github-actions · Oct 12, 2026
diff --git a/.openapi-generator/FILES b/.openapi-generator/FILES
diff --git a/README.md b/README.md
diff --git a/api/openapi.yaml b/api/openapi.yaml
diff --git a/docs/AccessEntityFilters.md b/docs/AccessEntityFilters.md
@@ -9,7 +9,10 @@ Name | Type | Description | Notes
 **entity_types** | **List[str]** | Filter by entity type. Only RESOURCE, GROUP, and USER are queryable via OpalQuery. | [optional] 
 **entity_item_types** | [**List[EntityItemTypeEnum]**](EntityItemTypeEnum.md) | Filter by entity item types. | [optional] 
 **entity_name** | [**EntityNameFilter**](EntityNameFilter.md) |  | [optional] 
+**entity_description** | [**EntityDescriptionFilter**](EntityDescriptionFilter.md) |  | [optional] 
 **entity_tag** | [**EntityTagFilter**](EntityTagFilter.md) |  | [optional] 
+**hr_idp_status** | [**IdpStatusFilter**](IdpStatusFilter.md) |  | [optional] 
+**entity_admin_owner** | [**EntityAdminFilter**](EntityAdminFilter.md) |  | [optional] 
 **entity_ids** | **List[UUID]** | Filter by specific entity UUIDs. | [optional] 
 **imported_from_app** | **List[UUID]** | Filter by app IDs from which returned nodes will be imported from. | [optional] 
 **role_remote_ids** | **List[str]** | Filter by role remote IDs. Can only be applied within a hasAccessTo clause. | [optional] 

diff --git a/docs/App.md b/docs/App.md
@@ -11,7 +11,11 @@ Name | Type | Description | Notes
 **description** | **str** | A description of the app. | 
 **admin_owner_id** | **UUID** | The ID of the owner of the app. | 
 **app_type** | [**AppTypeEnum**](AppTypeEnum.md) |  | 
+**visibility** | [**VisibilityTypeEnum**](VisibilityTypeEnum.md) |  | [optional] 
+**visibility_group_ids** | **List[UUID]** | The IDs of groups that can see this app when visibility is &#x60;LIMITED&#x60;. | [optional] 
+**import_visibility** | [**VisibilityTypeEnum**](VisibilityTypeEnum.md) | The visibility level of items imported from this app. | [optional] 
 **validations** | [**List[AppValidation]**](AppValidation.md) | Validation checks of an apps&#39; configuration and permissions. | [optional] 
+**custom_connector** | [**CustomConnectorAppConfig**](CustomConnectorAppConfig.md) |  | [optional] 
 
 ## Example
 

diff --git a/docs/AppTypeEnum.md b/docs/AppTypeEnum.md
@@ -22,14 +22,20 @@ The type of an app.
 
 * `CUSTOM` (value: `'CUSTOM'`)
 
+* `CONFLUENCE` (value: `'CONFLUENCE'`)
+
 * `CUSTOM_CONNECTOR` (value: `'CUSTOM_CONNECTOR'`)
 
 * `DATABRICKS` (value: `'DATABRICKS'`)
 
 * `DATASTAX_ASTRA` (value: `'DATASTAX_ASTRA'`)
 
+* `ALICLOUD` (value: `'ALICLOUD'`)
+
 * `DEVIN` (value: `'DEVIN'`)
 
+* `DOCUSIGN` (value: `'DOCUSIGN'`)
+
 * `DUO` (value: `'DUO'`)
 
 * `GCP` (value: `'GCP'`)
@@ -50,8 +56,12 @@ The type of an app.
 
 * `INCIDENTIO` (value: `'INCIDENTIO'`)
 
+* `JIRA` (value: `'JIRA'`)
+
 * `LDAP` (value: `'LDAP'`)
 
+* `LINEAR` (value: `'LINEAR'`)
+
 * `MARIADB` (value: `'MARIADB'`)
 
 * `MONGO` (value: `'MONGO'`)
@@ -86,6 +96,8 @@ The type of an app.
 
