Repository: auth0/auth0-deploy-cli

Issue:
Potentially dangerous and inconsistent behavior for secrets
### Checklist

- [X] I have looked into the [README](https://github.com/auth0/auth0-deploy-cli#readme) and have not found a suitable solution or answer.
- [X] I have looked into the [documentation](https://github.com/auth0/auth0-deploy-cli#documentation) and have not found a suitable solution or answer.
- [X] I have searched the [issues](https://github.com/auth0/auth0-deploy-cli/issues) and have not found a suitable solution or answer.
- [X] I have upgraded to the [latest version](https://github.com/auth0/auth0-deploy-cli/releases/latest) of this tool and the issue still persists.
- [X] I have searched the [Auth0 Community](https://community.auth0.com/c/sdks/5) forums and have not found a suitable solution or answer.
- [X] I agree to the terms within the [Auth0 Code of Conduct](https://github.com/auth0/open-source-template/blob/master/CODE-OF-CONDUCT.md).

### Description

When running `export`, the exported files contain some secret values by default. This is dangerous, since users might accidentally push secrets to a code repository.

Additionally, behavior is inconsistent between resource types. Some resource types provide sanitized values, but they are also sanitized differently.

I haven't done extensive testing, for now I've noticed the following in exported `tenant.yaml`:
* `connections.options.client_secret` for social connections (e.g. Google) contains actual value
* `emailProvider.smtp_user` contains actual value, `emailProvider.smtp_pass` contains sanitized value with keyword `'##SMTP_PASS##'`
* `logStreams.sink.httpAuthorization` (for log stream of type `http`) contains sanitized value `_VALUE_NOT_SHOWN_` 

### Expectation

I would expect the following:
* Behavior for secrets to be consistent across all resource types.
* Behavior for secrets to be better documented. If exporting secrets is intentional, there should be a clear notice in the README warning people about this.
* Safer default behavior for secrets.

I think it would be best to not expose secrets by default. Currently, there is a way to exclude secret fields by using `EXCLUDED_PROPS`, however you need to carefully examine the exported data and manually check for potential secret values to exclude. Instead of blacklisting approach, I propose to sanitize all secrets by default. Then users can whitelist some properties if they want to get actual secret values. For example, instead of using `EXCLUDED_PROPS`, add something like `INCLUDED_SECRETS`.

Regarding sanitization, secret values should be sanitized consistently, instead of using keywords (e.g. `'##SMTP_PASS##'`) and  `_VALUE_NOT_SHOWN_`. Keywords are probably more useful, since users could use https://github.com/auth0/auth0-deploy-cli/blob/master/docs/keyword-replacement.md to load secrets from environment variables. On other hand, this could be dangerous, if "reserved" Auth0 keywords (such as `'##SMTP_PASS##'`) would collide with existing keyword mappings. Though this could probably be prevented by doing additional validation on `AUTH0_KEYWORD_REPLACE_MAPPINGS`.

### Reproduction

1. Given Auth0 tenant with:
  * a social connection (e.g. Google)
  * Custom STMP Email Provider
  * Custom Webhook event stream, with `Authorization token` set
2. When exporting the tenant config with `a0deploy export --format=yaml --output_folder=config`
3. Then `config/tenant.yaml` contains:
  * `connections.options.client_secret` for social connection contains secret value
  * `emailProvider.smtp_pass` contains sanitized value `'##SMTP_PASS##'`
  * `logStreams.sink.httpAuthorization` contains sanitized value `_VALUE_NOT_SHOWN_` 

### Deploy CLI version

7.15.1

### Node version

v18.12.1

Discussion:
@jcerjak: Related also to #72 and #601.@willvedd: I certainly agree that there are inconsistencies with how secret obfuscation is (or isn't) handled. I'm mostly concerned about the Google social connection exposing the client secret, I'll certainly look into that. @jcerjak: Thanks. Maybe also consider some automated way of sanitizing secrets, since with manual whitelisting approach this could happen again (and it happened before, e.g. in #601).

And please check if `emailProvider.smtp_user` could be sanitized as well (similar to `##SMTP_PASS##`). This would make the export/import roundtrip easier for us, because the value (we use  `##SMTP_USER##`) will not be replaced on each export . Unless this will already be handled in #688.@jo-al-ra: I have also encountered the same issue and accidentally pushed the secrets of several social connections (like Google Enterprise Connections or SIWE) to our repository. I then tried to replace the secrets using `AUTH0_KEYWORD_REPLACE_MAPPINGS` in the config.json.

We usually push the config.json file for each tenant (dev, staging, prod) to our repository. Thus, we would like to replace those plain text secrets using environment variables, which will then be injected via bitbucket pipelines. But replacing specific values of the `AUTH0_KEYWORD_REPLACE_MAPPINGS` with environment variables is unfortunately not as easy as replacing top-level values such as the `AUTH0_CLIENT_SECRET`. Is there a way to replace single values of the `AUTH0_KEYWORD_REPLACE_MAPPINGS` without exporting the complete object as an environment variable as in the examples?
https://github.com/auth0/auth0-deploy-cli/blob/master/docs/configuring-the-deploy-cli.md#examples
```
# Non-primitive configuration values
export AUTH0_EXCLUDED='["actions","organizations"]'
export AUTH0_KEYWORD_REPLACE_MAPPINGS='{"ENVIRONMENT":"dev"}'
a0deploy export -c=config.json --format=yaml --output_folder=local
```@jo-al-ra: > But replacing specific values of the AUTH0_KEYWORD_REPLACE_MAPPINGS with environment variables is unfortunately not as easy as replacing top-level values such as the AUTH0_CLIENT_SECRET.

My bad. I did not set up my environment variables correctly. Using `"##MY_SECRET##"` also works in the `AUTH0_KEYWORD_REPLACE_MAPPINGS`.

I am sorry for hijacking this issue. Please be aware, that multiple connections with secrets can exist. Thus, sanitizing them all the same way using a constant like `'##CUSTOM_CONNECTION_SECRET##` could result in problems as well. As users might forget to replace it and will end up with the same secret for all connections. @ghenry: Hi all,

I've come to this issue as I exported my whole config from a dev UK tenant into a new EU tenant. Export has no client ids or secrets and import created all new ones on the new tenant.

Is `a0deploy` supposed to be able to backup a whole auth0 tenant *as-is*?

Thanks.@ghenry: Nevermind, I've enabled the export of these fields using `INCLUDED_PROPS`

Thanks!@p-hebert: Here's how I solved the issue on my end:

1. tenant.yaml created by dump should not be under svc
2. tenant.yaml managed by your team should be under svc

Assming you have pulled the remote tenant.yaml into `tenant-remote.yaml`, you can automatically replace secrets in the remote file with the keyword mappings using the following script:

```js

const fs = require("node:fs")
const path = require("node:path")
const YAML = require('yaml')

function walkMutateMany(objects, callback) {
  // Function to walk through the object
  function walk(path, key, nodes, parents) {
    // If all nodes are arrays, map over all indexes and reassign values
    if (nodes.every(Array.isArray)) {
      const maxLength = nodes.reduce(
        (maxLength, node) =>
          node.length > maxLength ? node.length : maxLength,
        0
      );
      // If the value is an array, iterate through each element
      let resultNodes = nodes;
      for (let i = 0; i < maxLength; i += 1) {
        const values = walk(
          `${path}[${i}]`,
          i,
          nodes.map((node) => node[i]),
          nodes
        );
        resultNodes.forEach((node, nodeIndex) => {
          if (node.length > i) {
            node[i] = values[nodeIndex];
          }
        });
      }
      return resultNodes;
      // If all nodes are basic javascript objects, map over all keys and reassign values
    } else if (
      nodes.every(
        (node) =>
          typeof node === "object" &&
          node !== null &&
          node.constructor === Object
      )
    ) {
      // If the value is an object, iterate through its key-value pairs
      const allKeys = Object.keys(nodes.reduce(
        (keys, node) => {
          Object.keys(node).forEach((k) => keys[k] = true)
          return keys
        },
        {}
      ));
      let resultNodes = nodes;
      for (const key of allKeys) {
        const values = walk(
          `${path}.${key}`,
          key,
          nodes.map((node) => node[key]),
          nodes
        );
        resultNodes.forEach((node, nodeIndex) => {
          if (key in node && node.hasOwnProperty(key))
            node[key] = values[nodeIndex];
        });
      }
      return resultNodes;
      // If the value is neither an array nor an object, invoke the callback
      // This covers scalars as well as complex objects such as Date or objects created using a class
    } else {
      return callback(path, key, nodes, parents);
    }
  }

  // Start the walk from the root object
  return walk(
    "$",
    null,
    objects,
    objects.map(() => null)
  );
}

const localTenantManifest = YAML.parse(fs.readFileSync(path.join(__dirname, "../tenants/my-tenant", "tenant.yaml")).toString('utf8'))
const remoteTenantManifest = YAML.parse(fs.readFileSync(path.join(__dirname, "../tenants/my-tenant", "tenant-remote.yaml")).toString('utf8'))

function isKeyWordMapping(value) {
  return typeof value === "string" && /(##|@@)[A-Za-z0-9_]+(##|@@)/.test(value)
}

const results = walkMutateMany(
  [
    localTenantManifest,
    remoteTenantManifest
  ],
  (path, key, [local, remote], parents) => {
    console.log(path, key, [local, remote])
    return [local, isKeyWordMapping(local) ? local : remote]
  }
)

fs.writeFileSync(
  path.join(__dirname, "../tenants/my-tenant", "tenant-result.yaml"),
  YAML.stringify(results[1])
)
```

It basically walks through the `tenant-remote.yaml` and the `tenant.yaml` and rewrites any value in the remote that has a mapping in the tenant.yaml. That way you keep the updates in structure that can come from remote, but you also strip any secrets from the file. You can then overwrite your local tenant.yaml with the result.

WARNING: This assumes that the remote hasn't introduced secrets that aren't managed by the tooling in the repo. You should always check if the resulting file contains any new secrets before committing changes to svc.@kushalshit27: Thank you for your patience and for reporting this issue. We are planning to release a fix related to this [#1103](https://github.com/auth0/auth0-deploy-cli/pull/1103)@kushalshit27: The fix for this issue is now available in version [8.9.0](https://github.com/auth0/auth0-deploy-cli/releases/tag/v8.9.0). 🚀

We have added a fix for the keys advised in the description and a few more as part of the improvement.   

Thank you for your patience! This issue has been resolved. Feel free to reopen it if you encounter any further problems.@FalconerTC: Just upgraded and ran into this change. FYI this breaks the ability to do `a0deploy import` with these connections. Is there a configuration to disable this feature?@kushalshit27: Hi, @FalconerTC ,
Could you please provide more details on this issue?  like logs and how to reproduce it.

Your input will help us identify it more effectively.
@FalconerTC: It's a fairly straight-forward change I think. If you do an `a0deploy export` that includes eg `connections.options.client_secret` configurations, then those files can no longer be used in an `a0deploy import` as the secrets are no longer exported. My complaint is mostly that this was a breaking-change that was released as a minor version@kushalshit27: We’ll evaluate the feasibility of incorporating a configuration option to disable this feature. Thanks for bringing this up 🤝 .


Solution patch:
diff --git a/src/context/defaults.ts b/src/context/defaults.ts
index f556866..03d83be 100644
--- a/src/context/defaults.ts
+++ b/src/context/defaults.ts
@@ -1,3 +1,5 @@
+import { maskSecretAtPath } from '../tools/utils';
+
 // eslint-disable-next-line import/prefer-default-export
 export function emailProviderDefaults(emailProvider) {
   // eslint-disable-line
@@ -16,6 +18,10 @@ export function emailProviderDefaults(emailProvider) {
   }
 
   if (name === 'smtp') {
+    // This is to mask smtp_user to '##SMTP_USER##'
+    if (updated.credentials && 'smtp_user' in updated.credentials) {
+      delete updated.credentials.smtp_user;
+    }
     updated.credentials = {
       smtp_host: '##SMTP_HOSTNAME##',
       smtp_port: '##SMTP_PORT##',
@@ -82,3 +88,44 @@ export function phoneProviderDefaults(phoneProvider) {
   }
   return updated;
 }
+
+export function connectionDefaults(connection) {
+  if (connection.options) {
+    // Mask secret for key: connection.options.client_secret
+    maskSecretAtPath({
+      resourceTypeName: 'connections',
+      maskedKeyName: connection.strategy,
+      maskOnObj: connection.options,
+      keyJsonPath: 'client_secret',
+    });
+  }
+  return connection;
+}
+
+export function logStreamDefaults(logStreams) {
+  // masked sensitive fields
+  const sensitiveKeys = [
+    'httpAuthorization',
+    'splunkToken',
+    'datadogApiKey',
+    'mixpanelServiceAccountPassword',
+    'segmentWriteKey',
+  ];
+  const maskedLogStreams = logStreams.map((logStream) => {
+    if (logStream.sink) {
+      sensitiveKeys.forEach((key) => {
+        if (logStream.sink && logStream.sink[key]) {
+          maskSecretAtPath({
+            resourceTypeName: 'logStreams',
+            maskedKeyName: logStream.type,
+            maskOnObj: logStream.sink,
+            keyJsonPath: key,
+          });
+        }
+      });
+    }
+    return logStream;
+  });
+
+  return maskedLogStreams;
+}
diff --git a/src/context/directory/handlers/connections.ts b/src/context/directory/handlers/connections.ts
index e53f241..cf1a18a 100644
--- a/src/context/directory/handlers/connections.ts
+++ b/src/context/directory/handlers/connections.ts
@@ -17,6 +17,7 @@ import {
 import { DirectoryHandler } from '.';
 import DirectoryContext from '..';
 import { Asset, ParsedAsset } from '../../../types';
+import { connectionDefaults } from '../../defaults';
 
 type ParsedConnections = ParsedAsset<'connections', Asset[]>;
 
@@ -69,7 +70,7 @@ async function dump(context: DirectoryContext): Promise<void> {
 
   // Convert enabled_clients from id to name
   connections.forEach((connection) => {
-    const dumpedConnection = {
+    let dumpedConnection = {
       ...connection,
       ...(connection.enabled_clients && {
         enabled_clients: mapClientID2NameSorted(connection.enabled_clients, clientsOrig || []),
@@ -78,6 +79,9 @@ async function dump(context: DirectoryContext): Promise<void> {
 
     const connectionName = sanitize(dumpedConnection.name);
 
