From b50d7098e0550dcdd8b26260f75ddd60de410012 Mon Sep 17 00:00:00 2001
From: "stainless-app[bot]"
 <142633134+stainless-app[bot]@users.noreply.github.com>
Date: Tue, 12 May 2026 19:03:57 +0000
Subject: [PATCH 1/6] ci: pin GitHub Actions to commit SHAs

Pin all GitHub Actions referenced in generated workflows (both
first-party `actions/*` and third-party) to immutable commit SHAs.
Updating pinned actions is now a deliberate codegen-side bump rather
than implicit on every workflow run.
---
 .github/workflows/ci.yml             | 14 +++++++-------
 .github/workflows/publish-pypi.yml   |  4 ++--
 .github/workflows/release-doctor.yml |  2 +-
 3 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 92182d3..69d849f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -21,10 +21,10 @@ jobs:
     runs-on: ${{ github.repository == 'stainless-sdks/keycard-api-python' && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
     if: (github.event_name == 'push' || github.event.pull_request.head.repo.fork) && (github.event_name != 'push' || github.event.head_commit.message != 'codegen metadata')
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
         with:
           version: '0.10.2'
 
@@ -43,10 +43,10 @@ jobs:
       id-token: write
     runs-on: ${{ github.repository == 'stainless-sdks/keycard-api-python' && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
         with:
           version: '0.10.2'
 
@@ -61,7 +61,7 @@ jobs:
           github.repository == 'stainless-sdks/keycard-api-python' &&
           !startsWith(github.ref, 'refs/heads/stl/')
         id: github-oidc
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: core.setOutput('github_token', await core.getIDToken());
 
@@ -81,10 +81,10 @@ jobs:
     runs-on: ${{ github.repository == 'stainless-sdks/keycard-api-python' && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
     if: github.event_name == 'push' || github.event.pull_request.head.repo.fork
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
         with:
           version: '0.10.2'
 
diff --git a/.github/workflows/publish-pypi.yml b/.github/workflows/publish-pypi.yml
index 38e459f..7de0ca0 100644
--- a/.github/workflows/publish-pypi.yml
+++ b/.github/workflows/publish-pypi.yml
@@ -14,10 +14,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
         with:
           version: '0.9.13'
 
diff --git a/.github/workflows/release-doctor.yml b/.github/workflows/release-doctor.yml
index dcd9b97..bae7f6d 100644
--- a/.github/workflows/release-doctor.yml
+++ b/.github/workflows/release-doctor.yml
@@ -12,7 +12,7 @@ jobs:
     if: github.repository == 'keycardai/keycard-python' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || startsWith(github.head_ref, 'release-please') || github.head_ref == 'next')
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Check release environment
         run: |

From 744a2afd2465cc5c67ee665636f89675d0913192 Mon Sep 17 00:00:00 2001
From: "stainless-app[bot]"
 <142633134+stainless-app[bot]@users.noreply.github.com>
Date: Tue, 12 May 2026 19:12:41 +0000
Subject: [PATCH 2/6] fix: housekeeping

---
 .stats.yml                                    |  6 ++--
 src/keycardai_api/resources/zones/zones.py    | 22 -------------
 src/keycardai_api/types/zone.py               | 31 +++++++++++++------
 src/keycardai_api/types/zone_create_params.py | 31 +++++++++++++------
 src/keycardai_api/types/zone_update_params.py | 30 +++++++++++++-----
 tests/api_resources/test_zones.py             | 20 +++++++++---
 6 files changed, 84 insertions(+), 56 deletions(-)

diff --git a/.stats.yml b/.stats.yml
index 9cf88bb..fce4838 100644
--- a/.stats.yml
+++ b/.stats.yml
@@ -1,4 +1,4 @@
 configured_endpoints: 106
-openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/keycard/keycard-api-d976147b1bc79d44e82107b943099bc750c9b7d101e91bf1ea53b91a6b74e8a6.yml
-openapi_spec_hash: d2953fdcb3490866c4bef3ec7a8300bb
-config_hash: 62b00ad8d94230c7c9b8ed142c7dcfc8
+openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/keycard/keycard-api-e352f2d9cccdaf7adb243cfb5075939c650be691c90430f712c98b70fc435785.yml
+openapi_spec_hash: 9101cf8d40bb32fa4585f72c5b90d425
+config_hash: b0ee2dc67cc490e45f8fe0acabd76206
diff --git a/src/keycardai_api/resources/zones/zones.py b/src/keycardai_api/resources/zones/zones.py
index ea5d152..d9b3fae 100644
--- a/src/keycardai_api/resources/zones/zones.py
+++ b/src/keycardai_api/resources/zones/zones.py
@@ -232,7 +232,6 @@ def create(
         default_mcp_gateway_application: bool | Omit = omit,
         description: Optional[str] | Omit = omit,
         encryption_key: EncryptionKeyAwsKmsConfigParam | Omit = omit,
-        login_flow: Literal["default", "identifier_first"] | Omit = omit,
         protocols: zone_create_params.Protocols | Omit = omit,
         requires_invitation: bool | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
@@ -259,9 +258,6 @@ def create(
           encryption_key: AWS KMS configuration for zone encryption. When not specified, the default
               Keycard Cloud encryption key will be used.
 
-          login_flow: Login flow style for the zone. 'default' uses standard authentication,
-              'identifier_first' uses identifier-based provider routing.
-
           protocols: Protocol configuration for zone creation
 
           requires_invitation: Whether the zone requires an invitation for email/password registration, only
@@ -283,7 +279,6 @@ def create(
                     "default_mcp_gateway_application": default_mcp_gateway_application,
                     "description": description,
                     "encryption_key": encryption_key,
-                    "login_flow": login_flow,
                     "protocols": protocols,
                     "requires_invitation": requires_invitation,
                 },
@@ -341,7 +336,6 @@ def update(
         default_resource_id: Optional[str] | Omit = omit,
         description: Optional[str] | Omit = omit,
         encryption_key: Optional[zone_update_params.EncryptionKey] | Omit = omit,
-        login_flow: Optional[Literal["default", "identifier_first"]] | Omit = omit,
         name: str | Omit = omit,
         protocols: Optional[zone_update_params.Protocols] | Omit = omit,
         requires_invitation: bool | Omit = omit,
@@ -369,10 +363,6 @@ def update(
           encryption_key: AWS KMS configuration for zone encryption update (set to null to remove
               customer-managed key and revert to default)
 
-          login_flow: Login flow style for the zone. 'default' uses standard authentication,
-              'identifier_first' uses identifier-based provider routing. Set to null to reset
-              to 'default'.
-
           name: Human-readable name. Must not contain HTML tags (e.g. `<script>`, `<div>`) or
               control characters.
 
@@ -401,7 +391,6 @@ def update(
                     "default_resource_id": default_resource_id,
                     "description": description,
                     "encryption_key": encryption_key,
-                    "login_flow": login_flow,
                     "name": name,
                     "protocols": protocols,
                     "requires_invitation": requires_invitation,
@@ -605,7 +594,6 @@ async def create(
         default_mcp_gateway_application: bool | Omit = omit,
         description: Optional[str] | Omit = omit,
         encryption_key: EncryptionKeyAwsKmsConfigParam | Omit = omit,
-        login_flow: Literal["default", "identifier_first"] | Omit = omit,
         protocols: zone_create_params.Protocols | Omit = omit,
         requires_invitation: bool | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
@@ -632,9 +620,6 @@ async def create(
           encryption_key: AWS KMS configuration for zone encryption. When not specified, the default
               Keycard Cloud encryption key will be used.
 
-          login_flow: Login flow style for the zone. 'default' uses standard authentication,
-              'identifier_first' uses identifier-based provider routing.
-
           protocols: Protocol configuration for zone creation
 
           requires_invitation: Whether the zone requires an invitation for email/password registration, only
@@ -656,7 +641,6 @@ async def create(
                     "default_mcp_gateway_application": default_mcp_gateway_application,
                     "description": description,
                     "encryption_key": encryption_key,
-                    "login_flow": login_flow,
                     "protocols": protocols,
                     "requires_invitation": requires_invitation,
                 },
@@ -714,7 +698,6 @@ async def update(
         default_resource_id: Optional[str] | Omit = omit,
         description: Optional[str] | Omit = omit,
         encryption_key: Optional[zone_update_params.EncryptionKey] | Omit = omit,
-        login_flow: Optional[Literal["default", "identifier_first"]] | Omit = omit,
         name: str | Omit = omit,
         protocols: Optional[zone_update_params.Protocols] | Omit = omit,
         requires_invitation: bool | Omit = omit,
@@ -742,10 +725,6 @@ async def update(
           encryption_key: AWS KMS configuration for zone encryption update (set to null to remove
               customer-managed key and revert to default)
 
-          login_flow: Login flow style for the zone. 'default' uses standard authentication,
-              'identifier_first' uses identifier-based provider routing. Set to null to reset
-              to 'default'.
-
           name: Human-readable name. Must not contain HTML tags (e.g. `<script>`, `<div>`) or
               control characters.
 
@@ -774,7 +753,6 @@ async def update(
                     "default_resource_id": default_resource_id,
                     "description": description,
                     "encryption_key": encryption_key,
-                    "login_flow": login_flow,
                     "name": name,
                     "protocols": protocols,
                     "requires_invitation": requires_invitation,
diff --git a/src/keycardai_api/types/zone.py b/src/keycardai_api/types/zone.py
index 95e1c85..270623a 100644
--- a/src/keycardai_api/types/zone.py
+++ b/src/keycardai_api/types/zone.py
@@ -1,13 +1,28 @@
 # File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
 
-from typing import Dict, Optional
+from typing import Dict, List, Optional
 from datetime import datetime
-from typing_extensions import Literal
 
 from .._models import BaseModel
 from .encryption_key_aws_kms_config import EncryptionKeyAwsKmsConfig
 
-__all__ = ["Zone", "Protocols", "ProtocolsOauth2", "ProtocolsOpenid"]
+__all__ = ["Zone", "Protocols", "ProtocolsOauth2", "ProtocolsOauth2Cimd", "ProtocolsOpenid"]
+
+
+class ProtocolsOauth2Cimd(BaseModel):
+    """Client ID Metadata Document auto-provisioning configuration"""
+
+    allowed_client_ids: List[str]
+    """Allowlist for CIMD client_id URLs.
+
+    Each entry is an exact URL, a wildcard origin with a single _ replacing one
+    subdomain label (e.g. https://_.example.com matches https://app.example.com but
+    not https://a.b.example.com), or the literal _ to allow any client. Only one _
+    is permitted per entry.
+    """
+
+    enabled: bool
+    """Whether CIMD auto-provisioning is enabled for unregistered URL-based clients"""
 
 
 class ProtocolsOauth2(BaseModel):
@@ -22,6 +37,9 @@ class ProtocolsOauth2(BaseModel):
     (.well-known/oauth-authorization-server)
     """
 
+    cimd: ProtocolsOauth2Cimd
+    """Client ID Metadata Document auto-provisioning configuration"""
+
     dcr_enabled: bool
     """Whether Dynamic Client Registration is enabled"""
 
@@ -106,13 +124,6 @@ class Zone(BaseModel):
     When not specified, the default Keycard Cloud encryption key will be used.
     """
 
-    login_flow: Optional[Literal["default", "identifier_first"]] = None
-    """Login flow style for the zone.
-
-    'default' uses standard authentication, 'identifier_first' uses identifier-based
-    provider routing.
-    """
-
     permissions: Optional[Dict[str, Dict[str, bool]]] = None
     """Permissions granted to the authenticated principal.
 
diff --git a/src/keycardai_api/types/zone_create_params.py b/src/keycardai_api/types/zone_create_params.py
index 73dcfee..4d92484 100644
--- a/src/keycardai_api/types/zone_create_params.py
+++ b/src/keycardai_api/types/zone_create_params.py
@@ -3,11 +3,12 @@
 from __future__ import annotations
 
 from typing import Optional
-from typing_extensions import Literal, Required, TypedDict
+from typing_extensions import Required, TypedDict
 
+from .._types import SequenceNotStr
 from .encryption_key_aws_kms_config_param import EncryptionKeyAwsKmsConfigParam
 
-__all__ = ["ZoneCreateParams", "Protocols", "ProtocolsOauth2"]
+__all__ = ["ZoneCreateParams", "Protocols", "ProtocolsOauth2", "ProtocolsOauth2Cimd"]
 
 
 class ZoneCreateParams(TypedDict, total=False):
@@ -32,13 +33,6 @@ class ZoneCreateParams(TypedDict, total=False):
     When not specified, the default Keycard Cloud encryption key will be used.
     """
 
-    login_flow: Literal["default", "identifier_first"]
-    """Login flow style for the zone.
-
-    'default' uses standard authentication, 'identifier_first' uses identifier-based
-    provider routing.
-    """
-
     protocols: Protocols
     """Protocol configuration for zone creation"""
 
@@ -49,9 +43,28 @@ class ZoneCreateParams(TypedDict, total=False):
     """
 
 
+class ProtocolsOauth2Cimd(TypedDict, total=False):
+    """Client ID Metadata Document auto-provisioning configuration"""
+
+    allowed_client_ids: Required[SequenceNotStr[str]]
+    """Allowlist for CIMD client_id URLs.
+
+    Each entry is an exact URL, a wildcard origin with a single _ replacing one
+    subdomain label (e.g. https://_.example.com matches https://app.example.com but
+    not https://a.b.example.com), or the literal _ to allow any client. Only one _
+    is permitted per entry.
+    """
+
+    enabled: Required[bool]
+    """Whether CIMD auto-provisioning is enabled for unregistered URL-based clients"""
+
+
 class ProtocolsOauth2(TypedDict, total=False):
     """OAuth 2.0 protocol configuration for zone creation"""
 
+    cimd: ProtocolsOauth2Cimd
+    """Client ID Metadata Document auto-provisioning configuration"""
+
     dcr_enabled: bool
     """Whether Dynamic Client Registration is enabled"""
 
diff --git a/src/keycardai_api/types/zone_update_params.py b/src/keycardai_api/types/zone_update_params.py
index 2bbae9a..642f67f 100644
--- a/src/keycardai_api/types/zone_update_params.py
+++ b/src/keycardai_api/types/zone_update_params.py
@@ -5,7 +5,9 @@
 from typing import Optional
 from typing_extensions import Literal, Required, TypedDict
 
-__all__ = ["ZoneUpdateParams", "EncryptionKey", "Protocols", "ProtocolsOauth2"]
+from .._types import SequenceNotStr
+
+__all__ = ["ZoneUpdateParams", "EncryptionKey", "Protocols", "ProtocolsOauth2", "ProtocolsOauth2Cimd"]
 
 
 class ZoneUpdateParams(TypedDict, total=False):
@@ -33,13 +35,6 @@ class ZoneUpdateParams(TypedDict, total=False):
     customer-managed key and revert to default)
     """
 
-    login_flow: Optional[Literal["default", "identifier_first"]]
-    """Login flow style for the zone.
-
-    'default' uses standard authentication, 'identifier_first' uses identifier-based
-    provider routing. Set to null to reset to 'default'.
-    """
-
     name: str
     """Human-readable name.
 
