merge main

shared/management/http/api/openapi.yml

@@ -3713,6 +3713,177 @@ components:
           example: "https://invoice.stripe.com/i/acct_1M2DaBKina4I2KUb/test_YWNjdF8xTTJEdVBLaW5hM0kyS1ViLF1SeFpQdEJZd3lUOGNEajNqeWdrdXY2RFM4aHcyCnpsLDEzMjg3GTgyNQ02000JoIHc1X?s=db"
       required:
         - url
+    MSPStatusResponse:
+      type: object
+      properties:
+        id:
+          type: string
+          description: Tenant account ID (present only for tenants)
+          example: ch8i4ug6lnn4g9hqv7m0
+        parent:
+          type: string
+          description: Parent MSP account ID (present only for tenants)
+          example: ch8i4ug6lnn4g9hqv7m1
+        activated_at:
+          type: string
+          description: MSP or Tenant activation timestamp in RFC3339 format
+          example: "2024-01-01T00:00:00Z"
+        invited_at:
+          type: string
+          description: Tenant invitation timestamp in RFC3339 format (present only for tenants)
+          example: "2024-01-01T00:00:00Z"
+        status:
+          type: string
+          description: Tenant status (present only for tenants)
+          enum: ["existing", "invited", "pending", "active"]
+          example: active
+        name:
+          type: string
+          description: MSP name (present only for MSP accounts)
+          example: "My MSP"
+        domain:
+          type: string
+          description: MSP domain (present only for MSP accounts)
+          example: "msp.com"
+        has_reseller:
+          type: boolean
+          description: Whether the MSP has a reseller (present only for MSP accounts)
+          default: false
+          example: false
+        is_reseller:
+          type: boolean
+          description: Whether the account is a reseller
+          default: false
+          example: false
+        parent_name:
+          type: string
+          description: Parent MSP name (present only for tenants)
+          example: "My MSP"
+        parent_domain:
+          type: string
+          description: Parent MSP domain (present only for tenants)
+          example: "msp.com"
+        parent_owner_name:
+          type: string
+          description: Parent MSP owner name
+          example: "John Doe"
+        parent_owner_email:
+          type: string
+          description: Parent MSP owner email
+          example: "john@msp.com"
+    ResellerStatusResponse:
+      type: object
+      properties:
+        activated_at:
+          type: string
+          description: Reseller activation timestamp in RFC3339 format
+          example: "2024-01-01T00:00:00Z"
+        name:
+          type: string
+          description: Reseller name
+          example: "My Reseller"
+        domain:
+          type: string
+          description: Reseller domain
+          example: "reseller.com"
+        parent_owner_name:
+          type: string
+          description: Reseller owner name
+          example: "John Doe"
+        parent_owner_email:
+          type: string
+          description: Reseller owner email
+          example: "john@reseller.com"
+    ResellerMSPResponse:
+      type: object
+      description: An MSP account managed (or invited) by a reseller.
+      properties:
+        id:
+          type: string
+          description: The MSP account ID.
+          example: ch8i4ug6lnn4g9hqv7m0
+        name:
+          type: string
+          description: Display name of the MSP.
+          example: "Partner MSP"
+        domain:
+          type: string
+          description: The MSP account domain.
+          example: "partner-msp.com"
+        status:
+          type: string
+          description: |
+            Lifecycle status of the reseller↔MSP relationship.
+            * `existing` — MSP exists in the system but has not yet been invited.
+            * `invited` — Reseller has invited the MSP; MSP user has not accepted.
+            * `active` — MSP user accepted; reseller manages the account.
+          enum:
+            - existing
+            - invited
+            - active
+          example: "active"
+        tenant_number:
+          type: integer
+          description: Number of manageable (active or pending) tenants under this MSP.
+          example: 12
+        reseller_customer_id:
+          type: string
+          description: Reseller's internal customer reference for this MSP.
+          example: "CUST-12345"
+        activated_at:
+          type: string
+          format: date-time
+          description: When the MSP account was activated.
+          example: "2026-04-01T12:00:00Z"
+        invited_at:
+          type: string
+          format: date-time
+          description: When the reseller invited the MSP (set only if invited).
+          example: "2026-04-15T09:30:00Z"
+      required:
+        - id
+        - name
+        - domain
+        - status
+        - tenant_number
+    GetResellerMSPsResponse:
+      type: array
+      items:
+        $ref: "#/components/schemas/ResellerMSPResponse"
+    CreateResellerMSPRequest:
+      type: object
+      properties:
+        name:
+          type: string
+          description: The name for the MSP
+          example: "New Partner MSP"
+        domain:
+          type: string
+          description: The domain for the MSP
+          example: "new-partner.com"
+        priceID:
+          type: string
+          description: Stripe price ID to set up managed subscription for the MSP
+          example: "price_1234"
+        reseller_customer_id:
+          type: string
+          description: Reseller's internal customer reference for this MSP
+          example: "CUST-12345"
+      required:
+        - name
+        - domain
+    UpdateResellerMSPRequest:
+      type: object
+      description: Mutable fields the reseller can update on a managed MSP.
+      properties:
+        name:
+          type: string
+          description: New display name for the MSP. Whitespace is trimmed; empty/whitespace-only values are rejected.
+          example: "Renamed MSP"