+    // Mask secrets
+    dumpedConnection = connectionDefaults(dumpedConnection);
+
     if (dumpedConnection.strategy === 'email') {
       ensureProp(dumpedConnection, 'options.email.body');
       const html = dumpedConnection.options.email.body;
diff --git a/src/context/directory/handlers/logStreams.ts b/src/context/directory/handlers/logStreams.ts
index 03c2adc..c30bcd6 100644
--- a/src/context/directory/handlers/logStreams.ts
+++ b/src/context/directory/handlers/logStreams.ts
@@ -5,6 +5,7 @@ import { getFiles, existsMustBeDir, dumpJSON, loadJSON, sanitize } from '../../.
 import { DirectoryHandler } from '.';
 import DirectoryContext from '..';
 import { Asset, ParsedAsset } from '../../../types';
+import { logStreamDefaults } from '../../defaults';
 
 type ParsedLogStreams = ParsedAsset<'logStreams', Asset[]>;
 
@@ -29,15 +30,21 @@ function parse(context: DirectoryContext): ParsedLogStreams {
 }
 
 async function dump(context: DirectoryContext): Promise<void> {
-  const logStreams = context.assets.logStreams;
+  const { logStreams } = context.assets;
 
   if (!logStreams) return; // Skip, nothing to dump
 
   // Create Rules folder
   const logStreamsDirectory = path.join(context.filePath, constants.LOG_STREAMS_DIRECTORY);
+
   fs.ensureDirSync(logStreamsDirectory);
-  logStreams.forEach((logStream) => {
+
+  // masked sensitive fields
+  const maskedLogStreams = logStreamDefaults(logStreams);
+
+  maskedLogStreams.forEach((logStream) => {
     const ruleFile = path.join(logStreamsDirectory, `${sanitize(logStream.name)}.json`);
+
     dumpJSON(ruleFile, logStream);
   });
 }
diff --git a/src/context/yaml/handlers/connections.ts b/src/context/yaml/handlers/connections.ts
index c9dc300..bc0afcc 100644
--- a/src/context/yaml/handlers/connections.ts
+++ b/src/context/yaml/handlers/connections.ts
@@ -14,6 +14,7 @@ import {
 import { YAMLHandler } from '.';
 import YAMLContext from '..';
 import { Asset, ParsedAsset } from '../../../types';
+import { connectionDefaults } from '../../defaults';
 
 type ParsedConnections = ParsedAsset<'connections', Asset[]>;
 
@@ -69,7 +70,7 @@ async function dump(context: YAMLContext): Promise<ParsedConnections> {
 
   return {
     connections: connections.map((connection) => {
-      const dumpedConnection = {
+      let dumpedConnection = {
         ...connection,
         ...getFormattedOptions(connection, clients),
         ...(connection.enabled_clients && {
@@ -77,6 +78,9 @@ async function dump(context: YAMLContext): Promise<ParsedConnections> {
         }),
       };
 
+      // Mask secrets
+      dumpedConnection = connectionDefaults(dumpedConnection);
+
       if (dumpedConnection.strategy === 'email') {
         ensureProp(connection, 'options.email.body');
         const connectionsFolder = path.join(context.basePath, constants.CONNECTIONS_DIRECTORY);
@@ -102,6 +106,7 @@ async function dump(context: YAMLContext): Promise<ParsedConnections> {
           );
         }
       }
+
       return dumpedConnection;
     }),
   };
diff --git a/src/context/yaml/handlers/logStreams.ts b/src/context/yaml/handlers/logStreams.ts
index d1f63bd..dde1b57 100644
--- a/src/context/yaml/handlers/logStreams.ts
+++ b/src/context/yaml/handlers/logStreams.ts
@@ -1,10 +1,11 @@
 import { YAMLHandler } from '.';
 import YAMLContext from '..';
 import { Asset, ParsedAsset } from '../../../types';
+import { logStreamDefaults } from '../../defaults';
 
 type ParsedLogStreams = ParsedAsset<'logStreams', Asset[]>;
 
-async function parseAndDump(context: YAMLContext): Promise<ParsedLogStreams> {
+async function parse(context: YAMLContext): Promise<ParsedLogStreams> {
   const { logStreams } = context.assets;
 
   if (!logStreams) return { logStreams: null };
@@ -14,9 +15,22 @@ async function parseAndDump(context: YAMLContext): Promise<ParsedLogStreams> {
   };
 }
 
+async function dump(context: YAMLContext): Promise<ParsedLogStreams> {
+  const { logStreams } = context.assets;
+
+  if (!logStreams) return { logStreams: null };
+
+  // masked sensitive fields
+  const maskedLogStreams = logStreamDefaults(logStreams);
+
+  return {
+    logStreams: maskedLogStreams,
+  };
+}
+
 const logStreamsHandler: YAMLHandler<ParsedLogStreams> = {
-  parse: parseAndDump,
-  dump: parseAndDump,
+  parse: parse,
+  dump: dump,
 };
 
 export default logStreamsHandler;
diff --git a/src/tools/utils.ts b/src/tools/utils.ts
index cd6429a..0839424 100644
--- a/src/tools/utils.ts
+++ b/src/tools/utils.ts
@@ -283,3 +283,26 @@ export const isForbiddenFeatureError = (err, type): boolean => {
   }
   return false;
 };
+
+// This function masks the secret at the given JSON path in the object with the provided mask value.
+export function maskSecretAtPath({
+  resourceTypeName,
+  maskedKeyName,
+  maskOnObj,
+  keyJsonPath,
+}: {
+  resourceTypeName: string;
+  maskedKeyName: string;
+  maskOnObj: object;
+  keyJsonPath: string;
+}): any {
+  // Replace spaces and special characters with underscores
+  const sanitize = (str: string) => str.replace(/[^a-zA-Z0-9]/g, '_');
+  if (dotProp.has(maskOnObj, keyJsonPath)) {
+    const maskValue = `##${sanitize(resourceTypeName)}_${sanitize(
+      maskedKeyName
+    )}_SECRET##`.toUpperCase();
+    dotProp.set(maskOnObj, keyJsonPath, maskValue);
+  }
+  return maskOnObj;
+}



Test patch:
diff --git a/test/context/defaults.test.js b/test/context/defaults.test.js
index df21be2..61ff14f 100644
--- a/test/context/defaults.test.js
+++ b/test/context/defaults.test.js
@@ -1,6 +1,10 @@
 import { expect } from 'chai';
 
-import { emailProviderDefaults } from '../../src/context/defaults';
+import {
+  emailProviderDefaults,
+  connectionDefaults,
+  logStreamDefaults,
+} from '../../src/context/defaults';
 
 describe('#context defaults', () => {
   describe('emailProvider defaults', () => {
@@ -15,6 +19,28 @@ describe('#context defaults', () => {
         name: 'smtp',
       });
     });
+
+    it('should set emailProvider defaults for smtp and remove existing smtp_user', async () => {
+      const emailProvider = {
+        name: 'smtp',
+        credentials: {
+          smtp_user: 'existing_user@example.com',
+          smtp_host: 'existing_host',
+        },
+      };
+
+      const result = emailProviderDefaults(emailProvider);
+
+      expect(result).to.deep.equal({
+        credentials: {
+          smtp_host: 'existing_host',
+          smtp_port: '##SMTP_PORT##',
+          smtp_user: '##SMTP_USER##',
+          smtp_pass: '##SMTP_PASS##',
+        },
+        name: 'smtp',
+      });
+    });
   });
 