@@ -70,9 +65,28 @@ class EncryptionKey(TypedDict, total=False):
     type: Required[Literal["aws"]]
 
 
+class ProtocolsOauth2Cimd(TypedDict, total=False):
+    """Client ID Metadata Document auto-provisioning configuration"""
+
+    allowed_client_ids: Required[SequenceNotStr[str]]
+    """Allowlist for CIMD client_id URLs.
+
+    Each entry is an exact URL, a wildcard origin with a single _ replacing one
+    subdomain label (e.g. https://_.example.com matches https://app.example.com but
+    not https://a.b.example.com), or the literal _ to allow any client. Only one _
+    is permitted per entry.
+    """
+
+    enabled: Required[bool]
+    """Whether CIMD auto-provisioning is enabled for unregistered URL-based clients"""
+
+
 class ProtocolsOauth2(TypedDict, total=False):
     """OAuth 2.0 protocol configuration update for a zone (partial update)"""
 
+    cimd: ProtocolsOauth2Cimd
+    """Client ID Metadata Document auto-provisioning configuration"""
+
     dcr_enabled: Optional[bool]
     """Whether Dynamic Client Registration is enabled"""
 
diff --git a/tests/api_resources/test_zones.py b/tests/api_resources/test_zones.py
index 9d6cb07..189aedf 100644
--- a/tests/api_resources/test_zones.py
+++ b/tests/api_resources/test_zones.py
@@ -39,9 +39,12 @@ def test_method_create_with_all_params(self, client: KeycardAPI) -> None:
                 "arn": "x",
                 "type": "aws",
             },
-            login_flow="default",
             protocols={
                 "oauth2": {
+                    "cimd": {
+                        "allowed_client_ids": ["string"],
+                        "enabled": True,
+                    },
                     "dcr_enabled": True,
                     "pkce_required": True,
                 }
@@ -147,10 +150,13 @@ def test_method_update_with_all_params(self, client: KeycardAPI) -> None:
                 "arn": "x",
                 "type": "aws",
             },
-            login_flow="default",
             name="x",
             protocols={
                 "oauth2": {
+                    "cimd": {
+                        "allowed_client_ids": ["string"],
+                        "enabled": True,
+                    },
                     "dcr_enabled": True,
                     "pkce_required": True,
                 }
@@ -303,9 +309,12 @@ async def test_method_create_with_all_params(self, async_client: AsyncKeycardAPI
                 "arn": "x",
                 "type": "aws",
             },
-            login_flow="default",
             protocols={
                 "oauth2": {
+                    "cimd": {
+                        "allowed_client_ids": ["string"],
+                        "enabled": True,
+                    },
                     "dcr_enabled": True,
                     "pkce_required": True,
                 }
@@ -411,10 +420,13 @@ async def test_method_update_with_all_params(self, async_client: AsyncKeycardAPI
                 "arn": "x",
                 "type": "aws",
             },
-            login_flow="default",
             name="x",
             protocols={
                 "oauth2": {
+                    "cimd": {
+                        "allowed_client_ids": ["string"],
+                        "enabled": True,
+                    },
                     "dcr_enabled": True,
                     "pkce_required": True,
                 }

From 090a5cd8c0f02bc29b29a74b525924fff94320a7 Mon Sep 17 00:00:00 2001
From: "stainless-app[bot]"
 <142633134+stainless-app[bot]@users.noreply.github.com>
Date: Wed, 13 May 2026 19:05:19 +0000
Subject: [PATCH 3/6] feat: add jwt_lifetime_seconds to resources

---
 .stats.yml                                    |   4 +-
 .../resources/zones/resources.py              |  20 ++++
 src/keycardai_api/resources/zones/users.py    | 102 ++++++++++++++++--
 .../types/zones/applications/resource.py      |   7 ++
 .../types/zones/resource_create_params.py     |   6 ++
 .../types/zones/resource_update_params.py     |   6 ++
 .../types/zones/user_list_params.py           |  25 +++++
 tests/api_resources/zones/test_resources.py   |   4 +
 tests/api_resources/zones/test_users.py       |  12 +++
 9 files changed, 177 insertions(+), 9 deletions(-)

diff --git a/.stats.yml b/.stats.yml
index fce4838..7e7878c 100644
--- a/.stats.yml
+++ b/.stats.yml
@@ -1,4 +1,4 @@
 configured_endpoints: 106
-openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/keycard/keycard-api-e352f2d9cccdaf7adb243cfb5075939c650be691c90430f712c98b70fc435785.yml
-openapi_spec_hash: 9101cf8d40bb32fa4585f72c5b90d425
+openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/keycard/keycard-api-f29660ebb856f589e75784b8c73a153b1cfee0fe96d7429de4877a790195b408.yml
+openapi_spec_hash: eb42256d0e20dc7906082b149a3c82c1
 config_hash: b0ee2dc67cc490e45f8fe0acabd76206
diff --git a/src/keycardai_api/resources/zones/resources.py b/src/keycardai_api/resources/zones/resources.py
index 47e8ad6..2941cfe 100644
--- a/src/keycardai_api/resources/zones/resources.py
+++ b/src/keycardai_api/resources/zones/resources.py
@@ -59,6 +59,7 @@ def create(
         name: str,
         application_id: str | Omit = omit,
         application_type: Literal["native", "web"] | Omit = omit,
+        credential_lifetime_seconds: int | Omit = omit,
         credential_provider_id: str | Omit = omit,
         description: Optional[str] | Omit = omit,
         metadata: MetadataParam | Omit = omit,
@@ -88,6 +89,9 @@ def create(
               localhost URLs for redirect_uris or URIs with custom schemes. Web clients must
               use https URLs and must not use localhost as the hostname.
 
+          credential_lifetime_seconds: Credential lifetime override in seconds. When set, overrides the default
+              credential lifetime for this resource.
+
           credential_provider_id: ID of the credential provider to associate with the resource
 
           description: Human-readable description. Must not contain HTML tags (e.g. `<script>`,
@@ -119,6 +123,7 @@ def create(
                     "name": name,
                     "application_id": application_id,
                     "application_type": application_type,
+                    "credential_lifetime_seconds": credential_lifetime_seconds,
                     "credential_provider_id": credential_provider_id,
                     "description": description,
                     "metadata": metadata,
@@ -176,6 +181,7 @@ def update(
         zone_id: str,
         application_id: Optional[str] | Omit = omit,
         application_type: Literal["native", "web"] | Omit = omit,
+        credential_lifetime_seconds: Optional[int] | Omit = omit,
         credential_provider_id: Optional[str] | Omit = omit,
         description: Optional[str] | Omit = omit,
         identifier: str | Omit = omit,
@@ -200,6 +206,9 @@ def update(
               localhost URLs for redirect_uris or URIs with custom schemes. Web clients must
               use https URLs and must not use localhost as the hostname.
 
+          credential_lifetime_seconds: Credential lifetime override in seconds. Set to null to clear the override and
+              use the default.
+
           credential_provider_id: ID of the credential provider to associate with the resource (set to null to
               unset)
 
@@ -237,6 +246,7 @@ def update(
                 {
                     "application_id": application_id,
                     "application_type": application_type,
+                    "credential_lifetime_seconds": credential_lifetime_seconds,
                     "credential_provider_id": credential_provider_id,
                     "description": description,
                     "identifier": identifier,
@@ -384,6 +394,7 @@ async def create(
         name: str,
         application_id: str | Omit = omit,
         application_type: Literal["native", "web"] | Omit = omit,
+        credential_lifetime_seconds: int | Omit = omit,
         credential_provider_id: str | Omit = omit,
         description: Optional[str] | Omit = omit,
         metadata: MetadataParam | Omit = omit,
@@ -413,6 +424,9 @@ async def create(
               localhost URLs for redirect_uris or URIs with custom schemes. Web clients must
               use https URLs and must not use localhost as the hostname.
 
+          credential_lifetime_seconds: Credential lifetime override in seconds. When set, overrides the default
+              credential lifetime for this resource.
+
           credential_provider_id: ID of the credential provider to associate with the resource
 
           description: Human-readable description. Must not contain HTML tags (e.g. `<script>`,
@@ -444,6 +458,7 @@ async def create(
                     "name": name,
                     "application_id": application_id,
                     "application_type": application_type,
+                    "credential_lifetime_seconds": credential_lifetime_seconds,
                     "credential_provider_id": credential_provider_id,
                     "description": description,
                     "metadata": metadata,
@@ -501,6 +516,7 @@ async def update(
         zone_id: str,
         application_id: Optional[str] | Omit = omit,
         application_type: Literal["native", "web"] | Omit = omit,
+        credential_lifetime_seconds: Optional[int] | Omit = omit,
         credential_provider_id: Optional[str] | Omit = omit,
         description: Optional[str] | Omit = omit,
         identifier: str | Omit = omit,
@@ -525,6 +541,9 @@ async def update(
               localhost URLs for redirect_uris or URIs with custom schemes. Web clients must
               use https URLs and must not use localhost as the hostname.
 
+          credential_lifetime_seconds: Credential lifetime override in seconds. Set to null to clear the override and
+              use the default.
+
           credential_provider_id: ID of the credential provider to associate with the resource (set to null to
               unset)
 
@@ -562,6 +581,7 @@ async def update(
                 {
                     "application_id": application_id,
                     "application_type": application_type,
+                    "credential_lifetime_seconds": credential_lifetime_seconds,
                     "credential_provider_id": credential_provider_id,
                     "description": description,
                     "identifier": identifier,
diff --git a/src/keycardai_api/resources/zones/users.py b/src/keycardai_api/resources/zones/users.py
index 4edd9f4..f79e92f 100644
--- a/src/keycardai_api/resources/zones/users.py
+++ b/src/keycardai_api/resources/zones/users.py
@@ -7,7 +7,7 @@
 
 import httpx
 
-from ..._types import Body, Omit, Query, Headers, NotGiven, omit, not_given
+from ..._types import Body, Omit, Query, Headers, NotGiven, SequenceNotStr, omit, not_given
 from ..._utils import path_template, maybe_transform, async_maybe_transform
 from ..._compat import cached_property
 from ..._resource import SyncAPIResource, AsyncAPIResource
@@ -88,7 +88,13 @@ def list(
         after: str | Omit = omit,
         before: str | Omit = omit,
         expand: Union[Literal["total_count"], List[Literal["total_count"]]] | Omit = omit,
+        filter_email: Union[str, SequenceNotStr[str]] | Omit = omit,
+        filter_id: Union[str, SequenceNotStr[str]] | Omit = omit,
         limit: int | Omit = omit,
+        query: Union[str, SequenceNotStr[str]] | Omit = omit,
+        query_email: Union[str, SequenceNotStr[str]] | Omit = omit,
+        query_subject: Union[str, SequenceNotStr[str]] | Omit = omit,
+        sort: str | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
         # The extra values given here take precedence over values defined on the client or passed to this method.
         extra_headers: Headers | None = None,
@@ -96,17 +102,49 @@ def list(
         extra_body: Body | None = None,
         timeout: float | httpx.Timeout | None | NotGiven = not_given,
     ) -> UserListResponse:
-        """Returns a list of users in the specified zone.
-
-        Can be filtered by email address.
+        """
+        Returns a list of users in the specified zone.
+
+        **Rollout note:** the paginated/searchable/sortable behavior described below is
+        gated behind the `user-pagination` feature flag and is currently disabled for
+        most zones. While the flag is off, the response returns every user in the zone
+        (capped at 100) in `items` and a fixed pagination envelope where `after_cursor`
+        and `before_cursor` are `null` and `total_count` is `0`. The query parameters
+        below are accepted but ignored. The flag is rolled out per-zone in Datadog and
+        will become the default once Console adopts the paginated contract.
+
+        Use cursor pagination via `after`/`before`. Sort: comma-separated field list;
+        prefix with `-` for descending. Use `expand[]=total_count` to include the
+        matching row count. Filter by exact email via `filter[email]`; search via
+        `query[email]` / `query[subject]` / `query[]` (substring match, OR'd across
+        repeated values). `query[]` matches against email and federation credential
+        subject. Pass `filter[id]` (repeatable, max 100) to restrict results to a known
+        set of users — mutually exclusive with `after`/`before` (returns 400 if
+        combined). When `filter[id]` is set, `limit` is ignored and the response
+        contains every requested user that exists in the zone, in a single page. IDs not
+        in the zone are silently omitted.
 
