diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 92182d3..69d849f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -21,10 +21,10 @@ jobs:
     runs-on: ${{ github.repository == 'stainless-sdks/keycard-api-python' && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
     if: (github.event_name == 'push' || github.event.pull_request.head.repo.fork) && (github.event_name != 'push' || github.event.head_commit.message != 'codegen metadata')
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
         with:
           version: '0.10.2'
 
@@ -43,10 +43,10 @@ jobs:
       id-token: write
     runs-on: ${{ github.repository == 'stainless-sdks/keycard-api-python' && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
         with:
           version: '0.10.2'
 
@@ -61,7 +61,7 @@ jobs:
           github.repository == 'stainless-sdks/keycard-api-python' &&
           !startsWith(github.ref, 'refs/heads/stl/')
         id: github-oidc
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: core.setOutput('github_token', await core.getIDToken());
 
@@ -81,10 +81,10 @@ jobs:
     runs-on: ${{ github.repository == 'stainless-sdks/keycard-api-python' && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
     if: github.event_name == 'push' || github.event.pull_request.head.repo.fork
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
         with:
           version: '0.10.2'
 
diff --git a/.github/workflows/publish-pypi.yml b/.github/workflows/publish-pypi.yml
index 38e459f..7de0ca0 100644
--- a/.github/workflows/publish-pypi.yml
+++ b/.github/workflows/publish-pypi.yml
@@ -14,10 +14,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
         with:
           version: '0.9.13'
 
diff --git a/.github/workflows/release-doctor.yml b/.github/workflows/release-doctor.yml
index dcd9b97..bae7f6d 100644
--- a/.github/workflows/release-doctor.yml
+++ b/.github/workflows/release-doctor.yml
@@ -12,7 +12,7 @@ jobs:
     if: github.repository == 'keycardai/keycard-python' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || startsWith(github.head_ref, 'release-please') || github.head_ref == 'next')
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Check release environment
         run: |
diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index 091cfb1..f7014c3 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "0.10.0"
+  ".": "0.11.0"
 }
\ No newline at end of file
diff --git a/.stats.yml b/.stats.yml
index 9cf88bb..d9f05c9 100644
--- a/.stats.yml
+++ b/.stats.yml
@@ -1,4 +1,4 @@
 configured_endpoints: 106
-openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/keycard/keycard-api-d976147b1bc79d44e82107b943099bc750c9b7d101e91bf1ea53b91a6b74e8a6.yml
-openapi_spec_hash: d2953fdcb3490866c4bef3ec7a8300bb
-config_hash: 62b00ad8d94230c7c9b8ed142c7dcfc8
+openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/keycard/keycard-api-98bb06a2aca1b7ea066960a14eb4879aa4967bc4ed9686b66e60438824ce8415.yml
+openapi_spec_hash: b7bdac3288a2e626465c0baf6df49c17
+config_hash: b0ee2dc67cc490e45f8fe0acabd76206
diff --git a/CHANGELOG.md b/CHANGELOG.md
index f01f6c4..b54ceb4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,20 @@
 # Changelog
 
+## 0.11.0 (2026-05-15)
+
+Full Changelog: [v0.10.0...v0.11.0](https://github.com/keycardai/keycard-python/compare/v0.10.0...v0.11.0)
+
+### Features
+
+* **ACC-277:** list policy versions pinned by a policy-set draft ([1098f3d](https://github.com/keycardai/keycard-python/commit/1098f3dc1da65c5ecc00c7e132bd8c7b8e8bc4fc))
+* accept ID Zone platform principals in management API ([1e3311e](https://github.com/keycardai/keycard-python/commit/1e3311ed7a826618f9fe8a34c438e9cea81d5636))
+* add jwt_lifetime_seconds to resources ([090a5cd](https://github.com/keycardai/keycard-python/commit/090a5cd8c0f02bc29b29a74b525924fff94320a7))
+
+
+### Bug Fixes
+
+* housekeeping ([744a2af](https://github.com/keycardai/keycard-python/commit/744a2afd2465cc5c67ee665636f89675d0913192))
+
 ## 0.10.0 (2026-05-11)
 
 Full Changelog: [v0.9.1...v0.10.0](https://github.com/keycardai/keycard-python/compare/v0.9.1...v0.10.0)
diff --git a/pyproject.toml b/pyproject.toml
index cfc7ce1..bfa48fe 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "keycardai_api"
-version = "0.10.0"
+version = "0.11.0"
 description = "The official Python library for the keycard-api API"
 dynamic = ["readme"]
 license = "Apache-2.0"
diff --git a/src/keycardai_api/_version.py b/src/keycardai_api/_version.py
index d472cc7..fb2e193 100644
--- a/src/keycardai_api/_version.py
+++ b/src/keycardai_api/_version.py
@@ -1,4 +1,4 @@
 # File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
 