+        reseller_customer_id:
+          type: string
+          description: New reseller customer reference. Pass empty string to clear.
+          example: "CUST-67890"
     CreateTenantRequest:
       type: object
       properties:
@@ -8845,6 +9016,241 @@ paths:
           $ref: "#/components/responses/requires_authentication"
         "500":
           $ref: "#/components/responses/internal_error"
+  /api/integrations/msp:
+    get:
+      summary: Get MSP or Tenant status
+      description: Returns the MSP, Tenant, or Reseller status of the authenticated account
+      tags:
+        - MSP
+      responses:
+        "200":
+          description: MSP or Tenant status response
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/MSPStatusResponse"
+        "401":
+          $ref: "#/components/responses/requires_authentication"
+        "500":
+          $ref: "#/components/responses/internal_error"
+    post:
+      summary: Create MSP account
+      description: Activates the authenticated account as an MSP
+      tags:
+        - MSP
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                invite:
+                  type: string
+                  description: The invite code
+                  example: "705860a1-27a3-4976-bf63-c5cd2fc1582b"
+              required:
+                - invite
+      responses:
+        "200":
+          description: MSP account created or already exists
+        "400":
+          $ref: "#/components/responses/bad_request"
+        "401":
+          $ref: "#/components/responses/requires_authentication"
+        "403":
+          $ref: "#/components/responses/forbidden"
+        "412":
+          description: MSP account requirements not met
+        "500":
+          $ref: "#/components/responses/internal_error"
+  /api/integrations/msp/reseller:
+    get:
+      summary: Get Reseller status
+      description: Returns the reseller status of the authenticated account
+      tags:
+        - MSP
+      responses:
+        "200":
+          description: Reseller status response
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ResellerStatusResponse"
+        "401":
+          $ref: "#/components/responses/requires_authentication"
+        "500":
+          $ref: "#/components/responses/internal_error"
+  /api/integrations/msp/reseller/msps:
+    get:
+      summary: List MSPs under reseller
+      tags:
+        - MSP
+      responses:
+        "200":
+          description: List of MSPs managed by the reseller
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/GetResellerMSPsResponse"
+        "401":
+          $ref: "#/components/responses/requires_authentication"
+        "403":
+          $ref: "#/components/responses/forbidden"
+        "500":
+          $ref: "#/components/responses/internal_error"
+    post:
+      summary: Create MSP under reseller
+      description: Creates a new MSP account managed by the reseller. No domain validation required.
+      tags:
+        - MSP
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/CreateResellerMSPRequest"
+      responses:
+        "200":
+          description: MSP created successfully
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ResellerMSPResponse"
+        "400":
+          $ref: "#/components/responses/bad_request"
+        "401":
+          $ref: "#/components/responses/requires_authentication"
+        "403":
+          $ref: "#/components/responses/forbidden"
+        "409":
+          description: MSP already exists for this domain
+        "500":
+          $ref: "#/components/responses/internal_error"
+  /api/integrations/msp/reseller/msps/{id}:
+    put:
+      summary: Update MSP fields managed by reseller
+      description: Update editable reseller-level fields on an MSP (e.g. reseller_customer_id)
+      tags:
+        - MSP
+      parameters:
+        - in: path
+          name: id
+          required: true
+          schema:
+            type: string
+          description: The MSP account ID to update
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/UpdateResellerMSPRequest"
+      responses:
+        "200":
+          description: MSP updated successfully
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ResellerMSPResponse"
+        "400":
+          $ref: "#/components/responses/bad_request"
+        "401":
+          $ref: "#/components/responses/requires_authentication"
+        "403":
+          $ref: "#/components/responses/forbidden"
+        "404":
+          description: MSP not found or not managed by this reseller
+        "500":
+          $ref: "#/components/responses/internal_error"
+    delete:
+      summary: Unlink MSP from reseller
+      tags:
+        - MSP
+      parameters:
+        - in: path
+          name: id
+          required: true
+          schema:
+            type: string
+          description: The MSP account ID to unlink
+      responses:
+        "200":
+          description: MSP unlinked successfully
+        "401":
+          $ref: "#/components/responses/requires_authentication"
+        "403":
+          $ref: "#/components/responses/forbidden"
+        "404":
+          description: MSP not found or not managed by this reseller
+        "500":
+          $ref: "#/components/responses/internal_error"
+  /api/integrations/msp/reseller/msps/{id}/invite:
+    post:
+      summary: Invite existing MSP to reseller
+      description: Sends an invitation to an existing MSP to join the reseller
+      tags:
+        - MSP
+      parameters:
+        - in: path
+          name: id
+          required: true
+          schema:
+            type: string
+          description: The MSP account ID to invite
+      responses:
+        "200":
+          description: Invitation sent successfully
+        "401":
+          $ref: "#/components/responses/requires_authentication"
+        "403":
+          $ref: "#/components/responses/forbidden"
+        "404":
+          description: MSP not found
+        "412":
+          description: MSP is already managed by a reseller
+        "500":