   it('should set emailProvider defaults for ses', async () => {
@@ -63,4 +89,277 @@ describe('#context defaults', () => {
       name: 'sparkpost',
     });
   });
+
+  describe('connectionDefaults', () => {
+    it('should mask client_secret in connection options', () => {
+      const connection = {
+        name: 'Test Connection',
+        strategy: 'oauth2',
+        options: {
+          client_id: 'test_client_id',
+          client_secret: 'sensitive_secret_value',
+          scope: ['openid', 'profile'],
+        },
+      };
+
+      const result = connectionDefaults(connection);
+
+      expect(result.options.client_secret).to.equal('##CONNECTIONS_OAUTH2_SECRET##');
+      expect(result.options.client_id).to.equal('test_client_id');
+      expect(result.options.scope).to.deep.equal(['openid', 'profile']);
+    });
+
+    it('should handle connection without options', () => {
+      const connection = {
+        name: 'Test Connection',
+        strategy: 'oauth2',
+      };
+
+      const result = connectionDefaults(connection);
+
+      expect(result).to.deep.equal(connection);
+    });
+
+    it('should handle connection with options but no client_secret', () => {
+      const connection = {
+        name: 'Test Connection',
+        strategy: 'samlp',
+        options: {
+          client_id: 'test_client_id',
+          scope: ['openid'],
+        },
+      };
+
+      const result = connectionDefaults(connection);
+
+      expect(result).to.deep.equal(connection);
+    });
+
+    it('should mask client_secret for different strategies', () => {
+      const connection = {
+        name: 'SAML Connection',
+        strategy: 'samlp',
+        options: {
+          client_secret: 'another_secret',
+        },
+      };
+
+      const result = connectionDefaults(connection);
+
+      expect(result.options.client_secret).to.equal('##CONNECTIONS_SAMLP_SECRET##');
+    });
+
+    it('should handle strategy names with special characters', () => {
+      const connection = {
+        name: 'Custom Connection',
+        strategy: 'custom-oauth-2.0',
+        options: {
+          client_secret: 'secret_value',
+        },
+      };
+
+      const result = connectionDefaults(connection);
+
+      expect(result.options.client_secret).to.equal('##CONNECTIONS_CUSTOM_OAUTH_2_0_SECRET##');
+    });
+  });
+
+  describe('logStreamDefaults', () => {
+    it('should mask httpAuthorization in log stream sink', () => {
+      const logStreams = [
+        {
+          name: 'Test HTTP Stream',
+          type: 'http',
+          sink: {
+            httpEndpoint: 'https://example.com/logs',
+            httpAuthorization: 'Bearer secret_token',
+          },
+        },
+      ];
+
+      const result = logStreamDefaults(logStreams);
+
+      expect(result[0].sink.httpAuthorization).to.equal('##LOGSTREAMS_HTTP_SECRET##');
+      expect(result[0].sink.httpEndpoint).to.equal('https://example.com/logs');
+    });
+
+    it('should mask splunkToken in log stream sink', () => {
+      const logStreams = [
+        {
+          name: 'Splunk Stream',
+          type: 'splunk',
+          sink: {
+            splunkDomain: 'mycompany.splunkcloud.com',
+            splunkToken: 'secret_splunk_token',
+            splunkPort: '8088',
+          },
+        },
+      ];
+
+      const result = logStreamDefaults(logStreams);
+
+      expect(result[0].sink.splunkToken).to.equal('##LOGSTREAMS_SPLUNK_SECRET##');
+      expect(result[0].sink.splunkDomain).to.equal('mycompany.splunkcloud.com');
+      expect(result[0].sink.splunkPort).to.equal('8088');
+    });
+
+    it('should mask datadogApiKey in log stream sink', () => {
+      const logStreams = [
+        {
+          name: 'Datadog Stream',
+          type: 'datadog',
+          sink: {
+            datadogRegion: 'us',
+            datadogApiKey: 'secret_datadog_key',
+          },
+        },
+      ];
+
+      const result = logStreamDefaults(logStreams);
+
+      expect(result[0].sink.datadogApiKey).to.equal('##LOGSTREAMS_DATADOG_SECRET##');
+      expect(result[0].sink.datadogRegion).to.equal('us');
+    });
+
+    it('should mask mixpanelServiceAccountPassword in log stream sink', () => {
+      const logStreams = [
+        {
+          name: 'Mixpanel Stream',
+          type: 'mixpanel',
+          sink: {
+            mixpanelProjectId: 'project123',
+            mixpanelServiceAccountPassword: 'secret_password',
+            mixpanelServiceAccountUsername: 'service_account',
+          },
+        },
+      ];
+
+      const result = logStreamDefaults(logStreams);
+
+      expect(result[0].sink.mixpanelServiceAccountPassword).to.equal(
+        '##LOGSTREAMS_MIXPANEL_SECRET##'
+      );
+      expect(result[0].sink.mixpanelProjectId).to.equal('project123');
+      expect(result[0].sink.mixpanelServiceAccountUsername).to.equal('service_account');
+    });
+
+    it('should mask segmentWriteKey in log stream sink', () => {
+      const logStreams = [
+        {
+          name: 'Segment Stream',
+          type: 'segment',
+          sink: {
+            segmentRegion: 'us-west-2',
+            segmentWriteKey: 'secret_write_key',
+          },
+        },
+      ];
+
+      const result = logStreamDefaults(logStreams);
+
+      expect(result[0].sink.segmentWriteKey).to.equal('##LOGSTREAMS_SEGMENT_SECRET##');
+      expect(result[0].sink.segmentRegion).to.equal('us-west-2');
+    });
+
+    it('should mask multiple sensitive fields in a single log stream', () => {
+      const logStreams = [
+        {
+          name: 'Multi-secret Stream',
+          type: 'http',
+          sink: {
+            httpEndpoint: 'https://example.com/logs',
+            httpAuthorization: 'Bearer secret_token',
+            splunkToken: 'secret_splunk_token',
+            datadogApiKey: 'secret_datadog_key',
+          },
+        },
+      ];
+
+      const result = logStreamDefaults(logStreams);
+
+      expect(result[0].sink.httpAuthorization).to.equal('##LOGSTREAMS_HTTP_SECRET##');
+      expect(result[0].sink.splunkToken).to.equal('##LOGSTREAMS_HTTP_SECRET##');
+      expect(result[0].sink.datadogApiKey).to.equal('##LOGSTREAMS_HTTP_SECRET##');
+      expect(result[0].sink.httpEndpoint).to.equal('https://example.com/logs');
+    });
+
+    it('should handle multiple log streams with different types', () => {
+      const logStreams = [
+        {
+          name: 'HTTP Stream',
+          type: 'http',
+          sink: {
+            httpAuthorization: 'Bearer token1',
+          },
+        },
+        {
+          name: 'Splunk Stream',
+          type: 'splunk',
+          sink: {
+            splunkToken: 'splunk_token',
+          },
+        },
+      ];
+
+      const result = logStreamDefaults(logStreams);
+
+      expect(result[0].sink.httpAuthorization).to.equal('##LOGSTREAMS_HTTP_SECRET##');
+      expect(result[1].sink.splunkToken).to.equal('##LOGSTREAMS_SPLUNK_SECRET##');
+    });
+
+    it('should handle log streams without sink', () => {
+      const logStreams = [
+        {
+          name: 'No Sink Stream',
+          type: 'http',
+          status: 'active',
+        },
+      ];
+
+      const result = logStreamDefaults(logStreams);
+
+      expect(result).to.deep.equal(logStreams);
+    });
+
+    it('should handle log streams with sink but no sensitive fields', () => {
+      const logStreams = [
+        {
+          name: 'Safe Stream',
+          type: 'http',
+          sink: {
+            httpEndpoint: 'https://example.com/logs',
+            httpContentType: 'application/json',
+          },
+        },
+      ];
+
+      const result = logStreamDefaults(logStreams);
+
+      expect(result).to.deep.equal(logStreams);
+    });
+
+    it('should handle empty log streams array', () => {
+      const logStreams = [];
+
+      const result = logStreamDefaults(logStreams);
+
+      expect(result).to.deep.equal([]);
+    });
+
+    it('should handle log stream type with special characters', () => {
+      const logStreams = [
+        {
+          name: 'Custom Stream',
+          type: 'custom-http-2.0',
+          sink: {
+            httpAuthorization: 'Bearer token',
+          },
+        },
+      ];
+
+      const result = logStreamDefaults(logStreams);
+
+      expect(result[0].sink.httpAuthorization).to.equal('##LOGSTREAMS_CUSTOM_HTTP_2_0_SECRET##');
+    });
+  });
 });
diff --git a/test/e2e/recordings/should-dump-and-deploy-without-throwing-an-error.json b/test/e2e/recordings/should-dump-and-deploy-without-throwing-an-error.json
index 5d2134f..bbae80f 100644
--- a/test/e2e/recordings/should-dump-and-deploy-without-throwing-an-error.json
+++ b/test/e2e/recordings/should-dump-and-deploy-without-throwing-an-error.json
@@ -972,6 +972,22 @@
                             "description": "Delete Federated Connections Tokensets belonging to a user",
                             "value": "delete:federated_connections_tokens"
                         },
+                        {
+                            "description": "Create User Attribute Profiles",
+                            "value": "create:user_attribute_profiles"
+                        },
+                        {
+                            "description": "Read User Attribute Profiles",
+                            "value": "read:user_attribute_profiles"
+                        },
+                        {
+                            "description": "Update User Attribute Profiles",
+                            "value": "update:user_attribute_profiles"
+                        },
+                        {
+                            "description": "Delete User Attribute Profiles",
+                            "value": "delete:user_attribute_profiles"
+                        },
                         {
                             "value": "read:client_credentials",
                             "description": "Read Client Credentials"
@@ -999,6 +1015,30 @@
                         {
                             "value": "delete:organization_client_grants",
                             "description": "Delete Organization Client Grants"
+                        },
+                        {
+                            "value": "read:event_streams",
+                            "description": "Read Event Streams"
+                        },
+                        {
+                            "value": "create:event_streams",
+                            "description": "Create Event Streams"
+                        },
+                        {
+                            "value": "update:event_streams",
+                            "description": "Update Event Streams"
+                        },
+                        {
+                            "value": "delete:event_streams",
+                            "description": "Delete Event Streams"
+                        },
+                        {
+                            "value": "read:event_deliveries",
+                            "description": "Read event deliveries on an event stream"
+                        },
+                        {
+                            "value": "update:event_deliveries",
+                            "description": "Redeliver event(s) on an event stream"
                         }
                     ],
                     "is_system": true
@@ -2083,7 +2123,7 @@
     {
         "scope": "https://deploy-cli-dev.eu.auth0.com:443",
         "method": "GET",
-        "path": "/api/v2/email-templates/user_invitation",
+        "path": "/api/v2/email-templates/mfa_oob_code",
         "body": "",
         "status": 404,
         "response": {
@@ -2098,14 +2138,18 @@
     {
         "scope": "https://deploy-cli-dev.eu.auth0.com:443",
         "method": "GET",
-        "path": "/api/v2/email-templates/stolen_credentials",
+        "path": "/api/v2/email-templates/welcome_email",
         "body": "",
-        "status": 404,
+        "status": 200,
         "response": {
-            "statusCode": 404,
-            "error": "Not Found",
-            "message": "The template does not exist.",
-            "errorCode": "inexistent_email_template"
+            "template": "welcome_email",
+            "body": "<html>\n  <body>\n    <h1>Welcome!</h1>\n  </body>\n</html>\n",
+            "from": "",
+            "resultUrl": "https://example.com/welcome",
+            "subject": "Welcome",
+            "syntax": "liquid",
+            "urlLifetimeInSeconds": 3600,
+            "enabled": false
         },
         "rawHeaders": [],
         "responseIsBinary": false
@@ -2113,7 +2157,7 @@
     {
         "scope": "https://deploy-cli-dev.eu.auth0.com:443",
         "method": "GET",
-        "path": "/api/v2/email-templates/enrollment_email",
+        "path": "/api/v2/email-templates/stolen_credentials",
         "body": "",
         "status": 404,
         "response": {
@@ -2128,7 +2172,7 @@
     {
         "scope": "https://deploy-cli-dev.eu.auth0.com:443",
         "method": "GET",
-        "path": "/api/v2/email-templates/change_password",
+        "path": "/api/v2/email-templates/password_reset",
         "body": "",
         "status": 404,
         "response": {
@@ -2143,7 +2187,7 @@
     {
         "scope": "https://deploy-cli-dev.eu.auth0.com:443",
         "method": "GET",
-        "path": "/api/v2/email-templates/reset_email",
+        "path": "/api/v2/email-templates/user_invitation",
         "body": "",
         "status": 404,
         "response": {
@@ -2158,7 +2202,7 @@
     {
         "scope": "https://deploy-cli-dev.eu.auth0.com:443",
         "method": "GET",
-        "path": "/api/v2/email-templates/blocked_account",
+        "path": "/api/v2/email-templates/reset_email",
         "body": "",
         "status": 404,
         "response": {
@@ -2173,18 +2217,14 @@
     {
         "scope": "https://deploy-cli-dev.eu.auth0.com:443",
         "method": "GET",
-        "path": "/api/v2/email-templates/welcome_email",
+        "path": "/api/v2/email-templates/enrollment_email",
         "body": "",
-        "status": 200,
+        "status": 404,
         "response": {
-            "template": "welcome_email",
-            "body": "<html>\n  <body>\n    <h1>Welcome!</h1>\n  </body>\n</html>\n",
-            "from": "",
-            "resultUrl": "https://example.com/welcome",
-            "subject": "Welcome",
-            "syntax": "liquid",
-            "urlLifetimeInSeconds": 3600,
-            "enabled": false
+            "statusCode": 404,
+            "error": "Not Found",
+            "message": "The template does not exist.",
+            "errorCode": "inexistent_email_template"
         },
         "rawHeaders": [],
         "responseIsBinary": false
@@ -2207,7 +2247,7 @@
     {
         "scope": "https://deploy-cli-dev.eu.auth0.com:443",
         "method": "GET",
-        "path": "/api/v2/email-templates/password_reset",
+        "path": "/api/v2/email-templates/change_password",
         "body": "",
         "status": 404,
         "response": {
@@ -2222,7 +2262,7 @@
     {
         "scope": "https://deploy-cli-dev.eu.auth0.com:443",
         "method": "GET",
-        "path": "/api/v2/email-templates/reset_email_by_code",
+        "path": "/api/v2/email-templates/blocked_account",
         "body": "",
         "status": 404,
         "response": {
@@ -2237,7 +2277,7 @@
     {
         "scope": "https://deploy-cli-dev.eu.auth0.com:443",
         "method": "GET",
-        "path": "/api/v2/email-templates/mfa_oob_code",
+        "path": "/api/v2/email-templates/reset_email_by_code",
         "body": "",
         "status": 404,
         "response": {
@@ -3098,7 +3138,7 @@
     {
         "scope": "https://deploy-cli-dev.eu.auth0.com:443",
         "method": "GET",
-        "path": "/api/v2/prompts/login-id/custom-text/en",
+        "path": "/api/v2/prompts/login-password/custom-text/en",
         "body": "",
         "status": 200,
         "response": {},
@@ -3108,7 +3148,7 @@
     {
         "scope": "https://deploy-cli-dev.eu.auth0.com:443",
         "method": "GET",
-        "path": "/api/v2/prompts/login-password/custom-text/en",
+        "path": "/api/v2/prompts/login-id/custom-text/en",
         "body": "",
         "status": 200,
         "response": {},
@@ -3348,7 +3388,7 @@
     {
         "scope": "https://deploy-cli-dev.eu.auth0.com:443",
         "method": "GET",
-        "path": "/api/v2/prompts/email-verification/custom-text/en",
+        "path": "/api/v2/prompts/device-flow/custom-text/en",
         "body": "",
         "status": 200,
         "response": {},
@@ -3358,7 +3398,7 @@
     {
         "scope": "https://deploy-cli-dev.eu.auth0.com:443",
         "method": "GET",
-        "path": "/api/v2/prompts/email-otp-challenge/custom-text/en",
+        "path": "/api/v2/prompts/email-verification/custom-text/en",
         "body": "",
         "status": 200,
         "response": {},
@@ -3368,7 +3408,7 @@
     {
         "scope": "https://deploy-cli-dev.eu.auth0.com:443",
         "method": "GET",
-        "path": "/api/v2/prompts/device-flow/custom-text/en",
+        "path": "/api/v2/prompts/email-otp-challenge/custom-text/en",
         "body": "",
         "status": 200,
         "response": {},
@@ -3388,7 +3428,7 @@
     {
         "scope": "https://deploy-cli-dev.eu.auth0.com:443",
         "method": "GET",
-        "path": "/api/v2/prompts/invitation/custom-text/en",
+        "path": "/api/v2/prompts/common/custom-text/en",
         "body": "",
         "status": 200,
         "response": {},
@@ -3398,7 +3438,7 @@
     {
         "scope": "https://deploy-cli-dev.eu.auth0.com:443",
         "method": "GET",
-        "path": "/api/v2/prompts/common/custom-text/en",
+        "path": "/api/v2/prompts/invitation/custom-text/en",
         "body": "",
         "status": 200,
         "response": {},
@@ -3418,7 +3458,7 @@
     {
         "scope": "https://deploy-cli-dev.eu.auth0.com:443",
         "method": "GET",
-        "path": "/api/v2/prompts/login-id/partials",
+        "path": "/api/v2/prompts/login-password/partials",
         "body": "",
         "status": 200,
         "response": {},
@@ -3428,7 +3468,7 @@
     {
         "scope": "https://deploy-cli-dev.eu.auth0.com:443",
         "method": "GET",
-        "path": "/api/v2/prompts/login/partials",
+        "path": "/api/v2/prompts/login-id/partials",
         "body": "",
         "status": 200,
         "response": {},
@@ -3438,7 +3478,7 @@
     {
         "scope": "https://deploy-cli-dev.eu.auth0.com:443",
         "method": "GET",
-        "path": "/api/v2/prompts/login-password/partials",
+        "path": "/api/v2/prompts/login/partials",
         "body": "",
         "status": 200,
         "response": {},
@@ -3448,7 +3488,7 @@
     {
         "scope": "https://deploy-cli-dev.eu.auth0.com:443",
         "method": "GET",
-        "path": "/api/v2/prompts/login-passwordless/partials",
+        "path": "/api/v2/prompts/signup/partials",
         "body": "",
         "status": 200,
         "response": {},
@@ -3458,7 +3498,7 @@
     {
         "scope": "https://deploy-cli-dev.eu.auth0.com:443",
         "method": "GET",
-        "path": "/api/v2/prompts/signup/partials",
+        "path": "/api/v2/prompts/login-passwordless/partials",
         "body": "",
         "status": 200,
         "response": {},
@@ -3503,33 +3543,33 @@
                         }
                     ],
                     "created_at": "2025-04-10T08:40:53.519356631Z",