 __title__ = "keycardai_api"
-__version__ = "0.10.0"  # x-release-please-version
+__version__ = "0.11.0"  # x-release-please-version
diff --git a/src/keycardai_api/resources/zones/resources.py b/src/keycardai_api/resources/zones/resources.py
index 47e8ad6..2941cfe 100644
--- a/src/keycardai_api/resources/zones/resources.py
+++ b/src/keycardai_api/resources/zones/resources.py
@@ -59,6 +59,7 @@ def create(
         name: str,
         application_id: str | Omit = omit,
         application_type: Literal["native", "web"] | Omit = omit,
+        credential_lifetime_seconds: int | Omit = omit,
         credential_provider_id: str | Omit = omit,
         description: Optional[str] | Omit = omit,
         metadata: MetadataParam | Omit = omit,
@@ -88,6 +89,9 @@ def create(
               localhost URLs for redirect_uris or URIs with custom schemes. Web clients must
               use https URLs and must not use localhost as the hostname.
 
+          credential_lifetime_seconds: Credential lifetime override in seconds. When set, overrides the default
+              credential lifetime for this resource.
+
           credential_provider_id: ID of the credential provider to associate with the resource
 
           description: Human-readable description. Must not contain HTML tags (e.g. `<script>`,
@@ -119,6 +123,7 @@ def create(
                     "name": name,
                     "application_id": application_id,
                     "application_type": application_type,
+                    "credential_lifetime_seconds": credential_lifetime_seconds,
                     "credential_provider_id": credential_provider_id,
                     "description": description,
                     "metadata": metadata,
@@ -176,6 +181,7 @@ def update(
         zone_id: str,
         application_id: Optional[str] | Omit = omit,
         application_type: Literal["native", "web"] | Omit = omit,
+        credential_lifetime_seconds: Optional[int] | Omit = omit,
         credential_provider_id: Optional[str] | Omit = omit,
         description: Optional[str] | Omit = omit,
         identifier: str | Omit = omit,
@@ -200,6 +206,9 @@ def update(
               localhost URLs for redirect_uris or URIs with custom schemes. Web clients must
               use https URLs and must not use localhost as the hostname.
 
+          credential_lifetime_seconds: Credential lifetime override in seconds. Set to null to clear the override and
+              use the default.
+
           credential_provider_id: ID of the credential provider to associate with the resource (set to null to
               unset)
 
@@ -237,6 +246,7 @@ def update(
                 {
                     "application_id": application_id,
                     "application_type": application_type,
+                    "credential_lifetime_seconds": credential_lifetime_seconds,
                     "credential_provider_id": credential_provider_id,
                     "description": description,
                     "identifier": identifier,
@@ -384,6 +394,7 @@ async def create(
         name: str,
         application_id: str | Omit = omit,
         application_type: Literal["native", "web"] | Omit = omit,
+        credential_lifetime_seconds: int | Omit = omit,
         credential_provider_id: str | Omit = omit,
         description: Optional[str] | Omit = omit,
         metadata: MetadataParam | Omit = omit,
@@ -413,6 +424,9 @@ async def create(
               localhost URLs for redirect_uris or URIs with custom schemes. Web clients must
               use https URLs and must not use localhost as the hostname.
 
+          credential_lifetime_seconds: Credential lifetime override in seconds. When set, overrides the default
+              credential lifetime for this resource.
+
           credential_provider_id: ID of the credential provider to associate with the resource
 
           description: Human-readable description. Must not contain HTML tags (e.g. `<script>`,
@@ -444,6 +458,7 @@ async def create(
                     "name": name,
                     "application_id": application_id,
                     "application_type": application_type,
+                    "credential_lifetime_seconds": credential_lifetime_seconds,
                     "credential_provider_id": credential_provider_id,
                     "description": description,
                     "metadata": metadata,
@@ -501,6 +516,7 @@ async def update(
         zone_id: str,
         application_id: Optional[str] | Omit = omit,
         application_type: Literal["native", "web"] | Omit = omit,
+        credential_lifetime_seconds: Optional[int] | Omit = omit,
         credential_provider_id: Optional[str] | Omit = omit,
         description: Optional[str] | Omit = omit,
         identifier: str | Omit = omit,
@@ -525,6 +541,9 @@ async def update(
               localhost URLs for redirect_uris or URIs with custom schemes. Web clients must
               use https URLs and must not use localhost as the hostname.
 