 * `SLACK` (value: `'SLACK'`)
 
+* `TABLEAU` (value: `'TABLEAU'`)
+
 * `TAILSCALE` (value: `'TAILSCALE'`)
 
 * `TELEPORT` (value: `'TELEPORT'`)
@@ -98,6 +110,16 @@ The type of an app.
 
 * `ZENDESK` (value: `'ZENDESK'`)
 
+* `ZOOM` (value: `'ZOOM'`)
+
+* `RAMP` (value: `'RAMP'`)
+
+* `WRIKE` (value: `'WRIKE'`)
+
+* `VERCEL` (value: `'VERCEL'`)
+
+* `AXIOM` (value: `'AXIOM'`)
+
 [[Back to Model list]](../README.md#documentation-for-models) [[Back to API list]](../README.md#documentation-for-api-endpoints) [[Back to README]](../README.md)
 
 
diff --git a/docs/AppsApi.md b/docs/AppsApi.md
@@ -4,11 +4,175 @@ All URIs are relative to *https://api.opal.dev/v1*
 
 Method | HTTP request | Description
 ------------- | ------------- | -------------
+[**create_app**](AppsApi.md#create_app) | **POST** /apps | Create app
+[**delete_app**](AppsApi.md#delete_app) | **DELETE** /apps/{app_id} | Delete app
 [**get_app**](AppsApi.md#get_app) | **GET** /apps/{app_id} | Get app by ID
 [**get_apps**](AppsApi.md#get_apps) | **GET** /apps | Get apps
 [**get_sync_errors**](AppsApi.md#get_sync_errors) | **GET** /sync_errors | 
+[**update_app**](AppsApi.md#update_app) | **PUT** /apps/{app_id} | Update app
 