-                    "updated_at": "2025-04-10T08:53:38.511045004Z",
+                    "updated_at": "2025-04-10T09:00:57.353906908Z",
                     "code": "/**\n * Handler that will be called during the execution of a PostLogin flow.\n *\n * @param {Event} event - Details about the user and the context in which they are logging in.\n * @param {PostLoginAPI} api - Interface whose methods can be used to change the behavior of the login.\n */\nexports.onExecutePostLogin = async (event, api) => {\n  console.log('Some custom action!');\n};\n\n/**\n * Handler that will be invoked when this action is resuming after an external redirect. If your\n * onExecutePostLogin function does not perform a redirect, this function can be safely ignored.\n *\n * @param {Event} event - Details about the user and the context in which they are logging in.\n * @param {PostLoginAPI} api - Interface whose methods can be used to change the behavior of the login.\n */\n// exports.onContinuePostLogin = async (event, api) => {\n// };\n",
                     "dependencies": [],
                     "runtime": "node16",
                     "status": "built",
                     "secrets": [],
                     "current_version": {
-                        "id": "d4dae99b-d922-41bb-8e68-62587cd96be0",
+                        "id": "aff3ee7b-eba9-48f8-8d4a-a80abcf51d62",
                         "code": "/**\n * Handler that will be called during the execution of a PostLogin flow.\n *\n * @param {Event} event - Details about the user and the context in which they are logging in.\n * @param {PostLoginAPI} api - Interface whose methods can be used to change the behavior of the login.\n */\nexports.onExecutePostLogin = async (event, api) => {\n  console.log('Some custom action!');\n};\n\n/**\n * Handler that will be invoked when this action is resuming after an external redirect. If your\n * onExecutePostLogin function does not perform a redirect, this function can be safely ignored.\n *\n * @param {Event} event - Details about the user and the context in which they are logging in.\n * @param {PostLoginAPI} api - Interface whose methods can be used to change the behavior of the login.\n */\n// exports.onContinuePostLogin = async (event, api) => {\n// };\n",
                         "runtime": "node16",
                         "status": "BUILT",
-                        "number": 2,
-                        "build_time": "2025-04-10T08:53:39.257301430Z",
-                        "created_at": "2025-04-10T08:53:39.170711034Z",
-                        "updated_at": "2025-04-10T08:53:39.258749641Z"
+                        "number": 3,
+                        "build_time": "2025-04-10T09:00:58.103474016Z",
+                        "created_at": "2025-04-10T09:00:58.036697986Z",
+                        "updated_at": "2025-04-10T09:00:58.104420251Z"
                     },
                     "deployed_version": {
                         "code": "/**\n * Handler that will be called during the execution of a PostLogin flow.\n *\n * @param {Event} event - Details about the user and the context in which they are logging in.\n * @param {PostLoginAPI} api - Interface whose methods can be used to change the behavior of the login.\n */\nexports.onExecutePostLogin = async (event, api) => {\n  console.log('Some custom action!');\n};\n\n/**\n * Handler that will be invoked when this action is resuming after an external redirect. If your\n * onExecutePostLogin function does not perform a redirect, this function can be safely ignored.\n *\n * @param {Event} event - Details about the user and the context in which they are logging in.\n * @param {PostLoginAPI} api - Interface whose methods can be used to change the behavior of the login.\n */\n// exports.onContinuePostLogin = async (event, api) => {\n// };\n",
                         "dependencies": [],
-                        "id": "d4dae99b-d922-41bb-8e68-62587cd96be0",
+                        "id": "aff3ee7b-eba9-48f8-8d4a-a80abcf51d62",
                         "deployed": true,
-                        "number": 2,
-                        "built_at": "2025-04-10T08:53:39.257301430Z",
+                        "number": 3,
+                        "built_at": "2025-04-10T09:00:58.103474016Z",
                         "secrets": [],
                         "status": "built",
-                        "created_at": "2025-04-10T08:53:39.170711034Z",
-                        "updated_at": "2025-04-10T08:53:39.258749641Z",
+                        "created_at": "2025-04-10T09:00:58.036697986Z",
+                        "updated_at": "2025-04-10T09:00:58.104420251Z",
                         "runtime": "node16",
                         "supported_triggers": [
                             {
@@ -3555,6 +3595,17 @@
         "status": 200,
         "response": {
             "triggers": [
+                {
+                    "id": "post-login",
+                    "version": "v1",
+                    "status": "DEPRECATED",
+                    "runtimes": [
+                        "node12"
+                    ],
+                    "default_runtime": "node12",
+                    "binding_policy": "trigger-bound",
+                    "compatible_triggers": []
+                },
                 {
                     "id": "post-login",
                     "version": "v2",
@@ -3588,7 +3639,7 @@
                     ]
                 },
                 {
-                    "id": "post-login",
+                    "id": "credentials-exchange",
                     "version": "v1",
                     "status": "DEPRECATED",
                     "runtimes": [
@@ -3613,7 +3664,7 @@
                     "compatible_triggers": []
                 },
                 {
-                    "id": "credentials-exchange",
+                    "id": "pre-user-registration",
                     "version": "v1",
                     "status": "DEPRECATED",
                     "runtimes": [
@@ -3625,17 +3676,20 @@
                 },
                 {
                     "id": "pre-user-registration",
-                    "version": "v1",
-                    "status": "DEPRECATED",
+                    "version": "v2",
+                    "status": "CURRENT",
                     "runtimes": [
-                        "node12"
+                        "node12",
+                        "node16",
+                        "node18-actions",
+                        "node22"
                     ],
-                    "default_runtime": "node12",
+                    "default_runtime": "node22",
                     "binding_policy": "trigger-bound",
                     "compatible_triggers": []
                 },
                 {
-                    "id": "pre-user-registration",
+                    "id": "post-user-registration",
                     "version": "v2",
                     "status": "CURRENT",
                     "runtimes": [
@@ -3659,20 +3713,6 @@
                     "binding_policy": "trigger-bound",
                     "compatible_triggers": []
                 },
-                {
-                    "id": "post-user-registration",
-                    "version": "v2",
-                    "status": "CURRENT",
-                    "runtimes": [
-                        "node12",
-                        "node16",
-                        "node18-actions",
-                        "node22"
-                    ],
-                    "default_runtime": "node22",
-                    "binding_policy": "trigger-bound",
-                    "compatible_triggers": []
-                },
                 {
                     "id": "post-change-password",
                     "version": "v1",
@@ -4642,62 +4682,12 @@
                 "id": "lst_0000000000021093",
                 "name": "Suspended DD Log Stream",
                 "type": "datadog",
-                "status": "active",
+                "status": "suspended",
                 "sink": {
                     "datadogApiKey": "some-sensitive-api-key",
                     "datadogRegion": "us"
                 },
                 "isPriority": false
-            },
-            {
-                "id": "lst_0000000000021094",
-                "name": "Amazon EventBridge",
-                "type": "eventbridge",
-                "status": "active",
-                "sink": {
-                    "awsAccountId": "123456789012",
-                    "awsRegion": "us-east-2",
-                    "awsPartnerEventSource": "aws.partner/auth0.com/auth0-deploy-cli-e2e-bb95db57-c72d-4a97-bdf1-386d9219e13a/auth0.logs"
-                },
-                "filters": [
-                    {
-                        "type": "category",
-                        "name": "auth.login.success"
-                    },
-                    {
-                        "type": "category",
-                        "name": "auth.login.notification"
-                    },
-                    {
-                        "type": "category",
-                        "name": "auth.login.fail"
-                    },
-                    {
-                        "type": "category",
-                        "name": "auth.signup.success"
-                    },
-                    {
-                        "type": "category",
-                        "name": "auth.logout.success"
-                    },
-                    {
-                        "type": "category",
-                        "name": "auth.logout.fail"
-                    },
-                    {
-                        "type": "category",
-                        "name": "auth.silent_auth.fail"
-                    },
-                    {
-                        "type": "category",
-                        "name": "auth.silent_auth.success"
-                    },
-                    {
-                        "type": "category",
-                        "name": "auth.token_exchange.fail"
-                    }
-                ],
-                "isPriority": false
             }
         ],
         "rawHeaders": [],
@@ -4744,7 +4734,7 @@
                     "name": "Blank-form",
                     "flow_count": 0,
                     "created_at": "2024-11-26T11:58:18.187Z",
-                    "updated_at": "2025-04-10T08:53:56.028Z"
+                    "updated_at": "2025-05-27T11:32:08.928Z"
                 }
             ]
         },
@@ -4830,7 +4820,7 @@
                 }
             },
             "created_at": "2024-11-26T11:58:18.187Z",
-            "updated_at": "2025-04-10T08:53:56.028Z"
+            "updated_at": "2025-05-27T11:32:08.928Z"
         },
         "rawHeaders": [],
         "responseIsBinary": false
@@ -4838,14 +4828,14 @@
     {
         "scope": "https://deploy-cli-dev.eu.auth0.com:443",
         "method": "GET",
-        "path": "/api/v2/flows?page=0&per_page=100&include_totals=true",
+        "path": "/api/v2/flows/vault/connections?page=0&per_page=100&include_totals=true",
         "body": "",
         "status": 200,
         "response": {
             "limit": 100,
             "start": 0,
             "total": 0,
-            "flows": []
+            "connections": []
         },
         "rawHeaders": [],
         "responseIsBinary": false
@@ -4853,14 +4843,14 @@
     {
         "scope": "https://deploy-cli-dev.eu.auth0.com:443",
         "method": "GET",
-        "path": "/api/v2/flows/vault/connections?page=0&per_page=100&include_totals=true",
+        "path": "/api/v2/flows?page=0&per_page=100&include_totals=true",
         "body": "",
         "status": 200,
         "response": {
             "limit": 100,
             "start": 0,
             "total": 0,
-            "connections": []
+            "flows": []
         },
         "rawHeaders": [],
         "responseIsBinary": false
@@ -4909,7 +4899,7 @@
                         "okta"
                     ],
                     "created_at": "2024-11-26T11:58:18.962Z",
-                    "updated_at": "2025-04-10T08:53:41.258Z",
+                    "updated_at": "2025-04-10T09:01:00.721Z",
                     "branding": {
                         "colors": {
                             "primary": "#19aecc"
@@ -4961,7 +4951,7 @@
                         }
                     },
                     "created_at": "2025-04-09T10:50:23.683Z",
-                    "updated_at": "2025-04-10T08:53:41.961Z",
+                    "updated_at": "2025-04-10T09:01:01.363Z",
                     "id": "acl_5TpkFaNH63Mfc5EsaADFHg"
                 }
             ]
@@ -6021,6 +6011,22 @@
                             "description": "Delete Federated Connections Tokensets belonging to a user",
                             "value": "delete:federated_connections_tokens"
                         },
+                        {
+                            "description": "Create User Attribute Profiles",
+                            "value": "create:user_attribute_profiles"
+                        },
+                        {
+                            "description": "Read User Attribute Profiles",
+                            "value": "read:user_attribute_profiles"
+                        },
+                        {
+                            "description": "Update User Attribute Profiles",
+                            "value": "update:user_attribute_profiles"
+                        },
+                        {
+                            "description": "Delete User Attribute Profiles",
+                            "value": "delete:user_attribute_profiles"
+                        },
                         {
                             "value": "read:client_credentials",
                             "description": "Read Client Credentials"
@@ -6048,6 +6054,30 @@
                         {
                             "value": "delete:organization_client_grants",
                             "description": "Delete Organization Client Grants"
+                        },
+                        {
+                            "value": "read:event_streams",
+                            "description": "Read Event Streams"
+                        },
+                        {
+                            "value": "create:event_streams",
+                            "description": "Create Event Streams"
+                        },
+                        {
+                            "value": "update:event_streams",
+                            "description": "Update Event Streams"
+                        },
+                        {
+                            "value": "delete:event_streams",
+                            "description": "Delete Event Streams"
+                        },
+                        {
+                            "value": "read:event_deliveries",
+                            "description": "Read event deliveries on an event stream"
+                        },
+                        {
+                            "value": "update:event_deliveries",
+                            "description": "Redeliver event(s) on an event stream"
                         }
                     ],
                     "is_system": true
@@ -7327,7 +7357,7 @@
     {
         "scope": "https://deploy-cli-dev.eu.auth0.com:443",
         "method": "PUT",
-        "path": "/api/v2/guardian/factors/email",
+        "path": "/api/v2/guardian/factors/duo",
         "body": {
             "enabled": false
         },
@@ -7355,7 +7385,7 @@
     {
         "scope": "https://deploy-cli-dev.eu.auth0.com:443",
         "method": "PUT",
-        "path": "/api/v2/guardian/factors/duo",
+        "path": "/api/v2/guardian/factors/email",
         "body": {
             "enabled": false
         },
@@ -7369,7 +7399,7 @@
     {
         "scope": "https://deploy-cli-dev.eu.auth0.com:443",
         "method": "PUT",
-        "path": "/api/v2/guardian/factors/recovery-code",
+        "path": "/api/v2/guardian/factors/sms",
         "body": {
             "enabled": false
         },
@@ -7383,7 +7413,7 @@
     {
         "scope": "https://deploy-cli-dev.eu.auth0.com:443",
         "method": "PUT",
-        "path": "/api/v2/guardian/factors/push-notification",
+        "path": "/api/v2/guardian/factors/webauthn-roaming",
         "body": {
             "enabled": false
         },
@@ -7397,7 +7427,7 @@
     {
         "scope": "https://deploy-cli-dev.eu.auth0.com:443",
         "method": "PUT",
-        "path": "/api/v2/guardian/factors/webauthn-roaming",
+        "path": "/api/v2/guardian/factors/push-notification",
         "body": {
             "enabled": false
         },
@@ -7411,7 +7441,7 @@
     {
         "scope": "https://deploy-cli-dev.eu.auth0.com:443",
         "method": "PUT",
-        "path": "/api/v2/guardian/factors/sms",
+        "path": "/api/v2/guardian/factors/webauthn-platform",
         "body": {
             "enabled": false
         },
@@ -7425,7 +7455,7 @@
     {
         "scope": "https://deploy-cli-dev.eu.auth0.com:443",
         "method": "PUT",
-        "path": "/api/v2/guardian/factors/webauthn-platform",
+        "path": "/api/v2/guardian/factors/recovery-code",
         "body": {
             "enabled": false
         },
@@ -7524,33 +7554,33 @@
                         }
                     ],
                     "created_at": "2025-04-10T08:40:53.519356631Z",
-                    "updated_at": "2025-04-10T08:53:38.511045004Z",
+                    "updated_at": "2025-04-10T09:00:57.353906908Z",
                     "code": "/**\n * Handler that will be called during the execution of a PostLogin flow.\n *\n * @param {Event} event - Details about the user and the context in which they are logging in.\n * @param {PostLoginAPI} api - Interface whose methods can be used to change the behavior of the login.\n */\nexports.onExecutePostLogin = async (event, api) => {\n  console.log('Some custom action!');\n};\n\n/**\n * Handler that will be invoked when this action is resuming after an external redirect. If your\n * onExecutePostLogin function does not perform a redirect, this function can be safely ignored.\n *\n * @param {Event} event - Details about the user and the context in which they are logging in.\n * @param {PostLoginAPI} api - Interface whose methods can be used to change the behavior of the login.\n */\n// exports.onContinuePostLogin = async (event, api) => {\n// };\n",
                     "dependencies": [],
                     "runtime": "node16",
                     "status": "built",
                     "secrets": [],
                     "current_version": {
-                        "id": "d4dae99b-d922-41bb-8e68-62587cd96be0",
+                        "id": "aff3ee7b-eba9-48f8-8d4a-a80abcf51d62",
                         "code": "/**\n * Handler that will be called during the execution of a PostLogin flow.\n *\n * @param {Event} event - Details about the user and the context in which they are logging in.\n * @param {PostLoginAPI} api - Interface whose methods can be used to change the behavior of the login.\n */\nexports.onExecutePostLogin = async (event, api) => {\n  console.log('Some custom action!');\n};\n\n/**\n * Handler that will be invoked when this action is resuming after an external redirect. If your\n * onExecutePostLogin function does not perform a redirect, this function can be safely ignored.\n *\n * @param {Event} event - Details about the user and the context in which they are logging in.\n * @param {PostLoginAPI} api - Interface whose methods can be used to change the behavior of the login.\n */\n// exports.onContinuePostLogin = async (event, api) => {\n// };\n",