+          $ref: "#/components/responses/internal_error"
+    put:
+      summary: Accept or decline reseller invitation
+      description: MSP owner accepts or declines an invitation from a reseller
+      tags:
+        - MSP
+      parameters:
+        - in: path
+          name: id
+          required: true
+          schema:
+            type: string
+          description: The MSP account ID
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                value:
+                  type: string
+                  description: Accept or decline the invitation
+                  enum:
+                    - accept
+                    - decline
+              required:
+                - value
+      responses:
+        "200":
+          description: Invitation response processed
+        "400":
+          $ref: "#/components/responses/bad_request"
+        "401":
+          $ref: "#/components/responses/requires_authentication"
+        "403":
+          $ref: "#/components/responses/forbidden"
+        "404":
+          description: MSP not found or no pending invitation
+        "500":
+          $ref: "#/components/responses/internal_error"
   /api/integrations/msp/tenants:
     get:
       summary: Get MSP tenants
@@ -9082,6 +9488,165 @@ paths:
           description: The tenant was not found
         "500":
           $ref: "#/components/responses/internal_error"
+  /api/integrations/msp/reseller/msps/{id}/subscription:
+    post:
+      summary: Create MSP subscription under reseller
+      description: Creates a managed Stripe subscription for an MSP managed by the reseller
+      tags:
+        - MSP
+      parameters:
+        - in: path
+          name: id
+          required: true
+          schema:
+            type: string
+          description: The MSP account ID
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                priceID:
+                  type: string
+                  description: The Stripe price ID for the plan
+              required:
+                - priceID
+      responses:
+        "200":
+          description: Subscription created successfully
+        "400":
+          $ref: "#/components/responses/bad_request"
+        "401":
+          $ref: "#/components/responses/requires_authentication"
+        "403":
+          $ref: "#/components/responses/forbidden"
+        "404":
+          description: MSP not found or not managed by this reseller
+        "412":
+          description: MSP already has an active subscription or reseller has no subscription
+        "500":
+          $ref: "#/components/responses/internal_error"
+    put:
+      summary: Change MSP subscription plan
+      description: Changes the plan of an MSP subscription managed by the reseller
+      tags:
+        - MSP
+      parameters:
+        - in: path
+          name: id
+          required: true
+          schema:
+            type: string
+          description: The MSP account ID
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                priceID:
+                  type: string
+                  description: The new Stripe price ID
+              required:
+                - priceID
+      responses:
+        "200":
+          description: Subscription updated successfully
+        "400":
+          $ref: "#/components/responses/bad_request"
+        "401":
+          $ref: "#/components/responses/requires_authentication"
+        "403":
+          $ref: "#/components/responses/forbidden"
+        "404":
+          description: MSP not found or not managed by this reseller
+        "412":
+          description: Subscription was recently updated
+        "500":
+          $ref: "#/components/responses/internal_error"
+  /api/integrations/msp/reseller/invoices:
+    get:
+      summary: List reseller invoices
+      description: Returns paid invoices for the reseller account
+      tags:
+        - MSP
+      responses:
+        "200":
+          description: List of paid invoices
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/InvoiceResponse"
+        "401":
+          $ref: "#/components/responses/requires_authentication"
+        "403":
+          $ref: "#/components/responses/forbidden"
+        "404":
+          description: No invoices found
+        "500":
+          $ref: "#/components/responses/internal_error"
+  /api/integrations/msp/reseller/invoices/{invoiceId}/pdf:
+    get:
+      summary: Get reseller invoice PDF
+      description: Returns the Stripe hosted URL for a reseller invoice
+      tags:
+        - MSP
+      parameters:
+        - in: path
+          name: invoiceId
+          required: true
+          schema:
+            type: string
+          description: The Stripe invoice ID
+      responses:
+        "200":
+          description: Invoice PDF URL
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/InvoicePDFResponse"
+        "401":
+          $ref: "#/components/responses/requires_authentication"
+        "403":
+          $ref: "#/components/responses/forbidden"
+        "404":
+          description: Invoice not found
+        "500":
+          $ref: "#/components/responses/internal_error"
+  /api/integrations/msp/reseller/invoices/{invoiceId}/csv:
+    get:
+      summary: Get reseller invoice CSV
+      description: Returns the invoice data as CSV
+      tags:
+        - MSP
+      parameters:
+        - in: path
+          name: invoiceId
+          required: true
+          schema:
+            type: string
+          description: The Stripe invoice ID
+      responses:
+        "200":
+          description: CSV file
+          content:
+            text/csv:
+              schema:
+                type: string
+                format: binary
+        "401":
+          $ref: "#/components/responses/requires_authentication"
+        "403":
+          $ref: "#/components/responses/forbidden"
+        "404":
+          description: Invoice not found
+        "500":
+          $ref: "#/components/responses/internal_error"
   /api/integrations/edr/intune:
     post:
       tags:

shared/management/http/api/types.gen.go

@@ -1,6 +1,6 @@
 // Package api provides primitives to interact with the openapi HTTP API.
 //
-// Code generated by github.com/oapi-codegen/oapi-codegen/v2 version v2.6.0 DO NOT EDIT.
+// Code generated by github.com/oapi-codegen/oapi-codegen/v2 version v2.7.0 DO NOT EDIT.
 package api
 
 import (
@@ -13,8 +13,8 @@ import (
 )
 
 const (
-	BearerAuthScopes = "BearerAuth.Scopes"
-	TokenAuthScopes  = "TokenAuth.Scopes"
+	BearerAuthScopes bearerAuthContextKey = "BearerAuth.Scopes"
+	TokenAuthScopes  tokenAuthContextKey  = "TokenAuth.Scopes"
 )
 
 // Defines values for AccessRestrictionsCrowdsecMode.
@@ -511,6 +511,7 @@ func (e GroupMinimumIssued) Valid() bool {
 
 // Defines values for IdentityProviderType.
 const (
+	IdentityProviderTypeAdfs      IdentityProviderType = "adfs"
 	IdentityProviderTypeEntra     IdentityProviderType = "entra"
 	IdentityProviderTypeGoogle    IdentityProviderType = "google"
 	IdentityProviderTypeMicrosoft IdentityProviderType = "microsoft"
@@ -518,12 +519,13 @@ const (
 	IdentityProviderTypeOkta      IdentityProviderType = "okta"
 	IdentityProviderTypePocketid  IdentityProviderType = "pocketid"
 	IdentityProviderTypeZitadel   IdentityProviderType = "zitadel"
-	IdentityProviderTypeAdfs      IdentityProviderType = "adfs"
 )
 
 // Valid indicates whether the value is a known member of the IdentityProviderType enum.
 func (e IdentityProviderType) Valid() bool {
 	switch e {
+	case IdentityProviderTypeAdfs:
+		return true
 	case IdentityProviderTypeEntra:
 		return true
 	case IdentityProviderTypeGoogle:
@@ -538,8 +540,6 @@ func (e IdentityProviderType) Valid() bool {
 		return true
 	case IdentityProviderTypeZitadel:
 		return true
-	case IdentityProviderTypeAdfs:
-		return true
 	default:
 		return false
 	}
@@ -671,6 +671,30 @@ func (e JobResponseStatus) Valid() bool {
 	}
 }
 