         Args:
           after: Cursor for forward pagination
 
           before: Cursor for backward pagination
 
+          filter_email: Filter by exact email address
+
+          filter_id: Restrict results to users with this publicId. Repeatable, max 100. Mutually
+              exclusive with after/before.
+
           limit: Maximum number of items to return
 
+          query: Search across email and credential subject (substring match)
+
+          query_email: Search by email (substring match)
+
+          query_subject: Search by federated credential subject (substring match)
+
+          sort: Comma-separated sort fields. Prefix with - for descending. Allowed: created_at,
+              email, authenticated_at
+
           extra_headers: Send extra headers
 
           extra_query: Add additional query parameters to the request
@@ -129,7 +167,13 @@ def list(
                         "after": after,
                         "before": before,
                         "expand": expand,
+                        "filter_email": filter_email,
+                        "filter_id": filter_id,
                         "limit": limit,
+                        "query": query,
+                        "query_email": query_email,
+                        "query_subject": query_subject,
+                        "sort": sort,
                     },
                     user_list_params.UserListParams,
                 ),
@@ -201,7 +245,13 @@ async def list(
         after: str | Omit = omit,
         before: str | Omit = omit,
         expand: Union[Literal["total_count"], List[Literal["total_count"]]] | Omit = omit,
+        filter_email: Union[str, SequenceNotStr[str]] | Omit = omit,
+        filter_id: Union[str, SequenceNotStr[str]] | Omit = omit,
         limit: int | Omit = omit,
+        query: Union[str, SequenceNotStr[str]] | Omit = omit,
+        query_email: Union[str, SequenceNotStr[str]] | Omit = omit,
+        query_subject: Union[str, SequenceNotStr[str]] | Omit = omit,
+        sort: str | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
         # The extra values given here take precedence over values defined on the client or passed to this method.
         extra_headers: Headers | None = None,
@@ -209,17 +259,49 @@ async def list(
         extra_body: Body | None = None,
         timeout: float | httpx.Timeout | None | NotGiven = not_given,
     ) -> UserListResponse:
-        """Returns a list of users in the specified zone.
-
-        Can be filtered by email address.
+        """
+        Returns a list of users in the specified zone.
+
+        **Rollout note:** the paginated/searchable/sortable behavior described below is
+        gated behind the `user-pagination` feature flag and is currently disabled for
+        most zones. While the flag is off, the response returns every user in the zone
+        (capped at 100) in `items` and a fixed pagination envelope where `after_cursor`
+        and `before_cursor` are `null` and `total_count` is `0`. The query parameters
+        below are accepted but ignored. The flag is rolled out per-zone in Datadog and
+        will become the default once Console adopts the paginated contract.
+
+        Use cursor pagination via `after`/`before`. Sort: comma-separated field list;
+        prefix with `-` for descending. Use `expand[]=total_count` to include the
+        matching row count. Filter by exact email via `filter[email]`; search via
+        `query[email]` / `query[subject]` / `query[]` (substring match, OR'd across
+        repeated values). `query[]` matches against email and federation credential
+        subject. Pass `filter[id]` (repeatable, max 100) to restrict results to a known
+        set of users — mutually exclusive with `after`/`before` (returns 400 if
+        combined). When `filter[id]` is set, `limit` is ignored and the response
+        contains every requested user that exists in the zone, in a single page. IDs not
+        in the zone are silently omitted.
 
         Args:
           after: Cursor for forward pagination
 
           before: Cursor for backward pagination
 
+          filter_email: Filter by exact email address
+
+          filter_id: Restrict results to users with this publicId. Repeatable, max 100. Mutually
+              exclusive with after/before.
+
           limit: Maximum number of items to return
 
+          query: Search across email and credential subject (substring match)
+
+          query_email: Search by email (substring match)
+
+          query_subject: Search by federated credential subject (substring match)
+
+          sort: Comma-separated sort fields. Prefix with - for descending. Allowed: created_at,
+              email, authenticated_at
+
           extra_headers: Send extra headers
 
           extra_query: Add additional query parameters to the request
@@ -242,7 +324,13 @@ async def list(
                         "after": after,
                         "before": before,
                         "expand": expand,
+                        "filter_email": filter_email,
+                        "filter_id": filter_id,
                         "limit": limit,
+                        "query": query,
+                        "query_email": query_email,
+                        "query_subject": query_subject,
+                        "sort": sort,
                     },
                     user_list_params.UserListParams,
                 ),
diff --git a/src/keycardai_api/types/zones/applications/resource.py b/src/keycardai_api/types/zones/applications/resource.py
index 8991db7..a53d8ba 100644
--- a/src/keycardai_api/types/zones/applications/resource.py
+++ b/src/keycardai_api/types/zones/applications/resource.py
@@ -71,6 +71,13 @@ class Resource(BaseModel):
     application_id: Optional[str] = None
     """ID of the application that provides this resource"""
 
+    credential_lifetime_seconds: Optional[int] = None
+    """Credential lifetime override in seconds.
+
+    When set, overrides the default credential lifetime for this resource. When
+    absent, the default from the provider or zone is used.
+    """
+
     credential_provider: Optional[Provider] = None
     """
     A Provider is a system that supplies access to Resources and allows actors
diff --git a/src/keycardai_api/types/zones/resource_create_params.py b/src/keycardai_api/types/zones/resource_create_params.py
index 9abc2d1..27453fd 100644
--- a/src/keycardai_api/types/zones/resource_create_params.py
+++ b/src/keycardai_api/types/zones/resource_create_params.py
@@ -35,6 +35,12 @@ class ResourceCreateParams(TypedDict, total=False):
     hostname.
     """
 
+    credential_lifetime_seconds: int
+    """Credential lifetime override in seconds.
+
+    When set, overrides the default credential lifetime for this resource.
+    """
+
     credential_provider_id: str
     """ID of the credential provider to associate with the resource"""
 
diff --git a/src/keycardai_api/types/zones/resource_update_params.py b/src/keycardai_api/types/zones/resource_update_params.py
index cedcae0..0e910d8 100644
--- a/src/keycardai_api/types/zones/resource_update_params.py
+++ b/src/keycardai_api/types/zones/resource_update_params.py
@@ -26,6 +26,12 @@ class ResourceUpdateParams(TypedDict, total=False):
     hostname.
     """
 
+    credential_lifetime_seconds: Optional[int]
+    """Credential lifetime override in seconds.
+
+    Set to null to clear the override and use the default.
+    """
+
     credential_provider_id: Optional[str]
     """
     ID of the credential provider to associate with the resource (set to null to
diff --git a/src/keycardai_api/types/zones/user_list_params.py b/src/keycardai_api/types/zones/user_list_params.py
index e66a4c7..5ef469f 100644
--- a/src/keycardai_api/types/zones/user_list_params.py
+++ b/src/keycardai_api/types/zones/user_list_params.py
@@ -5,6 +5,7 @@
 from typing import List, Union
 from typing_extensions import Literal, Annotated, TypedDict
 
+from ..._types import SequenceNotStr
 from ..._utils import PropertyInfo
 
 __all__ = ["UserListParams"]
@@ -19,5 +20,29 @@ class UserListParams(TypedDict, total=False):
 
     expand: Annotated[Union[Literal["total_count"], List[Literal["total_count"]]], PropertyInfo(alias="expand[]")]
 
+    filter_email: Annotated[Union[str, SequenceNotStr[str]], PropertyInfo(alias="filter[email]")]
+    """Filter by exact email address"""
+
+    filter_id: Annotated[Union[str, SequenceNotStr[str]], PropertyInfo(alias="filter[id]")]
+    """Restrict results to users with this publicId.
+
+    Repeatable, max 100. Mutually exclusive with after/before.
+    """
+
     limit: int
     """Maximum number of items to return"""
+
+    query: Annotated[Union[str, SequenceNotStr[str]], PropertyInfo(alias="query[]")]
+    """Search across email and credential subject (substring match)"""
+
+    query_email: Annotated[Union[str, SequenceNotStr[str]], PropertyInfo(alias="query[email]")]
+    """Search by email (substring match)"""
+
+    query_subject: Annotated[Union[str, SequenceNotStr[str]], PropertyInfo(alias="query[subject]")]
+    """Search by federated credential subject (substring match)"""
+
+    sort: str
+    """Comma-separated sort fields.
+
+    Prefix with - for descending. Allowed: created_at, email, authenticated_at
+    """
diff --git a/tests/api_resources/zones/test_resources.py b/tests/api_resources/zones/test_resources.py
index 33116f7..0e57e9a 100644
--- a/tests/api_resources/zones/test_resources.py
+++ b/tests/api_resources/zones/test_resources.py
@@ -39,6 +39,7 @@ def test_method_create_with_all_params(self, client: KeycardAPI) -> None:
             name="x",
             application_id="application_id",
             application_type="native",
+            credential_lifetime_seconds=60,
             credential_provider_id="credential_provider_id",
             description="description",
             metadata={"docs_url": "https://example.com"},
@@ -156,6 +157,7 @@ def test_method_update_with_all_params(self, client: KeycardAPI) -> None:
             zone_id="zoneId",
             application_id="application_id",
             application_type="native",
+            credential_lifetime_seconds=60,
             credential_provider_id="credential_provider_id",
             description="description",
             identifier="x",
@@ -343,6 +345,7 @@ async def test_method_create_with_all_params(self, async_client: AsyncKeycardAPI
             name="x",
             application_id="application_id",
             application_type="native",
+            credential_lifetime_seconds=60,
             credential_provider_id="credential_provider_id",
             description="description",
             metadata={"docs_url": "https://example.com"},
@@ -460,6 +463,7 @@ async def test_method_update_with_all_params(self, async_client: AsyncKeycardAPI
             zone_id="zoneId",
             application_id="application_id",
             application_type="native",
+            credential_lifetime_seconds=60,
             credential_provider_id="credential_provider_id",
             description="description",
             identifier="x",
diff --git a/tests/api_resources/zones/test_users.py b/tests/api_resources/zones/test_users.py
index 3c9ac97..1a256ef 100644
--- a/tests/api_resources/zones/test_users.py
+++ b/tests/api_resources/zones/test_users.py
@@ -85,7 +85,13 @@ def test_method_list_with_all_params(self, client: KeycardAPI) -> None:
             after="x",
             before="x",
             expand="total_count",
+            filter_email="dev@stainless.com",
+            filter_id="string",
             limit=1,
+            query="x",
+            query_email="x",
+            query_subject="x",
+            sort="-authenticated_at,\t\r\r \tauthenticated_at,\n\t\ncreated_at",
         )
         assert_matches_type(UserListResponse, user, path=["response"])
 
@@ -197,7 +203,13 @@ async def test_method_list_with_all_params(self, async_client: AsyncKeycardAPI)
             after="x",
             before="x",
             expand="total_count",
+            filter_email="dev@stainless.com",
+            filter_id="string",
             limit=1,
+            query="x",
+            query_email="x",
+            query_subject="x",
+            sort="-authenticated_at,\t\r\r \tauthenticated_at,\n\t\ncreated_at",
         )
         assert_matches_type(UserListResponse, user, path=["response"])
 

From 1098f3dc1da65c5ecc00c7e132bd8c7b8e8bc4fc Mon Sep 17 00:00:00 2001
From: "stainless-app[bot]"
 <142633134+stainless-app[bot]@users.noreply.github.com>
Date: Thu, 14 May 2026 19:55:22 +0000
Subject: [PATCH 4/6] feat(ACC-277): list policy versions pinned by a
 policy-set draft

---
 .stats.yml                                    |   6 +-
 .../resources/zones/resources.py              |  20 ----
 src/keycardai_api/resources/zones/users.py    | 102 ++----------------
 src/keycardai_api/resources/zones/zones.py    |  26 ++++-
 src/keycardai_api/types/zone.py               |  31 ++----
 src/keycardai_api/types/zone_create_params.py |  31 ++----
 src/keycardai_api/types/zone_list_params.py   |   2 -
 src/keycardai_api/types/zone_update_params.py |  30 ++----
 .../types/zones/applications/resource.py      |   7 --
 .../types/zones/resource_create_params.py     |   6 --
 .../types/zones/resource_update_params.py     |   6 --
 .../types/zones/user_list_params.py           |  25 -----
 tests/api_resources/test_zones.py             |  22 +---
 tests/api_resources/zones/test_resources.py   |   4 -
 tests/api_resources/zones/test_users.py       |  12 ---
 15 files changed, 63 insertions(+), 267 deletions(-)

diff --git a/.stats.yml b/.stats.yml
index 7e7878c..f97c458 100644
--- a/.stats.yml
+++ b/.stats.yml
@@ -1,4 +1,4 @@
 configured_endpoints: 106
-openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/keycard/keycard-api-f29660ebb856f589e75784b8c73a153b1cfee0fe96d7429de4877a790195b408.yml
-openapi_spec_hash: eb42256d0e20dc7906082b149a3c82c1
-config_hash: b0ee2dc67cc490e45f8fe0acabd76206
+openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/keycard/keycard-api-90a3cb5250328e7d73f06ff3b3ca2808a479f428cd5a3b091920def603ea9519.yml
+openapi_spec_hash: 393982b9efe9c6fbdb9532eabd9ca313
+config_hash: 62b00ad8d94230c7c9b8ed142c7dcfc8
diff --git a/src/keycardai_api/resources/zones/resources.py b/src/keycardai_api/resources/zones/resources.py
index 2941cfe..47e8ad6 100644
--- a/src/keycardai_api/resources/zones/resources.py
+++ b/src/keycardai_api/resources/zones/resources.py
@@ -59,7 +59,6 @@ def create(
         name: str,
         application_id: str | Omit = omit,
         application_type: Literal["native", "web"] | Omit = omit,
-        credential_lifetime_seconds: int | Omit = omit,
         credential_provider_id: str | Omit = omit,
         description: Optional[str] | Omit = omit,
         metadata: MetadataParam | Omit = omit,
@@ -89,9 +88,6 @@ def create(
               localhost URLs for redirect_uris or URIs with custom schemes. Web clients must
               use https URLs and must not use localhost as the hostname.
 
-          credential_lifetime_seconds: Credential lifetime override in seconds. When set, overrides the default
-              credential lifetime for this resource.
-
           credential_provider_id: ID of the credential provider to associate with the resource
 
           description: Human-readable description. Must not contain HTML tags (e.g. `<script>`,
@@ -123,7 +119,6 @@ def create(
                     "name": name,
                     "application_id": application_id,
                     "application_type": application_type,
-                    "credential_lifetime_seconds": credential_lifetime_seconds,
                     "credential_provider_id": credential_provider_id,
                     "description": description,
                     "metadata": metadata,
@@ -181,7 +176,6 @@ def update(
         zone_id: str,
         application_id: Optional[str] | Omit = omit,
         application_type: Literal["native", "web"] | Omit = omit,
-        credential_lifetime_seconds: Optional[int] | Omit = omit,
         credential_provider_id: Optional[str] | Omit = omit,
         description: Optional[str] | Omit = omit,
         identifier: str | Omit = omit,
@@ -206,9 +200,6 @@ def update(
               localhost URLs for redirect_uris or URIs with custom schemes. Web clients must
               use https URLs and must not use localhost as the hostname.
 
-          credential_lifetime_seconds: Credential lifetime override in seconds. Set to null to clear the override and
-              use the default.
-
           credential_provider_id: ID of the credential provider to associate with the resource (set to null to
               unset)
 
@@ -246,7 +237,6 @@ def update(
                 {
                     "application_id": application_id,
                     "application_type": application_type,
-                    "credential_lifetime_seconds": credential_lifetime_seconds,
                     "credential_provider_id": credential_provider_id,
                     "description": description,
                     "identifier": identifier,
@@ -394,7 +384,6 @@ async def create(
         name: str,
         application_id: str | Omit = omit,
         application_type: Literal["native", "web"] | Omit = omit,
-        credential_lifetime_seconds: int | Omit = omit,
         credential_provider_id: str | Omit = omit,
         description: Optional[str] | Omit = omit,
         metadata: MetadataParam | Omit = omit,
@@ -424,9 +413,6 @@ async def create(
               localhost URLs for redirect_uris or URIs with custom schemes. Web clients must
               use https URLs and must not use localhost as the hostname.
 