+          credential_lifetime_seconds: Credential lifetime override in seconds. Set to null to clear the override and
+              use the default.
+
           credential_provider_id: ID of the credential provider to associate with the resource (set to null to
               unset)
 
@@ -562,6 +581,7 @@ async def update(
                 {
                     "application_id": application_id,
                     "application_type": application_type,
+                    "credential_lifetime_seconds": credential_lifetime_seconds,
                     "credential_provider_id": credential_provider_id,
                     "description": description,
                     "identifier": identifier,
diff --git a/src/keycardai_api/resources/zones/users.py b/src/keycardai_api/resources/zones/users.py
index 4edd9f4..f79e92f 100644
--- a/src/keycardai_api/resources/zones/users.py
+++ b/src/keycardai_api/resources/zones/users.py
@@ -7,7 +7,7 @@
 
 import httpx
 
-from ..._types import Body, Omit, Query, Headers, NotGiven, omit, not_given
+from ..._types import Body, Omit, Query, Headers, NotGiven, SequenceNotStr, omit, not_given
 from ..._utils import path_template, maybe_transform, async_maybe_transform
 from ..._compat import cached_property
 from ..._resource import SyncAPIResource, AsyncAPIResource
@@ -88,7 +88,13 @@ def list(
         after: str | Omit = omit,
         before: str | Omit = omit,
         expand: Union[Literal["total_count"], List[Literal["total_count"]]] | Omit = omit,
+        filter_email: Union[str, SequenceNotStr[str]] | Omit = omit,
+        filter_id: Union[str, SequenceNotStr[str]] | Omit = omit,
         limit: int | Omit = omit,
+        query: Union[str, SequenceNotStr[str]] | Omit = omit,
+        query_email: Union[str, SequenceNotStr[str]] | Omit = omit,
+        query_subject: Union[str, SequenceNotStr[str]] | Omit = omit,
+        sort: str | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
         # The extra values given here take precedence over values defined on the client or passed to this method.
         extra_headers: Headers | None = None,
@@ -96,17 +102,49 @@ def list(
         extra_body: Body | None = None,
         timeout: float | httpx.Timeout | None | NotGiven = not_given,
     ) -> UserListResponse:
-        """Returns a list of users in the specified zone.
-
-        Can be filtered by email address.
+        """
+        Returns a list of users in the specified zone.
+
+        **Rollout note:** the paginated/searchable/sortable behavior described below is
+        gated behind the `user-pagination` feature flag and is currently disabled for
+        most zones. While the flag is off, the response returns every user in the zone
+        (capped at 100) in `items` and a fixed pagination envelope where `after_cursor`
+        and `before_cursor` are `null` and `total_count` is `0`. The query parameters
+        below are accepted but ignored. The flag is rolled out per-zone in Datadog and
+        will become the default once Console adopts the paginated contract.
+
+        Use cursor pagination via `after`/`before`. Sort: comma-separated field list;
+        prefix with `-` for descending. Use `expand[]=total_count` to include the
+        matching row count. Filter by exact email via `filter[email]`; search via
+        `query[email]` / `query[subject]` / `query[]` (substring match, OR'd across
+        repeated values). `query[]` matches against email and federation credential
+        subject. Pass `filter[id]` (repeatable, max 100) to restrict results to a known
+        set of users — mutually exclusive with `after`/`before` (returns 400 if
+        combined). When `filter[id]` is set, `limit` is ignored and the response
+        contains every requested user that exists in the zone, in a single page. IDs not
+        in the zone are silently omitted.
 
         Args:
           after: Cursor for forward pagination
 
           before: Cursor for backward pagination
 
+          filter_email: Filter by exact email address
+
+          filter_id: Restrict results to users with this publicId. Repeatable, max 100. Mutually
+              exclusive with after/before.
+
           limit: Maximum number of items to return
 
+          query: Search across email and credential subject (substring match)
+
+          query_email: Search by email (substring match)
+
+          query_subject: Search by federated credential subject (substring match)
+
+          sort: Comma-separated sort fields. Prefix with - for descending. Allowed: created_at,
+              email, authenticated_at
+
           extra_headers: Send extra headers
 