+// Defines values for MSPStatusResponseStatus.
+const (
+	MSPStatusResponseStatusActive   MSPStatusResponseStatus = "active"
+	MSPStatusResponseStatusExisting MSPStatusResponseStatus = "existing"
+	MSPStatusResponseStatusInvited  MSPStatusResponseStatus = "invited"
+	MSPStatusResponseStatusPending  MSPStatusResponseStatus = "pending"
+)
+
+// Valid indicates whether the value is a known member of the MSPStatusResponseStatus enum.
+func (e MSPStatusResponseStatus) Valid() bool {
+	switch e {
+	case MSPStatusResponseStatusActive:
+		return true
+	case MSPStatusResponseStatusExisting:
+		return true
+	case MSPStatusResponseStatusInvited:
+		return true
+	case MSPStatusResponseStatusPending:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for NameserverNsType.
 const (
 	NameserverNsTypeUdp NameserverNsType = "udp"
@@ -878,6 +902,27 @@ func (e PolicyRuleUpdateProtocol) Valid() bool {
 	}
 }
 
+// Defines values for ResellerMSPResponseStatus.
+const (
+	ResellerMSPResponseStatusActive   ResellerMSPResponseStatus = "active"
+	ResellerMSPResponseStatusExisting ResellerMSPResponseStatus = "existing"
+	ResellerMSPResponseStatusInvited  ResellerMSPResponseStatus = "invited"
+)
+
+// Valid indicates whether the value is a known member of the ResellerMSPResponseStatus enum.
+func (e ResellerMSPResponseStatus) Valid() bool {
+	switch e {
+	case ResellerMSPResponseStatusActive:
+		return true
+	case ResellerMSPResponseStatusExisting:
+		return true
+	case ResellerMSPResponseStatusInvited:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for ResourceType.
 const (
 	ResourceTypeDomain ResourceType = "domain"
@@ -1319,6 +1364,24 @@ func (e GetApiEventsProxyParamsStatus) Valid() bool {
 	}
 }
 
+// Defines values for PutApiIntegrationsMspResellerMspsIdInviteJSONBodyValue.
+const (
+	PutApiIntegrationsMspResellerMspsIdInviteJSONBodyValueAccept  PutApiIntegrationsMspResellerMspsIdInviteJSONBodyValue = "accept"
+	PutApiIntegrationsMspResellerMspsIdInviteJSONBodyValueDecline PutApiIntegrationsMspResellerMspsIdInviteJSONBodyValue = "decline"
+)
+
+// Valid indicates whether the value is a known member of the PutApiIntegrationsMspResellerMspsIdInviteJSONBodyValue enum.
+func (e PutApiIntegrationsMspResellerMspsIdInviteJSONBodyValue) Valid() bool {
+	switch e {
+	case PutApiIntegrationsMspResellerMspsIdInviteJSONBodyValueAccept:
+		return true
+	case PutApiIntegrationsMspResellerMspsIdInviteJSONBodyValueDecline:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for PutApiIntegrationsMspTenantsIdInviteJSONBodyValue.
 const (
 	PutApiIntegrationsMspTenantsIdInviteJSONBodyValueAccept  PutApiIntegrationsMspTenantsIdInviteJSONBodyValue = "accept"
@@ -1626,7 +1689,9 @@ type Checks struct {
 	// OsVersionCheck Posture check for the version of operating system
 	OsVersionCheck *OSVersionCheck `json:"os_version_check,omitempty"`
 
-	// PeerNetworkRangeCheck Posture check for allow or deny access based on the peer's IP addresses. A range matches when it contains any of the peer's local network interface IPs or its public connection (NAT egress) IP, so ranges may target private subnets, public CIDRs, or single hosts via a /32 or /128.
+	// PeerNetworkRangeCheck Posture check for allow or deny access based on the peer's IP addresses. A range matches when it
+	// contains any of the peer's local network interface IPs or its public connection (NAT egress) IP,
+	// so ranges may target private subnets, public CIDRs, or single hosts via a /32 or /128.
 	PeerNetworkRangeCheck *PeerNetworkRangeCheck `json:"peer_network_range_check,omitempty"`
 