-          credential_lifetime_seconds: Credential lifetime override in seconds. When set, overrides the default
-              credential lifetime for this resource.
-
           credential_provider_id: ID of the credential provider to associate with the resource
 
           description: Human-readable description. Must not contain HTML tags (e.g. `<script>`,
@@ -458,7 +444,6 @@ async def create(
                     "name": name,
                     "application_id": application_id,
                     "application_type": application_type,
-                    "credential_lifetime_seconds": credential_lifetime_seconds,
                     "credential_provider_id": credential_provider_id,
                     "description": description,
                     "metadata": metadata,
@@ -516,7 +501,6 @@ async def update(
         zone_id: str,
         application_id: Optional[str] | Omit = omit,
         application_type: Literal["native", "web"] | Omit = omit,
-        credential_lifetime_seconds: Optional[int] | Omit = omit,
         credential_provider_id: Optional[str] | Omit = omit,
         description: Optional[str] | Omit = omit,
         identifier: str | Omit = omit,
@@ -541,9 +525,6 @@ async def update(
               localhost URLs for redirect_uris or URIs with custom schemes. Web clients must
               use https URLs and must not use localhost as the hostname.
 
-          credential_lifetime_seconds: Credential lifetime override in seconds. Set to null to clear the override and
-              use the default.
-
           credential_provider_id: ID of the credential provider to associate with the resource (set to null to
               unset)
 
@@ -581,7 +562,6 @@ async def update(
                 {
                     "application_id": application_id,
                     "application_type": application_type,
-                    "credential_lifetime_seconds": credential_lifetime_seconds,
                     "credential_provider_id": credential_provider_id,
                     "description": description,
                     "identifier": identifier,
diff --git a/src/keycardai_api/resources/zones/users.py b/src/keycardai_api/resources/zones/users.py
index f79e92f..4edd9f4 100644
--- a/src/keycardai_api/resources/zones/users.py
+++ b/src/keycardai_api/resources/zones/users.py
@@ -7,7 +7,7 @@
 
 import httpx
 
-from ..._types import Body, Omit, Query, Headers, NotGiven, SequenceNotStr, omit, not_given
+from ..._types import Body, Omit, Query, Headers, NotGiven, omit, not_given
 from ..._utils import path_template, maybe_transform, async_maybe_transform
 from ..._compat import cached_property
 from ..._resource import SyncAPIResource, AsyncAPIResource
@@ -88,13 +88,7 @@ def list(
         after: str | Omit = omit,
         before: str | Omit = omit,
         expand: Union[Literal["total_count"], List[Literal["total_count"]]] | Omit = omit,
-        filter_email: Union[str, SequenceNotStr[str]] | Omit = omit,
-        filter_id: Union[str, SequenceNotStr[str]] | Omit = omit,
         limit: int | Omit = omit,
-        query: Union[str, SequenceNotStr[str]] | Omit = omit,
-        query_email: Union[str, SequenceNotStr[str]] | Omit = omit,
-        query_subject: Union[str, SequenceNotStr[str]] | Omit = omit,
-        sort: str | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
         # The extra values given here take precedence over values defined on the client or passed to this method.
         extra_headers: Headers | None = None,
@@ -102,49 +96,17 @@ def list(
         extra_body: Body | None = None,
         timeout: float | httpx.Timeout | None | NotGiven = not_given,
     ) -> UserListResponse:
-        """
-        Returns a list of users in the specified zone.
-
-        **Rollout note:** the paginated/searchable/sortable behavior described below is
-        gated behind the `user-pagination` feature flag and is currently disabled for
-        most zones. While the flag is off, the response returns every user in the zone
-        (capped at 100) in `items` and a fixed pagination envelope where `after_cursor`
-        and `before_cursor` are `null` and `total_count` is `0`. The query parameters
-        below are accepted but ignored. The flag is rolled out per-zone in Datadog and
-        will become the default once Console adopts the paginated contract.
-
-        Use cursor pagination via `after`/`before`. Sort: comma-separated field list;
-        prefix with `-` for descending. Use `expand[]=total_count` to include the
-        matching row count. Filter by exact email via `filter[email]`; search via
-        `query[email]` / `query[subject]` / `query[]` (substring match, OR'd across
-        repeated values). `query[]` matches against email and federation credential
-        subject. Pass `filter[id]` (repeatable, max 100) to restrict results to a known
-        set of users — mutually exclusive with `after`/`before` (returns 400 if
-        combined). When `filter[id]` is set, `limit` is ignored and the response
-        contains every requested user that exists in the zone, in a single page. IDs not
-        in the zone are silently omitted.
+        """Returns a list of users in the specified zone.
+
+        Can be filtered by email address.
 
         Args:
           after: Cursor for forward pagination
 
           before: Cursor for backward pagination
 
-          filter_email: Filter by exact email address
-
-          filter_id: Restrict results to users with this publicId. Repeatable, max 100. Mutually
-              exclusive with after/before.
-
           limit: Maximum number of items to return
 
-          query: Search across email and credential subject (substring match)
-
-          query_email: Search by email (substring match)
-
-          query_subject: Search by federated credential subject (substring match)
-
-          sort: Comma-separated sort fields. Prefix with - for descending. Allowed: created_at,
-              email, authenticated_at
-
           extra_headers: Send extra headers
 
           extra_query: Add additional query parameters to the request
@@ -167,13 +129,7 @@ def list(
                         "after": after,
                         "before": before,
                         "expand": expand,
-                        "filter_email": filter_email,
-                        "filter_id": filter_id,
                         "limit": limit,
-                        "query": query,
-                        "query_email": query_email,
-                        "query_subject": query_subject,
-                        "sort": sort,
                     },
                     user_list_params.UserListParams,
                 ),
@@ -245,13 +201,7 @@ async def list(
         after: str | Omit = omit,
         before: str | Omit = omit,
         expand: Union[Literal["total_count"], List[Literal["total_count"]]] | Omit = omit,
-        filter_email: Union[str, SequenceNotStr[str]] | Omit = omit,
-        filter_id: Union[str, SequenceNotStr[str]] | Omit = omit,
         limit: int | Omit = omit,
-        query: Union[str, SequenceNotStr[str]] | Omit = omit,
-        query_email: Union[str, SequenceNotStr[str]] | Omit = omit,
-        query_subject: Union[str, SequenceNotStr[str]] | Omit = omit,
-        sort: str | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
         # The extra values given here take precedence over values defined on the client or passed to this method.
         extra_headers: Headers | None = None,
@@ -259,49 +209,17 @@ async def list(
         extra_body: Body | None = None,
         timeout: float | httpx.Timeout | None | NotGiven = not_given,
     ) -> UserListResponse:
-        """
-        Returns a list of users in the specified zone.
-
-        **Rollout note:** the paginated/searchable/sortable behavior described below is
-        gated behind the `user-pagination` feature flag and is currently disabled for
-        most zones. While the flag is off, the response returns every user in the zone
-        (capped at 100) in `items` and a fixed pagination envelope where `after_cursor`
-        and `before_cursor` are `null` and `total_count` is `0`. The query parameters
-        below are accepted but ignored. The flag is rolled out per-zone in Datadog and
-        will become the default once Console adopts the paginated contract.
-
-        Use cursor pagination via `after`/`before`. Sort: comma-separated field list;
-        prefix with `-` for descending. Use `expand[]=total_count` to include the
-        matching row count. Filter by exact email via `filter[email]`; search via
-        `query[email]` / `query[subject]` / `query[]` (substring match, OR'd across
-        repeated values). `query[]` matches against email and federation credential
-        subject. Pass `filter[id]` (repeatable, max 100) to restrict results to a known
-        set of users — mutually exclusive with `after`/`before` (returns 400 if
-        combined). When `filter[id]` is set, `limit` is ignored and the response
-        contains every requested user that exists in the zone, in a single page. IDs not
-        in the zone are silently omitted.
+        """Returns a list of users in the specified zone.
+
+        Can be filtered by email address.
 
         Args:
           after: Cursor for forward pagination
 
           before: Cursor for backward pagination
 
-          filter_email: Filter by exact email address
-
-          filter_id: Restrict results to users with this publicId. Repeatable, max 100. Mutually
-              exclusive with after/before.
-
           limit: Maximum number of items to return
 
-          query: Search across email and credential subject (substring match)
-
-          query_email: Search by email (substring match)
-
-          query_subject: Search by federated credential subject (substring match)
-
-          sort: Comma-separated sort fields. Prefix with - for descending. Allowed: created_at,
-              email, authenticated_at
-
           extra_headers: Send extra headers
 
           extra_query: Add additional query parameters to the request
@@ -324,13 +242,7 @@ async def list(
                         "after": after,
                         "before": before,
                         "expand": expand,
-                        "filter_email": filter_email,
-                        "filter_id": filter_id,
                         "limit": limit,
-                        "query": query,
-                        "query_email": query_email,
-                        "query_subject": query_subject,
-                        "sort": sort,
                     },
                     user_list_params.UserListParams,
                 ),
diff --git a/src/keycardai_api/resources/zones/zones.py b/src/keycardai_api/resources/zones/zones.py
index d9b3fae..fcd62a7 100644
--- a/src/keycardai_api/resources/zones/zones.py
+++ b/src/keycardai_api/resources/zones/zones.py
@@ -232,6 +232,7 @@ def create(
         default_mcp_gateway_application: bool | Omit = omit,
         description: Optional[str] | Omit = omit,
         encryption_key: EncryptionKeyAwsKmsConfigParam | Omit = omit,
+        login_flow: Literal["default", "identifier_first"] | Omit = omit,
         protocols: zone_create_params.Protocols | Omit = omit,
         requires_invitation: bool | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
@@ -258,6 +259,9 @@ def create(
           encryption_key: AWS KMS configuration for zone encryption. When not specified, the default
               Keycard Cloud encryption key will be used.
 
+          login_flow: Login flow style for the zone. 'default' uses standard authentication,
+              'identifier_first' uses identifier-based provider routing.
+
           protocols: Protocol configuration for zone creation
 
           requires_invitation: Whether the zone requires an invitation for email/password registration, only
@@ -279,6 +283,7 @@ def create(
                     "default_mcp_gateway_application": default_mcp_gateway_application,
                     "description": description,
                     "encryption_key": encryption_key,
+                    "login_flow": login_flow,
                     "protocols": protocols,
                     "requires_invitation": requires_invitation,
                 },
@@ -336,6 +341,7 @@ def update(
         default_resource_id: Optional[str] | Omit = omit,
         description: Optional[str] | Omit = omit,
         encryption_key: Optional[zone_update_params.EncryptionKey] | Omit = omit,
+        login_flow: Optional[Literal["default", "identifier_first"]] | Omit = omit,
         name: str | Omit = omit,
         protocols: Optional[zone_update_params.Protocols] | Omit = omit,
         requires_invitation: bool | Omit = omit,
@@ -363,6 +369,10 @@ def update(
           encryption_key: AWS KMS configuration for zone encryption update (set to null to remove
               customer-managed key and revert to default)
 
+          login_flow: Login flow style for the zone. 'default' uses standard authentication,
+              'identifier_first' uses identifier-based provider routing. Set to null to reset
+              to 'default'.
+
           name: Human-readable name. Must not contain HTML tags (e.g. `<script>`, `<div>`) or
               control characters.
 
@@ -391,6 +401,7 @@ def update(
                     "default_resource_id": default_resource_id,
                     "description": description,
                     "encryption_key": encryption_key,
+                    "login_flow": login_flow,
                     "name": name,
                     "protocols": protocols,
                     "requires_invitation": requires_invitation,
@@ -411,7 +422,6 @@ def list(
         before: str | Omit = omit,
         cursor: str | Omit = omit,
         expand: Union[Literal["total_count", "permissions"], List[Literal["total_count", "permissions"]]] | Omit = omit,
-        filter_organization_id: str | Omit = omit,
         limit: int | Omit = omit,
         slug: str | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
@@ -452,7 +462,6 @@ def list(
                         "before": before,
                         "cursor": cursor,
                         "expand": expand,
-                        "filter_organization_id": filter_organization_id,
                         "limit": limit,
                         "slug": slug,
                     },
@@ -594,6 +603,7 @@ async def create(
         default_mcp_gateway_application: bool | Omit = omit,
         description: Optional[str] | Omit = omit,
         encryption_key: EncryptionKeyAwsKmsConfigParam | Omit = omit,
+        login_flow: Literal["default", "identifier_first"] | Omit = omit,
         protocols: zone_create_params.Protocols | Omit = omit,
         requires_invitation: bool | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
@@ -620,6 +630,9 @@ async def create(
           encryption_key: AWS KMS configuration for zone encryption. When not specified, the default
               Keycard Cloud encryption key will be used.
 
+          login_flow: Login flow style for the zone. 'default' uses standard authentication,
+              'identifier_first' uses identifier-based provider routing.
+
           protocols: Protocol configuration for zone creation
 
           requires_invitation: Whether the zone requires an invitation for email/password registration, only
@@ -641,6 +654,7 @@ async def create(
                     "default_mcp_gateway_application": default_mcp_gateway_application,
                     "description": description,
                     "encryption_key": encryption_key,
+                    "login_flow": login_flow,
                     "protocols": protocols,
                     "requires_invitation": requires_invitation,
                 },
@@ -698,6 +712,7 @@ async def update(
         default_resource_id: Optional[str] | Omit = omit,
         description: Optional[str] | Omit = omit,
         encryption_key: Optional[zone_update_params.EncryptionKey] | Omit = omit,
+        login_flow: Optional[Literal["default", "identifier_first"]] | Omit = omit,
         name: str | Omit = omit,
         protocols: Optional[zone_update_params.Protocols] | Omit = omit,
         requires_invitation: bool | Omit = omit,
@@ -725,6 +740,10 @@ async def update(
           encryption_key: AWS KMS configuration for zone encryption update (set to null to remove
               customer-managed key and revert to default)
 
+          login_flow: Login flow style for the zone. 'default' uses standard authentication,
+              'identifier_first' uses identifier-based provider routing. Set to null to reset
+              to 'default'.
+
           name: Human-readable name. Must not contain HTML tags (e.g. `<script>`, `<div>`) or
               control characters.
 