           extra_query: Add additional query parameters to the request
@@ -129,7 +167,13 @@ def list(
                         "after": after,
                         "before": before,
                         "expand": expand,
+                        "filter_email": filter_email,
+                        "filter_id": filter_id,
                         "limit": limit,
+                        "query": query,
+                        "query_email": query_email,
+                        "query_subject": query_subject,
+                        "sort": sort,
                     },
                     user_list_params.UserListParams,
                 ),
@@ -201,7 +245,13 @@ async def list(
         after: str | Omit = omit,
         before: str | Omit = omit,
         expand: Union[Literal["total_count"], List[Literal["total_count"]]] | Omit = omit,
+        filter_email: Union[str, SequenceNotStr[str]] | Omit = omit,
+        filter_id: Union[str, SequenceNotStr[str]] | Omit = omit,
         limit: int | Omit = omit,
+        query: Union[str, SequenceNotStr[str]] | Omit = omit,
+        query_email: Union[str, SequenceNotStr[str]] | Omit = omit,
+        query_subject: Union[str, SequenceNotStr[str]] | Omit = omit,
+        sort: str | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
         # The extra values given here take precedence over values defined on the client or passed to this method.
         extra_headers: Headers | None = None,
@@ -209,17 +259,49 @@ async def list(
         extra_body: Body | None = None,
         timeout: float | httpx.Timeout | None | NotGiven = not_given,
     ) -> UserListResponse:
-        """Returns a list of users in the specified zone.
-
-        Can be filtered by email address.
+        """
+        Returns a list of users in the specified zone.
+
+        **Rollout note:** the paginated/searchable/sortable behavior described below is
+        gated behind the `user-pagination` feature flag and is currently disabled for
+        most zones. While the flag is off, the response returns every user in the zone
+        (capped at 100) in `items` and a fixed pagination envelope where `after_cursor`
+        and `before_cursor` are `null` and `total_count` is `0`. The query parameters
+        below are accepted but ignored. The flag is rolled out per-zone in Datadog and
+        will become the default once Console adopts the paginated contract.
+
+        Use cursor pagination via `after`/`before`. Sort: comma-separated field list;
+        prefix with `-` for descending. Use `expand[]=total_count` to include the
+        matching row count. Filter by exact email via `filter[email]`; search via
+        `query[email]` / `query[subject]` / `query[]` (substring match, OR'd across
+        repeated values). `query[]` matches against email and federation credential
+        subject. Pass `filter[id]` (repeatable, max 100) to restrict results to a known
+        set of users — mutually exclusive with `after`/`before` (returns 400 if
+        combined). When `filter[id]` is set, `limit` is ignored and the response
+        contains every requested user that exists in the zone, in a single page. IDs not
+        in the zone are silently omitted.
 
         Args:
           after: Cursor for forward pagination
 
           before: Cursor for backward pagination
 
+          filter_email: Filter by exact email address
+
+          filter_id: Restrict results to users with this publicId. Repeatable, max 100. Mutually
+              exclusive with after/before.
+
           limit: Maximum number of items to return
 
+          query: Search across email and credential subject (substring match)
+
+          query_email: Search by email (substring match)
+
+          query_subject: Search by federated credential subject (substring match)
+
+          sort: Comma-separated sort fields. Prefix with - for descending. Allowed: created_at,
+              email, authenticated_at
+
           extra_headers: Send extra headers
 
           extra_query: Add additional query parameters to the request
@@ -242,7 +324,13 @@ async def list(
                         "after": after,
                         "before": before,
                         "expand": expand,
+                        "filter_email": filter_email,
+                        "filter_id": filter_id,
                         "limit": limit,
+                        "query": query,
+                        "query_email": query_email,
+                        "query_subject": query_subject,
+                        "sort": sort,
                     },
                     user_list_params.UserListParams,
                 ),
diff --git a/src/keycardai_api/resources/zones/zones.py b/src/keycardai_api/resources/zones/zones.py
index ea5d152..fcbdb8a 100644
--- a/src/keycardai_api/resources/zones/zones.py
+++ b/src/keycardai_api/resources/zones/zones.py
@@ -232,7 +232,7 @@ def create(
         default_mcp_gateway_application: bool | Omit = omit,
         description: Optional[str] | Omit = omit,
         encryption_key: EncryptionKeyAwsKmsConfigParam | Omit = omit,
-        login_flow: Literal["default", "identifier_first"] | Omit = omit,
+        organization_id: str | Omit = omit,
         protocols: zone_create_params.Protocols | Omit = omit,
         requires_invitation: bool | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
@@ -259,8 +259,9 @@ def create(
           encryption_key: AWS KMS configuration for zone encryption. When not specified, the default
               Keycard Cloud encryption key will be used.
 
-          login_flow: Login flow style for the zone. 'default' uses standard authentication,
-              'identifier_first' uses identifier-based provider routing.
+          organization_id: Target organization ID. Required for platform principals (whose tokens carry no
+              organization claim); for organization-scoped principals it is optional and must
+              match the authenticated organization if supplied.
 
           protocols: Protocol configuration for zone creation
 
@@ -283,7 +284,7 @@ def create(
                     "default_mcp_gateway_application": default_mcp_gateway_application,
                     "description": description,
                     "encryption_key": encryption_key,
-                    "login_flow": login_flow,
+                    "organization_id": organization_id,
                     "protocols": protocols,
                     "requires_invitation": requires_invitation,
                 },
@@ -341,7 +342,6 @@ def update(
         default_resource_id: Optional[str] | Omit = omit,
         description: Optional[str] | Omit = omit,
         encryption_key: Optional[zone_update_params.EncryptionKey] | Omit = omit,
-        login_flow: Optional[Literal["default", "identifier_first"]] | Omit = omit,
         name: str | Omit = omit,
         protocols: Optional[zone_update_params.Protocols] | Omit = omit,
         requires_invitation: bool | Omit = omit,
@@ -369,10 +369,6 @@ def update(
           encryption_key: AWS KMS configuration for zone encryption update (set to null to remove
               customer-managed key and revert to default)
 
-          login_flow: Login flow style for the zone. 'default' uses standard authentication,
-              'identifier_first' uses identifier-based provider routing. Set to null to reset
-              to 'default'.
-
           name: Human-readable name. Must not contain HTML tags (e.g. `<script>`, `<div>`) or
               control characters.
 
