ResourceIdentifier>,
        conjure_http::private::Error,
    >;
    /// Given a set of resources, returns the workspace that each resource belongs to. If a user
    /// is not authorized on the resource, will omit the resource from the response.
    #[endpoint(
        method = POST,
        path = "/authorization/v1/batch-get-workspace-for-resource",
        name = "batchGetWorkspaceForResource",
        produces = conjure_http::server::conjure::CollectionResponseSerializer
    )]
    async fn batch_get_workspace_for_resource(
        &self,
        #[auth]
        auth_: conjure_object::BearerToken,
        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
        request: std::collections::BTreeSet<conjure_object::ResourceIdentifier>,
    ) -> Result<
        std::collections::BTreeMap<
            conjure_object::ResourceIdentifier,
            super::super::super::objects::api::rids::WorkspaceRid,
        >,
        conjure_http::private::Error,
    >;
    /// Marks a set of resources as belonging to a workspace. Either all resources are
    /// registered or none are.
    /// If the user is not in the workspace, this will throw.
    /// If a resource already belongs to a different workspace, this will throw.
    /// If a resource already belongs to this workspace, this is a no-op.
    #[endpoint(
        method = POST,
        path = "/authorization/v1/register-in-workspace",
        name = "registerInWorkspace"
    )]
    async fn register_in_workspace(
        &self,
        #[auth]
        auth_: conjure_object::BearerToken,
        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
        request: super::super::super::objects::authorization::RegisterInWorkspaceRequest,
    ) -> Result<(), conjure_http::private::Error>;
    /// Given an authenticated session, this endpoint returns a HTTP 204 if the
    /// authenticated user is an admin and HTTP 403 otherwise.
    #[endpoint(method = GET, path = "/authorization/v1/checkAdmin", name = "checkAdmin")]
    async fn check_admin(
        &self,
        #[auth]
        auth_: conjure_object::BearerToken,
    ) -> Result<(), conjure_http::private::Error>;
    /// Checks if the email is allowed to register.
    #[endpoint(
        method = POST,
        path = "/authorization/v1/is-email-allowed",
        name = "isEmailAllowed",
        produces = conjure_http::server::StdResponseSerializer
    )]
    async fn is_email_allowed(
        &self,
        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
        request: super::super::super::objects::authorization::IsEmailAllowedRequest,
    ) -> Result<
        super::super::super::objects::authorization::IsEmailAllowedResponse,
        conjure_http::private::Error,
    >;
    /// Checks if the email is allowed to register, following Okta "registration inline hook" API.
    #[endpoint(
        method = POST,
        path = "/authorization/v1/is-email-allowed-okta",
        name = "isEmailAllowedOkta",
        produces = conjure_http::server::StdResponseSerializer
    )]
    async fn is_email_allowed_okta(
        &self,
        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
        request: super::super::super::objects::authorization::OktaRegistrationRequest,
    ) -> Result<
        super::super::super::objects::authorization::OktaRegistrationResponse,
        conjure_http::private::Error,
    >;
    /// Provides an OIDC ID token to get the orgs that the user is a member of. Throws NotAuthorized if the ID token
    /// is invalid or if the OIDC provider is not known.
    #[endpoint(
        method = POST,
        path = "/authorization/v1/user-orgs",
        name = "getUserOrgs",
        produces = conjure_http::server::StdResponseSerializer
    )]
    async fn get_user_orgs(
        &self,
        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
        request: super::super::super::objects::authorization::GetUserOrgsRequest,
    ) -> Result<
        super::super::super::objects::authorization::GetUserOrgsResponse,
        conjure_http::private::Error,
    >;
    /// Provide an OIDC ID token to get a Nominal access token suitable for making API requests.
    /// Its expiry will match that of the input ID token, capped at 24h. TODO(MGMT-933): reduce this duration.
    /// Throws NotAuthorized if the ID token is invalid or if the OIDC provider is not known.