                         "runtime": "node16",
                         "status": "BUILT",
-                        "number": 2,
-                        "build_time": "2025-04-10T08:53:39.257301430Z",
-                        "created_at": "2025-04-10T08:53:39.170711034Z",
-                        "updated_at": "2025-04-10T08:53:39.258749641Z"
+                        "number": 3,
+                        "build_time": "2025-04-10T09:00:58.103474016Z",
+                        "created_at": "2025-04-10T09:00:58.036697986Z",
+                        "updated_at": "2025-04-10T09:00:58.104420251Z"
                     },
                     "deployed_version": {
                         "code": "/**\n * Handler that will be called during the execution of a PostLogin flow.\n *\n * @param {Event} event - Details about the user and the context in which they are logging in.\n * @param {PostLoginAPI} api - Interface whose methods can be used to change the behavior of the login.\n */\nexports.onExecutePostLogin = async (event, api) => {\n  console.log('Some custom action!');\n};\n\n/**\n * Handler that will be invoked when this action is resuming after an external redirect. If your\n * onExecutePostLogin function does not perform a redirect, this function can be safely ignored.\n *\n * @param {Event} event - Details about the user and the context in which they are logging in.\n * @param {PostLoginAPI} api - Interface whose methods can be used to change the behavior of the login.\n */\n// exports.onContinuePostLogin = async (event, api) => {\n// };\n",
                         "dependencies": [],
-                        "id": "d4dae99b-d922-41bb-8e68-62587cd96be0",
+                        "id": "aff3ee7b-eba9-48f8-8d4a-a80abcf51d62",
                         "deployed": true,
-                        "number": 2,
-                        "built_at": "2025-04-10T08:53:39.257301430Z",
+                        "number": 3,
+                        "built_at": "2025-04-10T09:00:58.103474016Z",
                         "secrets": [],
                         "status": "built",
-                        "created_at": "2025-04-10T08:53:39.170711034Z",
-                        "updated_at": "2025-04-10T08:53:39.258749641Z",
+                        "created_at": "2025-04-10T09:00:58.036697986Z",
+                        "updated_at": "2025-04-10T09:00:58.104420251Z",
                         "runtime": "node16",
                         "supported_triggers": [
                             {
@@ -7596,33 +7626,33 @@
                 }
             ],
             "created_at": "2025-04-10T08:40:53.519356631Z",
-            "updated_at": "2025-04-10T09:00:57.353906908Z",
+            "updated_at": "2025-05-27T13:47:50.553583374Z",
             "code": "/**\n * Handler that will be called during the execution of a PostLogin flow.\n *\n * @param {Event} event - Details about the user and the context in which they are logging in.\n * @param {PostLoginAPI} api - Interface whose methods can be used to change the behavior of the login.\n */\nexports.onExecutePostLogin = async (event, api) => {\n  console.log('Some custom action!');\n};\n\n/**\n * Handler that will be invoked when this action is resuming after an external redirect. If your\n * onExecutePostLogin function does not perform a redirect, this function can be safely ignored.\n *\n * @param {Event} event - Details about the user and the context in which they are logging in.\n * @param {PostLoginAPI} api - Interface whose methods can be used to change the behavior of the login.\n */\n// exports.onContinuePostLogin = async (event, api) => {\n// };\n",
             "dependencies": [],
             "runtime": "node16",
             "status": "pending",
             "secrets": [],
             "current_version": {
-                "id": "d4dae99b-d922-41bb-8e68-62587cd96be0",
+                "id": "aff3ee7b-eba9-48f8-8d4a-a80abcf51d62",
                 "code": "/**\n * Handler that will be called during the execution of a PostLogin flow.\n *\n * @param {Event} event - Details about the user and the context in which they are logging in.\n * @param {PostLoginAPI} api - Interface whose methods can be used to change the behavior of the login.\n */\nexports.onExecutePostLogin = async (event, api) => {\n  console.log('Some custom action!');\n};\n\n/**\n * Handler that will be invoked when this action is resuming after an external redirect. If your\n * onExecutePostLogin function does not perform a redirect, this function can be safely ignored.\n *\n * @param {Event} event - Details about the user and the context in which they are logging in.\n * @param {PostLoginAPI} api - Interface whose methods can be used to change the behavior of the login.\n */\n// exports.onContinuePostLogin = async (event, api) => {\n// };\n",
                 "runtime": "node16",
                 "status": "BUILT",
-                "number": 2,
-                "build_time": "2025-04-10T08:53:39.257301430Z",
-                "created_at": "2025-04-10T08:53:39.170711034Z",
-                "updated_at": "2025-04-10T08:53:39.258749641Z"
+                "number": 3,
+                "build_time": "2025-04-10T09:00:58.103474016Z",
+                "created_at": "2025-04-10T09:00:58.036697986Z",
+                "updated_at": "2025-04-10T09:00:58.104420251Z"
             },
             "deployed_version": {
                 "code": "/**\n * Handler that will be called during the execution of a PostLogin flow.\n *\n * @param {Event} event - Details about the user and the context in which they are logging in.\n * @param {PostLoginAPI} api - Interface whose methods can be used to change the behavior of the login.\n */\nexports.onExecutePostLogin = async (event, api) => {\n  console.log('Some custom action!');\n};\n\n/**\n * Handler that will be invoked when this action is resuming after an external redirect. If your\n * onExecutePostLogin function does not perform a redirect, this function can be safely ignored.\n *\n * @param {Event} event - Details about the user and the context in which they are logging in.\n * @param {PostLoginAPI} api - Interface whose methods can be used to change the behavior of the login.\n */\n// exports.onContinuePostLogin = async (event, api) => {\n// };\n",
                 "dependencies": [],
-                "id": "d4dae99b-d922-41bb-8e68-62587cd96be0",
+                "id": "aff3ee7b-eba9-48f8-8d4a-a80abcf51d62",
                 "deployed": true,
-                "number": 2,
-                "built_at": "2025-04-10T08:53:39.257301430Z",
+                "number": 3,
+                "built_at": "2025-04-10T09:00:58.103474016Z",
                 "secrets": [],
                 "status": "built",
-                "created_at": "2025-04-10T08:53:39.170711034Z",
-                "updated_at": "2025-04-10T08:53:39.258749641Z",
+                "created_at": "2025-04-10T09:00:58.036697986Z",
+                "updated_at": "2025-04-10T09:00:58.104420251Z",
                 "runtime": "node16",
                 "supported_triggers": [
                     {
@@ -7654,33 +7684,33 @@
                         }
                     ],
                     "created_at": "2025-04-10T08:40:53.519356631Z",
-                    "updated_at": "2025-04-10T09:00:57.353906908Z",
+                    "updated_at": "2025-05-27T13:47:50.553583374Z",
                     "code": "/**\n * Handler that will be called during the execution of a PostLogin flow.\n *\n * @param {Event} event - Details about the user and the context in which they are logging in.\n * @param {PostLoginAPI} api - Interface whose methods can be used to change the behavior of the login.\n */\nexports.onExecutePostLogin = async (event, api) => {\n  console.log('Some custom action!');\n};\n\n/**\n * Handler that will be invoked when this action is resuming after an external redirect. If your\n * onExecutePostLogin function does not perform a redirect, this function can be safely ignored.\n *\n * @param {Event} event - Details about the user and the context in which they are logging in.\n * @param {PostLoginAPI} api - Interface whose methods can be used to change the behavior of the login.\n */\n// exports.onContinuePostLogin = async (event, api) => {\n// };\n",
                     "dependencies": [],
                     "runtime": "node16",
                     "status": "built",
                     "secrets": [],
                     "current_version": {
-                        "id": "d4dae99b-d922-41bb-8e68-62587cd96be0",
+                        "id": "aff3ee7b-eba9-48f8-8d4a-a80abcf51d62",
                         "code": "/**\n * Handler that will be called during the execution of a PostLogin flow.\n *\n * @param {Event} event - Details about the user and the context in which they are logging in.\n * @param {PostLoginAPI} api - Interface whose methods can be used to change the behavior of the login.\n */\nexports.onExecutePostLogin = async (event, api) => {\n  console.log('Some custom action!');\n};\n\n/**\n * Handler that will be invoked when this action is resuming after an external redirect. If your\n * onExecutePostLogin function does not perform a redirect, this function can be safely ignored.\n *\n * @param {Event} event - Details about the user and the context in which they are logging in.\n * @param {PostLoginAPI} api - Interface whose methods can be used to change the behavior of the login.\n */\n// exports.onContinuePostLogin = async (event, api) => {\n// };\n",
                         "runtime": "node16",
                         "status": "BUILT",
-                        "number": 2,
-                        "build_time": "2025-04-10T08:53:39.257301430Z",
-                        "created_at": "2025-04-10T08:53:39.170711034Z",
-                        "updated_at": "2025-04-10T08:53:39.258749641Z"
+                        "number": 3,
+                        "build_time": "2025-04-10T09:00:58.103474016Z",
+                        "created_at": "2025-04-10T09:00:58.036697986Z",
+                        "updated_at": "2025-04-10T09:00:58.104420251Z"
                     },
                     "deployed_version": {
                         "code": "/**\n * Handler that will be called during the execution of a PostLogin flow.\n *\n * @param {Event} event - Details about the user and the context in which they are logging in.\n * @param {PostLoginAPI} api - Interface whose methods can be used to change the behavior of the login.\n */\nexports.onExecutePostLogin = async (event, api) => {\n  console.log('Some custom action!');\n};\n\n/**\n * Handler that will be invoked when this action is resuming after an external redirect. If your\n * onExecutePostLogin function does not perform a redirect, this function can be safely ignored.\n *\n * @param {Event} event - Details about the user and the context in which they are logging in.\n * @param {PostLoginAPI} api - Interface whose methods can be used to change the behavior of the login.\n */\n// exports.onContinuePostLogin = async (event, api) => {\n// };\n",
                         "dependencies": [],
-                        "id": "d4dae99b-d922-41bb-8e68-62587cd96be0",
+                        "id": "aff3ee7b-eba9-48f8-8d4a-a80abcf51d62",
                         "deployed": true,
-                        "number": 2,
-                        "built_at": "2025-04-10T08:53:39.257301430Z",
+                        "number": 3,
+                        "built_at": "2025-04-10T09:00:58.103474016Z",
                         "secrets": [],
                         "status": "built",
-                        "created_at": "2025-04-10T08:53:39.170711034Z",
-                        "updated_at": "2025-04-10T08:53:39.258749641Z",
+                        "created_at": "2025-04-10T09:00:58.036697986Z",
+                        "updated_at": "2025-04-10T09:00:58.104420251Z",
                         "runtime": "node16",
                         "supported_triggers": [
                             {
@@ -7707,13 +7737,13 @@
         "response": {
             "code": "/**\n * Handler that will be called during the execution of a PostLogin flow.\n *\n * @param {Event} event - Details about the user and the context in which they are logging in.\n * @param {PostLoginAPI} api - Interface whose methods can be used to change the behavior of the login.\n */\nexports.onExecutePostLogin = async (event, api) => {\n  console.log('Some custom action!');\n};\n\n/**\n * Handler that will be invoked when this action is resuming after an external redirect. If your\n * onExecutePostLogin function does not perform a redirect, this function can be safely ignored.\n *\n * @param {Event} event - Details about the user and the context in which they are logging in.\n * @param {PostLoginAPI} api - Interface whose methods can be used to change the behavior of the login.\n */\n// exports.onContinuePostLogin = async (event, api) => {\n// };\n",
             "dependencies": [],
-            "id": "aff3ee7b-eba9-48f8-8d4a-a80abcf51d62",
+            "id": "ba15fb92-52c7-44e3-9cfb-6253df220b8c",
             "deployed": false,
-            "number": 3,
+            "number": 4,
             "secrets": [],
             "status": "built",
-            "created_at": "2025-04-10T09:00:58.036697986Z",
-            "updated_at": "2025-04-10T09:00:58.036697986Z",
+            "created_at": "2025-05-27T13:47:51.262547034Z",
+            "updated_at": "2025-05-27T13:47:51.262547034Z",
             "runtime": "node16",
             "supported_triggers": [
                 {
@@ -7731,7 +7761,7 @@
                     }
                 ],
                 "created_at": "2025-04-10T08:40:53.519356631Z",
-                "updated_at": "2025-04-10T09:00:57.348270238Z",
+                "updated_at": "2025-05-27T13:47:50.549325889Z",
                 "all_changes_deployed": false
             }
         },
@@ -7782,34 +7812,6 @@
         "rawHeaders": [],
         "responseIsBinary": false
     },
-    {
-        "scope": "https://deploy-cli-dev.eu.auth0.com:443",
-        "method": "PATCH",
-        "path": "/api/v2/attack-protection/brute-force-protection",
-        "body": {
-            "enabled": true,
-            "shields": [
-                "block",
-                "user_notification"
-            ],
-            "mode": "count_per_identifier_and_ip",
-            "allowlist": [],
-            "max_attempts": 10
-        },
-        "status": 200,
-        "response": {
-            "enabled": true,
-            "shields": [
-                "block",
-                "user_notification"
-            ],
-            "mode": "count_per_identifier_and_ip",
-            "allowlist": [],
-            "max_attempts": 10
-        },
-        "rawHeaders": [],
-        "responseIsBinary": false
-    },
     {
         "scope": "https://deploy-cli-dev.eu.auth0.com:443",
         "method": "PATCH",
@@ -7848,174 +7850,51 @@
     },
     {
         "scope": "https://deploy-cli-dev.eu.auth0.com:443",
-        "method": "GET",
-        "path": "/api/v2/log-streams",
-        "body": "",
+        "method": "PATCH",
+        "path": "/api/v2/attack-protection/brute-force-protection",
+        "body": {
+            "enabled": true,
+            "shields": [
+                "block",
+                "user_notification"
+            ],
+            "mode": "count_per_identifier_and_ip",
+            "allowlist": [],
+            "max_attempts": 10
+        },
         "status": 200,
-        "response": [
-            {
-                "id": "lst_0000000000021093",
-                "name": "Suspended DD Log Stream",
-                "type": "datadog",
-                "status": "active",
-                "sink": {
-                    "datadogApiKey": "some-sensitive-api-key",
-                    "datadogRegion": "us"
-                },
-                "isPriority": false
-            },
-            {
-                "id": "lst_0000000000021094",
-                "name": "Amazon EventBridge",
-                "type": "eventbridge",
-                "status": "active",
-                "sink": {
-                    "awsAccountId": "123456789012",
-                    "awsRegion": "us-east-2",
-                    "awsPartnerEventSource": "aws.partner/auth0.com/auth0-deploy-cli-e2e-bb95db57-c72d-4a97-bdf1-386d9219e13a/auth0.logs"
-                },
-                "filters": [
-                    {
-                        "type": "category",
-                        "name": "auth.login.success"
-                    },
-                    {
-                        "type": "category",
-                        "name": "auth.login.notification"
-                    },
-                    {
-                        "type": "category",
-                        "name": "auth.login.fail"
-                    },
-                    {
-                        "type": "category",
-                        "name": "auth.signup.success"
-                    },
-                    {
-                        "type": "category",
-                        "name": "auth.logout.success"
-                    },
-                    {
-                        "type": "category",
-                        "name": "auth.logout.fail"
-                    },
-                    {
-                        "type": "category",
-                        "name": "auth.silent_auth.fail"
-                    },
-                    {
-                        "type": "category",
-                        "name": "auth.silent_auth.success"
-                    },
-                    {
-                        "type": "category",
-                        "name": "auth.token_exchange.fail"
-                    }
-                ],
-                "isPriority": false
-            }
-        ],
+        "response": {
+            "enabled": true,
+            "shields": [
+                "block",
+                "user_notification"
+            ],
+            "mode": "count_per_identifier_and_ip",
+            "allowlist": [],
+            "max_attempts": 10
+        },
         "rawHeaders": [],
         "responseIsBinary": false
     },
     {
         "scope": "https://deploy-cli-dev.eu.auth0.com:443",
-        "method": "PATCH",
-        "path": "/api/v2/log-streams/lst_0000000000021094",
-        "body": {
-            "name": "Amazon EventBridge",
-            "filters": [
-                {
-                    "type": "category",
-                    "name": "auth.login.success"
-                },
-                {
-                    "type": "category",
-                    "name": "auth.login.notification"
-                },
-                {
-                    "type": "category",
-                    "name": "auth.login.fail"
-                },
-                {
-                    "type": "category",
-                    "name": "auth.signup.success"
-                },
-                {
-                    "type": "category",
-                    "name": "auth.logout.success"
-                },
-                {