 
+# **create_app**
+> App create_app(create_app_info)
+
+Create app
+
+Creates an `App` in Opal. Currently supports only Push-only apps (`CUSTOM`)
+and Custom Connector apps (`CUSTOM_CONNECTOR`).
+
+### Example
+
+* Bearer Authentication (BearerAuth):
+
+```python
+import opal_security
+from opal_security.models.app import App
+from opal_security.models.create_app_info import CreateAppInfo
+from opal_security.rest import ApiException
+from pprint import pprint
+
+# Defining the host is optional and defaults to https://api.opal.dev/v1
+# See configuration.py for a list of all supported configuration parameters.
+import opal_security as opal
+
+configuration = opal.Configuration(
+    host = "https://api.opal.dev/v1"
+)
+
+# The client must configure the authentication and authorization parameters
+# in accordance with the API server security policy.
+# Examples for each auth method are provided below, use the example that
+# satisfies your auth use case.
+
+# Configure Bearer authorization: BearerAuth
+configuration = opal.Configuration(
+    access_token = os.environ["BEARER_TOKEN"]
+)
+
+# Enter a context with an instance of the API client
+with opal_security.ApiClient(configuration) as api_client:
+    # Create an instance of the API class
+    api_instance = opal_security.AppsApi(api_client)
+    create_app_info = opal_security.CreateAppInfo() # CreateAppInfo | 
+
+    try:
+        # Create app
+        api_response = api_instance.create_app(create_app_info)
+        print("The response of AppsApi->create_app:\n")
+        pprint(api_response)
+    except Exception as e:
+        print("Exception when calling AppsApi->create_app: %s\n" % e)
+```
+
+
+
+### Parameters
+
+
+Name | Type | Description  | Notes
+------------- | ------------- | ------------- | -------------
+ **create_app_info** | [**CreateAppInfo**](CreateAppInfo.md)|  | 
+
+### Return type
+
+[**App**](App.md)
+
+### Authorization
+
+[BearerAuth](../README.md#BearerAuth)
+
+### HTTP request headers
+
+ - **Content-Type**: application/json
+ - **Accept**: application/json
+
+### HTTP response details
+
+| Status code | Description | Response headers |
+|-------------|-------------|------------------|
+**200** | The app that was created. |  -  |
+
+[[Back to top]](#) [[Back to API list]](../README.md#documentation-for-api-endpoints) [[Back to Model list]](../README.md#documentation-for-models) [[Back to README]](../README.md)
+
+# **delete_app**
+> delete_app(app_id)
+
+Delete app
+
+Deletes an `App`. Currently supports only Push-only apps (`CUSTOM`) and
+Custom Connector apps (`CUSTOM_CONNECTOR`). Matches the UI: soft-deletes
+the app and cleans up its resources, groups, and users.
+
+### Example
+
+* Bearer Authentication (BearerAuth):
+
+```python
+import opal_security
+from opal_security.rest import ApiException
+from pprint import pprint
+
+# Defining the host is optional and defaults to https://api.opal.dev/v1
+# See configuration.py for a list of all supported configuration parameters.
+import opal_security as opal
+
+configuration = opal.Configuration(
+    host = "https://api.opal.dev/v1"
+)
+
+# The client must configure the authentication and authorization parameters
+# in accordance with the API server security policy.
+# Examples for each auth method are provided below, use the example that
+# satisfies your auth use case.
+
+# Configure Bearer authorization: BearerAuth
+configuration = opal.Configuration(
+    access_token = os.environ["BEARER_TOKEN"]
+)
+
+# Enter a context with an instance of the API client
+with opal_security.ApiClient(configuration) as api_client:
+    # Create an instance of the API class
+    api_instance = opal_security.AppsApi(api_client)
+    app_id = UUID('32acc112-21ff-4669-91c2-21e27683eaa1') # UUID | The ID of the app.
+
+    try:
+        # Delete app
+        api_instance.delete_app(app_id)
+    except Exception as e:
+        print("Exception when calling AppsApi->delete_app: %s\n" % e)
+```
+
+
+
+### Parameters
+
+
+Name | Type | Description  | Notes
+------------- | ------------- | ------------- | -------------
+ **app_id** | **UUID**| The ID of the app. | 
+
+### Return type
+
+void (empty response body)
+
+### Authorization
+
+[BearerAuth](../README.md#BearerAuth)
+
+### HTTP request headers
+
+ - **Content-Type**: Not defined
+ - **Accept**: Not defined
+
+### HTTP response details
+
+| Status code | Description | Response headers |
+|-------------|-------------|------------------|
+**200** | The app was successfully deleted. |  -  |
+
+[[Back to top]](#) [[Back to API list]](../README.md#documentation-for-api-endpoints) [[Back to Model list]](../README.md#documentation-for-models) [[Back to README]](../README.md)
+
 # **get_app**
 > App get_app(app_id)
 
@@ -253,3 +417,87 @@ Name | Type | Description  | Notes
 
 [[Back to top]](#) [[Back to API list]](../README.md#documentation-for-api-endpoints) [[Back to Model list]](../README.md#documentation-for-models) [[Back to README]](../README.md)
 