@@ -753,6 +772,7 @@ async def update(
                     "default_resource_id": default_resource_id,
                     "description": description,
                     "encryption_key": encryption_key,
+                    "login_flow": login_flow,
                     "name": name,
                     "protocols": protocols,
                     "requires_invitation": requires_invitation,
@@ -773,7 +793,6 @@ async def list(
         before: str | Omit = omit,
         cursor: str | Omit = omit,
         expand: Union[Literal["total_count", "permissions"], List[Literal["total_count", "permissions"]]] | Omit = omit,
-        filter_organization_id: str | Omit = omit,
         limit: int | Omit = omit,
         slug: str | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
@@ -814,7 +833,6 @@ async def list(
                         "before": before,
                         "cursor": cursor,
                         "expand": expand,
-                        "filter_organization_id": filter_organization_id,
                         "limit": limit,
                         "slug": slug,
                     },
diff --git a/src/keycardai_api/types/zone.py b/src/keycardai_api/types/zone.py
index 270623a..95e1c85 100644
--- a/src/keycardai_api/types/zone.py
+++ b/src/keycardai_api/types/zone.py
@@ -1,28 +1,13 @@
 # File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
 
-from typing import Dict, List, Optional
+from typing import Dict, Optional
 from datetime import datetime
+from typing_extensions import Literal
 
 from .._models import BaseModel
 from .encryption_key_aws_kms_config import EncryptionKeyAwsKmsConfig
 
-__all__ = ["Zone", "Protocols", "ProtocolsOauth2", "ProtocolsOauth2Cimd", "ProtocolsOpenid"]
-
-
-class ProtocolsOauth2Cimd(BaseModel):
-    """Client ID Metadata Document auto-provisioning configuration"""
-
-    allowed_client_ids: List[str]
-    """Allowlist for CIMD client_id URLs.
-
-    Each entry is an exact URL, a wildcard origin with a single _ replacing one
-    subdomain label (e.g. https://_.example.com matches https://app.example.com but
-    not https://a.b.example.com), or the literal _ to allow any client. Only one _
-    is permitted per entry.
-    """
-
-    enabled: bool
-    """Whether CIMD auto-provisioning is enabled for unregistered URL-based clients"""
+__all__ = ["Zone", "Protocols", "ProtocolsOauth2", "ProtocolsOpenid"]
 
 
 class ProtocolsOauth2(BaseModel):
@@ -37,9 +22,6 @@ class ProtocolsOauth2(BaseModel):
     (.well-known/oauth-authorization-server)
     """
 
-    cimd: ProtocolsOauth2Cimd
-    """Client ID Metadata Document auto-provisioning configuration"""
-
     dcr_enabled: bool
     """Whether Dynamic Client Registration is enabled"""
 
@@ -124,6 +106,13 @@ class Zone(BaseModel):
     When not specified, the default Keycard Cloud encryption key will be used.
     """
 
+    login_flow: Optional[Literal["default", "identifier_first"]] = None
+    """Login flow style for the zone.
+
+    'default' uses standard authentication, 'identifier_first' uses identifier-based
+    provider routing.
+    """
+
     permissions: Optional[Dict[str, Dict[str, bool]]] = None
     """Permissions granted to the authenticated principal.
 
diff --git a/src/keycardai_api/types/zone_create_params.py b/src/keycardai_api/types/zone_create_params.py
index 4d92484..73dcfee 100644
--- a/src/keycardai_api/types/zone_create_params.py
+++ b/src/keycardai_api/types/zone_create_params.py
@@ -3,12 +3,11 @@
 from __future__ import annotations
 
 from typing import Optional
-from typing_extensions import Required, TypedDict
+from typing_extensions import Literal, Required, TypedDict
 
-from .._types import SequenceNotStr
 from .encryption_key_aws_kms_config_param import EncryptionKeyAwsKmsConfigParam
 
-__all__ = ["ZoneCreateParams", "Protocols", "ProtocolsOauth2", "ProtocolsOauth2Cimd"]
+__all__ = ["ZoneCreateParams", "Protocols", "ProtocolsOauth2"]
 
 
 class ZoneCreateParams(TypedDict, total=False):
@@ -33,6 +32,13 @@ class ZoneCreateParams(TypedDict, total=False):
     When not specified, the default Keycard Cloud encryption key will be used.
     """
 
+    login_flow: Literal["default", "identifier_first"]
+    """Login flow style for the zone.
+
+    'default' uses standard authentication, 'identifier_first' uses identifier-based
+    provider routing.
+    """
+
     protocols: Protocols
     """Protocol configuration for zone creation"""
 
@@ -43,28 +49,9 @@ class ZoneCreateParams(TypedDict, total=False):
     """
 
 
-class ProtocolsOauth2Cimd(TypedDict, total=False):
-    """Client ID Metadata Document auto-provisioning configuration"""
-
-    allowed_client_ids: Required[SequenceNotStr[str]]
-    """Allowlist for CIMD client_id URLs.
-
-    Each entry is an exact URL, a wildcard origin with a single _ replacing one
-    subdomain label (e.g. https://_.example.com matches https://app.example.com but
-    not https://a.b.example.com), or the literal _ to allow any client. Only one _
-    is permitted per entry.
-    """
-
-    enabled: Required[bool]
-    """Whether CIMD auto-provisioning is enabled for unregistered URL-based clients"""
-
-
 class ProtocolsOauth2(TypedDict, total=False):
     """OAuth 2.0 protocol configuration for zone creation"""
 
-    cimd: ProtocolsOauth2Cimd
-    """Client ID Metadata Document auto-provisioning configuration"""
-
     dcr_enabled: bool
     """Whether Dynamic Client Registration is enabled"""
 
diff --git a/src/keycardai_api/types/zone_list_params.py b/src/keycardai_api/types/zone_list_params.py
index 346a856..dd7fe06 100644
--- a/src/keycardai_api/types/zone_list_params.py
+++ b/src/keycardai_api/types/zone_list_params.py
@@ -24,8 +24,6 @@ class ZoneListParams(TypedDict, total=False):
         PropertyInfo(alias="expand[]"),
     ]
 
-    filter_organization_id: Annotated[str, PropertyInfo(alias="filter[organization_id]")]
-
     limit: int
     """Maximum number of items to return"""
 
diff --git a/src/keycardai_api/types/zone_update_params.py b/src/keycardai_api/types/zone_update_params.py
index 642f67f..2bbae9a 100644
--- a/src/keycardai_api/types/zone_update_params.py
+++ b/src/keycardai_api/types/zone_update_params.py
@@ -5,9 +5,7 @@
 from typing import Optional
 from typing_extensions import Literal, Required, TypedDict
 
-from .._types import SequenceNotStr
-
-__all__ = ["ZoneUpdateParams", "EncryptionKey", "Protocols", "ProtocolsOauth2", "ProtocolsOauth2Cimd"]
+__all__ = ["ZoneUpdateParams", "EncryptionKey", "Protocols", "ProtocolsOauth2"]
 
 
 class ZoneUpdateParams(TypedDict, total=False):
@@ -35,6 +33,13 @@ class ZoneUpdateParams(TypedDict, total=False):
     customer-managed key and revert to default)
     """
 
+    login_flow: Optional[Literal["default", "identifier_first"]]
+    """Login flow style for the zone.
+
+    'default' uses standard authentication, 'identifier_first' uses identifier-based
+    provider routing. Set to null to reset to 'default'.
+    """
+
     name: str
     """Human-readable name.
 
@@ -65,28 +70,9 @@ class EncryptionKey(TypedDict, total=False):
     type: Required[Literal["aws"]]
 
 
-class ProtocolsOauth2Cimd(TypedDict, total=False):
-    """Client ID Metadata Document auto-provisioning configuration"""
-
-    allowed_client_ids: Required[SequenceNotStr[str]]
-    """Allowlist for CIMD client_id URLs.
-
-    Each entry is an exact URL, a wildcard origin with a single _ replacing one
-    subdomain label (e.g. https://_.example.com matches https://app.example.com but
-    not https://a.b.example.com), or the literal _ to allow any client. Only one _
-    is permitted per entry.
-    """
-
-    enabled: Required[bool]
-    """Whether CIMD auto-provisioning is enabled for unregistered URL-based clients"""
-
-
 class ProtocolsOauth2(TypedDict, total=False):
     """OAuth 2.0 protocol configuration update for a zone (partial update)"""
 
-    cimd: ProtocolsOauth2Cimd
-    """Client ID Metadata Document auto-provisioning configuration"""
-
     dcr_enabled: Optional[bool]
     """Whether Dynamic Client Registration is enabled"""
 
diff --git a/src/keycardai_api/types/zones/applications/resource.py b/src/keycardai_api/types/zones/applications/resource.py
index a53d8ba..8991db7 100644
--- a/src/keycardai_api/types/zones/applications/resource.py
+++ b/src/keycardai_api/types/zones/applications/resource.py
@@ -71,13 +71,6 @@ class Resource(BaseModel):
     application_id: Optional[str] = None
     """ID of the application that provides this resource"""
 
-    credential_lifetime_seconds: Optional[int] = None
-    """Credential lifetime override in seconds.
-
-    When set, overrides the default credential lifetime for this resource. When
-    absent, the default from the provider or zone is used.
-    """
-
     credential_provider: Optional[Provider] = None
     """
     A Provider is a system that supplies access to Resources and allows actors
diff --git a/src/keycardai_api/types/zones/resource_create_params.py b/src/keycardai_api/types/zones/resource_create_params.py
index 27453fd..9abc2d1 100644
--- a/src/keycardai_api/types/zones/resource_create_params.py
+++ b/src/keycardai_api/types/zones/resource_create_params.py
@@ -35,12 +35,6 @@ class ResourceCreateParams(TypedDict, total=False):
     hostname.
     """
 
-    credential_lifetime_seconds: int
-    """Credential lifetime override in seconds.
-
-    When set, overrides the default credential lifetime for this resource.
-    """
-
     credential_provider_id: str
     """ID of the credential provider to associate with the resource"""
 
diff --git a/src/keycardai_api/types/zones/resource_update_params.py b/src/keycardai_api/types/zones/resource_update_params.py
index 0e910d8..cedcae0 100644
--- a/src/keycardai_api/types/zones/resource_update_params.py
+++ b/src/keycardai_api/types/zones/resource_update_params.py
@@ -26,12 +26,6 @@ class ResourceUpdateParams(TypedDict, total=False):
     hostname.
     """
 
-    credential_lifetime_seconds: Optional[int]
-    """Credential lifetime override in seconds.
-
-    Set to null to clear the override and use the default.
-    """
-
     credential_provider_id: Optional[str]
     """
     ID of the credential provider to associate with the resource (set to null to
diff --git a/src/keycardai_api/types/zones/user_list_params.py b/src/keycardai_api/types/zones/user_list_params.py
index 5ef469f..e66a4c7 100644
--- a/src/keycardai_api/types/zones/user_list_params.py
+++ b/src/keycardai_api/types/zones/user_list_params.py
@@ -5,7 +5,6 @@
 from typing import List, Union
 from typing_extensions import Literal, Annotated, TypedDict
 
-from ..._types import SequenceNotStr
 from ..._utils import PropertyInfo
 
 __all__ = ["UserListParams"]
@@ -20,29 +19,5 @@ class UserListParams(TypedDict, total=False):
 
     expand: Annotated[Union[Literal["total_count"], List[Literal["total_count"]]], PropertyInfo(alias="expand[]")]
 
-    filter_email: Annotated[Union[str, SequenceNotStr[str]], PropertyInfo(alias="filter[email]")]
-    """Filter by exact email address"""
-
-    filter_id: Annotated[Union[str, SequenceNotStr[str]], PropertyInfo(alias="filter[id]")]
-    """Restrict results to users with this publicId.
-
-    Repeatable, max 100. Mutually exclusive with after/before.
-    """
-
     limit: int
     """Maximum number of items to return"""
-
-    query: Annotated[Union[str, SequenceNotStr[str]], PropertyInfo(alias="query[]")]
-    """Search across email and credential subject (substring match)"""
-
-    query_email: Annotated[Union[str, SequenceNotStr[str]], PropertyInfo(alias="query[email]")]
-    """Search by email (substring match)"""
-
-    query_subject: Annotated[Union[str, SequenceNotStr[str]], PropertyInfo(alias="query[subject]")]
-    """Search by federated credential subject (substring match)"""
-
-    sort: str
-    """Comma-separated sort fields.
-
-    Prefix with - for descending. Allowed: created_at, email, authenticated_at
-    """
diff --git a/tests/api_resources/test_zones.py b/tests/api_resources/test_zones.py
index 189aedf..c39b354 100644
--- a/tests/api_resources/test_zones.py
+++ b/tests/api_resources/test_zones.py
@@ -39,12 +39,9 @@ def test_method_create_with_all_params(self, client: KeycardAPI) -> None:
                 "arn": "x",
                 "type": "aws",
             },
+            login_flow="default",
             protocols={
                 "oauth2": {
-                    "cimd": {
-                        "allowed_client_ids": ["string"],
-                        "enabled": True,
-                    },
                     "dcr_enabled": True,
                     "pkce_required": True,
                 }
@@ -150,13 +147,10 @@ def test_method_update_with_all_params(self, client: KeycardAPI) -> None:
                 "arn": "x",
                 "type": "aws",
             },
+            login_flow="default",
             name="x",
             protocols={
                 "oauth2": {
-                    "cimd": {
-                        "allowed_client_ids": ["string"],
-                        "enabled": True,
-                    },
                     "dcr_enabled": True,
                     "pkce_required": True,
                 }
@@ -214,7 +208,6 @@ def test_method_list_with_all_params(self, client: KeycardAPI) -> None:
             before="x",
             cursor="cursor",
             expand="total_count",
-            filter_organization_id="filter[organization_id]",
             limit=1,
             slug="slug",
         )
@@ -309,12 +302,9 @@ async def test_method_create_with_all_params(self, async_client: AsyncKeycardAPI
                 "arn": "x",
                 "type": "aws",
             },
+            login_flow="default",
             protocols={
                 "oauth2": {
-                    "cimd": {
-                        "allowed_client_ids": ["string"],
-                        "enabled": True,
-                    },
                     "dcr_enabled": True,
                     "pkce_required": True,
                 }
@@ -420,13 +410,10 @@ async def test_method_update_with_all_params(self, async_client: AsyncKeycardAPI
                 "arn": "x",
                 "type": "aws",
             },
+            login_flow="default",
             name="x",
             protocols={
                 "oauth2": {
-                    "cimd": {
-                        "allowed_client_ids": ["string"],
-                        "enabled": True,
-                    },
                     "dcr_enabled": True,
                     "pkce_required": True,
                 }
@@ -484,7 +471,6 @@ async def test_method_list_with_all_params(self, async_client: AsyncKeycardAPI)
             before="x",
             cursor="cursor",
             expand="total_count",
-            filter_organization_id="filter[organization_id]",
             limit=1,
             slug="slug",
         )
diff --git a/tests/api_resources/zones/test_resources.py b/tests/api_resources/zones/test_resources.py
index 0e57e9a..33116f7 100644
--- a/tests/api_resources/zones/test_resources.py
+++ b/tests/api_resources/zones/test_resources.py
@@ -39,7 +39,6 @@ def test_method_create_with_all_params(self, client: KeycardAPI) -> None:
             name="x",
             application_id="application_id",
             application_type="native",
-            credential_lifetime_seconds=60,
             credential_provider_id="credential_provider_id",
             description="description",
             metadata={"docs_url": "https://example.com"},
@@ -157,7 +156,6 @@ def test_method_update_with_all_params(self, client: KeycardAPI) -> None:
             zone_id="zoneId",
             application_id="application_id",
             application_type="native",
-            credential_lifetime_seconds=60,
             credential_provider_id="credential_provider_id",
             description="description",
             identifier="x",
@@ -345,7 +343,6 @@ async def test_method_create_with_all_params(self, async_client: AsyncKeycardAPI
             name="x",
             application_id="application_id",
             application_type="native",
-            credential_lifetime_seconds=60,
             credential_provider_id="credential_provider_id",
             description="description",
             metadata={"docs_url": "https://example.com"},
@@ -463,7 +460,6 @@ async def test_method_update_with_all_params(self, async_client: AsyncKeycardAPI
             zone_id="zoneId",
             application_id="application_id",
             application_type="native",
-            credential_lifetime_seconds=60,
             credential_provider_id="credential_provider_id",
             description="description",
             identifier="x",
diff --git a/tests/api_resources/zones/test_users.py b/tests/api_resources/zones/test_users.py
index 1a256ef..3c9ac97 100644
--- a/tests/api_resources/zones/test_users.py
+++ b/tests/api_resources/zones/test_users.py
@@ -85,13 +85,7 @@ def test_method_list_with_all_params(self, client: KeycardAPI) -> None:
             after="x",
             before="x",
             expand="total_count",
-            filter_email="dev@stainless.com",
-            filter_id="string",
             limit=1,
-            query="x",
-            query_email="x",
-            query_subject="x",
-            sort="-authenticated_at,\t\r\r \tauthenticated_at,\n\t\ncreated_at",
         )
         assert_matches_type(UserListResponse, user, path=["response"])
 