    #[endpoint(
        method = POST,
        path = "/authorization/v1/access-token",
        name = "getAccessToken",
        produces = conjure_http::server::StdResponseSerializer
    )]
    async fn get_access_token(
        &self,
        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
        request: super::super::super::objects::authorization::GetAccessTokenRequest,
    ) -> Result<
        super::super::super::objects::authorization::GetAccessTokenResponse,
        conjure_http::private::Error,
    >;
    /// Given an authenticated session, provide an OIDC access token to get a Nominal access token suitable
    /// for making API requests. Its expiry will match that of the input access token, capped at 24h. TODO(MGMT-933):
    /// reduce this duration. Throws NotAuthorized if the access token is invalid or if the OIDC provider is not
    /// known.
    #[endpoint(
        method = POST,
        path = "/authorization/v1/refresh-access-token",
        name = "refreshAccessToken",
        produces = conjure_http::server::StdResponseSerializer
    )]
    async fn refresh_access_token(
        &self,
        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
        request: super::super::super::objects::authorization::RefreshAccessTokenRequest,
    ) -> Result<
        super::super::super::objects::authorization::RefreshAccessTokenResponse,
        conjure_http::private::Error,
    >;
    /// Given an IDP issued id token, return the end session endpoint, accessed through the
    /// .well-known/openid-configuration endpoint.
    #[endpoint(
        method = POST,
        path = "/authorization/v1/get-idp-end-session-endpoint",
        name = "getIdpEndSessionEndpoint",
        produces = conjure_http::server::StdResponseSerializer
    )]
    async fn get_idp_end_session_endpoint(
        &self,
        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
        request: super::super::super::objects::authorization::GetIdpEndSessionEndpointRequest,
    ) -> Result<
        super::super::super::objects::authorization::GetIdpEndSessionEndpointResponse,
        conjure_http::private::Error,
    >;
    /// Provide a long-lived API key for making API requests.
    /// The API key is irretrievable after initial creation.
    #[endpoint(
        method = POST,
        path = "/authorization/v1/api-key",
        name = "createApiKey",
        produces = conjure_http::server::StdResponseSerializer
    )]
    async fn create_api_key(
        &self,
        #[auth]
        auth_: conjure_object::BearerToken,
        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
        request: super::super::super::objects::authorization::CreateApiKeyRequest,
    ) -> Result<
        super::super::super::objects::authorization::CreateApiKeyResponse,
        conjure_http::private::Error,
    >;
    /// List all API keys in the organization.
    #[endpoint(
        method = POST,
        path = "/authorization/v1/api-keys/org",
        name = "listApiKeysInOrg",
        produces = conjure_http::server::StdResponseSerializer
    )]
    async fn list_api_keys_in_org(
        &self,
        #[auth]
        auth_: conjure_object::BearerToken,
        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
        request: super::super::super::objects::authorization::ListApiKeyRequest,
    ) -> Result<
        super::super::super::objects::authorization::ListApiKeyResponse,
        conjure_http::private::Error,
    >;
    /// List all API keys for the user.
    #[endpoint(
        method = POST,
        path = "/authorization/v1/api-keys/user",
        name = "listUserApiKeys",
        produces = conjure_http::server::StdResponseSerializer
    )]
    async fn list_user_api_keys(
        &self,
        #[auth]
        auth_: conjure_object::BearerToken,
        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
        request: super::super::super::objects::authorization::ListApiKeyRequest,
    ) -> Result<
        super::super::super::objects::authorization::ListApiKeyResponse,
        conjure_http::private::Error,
    >;
    /// Delete an API key.
    #[endpoint(
        method = PUT,
        path = "/authorization/v1/api-key/{rid}/delete",
        name = "revokeApiKey"
    )]
    async fn revoke_api_key(
        &self,
        #[auth]
        auth_: conjure_object::BearerToken,
        #[path(
            name = "rid",
            decoder = conjure_http::server::conjure::FromPlainDecoder,
            safe
        )]
        rid: super::super::super::objects::authorization::ApiKeyRid,
    ) -> Result<(), conjure_http::private::Error>;
}