-                    "type": "category",
-                    "name": "auth.logout.fail"
-                },
-                {
-                    "type": "category",
-                    "name": "auth.silent_auth.fail"
-                },
-                {
-                    "type": "category",
-                    "name": "auth.silent_auth.success"
-                },
-                {
-                    "type": "category",
-                    "name": "auth.token_exchange.fail"
-                }
-            ],
-            "isPriority": false,
-            "status": "active"
-        },
+        "method": "GET",
+        "path": "/api/v2/log-streams",
+        "body": "",
         "status": 200,
-        "response": {
-            "id": "lst_0000000000021094",
-            "name": "Amazon EventBridge",
-            "type": "eventbridge",
-            "status": "active",
-            "sink": {
-                "awsAccountId": "123456789012",
-                "awsRegion": "us-east-2",
-                "awsPartnerEventSource": "aws.partner/auth0.com/auth0-deploy-cli-e2e-bb95db57-c72d-4a97-bdf1-386d9219e13a/auth0.logs"
-            },
-            "filters": [
-                {
-                    "type": "category",
-                    "name": "auth.login.success"
-                },
-                {
-                    "type": "category",
-                    "name": "auth.login.notification"
-                },
-                {
-                    "type": "category",
-                    "name": "auth.login.fail"
-                },
-                {
-                    "type": "category",
-                    "name": "auth.signup.success"
-                },
-                {
-                    "type": "category",
-                    "name": "auth.logout.success"
-                },
-                {
-                    "type": "category",
-                    "name": "auth.logout.fail"
-                },
-                {
-                    "type": "category",
-                    "name": "auth.silent_auth.fail"
-                },
-                {
-                    "type": "category",
-                    "name": "auth.silent_auth.success"
+        "response": [
+            {
+                "id": "lst_0000000000021093",
+                "name": "Suspended DD Log Stream",
+                "type": "datadog",
+                "status": "suspended",
+                "sink": {
+                    "datadogApiKey": "some-sensitive-api-key",
+                    "datadogRegion": "us"
                 },
-                {
-                    "type": "category",
-                    "name": "auth.token_exchange.fail"
-                }
-            ],
-            "isPriority": false
-        },
+                "isPriority": false
+            }
+        ],
         "rawHeaders": [],
         "responseIsBinary": false
     },
@@ -8027,18 +7906,18 @@
             "name": "Suspended DD Log Stream",
             "isPriority": false,
             "sink": {
+                "datadogApiKey": "##LOGSTREAMS_DATADOG_SECRET##",
                 "datadogRegion": "us"
-            },
-            "status": "active"
+            }
         },
         "status": 200,
         "response": {
             "id": "lst_0000000000021093",
             "name": "Suspended DD Log Stream",
             "type": "datadog",
-            "status": "active",
+            "status": "suspended",
             "sink": {
-                "datadogApiKey": "some-sensitive-api-key",
+                "datadogApiKey": "##LOGSTREAMS_DATADOG_SECRET##",
                 "datadogRegion": "us"
             },
             "isPriority": false
@@ -8100,7 +7979,7 @@
                         "okta"
                     ],
                     "created_at": "2024-11-26T11:58:18.962Z",
-                    "updated_at": "2025-04-10T08:53:41.258Z",
+                    "updated_at": "2025-04-10T09:01:00.721Z",
                     "branding": {
                         "colors": {
                             "primary": "#19aecc"
@@ -8176,7 +8055,7 @@
                 "okta"
             ],
             "created_at": "2024-11-26T11:58:18.962Z",
-            "updated_at": "2025-04-10T09:01:00.721Z",
+            "updated_at": "2025-05-27T13:47:54.076Z",
             "branding": {
                 "colors": {
                     "primary": "#19aecc"
@@ -8213,7 +8092,7 @@
                         }
                     },
                     "created_at": "2025-04-09T10:50:23.683Z",
-                    "updated_at": "2025-04-10T08:53:41.961Z",
+                    "updated_at": "2025-04-10T09:01:01.363Z",
                     "id": "acl_5TpkFaNH63Mfc5EsaADFHg"
                 }
             ]
@@ -8258,7 +8137,7 @@
                 }
             },
             "created_at": "2025-04-09T10:50:23.683Z",
-            "updated_at": "2025-04-10T09:01:01.363Z",
+            "updated_at": "2025-05-27T13:47:54.788Z",
             "id": "acl_5TpkFaNH63Mfc5EsaADFHg"
         },
         "rawHeaders": [],
@@ -11688,7 +11567,7 @@
     {
         "scope": "https://deploy-cli-dev.eu.auth0.com:443",
         "method": "PATCH",
-        "path": "/api/v2/client-grants/cgr_5vcTfyeHl5H4fAX9",
+        "path": "/api/v2/client-grants/cgr_VOMMRiAXG3bqPOOY",
         "body": {
             "scope": [
                 "read:client_grants",
@@ -11825,8 +11704,8 @@
         },
         "status": 200,
         "response": {
-            "id": "cgr_5vcTfyeHl5H4fAX9",
-            "client_id": "f4eBblJcLD2brx8wnnicXn70F7FN0yzJ",
+            "id": "cgr_VOMMRiAXG3bqPOOY",
+            "client_id": "l7YeaTKUoTupuw44MDo3475XYGglfuGn",
             "audience": "https://auth0-deploy-cli-e2e.us.auth0.com/api/v2/",
             "scope": [
                 "read:client_grants",
@@ -11967,7 +11846,7 @@
     {
         "scope": "https://deploy-cli-dev.eu.auth0.com:443",
         "method": "PATCH",
-        "path": "/api/v2/client-grants/cgr_VOMMRiAXG3bqPOOY",
+        "path": "/api/v2/client-grants/cgr_5vcTfyeHl5H4fAX9",
         "body": {
             "scope": [
                 "read:client_grants",
@@ -12104,8 +11983,8 @@
         },
         "status": 200,
         "response": {
-            "id": "cgr_VOMMRiAXG3bqPOOY",
-            "client_id": "l7YeaTKUoTupuw44MDo3475XYGglfuGn",
+            "id": "cgr_5vcTfyeHl5H4fAX9",
+            "client_id": "f4eBblJcLD2brx8wnnicXn70F7FN0yzJ",
             "audience": "https://auth0-deploy-cli-e2e.us.auth0.com/api/v2/",
             "scope": [
                 "read:client_grants",
@@ -13424,513 +13303,14 @@
     {
         "scope": "https://deploy-cli-dev.eu.auth0.com:443",
         "method": "GET",
-        "path": "/api/v2/client-grants?per_page=100&page=0&include_totals=true",
+        "path": "/api/v2/clients?page=0&per_page=100&include_totals=true",
         "body": "",
         "status": 200,
         "response": {
-            "total": 3,
+            "total": 10,
             "start": 0,
             "limit": 100,
-            "client_grants": [
-                {
-                    "id": "cgr_5vcTfyeHl5H4fAX9",
-                    "client_id": "f4eBblJcLD2brx8wnnicXn70F7FN0yzJ",
-                    "audience": "https://auth0-deploy-cli-e2e.us.auth0.com/api/v2/",
-                    "scope": [
-                        "read:client_grants",
-                        "create:client_grants",
-                        "delete:client_grants",
-                        "update:client_grants",
-                        "read:users",
-                        "update:users",
-                        "delete:users",
-                        "create:users",
-                        "read:users_app_metadata",
-                        "update:users_app_metadata",
-                        "delete:users_app_metadata",
-                        "create:users_app_metadata",
-                        "read:user_custom_blocks",
-                        "create:user_custom_blocks",
-                        "delete:user_custom_blocks",
-                        "create:user_tickets",
-                        "read:clients",
-                        "update:clients",
-                        "delete:clients",
-                        "create:clients",
-                        "read:client_keys",
-                        "update:client_keys",
-                        "delete:client_keys",
-                        "create:client_keys",
-                        "read:connections",
-                        "update:connections",
-                        "delete:connections",
-                        "create:connections",
-                        "read:resource_servers",
-                        "update:resource_servers",
-                        "delete:resource_servers",
-                        "create:resource_servers",
-                        "read:device_credentials",
-                        "update:device_credentials",
-                        "delete:device_credentials",
-                        "create:device_credentials",
-                        "read:rules",
-                        "update:rules",
-                        "delete:rules",
-                        "create:rules",
-                        "read:rules_configs",
-                        "update:rules_configs",
-                        "delete:rules_configs",
-                        "read:hooks",
-                        "update:hooks",
-                        "delete:hooks",
-                        "create:hooks",
-                        "read:actions",
-                        "update:actions",
-                        "delete:actions",
-                        "create:actions",
-                        "read:email_provider",
-                        "update:email_provider",
-                        "delete:email_provider",
-                        "create:email_provider",
-                        "blacklist:tokens",
-                        "read:stats",
-                        "read:insights",
-                        "read:tenant_settings",
-                        "update:tenant_settings",
-                        "read:logs",
-                        "read:logs_users",
-                        "read:shields",
-                        "create:shields",
-                        "update:shields",
-                        "delete:shields",
-                        "read:anomaly_blocks",
-                        "delete:anomaly_blocks",
-                        "update:triggers",
-                        "read:triggers",
-                        "read:grants",
-                        "delete:grants",
-                        "read:guardian_factors",
-                        "update:guardian_factors",
-                        "read:guardian_enrollments",
-                        "delete:guardian_enrollments",
-                        "create:guardian_enrollment_tickets",
-                        "read:user_idp_tokens",
-                        "create:passwords_checking_job",
-                        "delete:passwords_checking_job",
-                        "read:custom_domains",
-                        "delete:custom_domains",
-                        "create:custom_domains",
-                        "update:custom_domains",
-                        "read:email_templates",
-                        "create:email_templates",
-                        "update:email_templates",
-                        "read:mfa_policies",
-                        "update:mfa_policies",
-                        "read:roles",
-                        "create:roles",
-                        "delete:roles",
-                        "update:roles",
-                        "read:prompts",
-                        "update:prompts",
-                        "read:branding",
-                        "update:branding",
-                        "delete:branding",
-                        "read:log_streams",
-                        "create:log_streams",
-                        "delete:log_streams",
-                        "update:log_streams",
-                        "create:signing_keys",
-                        "read:signing_keys",
-                        "update:signing_keys",
-                        "read:limits",
-                        "update:limits",
-                        "create:role_members",
-                        "read:role_members",
-                        "delete:role_members",
-                        "read:entitlements",
-                        "read:attack_protection",
-                        "update:attack_protection",
-                        "read:organizations",
-                        "update:organizations",
-                        "create:organizations",
-                        "delete:organizations",
-                        "create:organization_members",
-                        "read:organization_members",
-                        "delete:organization_members",
-                        "create:organization_connections",
-                        "read:organization_connections",
-                        "update:organization_connections",
-                        "delete:organization_connections",
-                        "create:organization_member_roles",
-                        "read:organization_member_roles",
-                        "delete:organization_member_roles",
-                        "create:organization_invitations",
-                        "read:organization_invitations",
-                        "delete:organization_invitations"
-                    ]
-                },
-                {
-                    "id": "cgr_VOMMRiAXG3bqPOOY",
-                    "client_id": "l7YeaTKUoTupuw44MDo3475XYGglfuGn",
-                    "audience": "https://auth0-deploy-cli-e2e.us.auth0.com/api/v2/",
-                    "scope": [
-                        "read:client_grants",
-                        "create:client_grants",
-                        "delete:client_grants",
-                        "update:client_grants",
-                        "read:users",
-                        "update:users",
-                        "delete:users",
-                        "create:users",
-                        "read:users_app_metadata",
-                        "update:users_app_metadata",
-                        "delete:users_app_metadata",
-                        "create:users_app_metadata",
-                        "read:user_custom_blocks",
-                        "create:user_custom_blocks",
-                        "delete:user_custom_blocks",
-                        "create:user_tickets",
-                        "read:clients",
-                        "update:clients",
-                        "delete:clients",
-                        "create:clients",
-                        "read:client_keys",
-                        "update:client_keys",
-                        "delete:client_keys",
-                        "create:client_keys",
-                        "read:connections",
-                        "update:connections",
-                        "delete:connections",
-                        "create:connections",
-                        "read:resource_servers",
-                        "update:resource_servers",
-                        "delete:resource_servers",
-                        "create:resource_servers",
-                        "read:device_credentials",
-                        "update:device_credentials",
-                        "delete:device_credentials",
-                        "create:device_credentials",
-                        "read:rules",
-                        "update:rules",
-                        "delete:rules",
-                        "create:rules",
-                        "read:rules_configs",
-                        "update:rules_configs",
-                        "delete:rules_configs",
-                        "read:hooks",
-                        "update:hooks",
-                        "delete:hooks",
-                        "create:hooks",
-                        "read:actions",
-                        "update:actions",
-                        "delete:actions",
-                        "create:actions",
-                        "read:email_provider",
-                        "update:email_provider",
-                        "delete:email_provider",
-                        "create:email_provider",
-                        "blacklist:tokens",
-                        "read:stats",
-                        "read:insights",
-                        "read:tenant_settings",
-                        "update:tenant_settings",
-                        "read:logs",
-                        "read:logs_users",
-                        "read:shields",
-                        "create:shields",
-                        "update:shields",
-                        "delete:shields",
-                        "read:anomaly_blocks",
-                        "delete:anomaly_blocks",
-                        "update:triggers",
-                        "read:triggers",
-                        "read:grants",
-                        "delete:grants",
-                        "read:guardian_factors",
-                        "update:guardian_factors",
-                        "read:guardian_enrollments",
-                        "delete:guardian_enrollments",
-                        "create:guardian_enrollment_tickets",
-                        "read:user_idp_tokens",
-                        "create:passwords_checking_job",
-                        "delete:passwords_checking_job",
-                        "read:custom_domains",
-                        "delete:custom_domains",
-                        "create:custom_domains",
-                        "update:custom_domains",
-                        "read:email_templates",
-                        "create:email_templates",
-                        "update:email_templates",
-                        "read:mfa_policies",
-                        "update:mfa_policies",
-                        "read:roles",
-                        "create:roles",
-                        "delete:roles",
-                        "update:roles",
-                        "read:prompts",
-                        "update:prompts",
-                        "read:branding",
-                        "update:branding",
-                        "delete:branding",
-                        "read:log_streams",
-                        "create:log_streams",
-                        "delete:log_streams",
-                        "update:log_streams",
-                        "create:signing_keys",
-                        "read:signing_keys",
-                        "update:signing_keys",
-                        "read:limits",
-                        "update:limits",
-                        "create:role_members",
-                        "read:role_members",
-                        "delete:role_members",
-                        "read:entitlements",
-                        "read:attack_protection",
-                        "update:attack_protection",
-                        "read:organizations",
-                        "update:organizations",
-                        "create:organizations",
-                        "delete:organizations",
-                        "create:organization_members",
-                        "read:organization_members",
-                        "delete:organization_members",