@@ -203,13 +197,7 @@ async def test_method_list_with_all_params(self, async_client: AsyncKeycardAPI)
             after="x",
             before="x",
             expand="total_count",
-            filter_email="dev@stainless.com",
-            filter_id="string",
             limit=1,
-            query="x",
-            query_email="x",
-            query_subject="x",
-            sort="-authenticated_at,\t\r\r \tauthenticated_at,\n\t\ncreated_at",
         )
         assert_matches_type(UserListResponse, user, path=["response"])
 

From 1e3311ed7a826618f9fe8a34c438e9cea81d5636 Mon Sep 17 00:00:00 2001
From: "stainless-app[bot]"
 <142633134+stainless-app[bot]@users.noreply.github.com>
Date: Fri, 15 May 2026 17:54:42 +0000
Subject: [PATCH 5/6] feat: accept ID Zone platform principals in management
 API

---
 .stats.yml                                    |   6 +-
 .../resources/zones/resources.py              |  20 ++++
 src/keycardai_api/resources/zones/users.py    | 102 ++++++++++++++++--
 src/keycardai_api/resources/zones/zones.py    |  34 +++---
 src/keycardai_api/types/zone.py               |  31 ++++--
 src/keycardai_api/types/zone_create_params.py |  33 ++++--
 src/keycardai_api/types/zone_list_params.py   |   2 +
 src/keycardai_api/types/zone_update_params.py |  30 ++++--
 .../types/zones/applications/resource.py      |   7 ++
 .../types/zones/resource_create_params.py     |   6 ++
 .../types/zones/resource_update_params.py     |   6 ++
 .../types/zones/user_list_params.py           |  25 +++++
 tests/api_resources/test_zones.py             |  24 ++++-
 tests/api_resources/zones/test_resources.py   |   4 +
 tests/api_resources/zones/test_users.py       |  12 +++
 15 files changed, 284 insertions(+), 58 deletions(-)

diff --git a/.stats.yml b/.stats.yml
index f97c458..d9f05c9 100644
--- a/.stats.yml
+++ b/.stats.yml
@@ -1,4 +1,4 @@
 configured_endpoints: 106
-openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/keycard/keycard-api-90a3cb5250328e7d73f06ff3b3ca2808a479f428cd5a3b091920def603ea9519.yml
-openapi_spec_hash: 393982b9efe9c6fbdb9532eabd9ca313
-config_hash: 62b00ad8d94230c7c9b8ed142c7dcfc8
+openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/keycard/keycard-api-98bb06a2aca1b7ea066960a14eb4879aa4967bc4ed9686b66e60438824ce8415.yml
+openapi_spec_hash: b7bdac3288a2e626465c0baf6df49c17
+config_hash: b0ee2dc67cc490e45f8fe0acabd76206
diff --git a/src/keycardai_api/resources/zones/resources.py b/src/keycardai_api/resources/zones/resources.py
index 47e8ad6..2941cfe 100644
--- a/src/keycardai_api/resources/zones/resources.py
+++ b/src/keycardai_api/resources/zones/resources.py
@@ -59,6 +59,7 @@ def create(
         name: str,
         application_id: str | Omit = omit,
         application_type: Literal["native", "web"] | Omit = omit,
+        credential_lifetime_seconds: int | Omit = omit,
         credential_provider_id: str | Omit = omit,
         description: Optional[str] | Omit = omit,
         metadata: MetadataParam | Omit = omit,
@@ -88,6 +89,9 @@ def create(
               localhost URLs for redirect_uris or URIs with custom schemes. Web clients must
               use https URLs and must not use localhost as the hostname.
 
+          credential_lifetime_seconds: Credential lifetime override in seconds. When set, overrides the default
+              credential lifetime for this resource.
+
           credential_provider_id: ID of the credential provider to associate with the resource
 
           description: Human-readable description. Must not contain HTML tags (e.g. `<script>`,
@@ -119,6 +123,7 @@ def create(
                     "name": name,
                     "application_id": application_id,
                     "application_type": application_type,
+                    "credential_lifetime_seconds": credential_lifetime_seconds,
                     "credential_provider_id": credential_provider_id,
                     "description": description,
                     "metadata": metadata,
@@ -176,6 +181,7 @@ def update(
         zone_id: str,
         application_id: Optional[str] | Omit = omit,
         application_type: Literal["native", "web"] | Omit = omit,
+        credential_lifetime_seconds: Optional[int] | Omit = omit,
         credential_provider_id: Optional[str] | Omit = omit,
         description: Optional[str] | Omit = omit,
         identifier: str | Omit = omit,
@@ -200,6 +206,9 @@ def update(
               localhost URLs for redirect_uris or URIs with custom schemes. Web clients must
               use https URLs and must not use localhost as the hostname.
 
+          credential_lifetime_seconds: Credential lifetime override in seconds. Set to null to clear the override and
+              use the default.
+
           credential_provider_id: ID of the credential provider to associate with the resource (set to null to
               unset)
 
@@ -237,6 +246,7 @@ def update(
                 {
                     "application_id": application_id,
                     "application_type": application_type,
+                    "credential_lifetime_seconds": credential_lifetime_seconds,
                     "credential_provider_id": credential_provider_id,
                     "description": description,
                     "identifier": identifier,
@@ -384,6 +394,7 @@ async def create(
         name: str,
         application_id: str | Omit = omit,
         application_type: Literal["native", "web"] | Omit = omit,
+        credential_lifetime_seconds: int | Omit = omit,
         credential_provider_id: str | Omit = omit,
         description: Optional[str] | Omit = omit,
         metadata: MetadataParam | Omit = omit,
@@ -413,6 +424,9 @@ async def create(
               localhost URLs for redirect_uris or URIs with custom schemes. Web clients must
               use https URLs and must not use localhost as the hostname.
 
+          credential_lifetime_seconds: Credential lifetime override in seconds. When set, overrides the default
+              credential lifetime for this resource.
+
           credential_provider_id: ID of the credential provider to associate with the resource
 
           description: Human-readable description. Must not contain HTML tags (e.g. `<script>`,
@@ -444,6 +458,7 @@ async def create(
                     "name": name,
                     "application_id": application_id,
                     "application_type": application_type,
+                    "credential_lifetime_seconds": credential_lifetime_seconds,
                     "credential_provider_id": credential_provider_id,
                     "description": description,
                     "metadata": metadata,
@@ -501,6 +516,7 @@ async def update(
         zone_id: str,
         application_id: Optional[str] | Omit = omit,
         application_type: Literal["native", "web"] | Omit = omit,
+        credential_lifetime_seconds: Optional[int] | Omit = omit,
         credential_provider_id: Optional[str] | Omit = omit,
         description: Optional[str] | Omit = omit,
         identifier: str | Omit = omit,
@@ -525,6 +541,9 @@ async def update(
               localhost URLs for redirect_uris or URIs with custom schemes. Web clients must
               use https URLs and must not use localhost as the hostname.
 
+          credential_lifetime_seconds: Credential lifetime override in seconds. Set to null to clear the override and
+              use the default.
+
           credential_provider_id: ID of the credential provider to associate with the resource (set to null to
               unset)
 
@@ -562,6 +581,7 @@ async def update(
                 {
                     "application_id": application_id,
                     "application_type": application_type,
+                    "credential_lifetime_seconds": credential_lifetime_seconds,
                     "credential_provider_id": credential_provider_id,
                     "description": description,
                     "identifier": identifier,
diff --git a/src/keycardai_api/resources/zones/users.py b/src/keycardai_api/resources/zones/users.py
index 4edd9f4..f79e92f 100644
--- a/src/keycardai_api/resources/zones/users.py
+++ b/src/keycardai_api/resources/zones/users.py
@@ -7,7 +7,7 @@
 
 import httpx
 
-from ..._types import Body, Omit, Query, Headers, NotGiven, omit, not_given
+from ..._types import Body, Omit, Query, Headers, NotGiven, SequenceNotStr, omit, not_given
 from ..._utils import path_template, maybe_transform, async_maybe_transform
 from ..._compat import cached_property
 from ..._resource import SyncAPIResource, AsyncAPIResource
@@ -88,7 +88,13 @@ def list(
         after: str | Omit = omit,
         before: str | Omit = omit,
         expand: Union[Literal["total_count"], List[Literal["total_count"]]] | Omit = omit,
+        filter_email: Union[str, SequenceNotStr[str]] | Omit = omit,
+        filter_id: Union[str, SequenceNotStr[str]] | Omit = omit,
         limit: int | Omit = omit,
+        query: Union[str, SequenceNotStr[str]] | Omit = omit,
+        query_email: Union[str, SequenceNotStr[str]] | Omit = omit,
+        query_subject: Union[str, SequenceNotStr[str]] | Omit = omit,
+        sort: str | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
         # The extra values given here take precedence over values defined on the client or passed to this method.
         extra_headers: Headers | None = None,
@@ -96,17 +102,49 @@ def list(
         extra_body: Body | None = None,
         timeout: float | httpx.Timeout | None | NotGiven = not_given,
     ) -> UserListResponse:
-        """Returns a list of users in the specified zone.
-
-        Can be filtered by email address.
+        """
+        Returns a list of users in the specified zone.
+
+        **Rollout note:** the paginated/searchable/sortable behavior described below is
+        gated behind the `user-pagination` feature flag and is currently disabled for
+        most zones. While the flag is off, the response returns every user in the zone
+        (capped at 100) in `items` and a fixed pagination envelope where `after_cursor`
+        and `before_cursor` are `null` and `total_count` is `0`. The query parameters
+        below are accepted but ignored. The flag is rolled out per-zone in Datadog and
+        will become the default once Console adopts the paginated contract.
+
+        Use cursor pagination via `after`/`before`. Sort: comma-separated field list;
+        prefix with `-` for descending. Use `expand[]=total_count` to include the
+        matching row count. Filter by exact email via `filter[email]`; search via
+        `query[email]` / `query[subject]` / `query[]` (substring match, OR'd across
+        repeated values). `query[]` matches against email and federation credential
+        subject. Pass `filter[id]` (repeatable, max 100) to restrict results to a known
+        set of users — mutually exclusive with `after`/`before` (returns 400 if
+        combined). When `filter[id]` is set, `limit` is ignored and the response
+        contains every requested user that exists in the zone, in a single page. IDs not
+        in the zone are silently omitted.
 