@@ -401,7 +397,6 @@ def update(
                     "default_resource_id": default_resource_id,
                     "description": description,
                     "encryption_key": encryption_key,
-                    "login_flow": login_flow,
                     "name": name,
                     "protocols": protocols,
                     "requires_invitation": requires_invitation,
@@ -605,7 +600,7 @@ async def create(
         default_mcp_gateway_application: bool | Omit = omit,
         description: Optional[str] | Omit = omit,
         encryption_key: EncryptionKeyAwsKmsConfigParam | Omit = omit,
-        login_flow: Literal["default", "identifier_first"] | Omit = omit,
+        organization_id: str | Omit = omit,
         protocols: zone_create_params.Protocols | Omit = omit,
         requires_invitation: bool | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
@@ -632,8 +627,9 @@ async def create(
           encryption_key: AWS KMS configuration for zone encryption. When not specified, the default
               Keycard Cloud encryption key will be used.
 
-          login_flow: Login flow style for the zone. 'default' uses standard authentication,
-              'identifier_first' uses identifier-based provider routing.
+          organization_id: Target organization ID. Required for platform principals (whose tokens carry no
+              organization claim); for organization-scoped principals it is optional and must
+              match the authenticated organization if supplied.
 
           protocols: Protocol configuration for zone creation
 
@@ -656,7 +652,7 @@ async def create(
                     "default_mcp_gateway_application": default_mcp_gateway_application,
                     "description": description,
                     "encryption_key": encryption_key,
-                    "login_flow": login_flow,
+                    "organization_id": organization_id,
                     "protocols": protocols,
                     "requires_invitation": requires_invitation,
                 },
@@ -714,7 +710,6 @@ async def update(
         default_resource_id: Optional[str] | Omit = omit,
         description: Optional[str] | Omit = omit,
         encryption_key: Optional[zone_update_params.EncryptionKey] | Omit = omit,
-        login_flow: Optional[Literal["default", "identifier_first"]] | Omit = omit,
         name: str | Omit = omit,
         protocols: Optional[zone_update_params.Protocols] | Omit = omit,
         requires_invitation: bool | Omit = omit,
@@ -742,10 +737,6 @@ async def update(
           encryption_key: AWS KMS configuration for zone encryption update (set to null to remove
               customer-managed key and revert to default)
 
-          login_flow: Login flow style for the zone. 'default' uses standard authentication,
-              'identifier_first' uses identifier-based provider routing. Set to null to reset
-              to 'default'.
-
           name: Human-readable name. Must not contain HTML tags (e.g. `<script>`, `<div>`) or
               control characters.
 
@@ -774,7 +765,6 @@ async def update(
                     "default_resource_id": default_resource_id,
                     "description": description,
                     "encryption_key": encryption_key,
-                    "login_flow": login_flow,
                     "name": name,
                     "protocols": protocols,
                     "requires_invitation": requires_invitation,
diff --git a/src/keycardai_api/types/zone.py b/src/keycardai_api/types/zone.py
index 95e1c85..270623a 100644
--- a/src/keycardai_api/types/zone.py
+++ b/src/keycardai_api/types/zone.py
@@ -1,13 +1,28 @@
 # File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
 
-from typing import Dict, Optional
+from typing import Dict, List, Optional
 from datetime import datetime
-from typing_extensions import Literal
 
 from .._models import BaseModel
 from .encryption_key_aws_kms_config import EncryptionKeyAwsKmsConfig
 
-__all__ = ["Zone", "Protocols", "ProtocolsOauth2", "ProtocolsOpenid"]
+__all__ = ["Zone", "Protocols", "ProtocolsOauth2", "ProtocolsOauth2Cimd", "ProtocolsOpenid"]
+
+
+class ProtocolsOauth2Cimd(BaseModel):
+    """Client ID Metadata Document auto-provisioning configuration"""
+
+    allowed_client_ids: List[str]
+    """Allowlist for CIMD client_id URLs.
+
+    Each entry is an exact URL, a wildcard origin with a single _ replacing one
+    subdomain label (e.g. https://_.example.com matches https://app.example.com but
+    not https://a.b.example.com), or the literal _ to allow any client. Only one _
+    is permitted per entry.
+    """
+
+    enabled: bool
+    """Whether CIMD auto-provisioning is enabled for unregistered URL-based clients"""
 
 
 class ProtocolsOauth2(BaseModel):
@@ -22,6 +37,9 @@ class ProtocolsOauth2(BaseModel):
     (.well-known/oauth-authorization-server)
     """
 