-                        "create:organization_connections",
-                        "read:organization_connections",
-                        "update:organization_connections",
-                        "delete:organization_connections",
-                        "create:organization_member_roles",
-                        "read:organization_member_roles",
-                        "delete:organization_member_roles",
-                        "create:organization_invitations",
-                        "read:organization_invitations",
-                        "delete:organization_invitations"
-                    ]
-                },
-                {
-                    "id": "cgr_a5G2CpWYpgxCM4Xw",
-                    "client_id": "Vp0gMRF8PtMzekil38qWoj4Fjw2VjRZE",
-                    "audience": "https://auth0-deploy-cli-e2e.us.auth0.com/api/v2/",
-                    "scope": [
-                        "read:client_grants",
-                        "create:client_grants",
-                        "delete:client_grants",
-                        "update:client_grants",
-                        "read:users",
-                        "update:users",
-                        "delete:users",
-                        "create:users",
-                        "read:users_app_metadata",
-                        "update:users_app_metadata",
-                        "delete:users_app_metadata",
-                        "create:users_app_metadata",
-                        "read:user_custom_blocks",
-                        "create:user_custom_blocks",
-                        "delete:user_custom_blocks",
-                        "create:user_tickets",
-                        "read:clients",
-                        "update:clients",
-                        "delete:clients",
-                        "create:clients",
-                        "read:client_keys",
-                        "update:client_keys",
-                        "delete:client_keys",
-                        "create:client_keys",
-                        "read:connections",
-                        "update:connections",
-                        "delete:connections",
-                        "create:connections",
-                        "read:resource_servers",
-                        "update:resource_servers",
-                        "delete:resource_servers",
-                        "create:resource_servers",
-                        "read:device_credentials",
-                        "update:device_credentials",
-                        "delete:device_credentials",
-                        "create:device_credentials",
-                        "read:rules",
-                        "update:rules",
-                        "delete:rules",
-                        "create:rules",
-                        "read:rules_configs",
-                        "update:rules_configs",
-                        "delete:rules_configs",
-                        "read:hooks",
-                        "update:hooks",
-                        "delete:hooks",
-                        "create:hooks",
-                        "read:actions",
-                        "update:actions",
-                        "delete:actions",
-                        "create:actions",
-                        "read:email_provider",
-                        "update:email_provider",
-                        "delete:email_provider",
-                        "create:email_provider",
-                        "blacklist:tokens",
-                        "read:stats",
-                        "read:insights",
-                        "read:tenant_settings",
-                        "update:tenant_settings",
-                        "read:logs",
-                        "read:logs_users",
-                        "read:shields",
-                        "create:shields",
-                        "update:shields",
-                        "delete:shields",
-                        "read:anomaly_blocks",
-                        "delete:anomaly_blocks",
-                        "update:triggers",
-                        "read:triggers",
-                        "read:grants",
-                        "delete:grants",
-                        "read:guardian_factors",
-                        "update:guardian_factors",
-                        "read:guardian_enrollments",
-                        "delete:guardian_enrollments",
-                        "create:guardian_enrollment_tickets",
-                        "read:user_idp_tokens",
-                        "create:passwords_checking_job",
-                        "delete:passwords_checking_job",
-                        "read:custom_domains",
-                        "delete:custom_domains",
-                        "create:custom_domains",
-                        "update:custom_domains",
-                        "read:email_templates",
-                        "create:email_templates",
-                        "update:email_templates",
-                        "read:mfa_policies",
-                        "update:mfa_policies",
-                        "read:roles",
-                        "create:roles",
-                        "delete:roles",
-                        "update:roles",
-                        "read:prompts",
-                        "update:prompts",
-                        "read:branding",
-                        "update:branding",
-                        "delete:branding",
-                        "read:log_streams",
-                        "create:log_streams",
-                        "delete:log_streams",
-                        "update:log_streams",
-                        "create:signing_keys",
-                        "read:signing_keys",
-                        "update:signing_keys",
-                        "read:limits",
-                        "update:limits",
-                        "create:role_members",
-                        "read:role_members",
-                        "delete:role_members",
-                        "read:entitlements",
-                        "read:attack_protection",
-                        "update:attack_protection",
-                        "read:organizations_summary",
-                        "create:authentication_methods",
-                        "read:authentication_methods",
-                        "update:authentication_methods",
-                        "delete:authentication_methods",
-                        "read:organizations",
-                        "update:organizations",
-                        "create:organizations",
-                        "delete:organizations",
-                        "create:organization_members",
-                        "read:organization_members",
-                        "delete:organization_members",
-                        "create:organization_connections",
-                        "read:organization_connections",
-                        "update:organization_connections",
-                        "delete:organization_connections",
-                        "create:organization_member_roles",
-                        "read:organization_member_roles",
-                        "delete:organization_member_roles",
-                        "create:organization_invitations",
-                        "read:organization_invitations",
-                        "delete:organization_invitations",
-                        "read:scim_config",
-                        "create:scim_config",
-                        "update:scim_config",
-                        "delete:scim_config",
-                        "create:scim_token",
-                        "read:scim_token",
-                        "delete:scim_token",
-                        "delete:phone_providers",
-                        "create:phone_providers",
-                        "read:phone_providers",
-                        "update:phone_providers",
-                        "delete:phone_templates",
-                        "create:phone_templates",
-                        "read:phone_templates",
-                        "update:phone_templates",
-                        "create:encryption_keys",
-                        "read:encryption_keys",
-                        "update:encryption_keys",
-                        "delete:encryption_keys",
-                        "read:sessions",
-                        "delete:sessions",
-                        "read:refresh_tokens",
-                        "delete:refresh_tokens",
-                        "create:self_service_profiles",
-                        "read:self_service_profiles",
-                        "update:self_service_profiles",
-                        "delete:self_service_profiles",
-                        "create:sso_access_tickets",
-                        "delete:sso_access_tickets",
-                        "read:forms",
-                        "update:forms",
-                        "delete:forms",
-                        "create:forms",
-                        "read:flows",
-                        "update:flows",
-                        "delete:flows",
-                        "create:flows",
-                        "read:flows_vault",
-                        "read:flows_vault_connections",
-                        "update:flows_vault_connections",
-                        "delete:flows_vault_connections",
-                        "create:flows_vault_connections",
-                        "read:flows_executions",
-                        "delete:flows_executions",
-                        "read:connections_options",
-                        "update:connections_options",
-                        "read:self_service_profile_custom_texts",
-                        "update:self_service_profile_custom_texts",
-                        "create:network_acls",
-                        "update:network_acls",
-                        "read:network_acls",
-                        "delete:network_acls",
-                        "delete:vdcs_templates",
-                        "read:vdcs_templates",
-                        "create:vdcs_templates",
-                        "update:vdcs_templates",
-                        "create:custom_signing_keys",
-                        "read:custom_signing_keys",
-                        "update:custom_signing_keys",
-                        "delete:custom_signing_keys",
-                        "read:client_credentials",
-                        "create:client_credentials",
-                        "update:client_credentials",
-                        "delete:client_credentials",
-                        "read:organization_client_grants",
-                        "create:organization_client_grants",
-                        "delete:organization_client_grants"
-                    ]
-                }
-            ]
-        },
-        "rawHeaders": [],
-        "responseIsBinary": false
-    },
-    {
-        "scope": "https://deploy-cli-dev.eu.auth0.com:443",
-        "method": "GET",
-        "path": "/api/v2/clients?page=0&per_page=100&include_totals=true",
-        "body": "",
-        "status": 200,
-        "response": {
-            "total": 10,
-            "start": 0,
-            "limit": 100,
-            "clients": [
+            "clients": [
                 {
                     "tenant": "auth0-deploy-cli-e2e",
                     "global": false,
@@ -14399,62 +13779,545 @@
                     "custom_login_page_on": true
                 },
                 {
-                    "tenant": "auth0-deploy-cli-e2e",
-                    "global": true,
-                    "callbacks": [],
-                    "is_first_party": true,
-                    "name": "All Applications",
-                    "refresh_token": {
-                        "expiration_type": "non-expiring",
-                        "leeway": 0,
-                        "infinite_token_lifetime": true,
-                        "infinite_idle_token_lifetime": true,
-                        "token_lifetime": 2592000,
-                        "idle_token_lifetime": 1296000,
-                        "rotation_type": "non-rotating"
-                    },
-                    "owners": [
-                        "mr|samlp|okta|will.vedder@auth0.com",
-                        "mr|google-oauth2|102002633619863830825",
-                        "mr|samlp|okta|frederik.prijck@auth0.com",
-                        "mr|google-oauth2|109614534713742077035",
-                        "mr|google-oauth2|116771660953104383819",
-                        "mr|google-oauth2|112839029247827700155"
-                    ],
-                    "custom_login_page": "<html>TEST123</html>\n",
-                    "cross_origin_authentication": true,
-                    "signing_keys": [
-                        {
-                            "cert": "[REDACTED]",
-                            "pkcs7": "[REDACTED]",
-                            "subject": "deprecated"
-                        }
-                    ],
-                    "client_id": "Isi93ibGHIGwmdYjsLwTOn7Gu7nwxU3V",
-                    "client_secret": "[REDACTED]",
-                    "custom_login_page_on": true
+                    "tenant": "auth0-deploy-cli-e2e",
+                    "global": true,
+                    "callbacks": [],
+                    "is_first_party": true,
+                    "name": "All Applications",
+                    "refresh_token": {
+                        "expiration_type": "non-expiring",
+                        "leeway": 0,
+                        "infinite_token_lifetime": true,
+                        "infinite_idle_token_lifetime": true,
+                        "token_lifetime": 2592000,
+                        "idle_token_lifetime": 1296000,
+                        "rotation_type": "non-rotating"
+                    },
+                    "owners": [
+                        "mr|samlp|okta|will.vedder@auth0.com",
+                        "mr|google-oauth2|102002633619863830825",
+                        "mr|samlp|okta|frederik.prijck@auth0.com",
+                        "mr|google-oauth2|109614534713742077035",
+                        "mr|google-oauth2|116771660953104383819",
+                        "mr|google-oauth2|112839029247827700155"
+                    ],
+                    "custom_login_page": "<html>TEST123</html>\n",
+                    "cross_origin_authentication": true,
+                    "signing_keys": [
+                        {
+                            "cert": "[REDACTED]",
+                            "pkcs7": "[REDACTED]",
+                            "subject": "deprecated"
+                        }
+                    ],
+                    "client_id": "Isi93ibGHIGwmdYjsLwTOn7Gu7nwxU3V",
+                    "client_secret": "[REDACTED]",
+                    "custom_login_page_on": true
+                }
+            ]
+        },
+        "rawHeaders": [],
+        "responseIsBinary": false
+    },
+    {
+        "scope": "https://deploy-cli-dev.eu.auth0.com:443",
+        "method": "GET",
+        "path": "/api/v2/client-grants?per_page=100&page=0&include_totals=true",
+        "body": "",
+        "status": 200,
+        "response": {
+            "total": 3,
+            "start": 0,
+            "limit": 100,
+            "client_grants": [
+                {
+                    "id": "cgr_5vcTfyeHl5H4fAX9",
+                    "client_id": "f4eBblJcLD2brx8wnnicXn70F7FN0yzJ",
+                    "audience": "https://auth0-deploy-cli-e2e.us.auth0.com/api/v2/",
+                    "scope": [
+                        "read:client_grants",
+                        "create:client_grants",
+                        "delete:client_grants",
+                        "update:client_grants",
+                        "read:users",
+                        "update:users",
+                        "delete:users",
+                        "create:users",
+                        "read:users_app_metadata",
+                        "update:users_app_metadata",
+                        "delete:users_app_metadata",
+                        "create:users_app_metadata",
+                        "read:user_custom_blocks",
+                        "create:user_custom_blocks",
+                        "delete:user_custom_blocks",
+                        "create:user_tickets",
+                        "read:clients",
+                        "update:clients",
+                        "delete:clients",
+                        "create:clients",
+                        "read:client_keys",
+                        "update:client_keys",
+                        "delete:client_keys",
+                        "create:client_keys",
+                        "read:connections",
+                        "update:connections",
+                        "delete:connections",
+                        "create:connections",
+                        "read:resource_servers",
+                        "update:resource_servers",
+                        "delete:resource_servers",
+                        "create:resource_servers",
+                        "read:device_credentials",
+                        "update:device_credentials",
+                        "delete:device_credentials",
+                        "create:device_credentials",
+                        "read:rules",
+                        "update:rules",
+                        "delete:rules",
+                        "create:rules",
+                        "read:rules_configs",
+                        "update:rules_configs",
+                        "delete:rules_configs",
+                        "read:hooks",
+                        "update:hooks",
+                        "delete:hooks",
+                        "create:hooks",
+                        "read:actions",
+                        "update:actions",
+                        "delete:actions",
+                        "create:actions",
+                        "read:email_provider",
+                        "update:email_provider",
+                        "delete:email_provider",
+                        "create:email_provider",
+                        "blacklist:tokens",
+                        "read:stats",
+                        "read:insights",
+                        "read:tenant_settings",
+                        "update:tenant_settings",
+                        "read:logs",
+                        "read:logs_users",
+                        "read:shields",
+                        "create:shields",
+                        "update:shields",
+                        "delete:shields",
+                        "read:anomaly_blocks",
+                        "delete:anomaly_blocks",
+                        "update:triggers",
+                        "read:triggers",
+                        "read:grants",
+                        "delete:grants",
+                        "read:guardian_factors",
+                        "update:guardian_factors",
+                        "read:guardian_enrollments",
+                        "delete:guardian_enrollments",
+                        "create:guardian_enrollment_tickets",
+                        "read:user_idp_tokens",
+                        "create:passwords_checking_job",
+                        "delete:passwords_checking_job",
+                        "read:custom_domains",