         Args:
           after: Cursor for forward pagination
 
           before: Cursor for backward pagination
 
+          filter_email: Filter by exact email address
+
+          filter_id: Restrict results to users with this publicId. Repeatable, max 100. Mutually
+              exclusive with after/before.
+
           limit: Maximum number of items to return
 
+          query: Search across email and credential subject (substring match)
+
+          query_email: Search by email (substring match)
+
+          query_subject: Search by federated credential subject (substring match)
+
+          sort: Comma-separated sort fields. Prefix with - for descending. Allowed: created_at,
+              email, authenticated_at
+
           extra_headers: Send extra headers
 
           extra_query: Add additional query parameters to the request
@@ -129,7 +167,13 @@ def list(
                         "after": after,
                         "before": before,
                         "expand": expand,
+                        "filter_email": filter_email,
+                        "filter_id": filter_id,
                         "limit": limit,
+                        "query": query,
+                        "query_email": query_email,
+                        "query_subject": query_subject,
+                        "sort": sort,
                     },
                     user_list_params.UserListParams,
                 ),
@@ -201,7 +245,13 @@ async def list(
         after: str | Omit = omit,
         before: str | Omit = omit,
         expand: Union[Literal["total_count"], List[Literal["total_count"]]] | Omit = omit,
+        filter_email: Union[str, SequenceNotStr[str]] | Omit = omit,
+        filter_id: Union[str, SequenceNotStr[str]] | Omit = omit,
         limit: int | Omit = omit,
+        query: Union[str, SequenceNotStr[str]] | Omit = omit,
+        query_email: Union[str, SequenceNotStr[str]] | Omit = omit,
+        query_subject: Union[str, SequenceNotStr[str]] | Omit = omit,
+        sort: str | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
         # The extra values given here take precedence over values defined on the client or passed to this method.
         extra_headers: Headers | None = None,
@@ -209,17 +259,49 @@ async def list(
         extra_body: Body | None = None,
         timeout: float | httpx.Timeout | None | NotGiven = not_given,
     ) -> UserListResponse:
-        """Returns a list of users in the specified zone.
-
-        Can be filtered by email address.
+        """
+        Returns a list of users in the specified zone.
+
+        **Rollout note:** the paginated/searchable/sortable behavior described below is
+        gated behind the `user-pagination` feature flag and is currently disabled for
+        most zones. While the flag is off, the response returns every user in the zone
+        (capped at 100) in `items` and a fixed pagination envelope where `after_cursor`
+        and `before_cursor` are `null` and `total_count` is `0`. The query parameters
+        below are accepted but ignored. The flag is rolled out per-zone in Datadog and
+        will become the default once Console adopts the paginated contract.
+
+        Use cursor pagination via `after`/`before`. Sort: comma-separated field list;
+        prefix with `-` for descending. Use `expand[]=total_count` to include the
+        matching row count. Filter by exact email via `filter[email]`; search via
+        `query[email]` / `query[subject]` / `query[]` (substring match, OR'd across
+        repeated values). `query[]` matches against email and federation credential
+        subject. Pass `filter[id]` (repeatable, max 100) to restrict results to a known
+        set of users — mutually exclusive with `after`/`before` (returns 400 if
+        combined). When `filter[id]` is set, `limit` is ignored and the response
+        contains every requested user that exists in the zone, in a single page. IDs not
+        in the zone are silently omitted.
 
         Args:
           after: Cursor for forward pagination
 
           before: Cursor for backward pagination
 
+          filter_email: Filter by exact email address
+
+          filter_id: Restrict results to users with this publicId. Repeatable, max 100. Mutually
+              exclusive with after/before.
+
           limit: Maximum number of items to return
 
+          query: Search across email and credential subject (substring match)
+
+          query_email: Search by email (substring match)
+
+          query_subject: Search by federated credential subject (substring match)
+
+          sort: Comma-separated sort fields. Prefix with - for descending. Allowed: created_at,
+              email, authenticated_at
+
           extra_headers: Send extra headers
 
           extra_query: Add additional query parameters to the request
@@ -242,7 +324,13 @@ async def list(
                         "after": after,
                         "before": before,
                         "expand": expand,
+                        "filter_email": filter_email,
+                        "filter_id": filter_id,
                         "limit": limit,
+                        "query": query,
+                        "query_email": query_email,
+                        "query_subject": query_subject,
+                        "sort": sort,
                     },
                     user_list_params.UserListParams,
                 ),
diff --git a/src/keycardai_api/resources/zones/zones.py b/src/keycardai_api/resources/zones/zones.py
index fcd62a7..fcbdb8a 100644
--- a/src/keycardai_api/resources/zones/zones.py
+++ b/src/keycardai_api/resources/zones/zones.py
@@ -232,7 +232,7 @@ def create(
         default_mcp_gateway_application: bool | Omit = omit,
         description: Optional[str] | Omit = omit,
         encryption_key: EncryptionKeyAwsKmsConfigParam | Omit = omit,
-        login_flow: Literal["default", "identifier_first"] | Omit = omit,
+        organization_id: str | Omit = omit,
         protocols: zone_create_params.Protocols | Omit = omit,
         requires_invitation: bool | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
@@ -259,8 +259,9 @@ def create(
           encryption_key: AWS KMS configuration for zone encryption. When not specified, the default
               Keycard Cloud encryption key will be used.
 
-          login_flow: Login flow style for the zone. 'default' uses standard authentication,
-              'identifier_first' uses identifier-based provider routing.
+          organization_id: Target organization ID. Required for platform principals (whose tokens carry no
+              organization claim); for organization-scoped principals it is optional and must
+              match the authenticated organization if supplied.
 
           protocols: Protocol configuration for zone creation
 
@@ -283,7 +284,7 @@ def create(
                     "default_mcp_gateway_application": default_mcp_gateway_application,
                     "description": description,
                     "encryption_key": encryption_key,
-                    "login_flow": login_flow,
+                    "organization_id": organization_id,
                     "protocols": protocols,
                     "requires_invitation": requires_invitation,
                 },
@@ -341,7 +342,6 @@ def update(
         default_resource_id: Optional[str] | Omit = omit,
         description: Optional[str] | Omit = omit,
         encryption_key: Optional[zone_update_params.EncryptionKey] | Omit = omit,
-        login_flow: Optional[Literal["default", "identifier_first"]] | Omit = omit,
         name: str | Omit = omit,
         protocols: Optional[zone_update_params.Protocols] | Omit = omit,
         requires_invitation: bool | Omit = omit,
@@ -369,10 +369,6 @@ def update(
           encryption_key: AWS KMS configuration for zone encryption update (set to null to remove
               customer-managed key and revert to default)
 
-          login_flow: Login flow style for the zone. 'default' uses standard authentication,
-              'identifier_first' uses identifier-based provider routing. Set to null to reset
-              to 'default'.
-
           name: Human-readable name. Must not contain HTML tags (e.g. `<script>`, `<div>`) or
               control characters.
 
@@ -401,7 +397,6 @@ def update(
                     "default_resource_id": default_resource_id,
                     "description": description,
                     "encryption_key": encryption_key,
-                    "login_flow": login_flow,
                     "name": name,
                     "protocols": protocols,
                     "requires_invitation": requires_invitation,
@@ -422,6 +417,7 @@ def list(
         before: str | Omit = omit,
         cursor: str | Omit = omit,
         expand: Union[Literal["total_count", "permissions"], List[Literal["total_count", "permissions"]]] | Omit = omit,
+        filter_organization_id: str | Omit = omit,
         limit: int | Omit = omit,
         slug: str | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
@@ -462,6 +458,7 @@ def list(
                         "before": before,
                         "cursor": cursor,
                         "expand": expand,
+                        "filter_organization_id": filter_organization_id,
                         "limit": limit,
                         "slug": slug,
                     },
@@ -603,7 +600,7 @@ async def create(
         default_mcp_gateway_application: bool | Omit = omit,
         description: Optional[str] | Omit = omit,
         encryption_key: EncryptionKeyAwsKmsConfigParam | Omit = omit,
-        login_flow: Literal["default", "identifier_first"] | Omit = omit,
+        organization_id: str | Omit = omit,
         protocols: zone_create_params.Protocols | Omit = omit,
         requires_invitation: bool | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
@@ -630,8 +627,9 @@ async def create(
           encryption_key: AWS KMS configuration for zone encryption. When not specified, the default
               Keycard Cloud encryption key will be used.
 
-          login_flow: Login flow style for the zone. 'default' uses standard authentication,
-              'identifier_first' uses identifier-based provider routing.
+          organization_id: Target organization ID. Required for platform principals (whose tokens carry no
+              organization claim); for organization-scoped principals it is optional and must
+              match the authenticated organization if supplied.
 
           protocols: Protocol configuration for zone creation
 
@@ -654,7 +652,7 @@ async def create(
                     "default_mcp_gateway_application": default_mcp_gateway_application,
                     "description": description,
                     "encryption_key": encryption_key,
-                    "login_flow": login_flow,
+                    "organization_id": organization_id,
                     "protocols": protocols,
                     "requires_invitation": requires_invitation,
                 },
@@ -712,7 +710,6 @@ async def update(
         default_resource_id: Optional[str] | Omit = omit,
         description: Optional[str] | Omit = omit,
         encryption_key: Optional[zone_update_params.EncryptionKey] | Omit = omit,
-        login_flow: Optional[Literal["default", "identifier_first"]] | Omit = omit,
         name: str | Omit = omit,
         protocols: Optional[zone_update_params.Protocols] | Omit = omit,
         requires_invitation: bool | Omit = omit,
@@ -740,10 +737,6 @@ async def update(
           encryption_key: AWS KMS configuration for zone encryption update (set to null to remove
               customer-managed key and revert to default)
 
-          login_flow: Login flow style for the zone. 'default' uses standard authentication,
-              'identifier_first' uses identifier-based provider routing. Set to null to reset
-              to 'default'.
-
           name: Human-readable name. Must not contain HTML tags (e.g. `<script>`, `<div>`) or
               control characters.
 
@@ -772,7 +765,6 @@ async def update(
                     "default_resource_id": default_resource_id,
                     "description": description,
                     "encryption_key": encryption_key,
-                    "login_flow": login_flow,
                     "name": name,
                     "protocols": protocols,
                     "requires_invitation": requires_invitation,
@@ -793,6 +785,7 @@ async def list(
         before: str | Omit = omit,
         cursor: str | Omit = omit,
         expand: Union[Literal["total_count", "permissions"], List[Literal["total_count", "permissions"]]] | Omit = omit,
+        filter_organization_id: str | Omit = omit,
         limit: int | Omit = omit,
         slug: str | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
@@ -833,6 +826,7 @@ async def list(
                         "before": before,
                         "cursor": cursor,
                         "expand": expand,
+                        "filter_organization_id": filter_organization_id,
                         "limit": limit,
                         "slug": slug,
                     },
diff --git a/src/keycardai_api/types/zone.py b/src/keycardai_api/types/zone.py
index 95e1c85..270623a 100644
--- a/src/keycardai_api/types/zone.py
+++ b/src/keycardai_api/types/zone.py
@@ -1,13 +1,28 @@
 # File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
 
-from typing import Dict, Optional
+from typing import Dict, List, Optional
 from datetime import datetime
-from typing_extensions import Literal
 
 from .._models import BaseModel
 from .encryption_key_aws_kms_config import EncryptionKeyAwsKmsConfig
 
-__all__ = ["Zone", "Protocols", "ProtocolsOauth2", "ProtocolsOpenid"]
+__all__ = ["Zone", "Protocols", "ProtocolsOauth2", "ProtocolsOauth2Cimd", "ProtocolsOpenid"]
+
+
+class ProtocolsOauth2Cimd(BaseModel):
+    """Client ID Metadata Document auto-provisioning configuration"""
+
+    allowed_client_ids: List[str]
+    """Allowlist for CIMD client_id URLs.
+
+    Each entry is an exact URL, a wildcard origin with a single _ replacing one
+    subdomain label (e.g. https://_.example.com matches https://app.example.com but
+    not https://a.b.example.com), or the literal _ to allow any client. Only one _
+    is permitted per entry.
+    """
+
+    enabled: bool
+    """Whether CIMD auto-provisioning is enabled for unregistered URL-based clients"""
 
 
 class ProtocolsOauth2(BaseModel):
@@ -22,6 +37,9 @@ class ProtocolsOauth2(BaseModel):
     (.well-known/oauth-authorization-server)
     """
 
+    cimd: ProtocolsOauth2Cimd
+    """Client ID Metadata Document auto-provisioning configuration"""
+
     dcr_enabled: bool
     """Whether Dynamic Client Registration is enabled"""
 
@@ -106,13 +124,6 @@ class Zone(BaseModel):
     When not specified, the default Keycard Cloud encryption key will be used.
     """
 
-    login_flow: Optional[Literal["default", "identifier_first"]] = None
-    """Login flow style for the zone.
-
-    'default' uses standard authentication, 'identifier_first' uses identifier-based
-    provider routing.
-    """
-
     permissions: Optional[Dict[str, Dict[str, bool]]] = None
     """Permissions granted to the authenticated principal.
 
diff --git a/src/keycardai_api/types/zone_create_params.py b/src/keycardai_api/types/zone_create_params.py
index 73dcfee..73b6526 100644
--- a/src/keycardai_api/types/zone_create_params.py
+++ b/src/keycardai_api/types/zone_create_params.py
@@ -3,11 +3,12 @@
 from __future__ import annotations
 
 from typing import Optional
-from typing_extensions import Literal, Required, TypedDict
+from typing_extensions import Required, TypedDict
 
+from .._types import SequenceNotStr
 from .encryption_key_aws_kms_config_param import EncryptionKeyAwsKmsConfigParam
 
-__all__ = ["ZoneCreateParams", "Protocols", "ProtocolsOauth2"]
+__all__ = ["ZoneCreateParams", "Protocols", "ProtocolsOauth2", "ProtocolsOauth2Cimd"]
 
 
 class ZoneCreateParams(TypedDict, total=False):
@@ -32,11 +33,12 @@ class ZoneCreateParams(TypedDict, total=False):
     When not specified, the default Keycard Cloud encryption key will be used.
     """
 
-    login_flow: Literal["default", "identifier_first"]
-    """Login flow style for the zone.
+    organization_id: str
+    """Target organization ID.
 
-    'default' uses standard authentication, 'identifier_first' uses identifier-based
-    provider routing.
+    Required for platform principals (whose tokens carry no organization claim); for
+    organization-scoped principals it is optional and must match the authenticated
+    organization if supplied.
     """
 
     protocols: Protocols
@@ -49,9 +51,28 @@ class ZoneCreateParams(TypedDict, total=False):
     """
 
 
+class ProtocolsOauth2Cimd(TypedDict, total=False):
+    """Client ID Metadata Document auto-provisioning configuration"""
+
+    allowed_client_ids: Required[SequenceNotStr[str]]
+    """Allowlist for CIMD client_id URLs.
+
+    Each entry is an exact URL, a wildcard origin with a single _ replacing one
+    subdomain label (e.g. https://_.example.com matches https://app.example.com but
+    not https://a.b.example.com), or the literal _ to allow any client. Only one _
+    is permitted per entry.
+    """
+
+    enabled: Required[bool]
+    """Whether CIMD auto-provisioning is enabled for unregistered URL-based clients"""
+
+
 class ProtocolsOauth2(TypedDict, total=False):
     """OAuth 2.0 protocol configuration for zone creation"""
 
+    cimd: ProtocolsOauth2Cimd
+    """Client ID Metadata Document auto-provisioning configuration"""
+
     dcr_enabled: bool
     """Whether Dynamic Client Registration is enabled"""
 
diff --git a/src/keycardai_api/types/zone_list_params.py b/src/keycardai_api/types/zone_list_params.py
index dd7fe06..346a856 100644
--- a/src/keycardai_api/types/zone_list_params.py
+++ b/src/keycardai_api/types/zone_list_params.py
@@ -24,6 +24,8 @@ class ZoneListParams(TypedDict, total=False):
         PropertyInfo(alias="expand[]"),
     ]
 
+    filter_organization_id: Annotated[str, PropertyInfo(alias="filter[organization_id]")]
+
     limit: int
     """Maximum number of items to return"""
 
diff --git a/src/keycardai_api/types/zone_update_params.py b/src/keycardai_api/types/zone_update_params.py
index 2bbae9a..642f67f 100644
--- a/src/keycardai_api/types/zone_update_params.py
+++ b/src/keycardai_api/types/zone_update_params.py
@@ -5,7 +5,9 @@
 from typing import Optional
 from typing_extensions import Literal, Required, TypedDict
 
-__all__ = ["ZoneUpdateParams", "EncryptionKey", "Protocols", "ProtocolsOauth2"]
+from .._types import SequenceNotStr
+
+__all__ = ["ZoneUpdateParams", "EncryptionKey", "Protocols", "ProtocolsOauth2", "ProtocolsOauth2Cimd"]
 
 
 class ZoneUpdateParams(TypedDict, total=False):
@@ -33,13 +35,6 @@ class ZoneUpdateParams(TypedDict, total=False):
     customer-managed key and revert to default)
     """
 
-    login_flow: Optional[Literal["default", "identifier_first"]]
-    """Login flow style for the zone.
-
-    'default' uses standard authentication, 'identifier_first' uses identifier-based
-    provider routing. Set to null to reset to 'default'.
-    """
-
     name: str
     """Human-readable name.
 