+    cimd: ProtocolsOauth2Cimd
+    """Client ID Metadata Document auto-provisioning configuration"""
+
     dcr_enabled: bool
     """Whether Dynamic Client Registration is enabled"""
 
@@ -106,13 +124,6 @@ class Zone(BaseModel):
     When not specified, the default Keycard Cloud encryption key will be used.
     """
 
-    login_flow: Optional[Literal["default", "identifier_first"]] = None
-    """Login flow style for the zone.
-
-    'default' uses standard authentication, 'identifier_first' uses identifier-based
-    provider routing.
-    """
-
     permissions: Optional[Dict[str, Dict[str, bool]]] = None
     """Permissions granted to the authenticated principal.
 
diff --git a/src/keycardai_api/types/zone_create_params.py b/src/keycardai_api/types/zone_create_params.py
index 73dcfee..73b6526 100644
--- a/src/keycardai_api/types/zone_create_params.py
+++ b/src/keycardai_api/types/zone_create_params.py
@@ -3,11 +3,12 @@
 from __future__ import annotations
 
 from typing import Optional
-from typing_extensions import Literal, Required, TypedDict
+from typing_extensions import Required, TypedDict
 
+from .._types import SequenceNotStr
 from .encryption_key_aws_kms_config_param import EncryptionKeyAwsKmsConfigParam
 
-__all__ = ["ZoneCreateParams", "Protocols", "ProtocolsOauth2"]
+__all__ = ["ZoneCreateParams", "Protocols", "ProtocolsOauth2", "ProtocolsOauth2Cimd"]
 
 
 class ZoneCreateParams(TypedDict, total=False):
@@ -32,11 +33,12 @@ class ZoneCreateParams(TypedDict, total=False):
     When not specified, the default Keycard Cloud encryption key will be used.
     """
 
-    login_flow: Literal["default", "identifier_first"]
-    """Login flow style for the zone.
+    organization_id: str
+    """Target organization ID.
 
-    'default' uses standard authentication, 'identifier_first' uses identifier-based
-    provider routing.
+    Required for platform principals (whose tokens carry no organization claim); for
+    organization-scoped principals it is optional and must match the authenticated
+    organization if supplied.
     """
 
     protocols: Protocols
@@ -49,9 +51,28 @@ class ZoneCreateParams(TypedDict, total=False):
     """
 
 
+class ProtocolsOauth2Cimd(TypedDict, total=False):
+    """Client ID Metadata Document auto-provisioning configuration"""
+
+    allowed_client_ids: Required[SequenceNotStr[str]]
+    """Allowlist for CIMD client_id URLs.
+
+    Each entry is an exact URL, a wildcard origin with a single _ replacing one
+    subdomain label (e.g. https://_.example.com matches https://app.example.com but
+    not https://a.b.example.com), or the literal _ to allow any client. Only one _
+    is permitted per entry.
+    """
+
+    enabled: Required[bool]
+    """Whether CIMD auto-provisioning is enabled for unregistered URL-based clients"""
+
+
 class ProtocolsOauth2(TypedDict, total=False):
     """OAuth 2.0 protocol configuration for zone creation"""
 
+    cimd: ProtocolsOauth2Cimd
+    """Client ID Metadata Document auto-provisioning configuration"""
+
     dcr_enabled: bool
     """Whether Dynamic Client Registration is enabled"""
 
diff --git a/src/keycardai_api/types/zone_update_params.py b/src/keycardai_api/types/zone_update_params.py
index 2bbae9a..642f67f 100644
--- a/src/keycardai_api/types/zone_update_params.py
+++ b/src/keycardai_api/types/zone_update_params.py
@@ -5,7 +5,9 @@
 from typing import Optional
 from typing_extensions import Literal, Required, TypedDict
 
-__all__ = ["ZoneUpdateParams", "EncryptionKey", "Protocols", "ProtocolsOauth2"]
+from .._types import SequenceNotStr
+
+__all__ = ["ZoneUpdateParams", "EncryptionKey", "Protocols", "ProtocolsOauth2", "ProtocolsOauth2Cimd"]
 
 
 class ZoneUpdateParams(TypedDict, total=False):
@@ -33,13 +35,6 @@ class ZoneUpdateParams(TypedDict, total=False):
     customer-managed key and revert to default)
     """
 
-    login_flow: Optional[Literal["default", "identifier_first"]]
-    """Login flow style for the zone.
-
-    'default' uses standard authentication, 'identifier_first' uses identifier-based
-    provider routing. Set to null to reset to 'default'.
-    """
-
     name: str
     """Human-readable name.
 