 	// ProcessCheck Posture Check for binaries exist and are running in the peer’s system
@@ -1738,6 +1803,21 @@ type CreateOktaScimIntegrationRequest struct {
 	UserGroupPrefixes *[]string `json:"user_group_prefixes,omitempty"`
 }
 
+// CreateResellerMSPRequest defines model for CreateResellerMSPRequest.
+type CreateResellerMSPRequest struct {
+	// Domain The domain for the MSP
+	Domain string `json:"domain"`
+
+	// Name The name for the MSP
+	Name string `json:"name"`
+
+	// PriceID Stripe price ID to set up managed subscription for the MSP
+	PriceID *string `json:"priceID,omitempty"`
+
+	// ResellerCustomerId Reseller's internal customer reference for this MSP
+	ResellerCustomerId *string `json:"reseller_customer_id,omitempty"`
+}
+
 // CreateScimIntegrationRequest defines model for CreateScimIntegrationRequest.
 type CreateScimIntegrationRequest struct {
 	// ConnectorId DEX connector ID for embedded IDP setups
@@ -2194,6 +2274,9 @@ type GeoLocationCheck struct {
 // GeoLocationCheckAction Action to take upon policy match
 type GeoLocationCheckAction string
 
+// GetResellerMSPsResponse defines model for GetResellerMSPsResponse.
+type GetResellerMSPsResponse = []ResellerMSPResponse
+
 // GetTenantsResponse defines model for GetTenantsResponse.
 type GetTenantsResponse = []TenantResponse
 
@@ -2618,6 +2701,51 @@ type Location struct {
 	CountryCode CountryCode `json:"country_code"`
 }
 
+// MSPStatusResponse defines model for MSPStatusResponse.
+type MSPStatusResponse struct {
+	// ActivatedAt MSP or Tenant activation timestamp in RFC3339 format
+	ActivatedAt *string `json:"activated_at,omitempty"`
+
+	// Domain MSP domain (present only for MSP accounts)
+	Domain *string `json:"domain,omitempty"`
+
+	// HasReseller Whether the MSP has a reseller (present only for MSP accounts)
+	HasReseller *bool `json:"has_reseller,omitempty"`
+
+	// Id Tenant account ID (present only for tenants)
+	Id *string `json:"id,omitempty"`
+
+	// InvitedAt Tenant invitation timestamp in RFC3339 format (present only for tenants)
+	InvitedAt *string `json:"invited_at,omitempty"`
+
+	// IsReseller Whether the account is a reseller
+	IsReseller *bool `json:"is_reseller,omitempty"`
+
+	// Name MSP name (present only for MSP accounts)
+	Name *string `json:"name,omitempty"`
+
+	// Parent Parent MSP account ID (present only for tenants)
+	Parent *string `json:"parent,omitempty"`
+
+	// ParentDomain Parent MSP domain (present only for tenants)
+	ParentDomain *string `json:"parent_domain,omitempty"`
+
+	// ParentName Parent MSP name (present only for tenants)
+	ParentName *string `json:"parent_name,omitempty"`
+
+	// ParentOwnerEmail Parent MSP owner email
+	ParentOwnerEmail *string `json:"parent_owner_email,omitempty"`
+
+	// ParentOwnerName Parent MSP owner name
+	ParentOwnerName *string `json:"parent_owner_name,omitempty"`
+
+	// Status Tenant status (present only for tenants)
+	Status *MSPStatusResponseStatus `json:"status,omitempty"`
+}
+
+// MSPStatusResponseStatus Tenant status (present only for tenants)
+type MSPStatusResponseStatus string
+
 // MinKernelVersionCheck Posture check with the kernel version
 type MinKernelVersionCheck struct {
 	// MinKernelVersion Minimum acceptable version
@@ -3312,7 +3440,9 @@ type PeerMinimum struct {
 	Name string `json:"name"`
 }
 
-// PeerNetworkRangeCheck Posture check for allow or deny access based on the peer's IP addresses. A range matches when it contains any of the peer's local network interface IPs or its public connection (NAT egress) IP, so ranges may target private subnets, public CIDRs, or single hosts via a /32 or /128.
+// PeerNetworkRangeCheck Posture check for allow or deny access based on the peer's IP addresses. A range matches when it
+// contains any of the peer's local network interface IPs or its public connection (NAT egress) IP,
+// so ranges may target private subnets, public CIDRs, or single hosts via a /32 or /128.
 type PeerNetworkRangeCheck struct {
 	// Action Action to take upon policy match
 	Action PeerNetworkRangeCheckAction `json:"action"`
@@ -3771,6 +3901,60 @@ type ProxyCluster struct {
 	ConnectedProxies int `json:"connected_proxies"`
 }
 