@@ -70,9 +65,28 @@ class EncryptionKey(TypedDict, total=False):
     type: Required[Literal["aws"]]
 
 
+class ProtocolsOauth2Cimd(TypedDict, total=False):
+    """Client ID Metadata Document auto-provisioning configuration"""
+
+    allowed_client_ids: Required[SequenceNotStr[str]]
+    """Allowlist for CIMD client_id URLs.
+
+    Each entry is an exact URL, a wildcard origin with a single _ replacing one
+    subdomain label (e.g. https://_.example.com matches https://app.example.com but
+    not https://a.b.example.com), or the literal _ to allow any client. Only one _
+    is permitted per entry.
+    """
+
+    enabled: Required[bool]
+    """Whether CIMD auto-provisioning is enabled for unregistered URL-based clients"""
+
+
 class ProtocolsOauth2(TypedDict, total=False):
     """OAuth 2.0 protocol configuration update for a zone (partial update)"""
 
+    cimd: ProtocolsOauth2Cimd
+    """Client ID Metadata Document auto-provisioning configuration"""
+
     dcr_enabled: Optional[bool]
     """Whether Dynamic Client Registration is enabled"""
 
diff --git a/src/keycardai_api/types/zones/applications/resource.py b/src/keycardai_api/types/zones/applications/resource.py
index 8991db7..a53d8ba 100644
--- a/src/keycardai_api/types/zones/applications/resource.py
+++ b/src/keycardai_api/types/zones/applications/resource.py
@@ -71,6 +71,13 @@ class Resource(BaseModel):
     application_id: Optional[str] = None
     """ID of the application that provides this resource"""
 
+    credential_lifetime_seconds: Optional[int] = None
+    """Credential lifetime override in seconds.
+
+    When set, overrides the default credential lifetime for this resource. When
+    absent, the default from the provider or zone is used.
+    """
+
     credential_provider: Optional[Provider] = None
     """
     A Provider is a system that supplies access to Resources and allows actors
diff --git a/src/keycardai_api/types/zones/resource_create_params.py b/src/keycardai_api/types/zones/resource_create_params.py
index 9abc2d1..27453fd 100644
--- a/src/keycardai_api/types/zones/resource_create_params.py
+++ b/src/keycardai_api/types/zones/resource_create_params.py
@@ -35,6 +35,12 @@ class ResourceCreateParams(TypedDict, total=False):
     hostname.
     """
 
+    credential_lifetime_seconds: int
+    """Credential lifetime override in seconds.
+
+    When set, overrides the default credential lifetime for this resource.
+    """
+
     credential_provider_id: str
     """ID of the credential provider to associate with the resource"""
 
diff --git a/src/keycardai_api/types/zones/resource_update_params.py b/src/keycardai_api/types/zones/resource_update_params.py
index cedcae0..0e910d8 100644
--- a/src/keycardai_api/types/zones/resource_update_params.py
+++ b/src/keycardai_api/types/zones/resource_update_params.py
@@ -26,6 +26,12 @@ class ResourceUpdateParams(TypedDict, total=False):
     hostname.
     """
 
+    credential_lifetime_seconds: Optional[int]
+    """Credential lifetime override in seconds.
+
+    Set to null to clear the override and use the default.
+    """
+
     credential_provider_id: Optional[str]
     """
     ID of the credential provider to associate with the resource (set to null to
diff --git a/src/keycardai_api/types/zones/user_list_params.py b/src/keycardai_api/types/zones/user_list_params.py
index e66a4c7..5ef469f 100644
--- a/src/keycardai_api/types/zones/user_list_params.py
+++ b/src/keycardai_api/types/zones/user_list_params.py
@@ -5,6 +5,7 @@
 from typing import List, Union
 from typing_extensions import Literal, Annotated, TypedDict
 
+from ..._types import SequenceNotStr
 from ..._utils import PropertyInfo
 
 __all__ = ["UserListParams"]
@@ -19,5 +20,29 @@ class UserListParams(TypedDict, total=False):
 
     expand: Annotated[Union[Literal["total_count"], List[Literal["total_count"]]], PropertyInfo(alias="expand[]")]
 
+    filter_email: Annotated[Union[str, SequenceNotStr[str]], PropertyInfo(alias="filter[email]")]
+    """Filter by exact email address"""
+
+    filter_id: Annotated[Union[str, SequenceNotStr[str]], PropertyInfo(alias="filter[id]")]
+    """Restrict results to users with this publicId.
+
+    Repeatable, max 100. Mutually exclusive with after/before.
+    """
+
     limit: int
     """Maximum number of items to return"""
+
+    query: Annotated[Union[str, SequenceNotStr[str]], PropertyInfo(alias="query[]")]
+    """Search across email and credential subject (substring match)"""
+
+    query_email: Annotated[Union[str, SequenceNotStr[str]], PropertyInfo(alias="query[email]")]
+    """Search by email (substring match)"""
+
+    query_subject: Annotated[Union[str, SequenceNotStr[str]], PropertyInfo(alias="query[subject]")]
+    """Search by federated credential subject (substring match)"""
+
+    sort: str
+    """Comma-separated sort fields.
+
+    Prefix with - for descending. Allowed: created_at, email, authenticated_at
+    """
diff --git a/tests/api_resources/test_zones.py b/tests/api_resources/test_zones.py
index c39b354..4d8d51d 100644
--- a/tests/api_resources/test_zones.py
+++ b/tests/api_resources/test_zones.py
@@ -39,9 +39,13 @@ def test_method_create_with_all_params(self, client: KeycardAPI) -> None:
                 "arn": "x",
                 "type": "aws",
             },
-            login_flow="default",
+            organization_id="organization_id",
             protocols={
                 "oauth2": {
+                    "cimd": {
+                        "allowed_client_ids": ["string"],
+                        "enabled": True,
+                    },
                     "dcr_enabled": True,
                     "pkce_required": True,
                 }
@@ -147,10 +151,13 @@ def test_method_update_with_all_params(self, client: KeycardAPI) -> None:
                 "arn": "x",
                 "type": "aws",
             },
-            login_flow="default",
             name="x",
             protocols={
                 "oauth2": {
+                    "cimd": {
+                        "allowed_client_ids": ["string"],
+                        "enabled": True,
+                    },
                     "dcr_enabled": True,
                     "pkce_required": True,
                 }
@@ -208,6 +215,7 @@ def test_method_list_with_all_params(self, client: KeycardAPI) -> None:
             before="x",
             cursor="cursor",
             expand="total_count",
+            filter_organization_id="filter[organization_id]",
             limit=1,
             slug="slug",
         )
@@ -302,9 +310,13 @@ async def test_method_create_with_all_params(self, async_client: AsyncKeycardAPI
                 "arn": "x",
                 "type": "aws",
             },
-            login_flow="default",
+            organization_id="organization_id",
             protocols={
                 "oauth2": {
+                    "cimd": {
+                        "allowed_client_ids": ["string"],
+                        "enabled": True,
+                    },
                     "dcr_enabled": True,
                     "pkce_required": True,
                 }
@@ -410,10 +422,13 @@ async def test_method_update_with_all_params(self, async_client: AsyncKeycardAPI
                 "arn": "x",
                 "type": "aws",
             },
-            login_flow="default",
             name="x",
             protocols={
                 "oauth2": {
+                    "cimd": {
+                        "allowed_client_ids": ["string"],
+                        "enabled": True,
+                    },
                     "dcr_enabled": True,
                     "pkce_required": True,
                 }
@@ -471,6 +486,7 @@ async def test_method_list_with_all_params(self, async_client: AsyncKeycardAPI)
             before="x",
             cursor="cursor",
             expand="total_count",
+            filter_organization_id="filter[organization_id]",
             limit=1,
             slug="slug",
         )
diff --git a/tests/api_resources/zones/test_resources.py b/tests/api_resources/zones/test_resources.py
index 33116f7..0e57e9a 100644
--- a/tests/api_resources/zones/test_resources.py
+++ b/tests/api_resources/zones/test_resources.py
@@ -39,6 +39,7 @@ def test_method_create_with_all_params(self, client: KeycardAPI) -> None:
             name="x",
             application_id="application_id",
             application_type="native",
+            credential_lifetime_seconds=60,
             credential_provider_id="credential_provider_id",
             description="description",
             metadata={"docs_url": "https://example.com"},
@@ -156,6 +157,7 @@ def test_method_update_with_all_params(self, client: KeycardAPI) -> None:
             zone_id="zoneId",
             application_id="application_id",
             application_type="native",
+            credential_lifetime_seconds=60,
             credential_provider_id="credential_provider_id",
             description="description",
             identifier="x",
@@ -343,6 +345,7 @@ async def test_method_create_with_all_params(self, async_client: AsyncKeycardAPI
             name="x",
             application_id="application_id",
             application_type="native",
+            credential_lifetime_seconds=60,
             credential_provider_id="credential_provider_id",
             description="description",
             metadata={"docs_url": "https://example.com"},
@@ -460,6 +463,7 @@ async def test_method_update_with_all_params(self, async_client: AsyncKeycardAPI
             zone_id="zoneId",
             application_id="application_id",
             application_type="native",
+            credential_lifetime_seconds=60,
             credential_provider_id="credential_provider_id",
             description="description",
             identifier="x",
diff --git a/tests/api_resources/zones/test_users.py b/tests/api_resources/zones/test_users.py
index 3c9ac97..1a256ef 100644
--- a/tests/api_resources/zones/test_users.py
+++ b/tests/api_resources/zones/test_users.py
@@ -85,7 +85,13 @@ def test_method_list_with_all_params(self, client: KeycardAPI) -> None:
             after="x",
             before="x",
             expand="total_count",
+            filter_email="dev@stainless.com",
+            filter_id="string",
             limit=1,
+            query="x",
+            query_email="x",
+            query_subject="x",
+            sort="-authenticated_at,\t\r\r \tauthenticated_at,\n\t\ncreated_at",
         )
         assert_matches_type(UserListResponse, user, path=["response"])
 
@@ -197,7 +203,13 @@ async def test_method_list_with_all_params(self, async_client: AsyncKeycardAPI)
             after="x",
             before="x",
             expand="total_count",
+            filter_email="dev@stainless.com",
+            filter_id="string",
             limit=1,
+            query="x",
+            query_email="x",
+            query_subject="x",
+            sort="-authenticated_at,\t\r\r \tauthenticated_at,\n\t\ncreated_at",
         )
         assert_matches_type(UserListResponse, user, path=["response"])
 

From b3c9dae0212aa11b00789cf352a371254dbb3013 Mon Sep 17 00:00:00 2001
From: "stainless-app[bot]"
 <142633134+stainless-app[bot]@users.noreply.github.com>
Date: Fri, 15 May 2026 17:55:03 +0000
Subject: [PATCH 6/6] release: 0.11.0

---
 .release-please-manifest.json |  2 +-
 CHANGELOG.md                  | 15 +++++++++++++++
 pyproject.toml                |  2 +-
 src/keycardai_api/_version.py |  2 +-
 4 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index 091cfb1..f7014c3 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "0.10.0"
+  ".": "0.11.0"
 }
\ No newline at end of file
diff --git a/CHANGELOG.md b/CHANGELOG.md
index f01f6c4..b54ceb4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,20 @@
 # Changelog
 
+## 0.11.0 (2026-05-15)
+
+Full Changelog: [v0.10.0...v0.11.0](https://github.com/keycardai/keycard-python/compare/v0.10.0...v0.11.0)
+
+### Features
+
+* **ACC-277:** list policy versions pinned by a policy-set draft ([1098f3d](https://github.com/keycardai/keycard-python/commit/1098f3dc1da65c5ecc00c7e132bd8c7b8e8bc4fc))
+* accept ID Zone platform principals in management API ([1e3311e](https://github.com/keycardai/keycard-python/commit/1e3311ed7a826618f9fe8a34c438e9cea81d5636))
+* add jwt_lifetime_seconds to resources ([090a5cd](https://github.com/keycardai/keycard-python/commit/090a5cd8c0f02bc29b29a74b525924fff94320a7))
+
+
+### Bug Fixes
+
+* housekeeping ([744a2af](https://github.com/keycardai/keycard-python/commit/744a2afd2465cc5c67ee665636f89675d0913192))
+
 ## 0.10.0 (2026-05-11)
 
 Full Changelog: [v0.9.1...v0.10.0](https://github.com/keycardai/keycard-python/compare/v0.9.1...v0.10.0)
diff --git a/pyproject.toml b/pyproject.toml
index cfc7ce1..bfa48fe 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "keycardai_api"
-version = "0.10.0"
+version = "0.11.0"
 description = "The official Python library for the keycard-api API"
 dynamic = ["readme"]
 license = "Apache-2.0"
diff --git a/src/keycardai_api/_version.py b/src/keycardai_api/_version.py
index d472cc7..fb2e193 100644
--- a/src/keycardai_api/_version.py
+++ b/src/keycardai_api/_version.py
@@ -1,4 +1,4 @@
 # File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
 
 __title__ = "keycardai_api"
-__version__ = "0.10.0"  # x-release-please-version
+__version__ = "0.11.0"  # x-release-please-version