@@ -70,9 +65,28 @@ class EncryptionKey(TypedDict, total=False):
     type: Required[Literal["aws"]]
 
 
+class ProtocolsOauth2Cimd(TypedDict, total=False):
+    """Client ID Metadata Document auto-provisioning configuration"""
+
+    allowed_client_ids: Required[SequenceNotStr[str]]
+    """Allowlist for CIMD client_id URLs.
+
+    Each entry is an exact URL, a wildcard origin with a single _ replacing one
+    subdomain label (e.g. https://_.example.com matches https://app.example.com but
+    not https://a.b.example.com), or the literal _ to allow any client. Only one _
+    is permitted per entry.
+    """
+
+    enabled: Required[bool]
+    """Whether CIMD auto-provisioning is enabled for unregistered URL-based clients"""
+
+
 class ProtocolsOauth2(TypedDict, total=False):
     """OAuth 2.0 protocol configuration update for a zone (partial update)"""
 
+    cimd: ProtocolsOauth2Cimd
+    """Client ID Metadata Document auto-provisioning configuration"""
+
     dcr_enabled: Optional[bool]
     """Whether Dynamic Client Registration is enabled"""
 
diff --git a/src/keycardai_api/types/zones/applications/resource.py b/src/keycardai_api/types/zones/applications/resource.py
index 8991db7..a53d8ba 100644
--- a/src/keycardai_api/types/zones/applications/resource.py
+++ b/src/keycardai_api/types/zones/applications/resource.py
@@ -71,6 +71,13 @@ class Resource(BaseModel):
     application_id: Optional[str] = None
     """ID of the application that provides this resource"""
 
+    credential_lifetime_seconds: Optional[int] = None
+    """Credential lifetime override in seconds.
+
+    When set, overrides the default credential lifetime for this resource. When
+    absent, the default from the provider or zone is used.
+    """
+
     credential_provider: Optional[Provider] = None
     """
     A Provider is a system that supplies access to Resources and allows actors
diff --git a/src/keycardai_api/types/zones/resource_create_params.py b/src/keycardai_api/types/zones/resource_create_params.py
index 9abc2d1..27453fd 100644
--- a/src/keycardai_api/types/zones/resource_create_params.py
+++ b/src/keycardai_api/types/zones/resource_create_params.py
@@ -35,6 +35,12 @@ class ResourceCreateParams(TypedDict, total=False):
     hostname.
     """
 
+    credential_lifetime_seconds: int
+    """Credential lifetime override in seconds.
+
+    When set, overrides the default credential lifetime for this resource.
+    """
+
     credential_provider_id: str
     """ID of the credential provider to associate with the resource"""
 
diff --git a/src/keycardai_api/types/zones/resource_update_params.py b/src/keycardai_api/types/zones/resource_update_params.py
index cedcae0..0e910d8 100644
--- a/src/keycardai_api/types/zones/resource_update_params.py
+++ b/src/keycardai_api/types/zones/resource_update_params.py
@@ -26,6 +26,12 @@ class ResourceUpdateParams(TypedDict, total=False):
     hostname.
     """
 
+    credential_lifetime_seconds: Optional[int]
+    """Credential lifetime override in seconds.
+
+    Set to null to clear the override and use the default.
+    """
+
     credential_provider_id: Optional[str]
     """
     ID of the credential provider to associate with the resource (set to null to
diff --git a/src/keycardai_api/types/zones/user_list_params.py b/src/keycardai_api/types/zones/user_list_params.py
index e66a4c7..5ef469f 100644
--- a/src/keycardai_api/types/zones/user_list_params.py
+++ b/src/keycardai_api/types/zones/user_list_params.py
@@ -5,6 +5,7 @@
 from typing import List, Union
 from typing_extensions import Literal, Annotated, TypedDict
 
+from ..._types import SequenceNotStr
 from ..._utils import PropertyInfo
 
 __all__ = ["UserListParams"]
@@ -19,5 +20,29 @@ class UserListParams(TypedDict, total=False):
 
     expand: Annotated[Union[Literal["total_count"], List[Literal["total_count"]]], PropertyInfo(alias="expand[]")]
 