+# **update_app**
+> App update_app(app_id, update_app_info)
+
+Update app
+
+Updates an `App`. Currently supports only Push-only apps (`CUSTOM`) and
+Custom Connector apps (`CUSTOM_CONNECTOR`).
+
+### Example
+
+* Bearer Authentication (BearerAuth):
+
+```python
+import opal_security
+from opal_security.models.app import App
+from opal_security.models.update_app_info import UpdateAppInfo
+from opal_security.rest import ApiException
+from pprint import pprint
+
+# Defining the host is optional and defaults to https://api.opal.dev/v1
+# See configuration.py for a list of all supported configuration parameters.
+import opal_security as opal
+
+configuration = opal.Configuration(
+    host = "https://api.opal.dev/v1"
+)
+
+# The client must configure the authentication and authorization parameters
+# in accordance with the API server security policy.
+# Examples for each auth method are provided below, use the example that
+# satisfies your auth use case.
+
+# Configure Bearer authorization: BearerAuth
+configuration = opal.Configuration(
+    access_token = os.environ["BEARER_TOKEN"]
+)
+
+# Enter a context with an instance of the API client
+with opal_security.ApiClient(configuration) as api_client:
+    # Create an instance of the API class
+    api_instance = opal_security.AppsApi(api_client)
+    app_id = UUID('32acc112-21ff-4669-91c2-21e27683eaa1') # UUID | The ID of the app.
+    update_app_info = opal_security.UpdateAppInfo() # UpdateAppInfo | 
+
+    try:
+        # Update app
+        api_response = api_instance.update_app(app_id, update_app_info)
+        print("The response of AppsApi->update_app:\n")
+        pprint(api_response)
+    except Exception as e:
+        print("Exception when calling AppsApi->update_app: %s\n" % e)
+```
+
+
+
+### Parameters
+
+
+Name | Type | Description  | Notes
+------------- | ------------- | ------------- | -------------
+ **app_id** | **UUID**| The ID of the app. | 
+ **update_app_info** | [**UpdateAppInfo**](UpdateAppInfo.md)|  | 
+
+### Return type
+
+[**App**](App.md)
+
+### Authorization
+
+[BearerAuth](../README.md#BearerAuth)
+
+### HTTP request headers
+
+ - **Content-Type**: application/json
+ - **Accept**: application/json
+
+### HTTP response details
+
+| Status code | Description | Response headers |
+|-------------|-------------|------------------|
+**200** | The updated app. |  -  |
+
+[[Back to top]](#) [[Back to API list]](../README.md#documentation-for-api-endpoints) [[Back to Model list]](../README.md#documentation-for-models) [[Back to README]](../README.md)
+
diff --git a/docs/Campaign.md b/docs/Campaign.md
@@ -0,0 +1,43 @@
+# Campaign
+
+An access review campaign.
+
+## Properties
+
+Name | Type | Description | Notes
+------------ | ------------- | ------------- | -------------
+**campaign_id** | **UUID** | The ID of the campaign. | 
+**name** | **str** | The name of the campaign. | 
+**status** | [**CampaignStatusEnum**](CampaignStatusEnum.md) |  | 
+**is_template** | **bool** | Whether this campaign is a recurring schedule template. Templates spawn draft campaigns on schedule rather than being reviewed directly. | 
+**created_at** | **datetime** | The creation time of the campaign. | 
+**updated_at** | **datetime** | The last updated time of the campaign. | 
+**created_by_user_id** | **UUID** | The ID of the user who created the campaign. | 
+**configuration** | [**CampaignConfiguration**](CampaignConfiguration.md) | The campaign&#39;s configuration, if set. | [optional] 
+**started_at** | **datetime** | The time the campaign was started, if started. | [optional] 
+**started_by_user_id** | **UUID** | The ID of the user who started the campaign, if started. | [optional] 
+**stopped_at** | **datetime** | The time the campaign was manually stopped, if stopped. | [optional] 
+**stopped_by_user_id** | **UUID** | The ID of the user who stopped the campaign, if stopped. | [optional] 
+**ended_at** | **datetime** | The time the campaign reached its scheduled end, if ended. | [optional] 
+**ended_by_user_id** | **UUID** | The ID of the user who ended the campaign, if ended. | [optional] 
+
+## Example
+
+```python
+from opal_security.models.campaign import Campaign
+
+# TODO update the JSON string below
+json = "{}"
+# create an instance of Campaign from a JSON string
+campaign_instance = Campaign.from_json(json)
+# print the JSON string representation of the object
+print(Campaign.to_json())
+
+# convert the object into a dict
+campaign_dict = campaign_instance.to_dict()
+# create an instance of Campaign from a dict
+campaign_from_dict = Campaign.from_dict(campaign_dict)
+```
+[[Back to Model list]](../README.md#documentation-for-models) [[Back to API list]](../README.md#documentation-for-api-endpoints) [[Back to README]](../README.md)
+
+