{  "appUrl": "string",  "customDomain": "string",  "trustedDomains": "string",  "defaultNoSSOApps": true,  "tenantUserIsolation": true,  "testUserRegex": false,  "testUserAllowFixedAuth": false,  "testUserFixedAuthToken": false,  "testUserFixedAuthVerifierRegex": false,  "allowAuthHostingIframeEmbedding": true,  "userTemplateId": "string",  "keyTemplateId": "string",  "refreshTokenExpiration": 0,  "refreshTokenExpirationUnit": "string",  "rotateJwt": true,  "sessionTokenExpiration": 0,  "sessionTokenExpirationUnit": "string",  "stepupTokenExpiration": 0,  "stepupTokenExpirationUnit": "string",  "trustedDeviceTokenExpiration": 0,  "trustedDeviceTokenExpirationUnit": "string",  "keySessionTokenExpiration": 0,  "keySessionTokenExpirationUnit": "string",  "enableInactivity": true,  "inactivityTime": 0,  "inactivityTimeUnit": "string",  "refreshTokenResponseMethod": "string",  "refreshTokenCookiePolicy": "string",  "refreshTokenCookieDomain": "string",  "sessionTokenResponseMethod": "string",  "sessionTokenCookiePolicy": "string",  "sessionTokenCookieDomain": "string",  "maxConcurrentSessions": 0,  "sessionMigration": {    "vendor": "string",    "clientId": "string",    "domain": "string",    "audience": "string",    "issuer": "string",    "apiToken": "string",    "userSyncType": "string",    "loginIdExternalUserSources": [      "string"    ],    "userMapping": [      {        "externalKey": "string",        "descopeKey": "string"      }    ]  },  "projectSelfProvisioning": true,  "inviteUrl": "string",  "inviteExpireUser": true,  "inviteExpirationTime": 0,  "inviteExpirationTimeUnit": "string",  "inviteMagicLink": true,  "inviteSendEmail": true,  "inviteSendSms": true,  "inviteEmailConnectorId": "string",  "inviteEmailTemplateId": "string"}

/** * Project settings (Terraform: descope_project_settings / descope_session_settings / *  descope_session_migration / descope_invite_settings). Patch semantics: every field is *  optional, absent fields are left untouched, and present fields are set. The submessage *  fields are replace-units that fully replace the stored value when present. The Get *  response uses the same message with all fields populated. */export interface Response {appUrl?: stringcustomDomain?: stringtrustedDomains?: stringdefaultNoSSOApps?: booleantenantUserIsolation?: booleantestUserRegex?: (boolean & string)testUserAllowFixedAuth?: booleantestUserFixedAuthToken?: (boolean & string)testUserFixedAuthVerifierRegex?: (boolean & string)allowAuthHostingIframeEmbedding?: booleanuserTemplateId?: stringkeyTemplateId?: stringrefreshTokenExpiration?: numberrefreshTokenExpirationUnit?: stringrotateJwt?: booleansessionTokenExpiration?: numbersessionTokenExpirationUnit?: stringstepupTokenExpiration?: numberstepupTokenExpirationUnit?: stringtrustedDeviceTokenExpiration?: numbertrustedDeviceTokenExpirationUnit?: stringkeySessionTokenExpiration?: numberkeySessionTokenExpirationUnit?: stringenableInactivity?: booleaninactivityTime?: numberinactivityTimeUnit?: stringrefreshTokenResponseMethod?: stringrefreshTokenCookiePolicy?: stringrefreshTokenCookieDomain?: stringsessionTokenResponseMethod?: stringsessionTokenCookiePolicy?: stringsessionTokenCookieDomain?: string/** * Concurrent-session limit (NIST SP 800-53 AC-10). 0 means no limit. The upper bound is *  configured per deployment and enforced by projectservice, so it is deliberately not repeated *  here - a hardcoded ceiling would reject values the console accepts. *  Enforcement applies to sessions created after it is set; pre-existing sessions are untracked. */maxConcurrentSessions?: number/** * session migration, fully replaced when present (not patched field by field) */sessionMigration?: SessionMigrationSettingsprojectSelfProvisioning?: booleaninviteUrl?: stringinviteExpireUser?: booleaninviteExpirationTime?: numberinviteExpirationTimeUnit?: stringinviteMagicLink?: booleaninviteSendEmail?: booleaninviteSendSms?: booleaninviteEmailConnectorId?: string/** * Active template selection by id. Absent = keep the current selection; "" = reset to the *  built-in System template; a template id = select that stored template. */inviteEmailTemplateId?: string}/** * Vendor-keyed session migration config, stored as externalAuthConfig. An empty vendor disables migration. */export interface SessionMigrationSettings {vendor?: stringclientId?: stringdomain?: stringaudience?: stringissuer?: string/** * okta only. Write-only. Read returns PLACEHOLDER_VALUE when set. Absent or PLACEHOLDER_VALUE=keep, ""=clear, value=set. */apiToken?: stringuserSyncType?: stringloginIdExternalUserSources?: string[]userMapping?: ExternalAuthUserMappingItem[]}export interface ExternalAuthUserMappingItem {externalKey?: stringdescopeKey?: string}