+    filter_email: Annotated[Union[str, SequenceNotStr[str]], PropertyInfo(alias="filter[email]")]
+    """Filter by exact email address"""
+
+    filter_id: Annotated[Union[str, SequenceNotStr[str]], PropertyInfo(alias="filter[id]")]
+    """Restrict results to users with this publicId.
+
+    Repeatable, max 100. Mutually exclusive with after/before.
+    """
+
     limit: int
     """Maximum number of items to return"""
+
+    query: Annotated[Union[str, SequenceNotStr[str]], PropertyInfo(alias="query[]")]
+    """Search across email and credential subject (substring match)"""
+
+    query_email: Annotated[Union[str, SequenceNotStr[str]], PropertyInfo(alias="query[email]")]
+    """Search by email (substring match)"""
+
+    query_subject: Annotated[Union[str, SequenceNotStr[str]], PropertyInfo(alias="query[subject]")]
+    """Search by federated credential subject (substring match)"""
+
+    sort: str
+    """Comma-separated sort fields.
+
+    Prefix with - for descending. Allowed: created_at, email, authenticated_at
+    """
diff --git a/tests/api_resources/test_zones.py b/tests/api_resources/test_zones.py
index 9d6cb07..4d8d51d 100644
--- a/tests/api_resources/test_zones.py
+++ b/tests/api_resources/test_zones.py
@@ -39,9 +39,13 @@ def test_method_create_with_all_params(self, client: KeycardAPI) -> None:
                 "arn": "x",
                 "type": "aws",
             },
-            login_flow="default",
+            organization_id="organization_id",
             protocols={
                 "oauth2": {
+                    "cimd": {
+                        "allowed_client_ids": ["string"],
+                        "enabled": True,
+                    },
                     "dcr_enabled": True,
                     "pkce_required": True,
                 }
@@ -147,10 +151,13 @@ def test_method_update_with_all_params(self, client: KeycardAPI) -> None:
                 "arn": "x",
                 "type": "aws",
             },
-            login_flow="default",
             name="x",
             protocols={
                 "oauth2": {
+                    "cimd": {
+                        "allowed_client_ids": ["string"],
+                        "enabled": True,
+                    },
                     "dcr_enabled": True,
                     "pkce_required": True,
                 }
@@ -303,9 +310,13 @@ async def test_method_create_with_all_params(self, async_client: AsyncKeycardAPI
                 "arn": "x",
                 "type": "aws",
             },
-            login_flow="default",
+            organization_id="organization_id",
             protocols={
                 "oauth2": {
+                    "cimd": {
+                        "allowed_client_ids": ["string"],
+                        "enabled": True,
+                    },
                     "dcr_enabled": True,
                     "pkce_required": True,
                 }
@@ -411,10 +422,13 @@ async def test_method_update_with_all_params(self, async_client: AsyncKeycardAPI
                 "arn": "x",
                 "type": "aws",
             },
-            login_flow="default",
             name="x",
             protocols={
                 "oauth2": {
+                    "cimd": {
+                        "allowed_client_ids": ["string"],
+                        "enabled": True,
+                    },
                     "dcr_enabled": True,
                     "pkce_required": True,
                 }
diff --git a/tests/api_resources/zones/test_resources.py b/tests/api_resources/zones/test_resources.py
index 33116f7..0e57e9a 100644
--- a/tests/api_resources/zones/test_resources.py
+++ b/tests/api_resources/zones/test_resources.py
@@ -39,6 +39,7 @@ def test_method_create_with_all_params(self, client: KeycardAPI) -> None:
             name="x",
             application_id="application_id",
             application_type="native",
+            credential_lifetime_seconds=60,
             credential_provider_id="credential_provider_id",
             description="description",
             metadata={"docs_url": "https://example.com"},
@@ -156,6 +157,7 @@ def test_method_update_with_all_params(self, client: KeycardAPI) -> None:
             zone_id="zoneId",
             application_id="application_id",
             application_type="native",
+            credential_lifetime_seconds=60,
             credential_provider_id="credential_provider_id",
             description="description",
             identifier="x",
@@ -343,6 +345,7 @@ async def test_method_create_with_all_params(self, async_client: AsyncKeycardAPI
             name="x",
             application_id="application_id",
             application_type="native",
+            credential_lifetime_seconds=60,
             credential_provider_id="credential_provider_id",
             description="description",
             metadata={"docs_url": "https://example.com"},
@@ -460,6 +463,7 @@ async def test_method_update_with_all_params(self, async_client: AsyncKeycardAPI
             zone_id="zoneId",
             application_id="application_id",
             application_type="native",
+            credential_lifetime_seconds=60,
             credential_provider_id="credential_provider_id",
             description="description",
             identifier="x",
diff --git a/tests/api_resources/zones/test_users.py b/tests/api_resources/zones/test_users.py
index 3c9ac97..1a256ef 100644
--- a/tests/api_resources/zones/test_users.py
+++ b/tests/api_resources/zones/test_users.py
@@ -85,7 +85,13 @@ def test_method_list_with_all_params(self, client: KeycardAPI) -> None:
             after="x",
             before="x",
             expand="total_count",
+            filter_email="dev@stainless.com",
+            filter_id="string",
             limit=1,
+            query="x",
+            query_email="x",
+            query_subject="x",
+            sort="-authenticated_at,\t\r\r \tauthenticated_at,\n\t\ncreated_at",
         )
         assert_matches_type(UserListResponse, user, path=["response"])
 
@@ -197,7 +203,13 @@ async def test_method_list_with_all_params(self, async_client: AsyncKeycardAPI)
             after="x",
             before="x",
             expand="total_count",
+            filter_email="dev@stainless.com",
+            filter_id="string",
             limit=1,
+            query="x",
+            query_email="x",
+            query_subject="x",
+            sort="-authenticated_at,\t\r\r \tauthenticated_at,\n\t\ncreated_at",
         )
         assert_matches_type(UserListResponse, user, path=["response"])