+// ResellerMSPResponse An MSP account managed (or invited) by a reseller.
+type ResellerMSPResponse struct {
+	// ActivatedAt When the MSP account was activated.
+	ActivatedAt *time.Time `json:"activated_at,omitempty"`
+
+	// Domain The MSP account domain.
+	Domain string `json:"domain"`
+
+	// Id The MSP account ID.
+	Id string `json:"id"`
+
+	// InvitedAt When the reseller invited the MSP (set only if invited).
+	InvitedAt *time.Time `json:"invited_at,omitempty"`
+
+	// Name Display name of the MSP.
+	Name string `json:"name"`
+
+	// ResellerCustomerId Reseller's internal customer reference for this MSP.
+	ResellerCustomerId *string `json:"reseller_customer_id,omitempty"`
+
+	// Status Lifecycle status of the reseller↔MSP relationship.
+	// * `existing` — MSP exists in the system but has not yet been invited.
+	// * `invited` — Reseller has invited the MSP; MSP user has not accepted.
+	// * `active` — MSP user accepted; reseller manages the account.
+	Status ResellerMSPResponseStatus `json:"status"`
+
+	// TenantNumber Number of manageable (active or pending) tenants under this MSP.
+	TenantNumber int `json:"tenant_number"`
+}
+
+// ResellerMSPResponseStatus Lifecycle status of the reseller↔MSP relationship.
+// * `existing` — MSP exists in the system but has not yet been invited.
+// * `invited` — Reseller has invited the MSP; MSP user has not accepted.
+// * `active` — MSP user accepted; reseller manages the account.
+type ResellerMSPResponseStatus string
+
+// ResellerStatusResponse defines model for ResellerStatusResponse.
+type ResellerStatusResponse struct {
+	// ActivatedAt Reseller activation timestamp in RFC3339 format
+	ActivatedAt *string `json:"activated_at,omitempty"`
+
+	// Domain Reseller domain
+	Domain *string `json:"domain,omitempty"`
+
+	// Name Reseller name
+	Name *string `json:"name,omitempty"`
+
+	// ParentOwnerEmail Reseller owner email
+	ParentOwnerEmail *string `json:"parent_owner_email,omitempty"`
+
+	// ParentOwnerName Reseller owner name
+	ParentOwnerName *string `json:"parent_owner_name,omitempty"`
+}
+
 // Resource defines model for Resource.
 type Resource struct {
 	// Id ID of the resource
@@ -4471,6 +4655,15 @@ type UpdateOktaScimIntegrationRequest struct {
 	UserGroupPrefixes *[]string `json:"user_group_prefixes,omitempty"`
 }
 
+// UpdateResellerMSPRequest Mutable fields the reseller can update on a managed MSP.
+type UpdateResellerMSPRequest struct {
+	// Name New display name for the MSP. Whitespace is trimmed; empty/whitespace-only values are rejected.
+	Name *string `json:"name,omitempty"`
+
+	// ResellerCustomerId New reseller customer reference. Pass empty string to clear.
+	ResellerCustomerId *string `json:"reseller_customer_id,omitempty"`
+}
+
 // UpdateScimIntegrationRequest defines model for UpdateScimIntegrationRequest.
 type UpdateScimIntegrationRequest struct {
 	// ConnectorId DEX connector ID for embedded IDP setups
@@ -4761,6 +4954,12 @@ type ZoneRequest struct {
 // Conflict Standard error response. Note: The exact structure of this error response is inferred from `util.WriteErrorResponse` and `util.WriteError` usage in the provided Go code, as a specific Go struct for errors was not provided.
 type Conflict = ErrorResponse
 
+// bearerAuthContextKey is the context key for BearerAuth security scheme
+type bearerAuthContextKey string
+
+// tokenAuthContextKey is the context key for TokenAuth security scheme
+type tokenAuthContextKey string
+
 // GetApiEventsNetworkTrafficParams defines parameters for GetApiEventsNetworkTraffic.
 type GetApiEventsNetworkTrafficParams struct {
 	// Page Page number
@@ -4914,6 +5113,33 @@ type PutApiIntegrationsBillingSubscriptionJSONBody struct {
 	PriceID *string `json:"priceID,omitempty"`
 }
 
+// PostApiIntegrationsMspJSONBody defines parameters for PostApiIntegrationsMsp.
+type PostApiIntegrationsMspJSONBody struct {
+	// Invite The invite code
+	Invite string `json:"invite"`
+}
+
+// PutApiIntegrationsMspResellerMspsIdInviteJSONBody defines parameters for PutApiIntegrationsMspResellerMspsIdInvite.
+type PutApiIntegrationsMspResellerMspsIdInviteJSONBody struct {
+	// Value Accept or decline the invitation
+	Value PutApiIntegrationsMspResellerMspsIdInviteJSONBodyValue `json:"value"`
+}
+
+// PutApiIntegrationsMspResellerMspsIdInviteJSONBodyValue defines parameters for PutApiIntegrationsMspResellerMspsIdInvite.
+type PutApiIntegrationsMspResellerMspsIdInviteJSONBodyValue string
+
+// PostApiIntegrationsMspResellerMspsIdSubscriptionJSONBody defines parameters for PostApiIntegrationsMspResellerMspsIdSubscription.
+type PostApiIntegrationsMspResellerMspsIdSubscriptionJSONBody struct {
+	// PriceID The Stripe price ID for the plan
+	PriceID string `json:"priceID"`
+}
+
+// PutApiIntegrationsMspResellerMspsIdSubscriptionJSONBody defines parameters for PutApiIntegrationsMspResellerMspsIdSubscription.
+type PutApiIntegrationsMspResellerMspsIdSubscriptionJSONBody struct {
+	// PriceID The new Stripe price ID
+	PriceID string `json:"priceID"`
+}
+
 // PutApiIntegrationsMspTenantsIdInviteJSONBody defines parameters for PutApiIntegrationsMspTenantsIdInvite.
 type PutApiIntegrationsMspTenantsIdInviteJSONBody struct {
 	// Value Accept or decline the invitation.
@@ -5058,6 +5284,24 @@ type CreateGoogleIntegrationJSONRequestBody = CreateGoogleIntegrationRequest
 // UpdateGoogleIntegrationJSONRequestBody defines body for UpdateGoogleIntegration for application/json ContentType.
 type UpdateGoogleIntegrationJSONRequestBody = UpdateGoogleIntegrationRequest
 
+// PostApiIntegrationsMspJSONRequestBody defines body for PostApiIntegrationsMsp for application/json ContentType.
+type PostApiIntegrationsMspJSONRequestBody PostApiIntegrationsMspJSONBody
+
+// PostApiIntegrationsMspResellerMspsJSONRequestBody defines body for PostApiIntegrationsMspResellerMsps for application/json ContentType.
+type PostApiIntegrationsMspResellerMspsJSONRequestBody = CreateResellerMSPRequest
+
+// PutApiIntegrationsMspResellerMspsIdJSONRequestBody defines body for PutApiIntegrationsMspResellerMspsId for application/json ContentType.
+type PutApiIntegrationsMspResellerMspsIdJSONRequestBody = UpdateResellerMSPRequest
+
+// PutApiIntegrationsMspResellerMspsIdInviteJSONRequestBody defines body for PutApiIntegrationsMspResellerMspsIdInvite for application/json ContentType.
+type PutApiIntegrationsMspResellerMspsIdInviteJSONRequestBody PutApiIntegrationsMspResellerMspsIdInviteJSONBody
+
+// PostApiIntegrationsMspResellerMspsIdSubscriptionJSONRequestBody defines body for PostApiIntegrationsMspResellerMspsIdSubscription for application/json ContentType.
+type PostApiIntegrationsMspResellerMspsIdSubscriptionJSONRequestBody PostApiIntegrationsMspResellerMspsIdSubscriptionJSONBody
+
+// PutApiIntegrationsMspResellerMspsIdSubscriptionJSONRequestBody defines body for PutApiIntegrationsMspResellerMspsIdSubscription for application/json ContentType.
+type PutApiIntegrationsMspResellerMspsIdSubscriptionJSONRequestBody PutApiIntegrationsMspResellerMspsIdSubscriptionJSONBody
+
 // PostApiIntegrationsMspTenantsJSONRequestBody defines body for PostApiIntegrationsMspTenants for application/json ContentType.
 type PostApiIntegrationsMspTenantsJSONRequestBody = CreateTenantRequest