+                        "delete:custom_domains",
+                        "create:custom_domains",
+                        "update:custom_domains",
+                        "read:email_templates",
+                        "create:email_templates",
+                        "update:email_templates",
+                        "read:mfa_policies",
+                        "update:mfa_policies",
+                        "read:roles",
+                        "create:roles",
+                        "delete:roles",
+                        "update:roles",
+                        "read:prompts",
+                        "update:prompts",
+                        "read:branding",
+                        "update:branding",
+                        "delete:branding",
+                        "read:log_streams",
+                        "create:log_streams",
+                        "delete:log_streams",
+                        "update:log_streams",
+                        "create:signing_keys",
+                        "read:signing_keys",
+                        "update:signing_keys",
+                        "read:limits",
+                        "update:limits",
+                        "create:role_members",
+                        "read:role_members",
+                        "delete:role_members",
+                        "read:entitlements",
+                        "read:attack_protection",
+                        "update:attack_protection",
+                        "read:organizations",
+                        "update:organizations",
+                        "create:organizations",
+                        "delete:organizations",
+                        "create:organization_members",
+                        "read:organization_members",
+                        "delete:organization_members",
+                        "create:organization_connections",
+                        "read:organization_connections",
+                        "update:organization_connections",
+                        "delete:organization_connections",
+                        "create:organization_member_roles",
+                        "read:organization_member_roles",
+                        "delete:organization_member_roles",
+                        "create:organization_invitations",
+                        "read:organization_invitations",
+                        "delete:organization_invitations"
+                    ]
+                },
+                {
+                    "id": "cgr_VOMMRiAXG3bqPOOY",
+                    "client_id": "l7YeaTKUoTupuw44MDo3475XYGglfuGn",
+                    "audience": "https://auth0-deploy-cli-e2e.us.auth0.com/api/v2/",
+                    "scope": [
+                        "read:client_grants",
+                        "create:client_grants",
+                        "delete:client_grants",
+                        "update:client_grants",
+                        "read:users",
+                        "update:users",
+                        "delete:users",
+                        "create:users",
+                        "read:users_app_metadata",
+                        "update:users_app_metadata",
+                        "delete:users_app_metadata",
+                        "create:users_app_metadata",
+                        "read:user_custom_blocks",
+                        "create:user_custom_blocks",
+                        "delete:user_custom_blocks",
+                        "create:user_tickets",
+                        "read:clients",
+                        "update:clients",
+                        "delete:clients",
+                        "create:clients",
+                        "read:client_keys",
+                        "update:client_keys",
+                        "delete:client_keys",
+                        "create:client_keys",
+                        "read:connections",
+                        "update:connections",
+                        "delete:connections",
+                        "create:connections",
+                        "read:resource_servers",
+                        "update:resource_servers",
+                        "delete:resource_servers",
+                        "create:resource_servers",
+                        "read:device_credentials",
+                        "update:device_credentials",
+                        "delete:device_credentials",
+                        "create:device_credentials",
+                        "read:rules",
+                        "update:rules",
+                        "delete:rules",
+                        "create:rules",
+                        "read:rules_configs",
+                        "update:rules_configs",
+                        "delete:rules_configs",
+                        "read:hooks",
+                        "update:hooks",
+                        "delete:hooks",
+                        "create:hooks",
+                        "read:actions",
+                        "update:actions",
+                        "delete:actions",
+                        "create:actions",
+                        "read:email_provider",
+                        "update:email_provider",
+                        "delete:email_provider",
+                        "create:email_provider",
+                        "blacklist:tokens",
+                        "read:stats",
+                        "read:insights",
+                        "read:tenant_settings",
+                        "update:tenant_settings",
+                        "read:logs",
+                        "read:logs_users",
+                        "read:shields",
+                        "create:shields",
+                        "update:shields",
+                        "delete:shields",
+                        "read:anomaly_blocks",
+                        "delete:anomaly_blocks",
+                        "update:triggers",
+                        "read:triggers",
+                        "read:grants",
+                        "delete:grants",
+                        "read:guardian_factors",
+                        "update:guardian_factors",
+                        "read:guardian_enrollments",
+                        "delete:guardian_enrollments",
+                        "create:guardian_enrollment_tickets",
+                        "read:user_idp_tokens",
+                        "create:passwords_checking_job",
+                        "delete:passwords_checking_job",
+                        "read:custom_domains",
+                        "delete:custom_domains",
+                        "create:custom_domains",
+                        "update:custom_domains",
+                        "read:email_templates",
+                        "create:email_templates",
+                        "update:email_templates",
+                        "read:mfa_policies",
+                        "update:mfa_policies",
+                        "read:roles",
+                        "create:roles",
+                        "delete:roles",
+                        "update:roles",
+                        "read:prompts",
+                        "update:prompts",
+                        "read:branding",
+                        "update:branding",
+                        "delete:branding",
+                        "read:log_streams",
+                        "create:log_streams",
+                        "delete:log_streams",
+                        "update:log_streams",
+                        "create:signing_keys",
+                        "read:signing_keys",
+                        "update:signing_keys",
+                        "read:limits",
+                        "update:limits",
+                        "create:role_members",
+                        "read:role_members",
+                        "delete:role_members",
+                        "read:entitlements",
+                        "read:attack_protection",
+                        "update:attack_protection",
+                        "read:organizations",
+                        "update:organizations",
+                        "create:organizations",
+                        "delete:organizations",
+                        "create:organization_members",
+                        "read:organization_members",
+                        "delete:organization_members",
+                        "create:organization_connections",
+                        "read:organization_connections",
+                        "update:organization_connections",
+                        "delete:organization_connections",
+                        "create:organization_member_roles",
+                        "read:organization_member_roles",
+                        "delete:organization_member_roles",
+                        "create:organization_invitations",
+                        "read:organization_invitations",
+                        "delete:organization_invitations"
+                    ]
+                },
+                {
+                    "id": "cgr_a5G2CpWYpgxCM4Xw",
+                    "client_id": "Vp0gMRF8PtMzekil38qWoj4Fjw2VjRZE",
+                    "audience": "https://auth0-deploy-cli-e2e.us.auth0.com/api/v2/",
+                    "scope": [
+                        "read:client_grants",
+                        "create:client_grants",
+                        "delete:client_grants",
+                        "update:client_grants",
+                        "read:users",
+                        "update:users",
+                        "delete:users",
+                        "create:users",
+                        "read:users_app_metadata",
+                        "update:users_app_metadata",
+                        "delete:users_app_metadata",
+                        "create:users_app_metadata",
+                        "read:user_custom_blocks",
+                        "create:user_custom_blocks",
+                        "delete:user_custom_blocks",
+                        "create:user_tickets",
+                        "read:clients",
+                        "update:clients",
+                        "delete:clients",
+                        "create:clients",
+                        "read:client_keys",
+                        "update:client_keys",
+                        "delete:client_keys",
+                        "create:client_keys",
+                        "read:connections",
+                        "update:connections",
+                        "delete:connections",
+                        "create:connections",
+                        "read:resource_servers",
+                        "update:resource_servers",
+                        "delete:resource_servers",
+                        "create:resource_servers",
+                        "read:device_credentials",
+                        "update:device_credentials",
+                        "delete:device_credentials",
+                        "create:device_credentials",
+                        "read:rules",
+                        "update:rules",
+                        "delete:rules",
+                        "create:rules",
+                        "read:rules_configs",
+                        "update:rules_configs",
+                        "delete:rules_configs",
+                        "read:hooks",
+                        "update:hooks",
+                        "delete:hooks",
+                        "create:hooks",
+                        "read:actions",
+                        "update:actions",
+                        "delete:actions",
+                        "create:actions",
+                        "read:email_provider",
+                        "update:email_provider",
+                        "delete:email_provider",
+                        "create:email_provider",
+                        "blacklist:tokens",
+                        "read:stats",
+                        "read:insights",
+                        "read:tenant_settings",
+                        "update:tenant_settings",
+                        "read:logs",
+                        "read:logs_users",
+                        "read:shields",
+                        "create:shields",
+                        "update:shields",
+                        "delete:shields",
+                        "read:anomaly_blocks",
+                        "delete:anomaly_blocks",
+                        "update:triggers",
+                        "read:triggers",
+                        "read:grants",
+                        "delete:grants",
+                        "read:guardian_factors",
+                        "update:guardian_factors",
+                        "read:guardian_enrollments",
+                        "delete:guardian_enrollments",
+                        "create:guardian_enrollment_tickets",
+                        "read:user_idp_tokens",
+                        "create:passwords_checking_job",
+                        "delete:passwords_checking_job",
+                        "read:custom_domains",
+                        "delete:custom_domains",
+                        "create:custom_domains",
+                        "update:custom_domains",
+                        "read:email_templates",
+                        "create:email_templates",
+                        "update:email_templates",
+                        "read:mfa_policies",
+                        "update:mfa_policies",
+                        "read:roles",
+                        "create:roles",
+                        "delete:roles",
+                        "update:roles",
+                        "read:prompts",
+                        "update:prompts",
+                        "read:branding",
+                        "update:branding",
+                        "delete:branding",
+                        "read:log_streams",
+                        "create:log_streams",
+                        "delete:log_streams",
+                        "update:log_streams",
+                        "create:signing_keys",
+                        "read:signing_keys",
+                        "update:signing_keys",
+                        "read:limits",
+                        "update:limits",
+                        "create:role_members",
+                        "read:role_members",
+                        "delete:role_members",
+                        "read:entitlements",
+                        "read:attack_protection",
+                        "update:attack_protection",
+                        "read:organizations_summary",
+                        "create:authentication_methods",
+                        "read:authentication_methods",
+                        "update:authentication_methods",
+                        "delete:authentication_methods",
+                        "read:organizations",
+                        "update:organizations",
+                        "create:organizations",
+                        "delete:organizations",
+                        "create:organization_members",
+                        "read:organization_members",
+                        "delete:organization_members",
+                        "create:organization_connections",
+                        "read:organization_connections",
+                        "update:organization_connections",
+                        "delete:organization_connections",
+                        "create:organization_member_roles",
+                        "read:organization_member_roles",
+                        "delete:organization_member_roles",
+                        "create:organization_invitations",
+                        "read:organization_invitations",
+                        "delete:organization_invitations",
+                        "read:scim_config",
+                        "create:scim_config",
+                        "update:scim_config",
+                        "delete:scim_config",
+                        "create:scim_token",
+                        "read:scim_token",
+                        "delete:scim_token",
+                        "delete:phone_providers",
+                        "create:phone_providers",
+                        "read:phone_providers",
+                        "update:phone_providers",
+                        "delete:phone_templates",
+                        "create:phone_templates",
+                        "read:phone_templates",
+                        "update:phone_templates",
+                        "create:encryption_keys",
+                        "read:encryption_keys",
+                        "update:encryption_keys",
+                        "delete:encryption_keys",
+                        "read:sessions",
+                        "delete:sessions",
+                        "read:refresh_tokens",
+                        "delete:refresh_tokens",
+                        "create:self_service_profiles",
+                        "read:self_service_profiles",
+                        "update:self_service_profiles",
+                        "delete:self_service_profiles",
+                        "create:sso_access_tickets",
+                        "delete:sso_access_tickets",
+                        "read:forms",
+                        "update:forms",
+                        "delete:forms",
+                        "create:forms",
+                        "read:flows",
+                        "update:flows",
+                        "delete:flows",
+                        "create:flows",
+                        "read:flows_vault",
+                        "read:flows_vault_connections",
+                        "update:flows_vault_connections",
+                        "delete:flows_vault_connections",
+                        "create:flows_vault_connections",
+                        "read:flows_executions",
+                        "delete:flows_executions",
+                        "read:connections_options",
+                        "update:connections_options",
+                        "read:self_service_profile_custom_texts",
+                        "update:self_service_profile_custom_texts",
+                        "create:network_acls",
+                        "update:network_acls",
+                        "read:network_acls",
+                        "delete:network_acls",
+                        "delete:vdcs_templates",
+                        "read:vdcs_templates",
+                        "create:vdcs_templates",
+                        "update:vdcs_templates",
+                        "create:custom_signing_keys",
+                        "read:custom_signing_keys",
+                        "update:custom_signing_keys",
+                        "delete:custom_signing_keys",
+                        "read:client_credentials",
+                        "create:client_credentials",
+                        "update:client_credentials",
+                        "delete:client_credentials",
+                        "read:organization_client_grants",
+                        "create:organization_client_grants",
+                        "delete:organization_client_grants"
+                    ]
                 }
             ]
         },
         "rawHeaders": [],
         "responseIsBinary": false
     },
-    {
-        "scope": "https://deploy-cli-dev.eu.auth0.com:443",
-        "method": "PATCH",
-        "path": "/api/v2/organizations/org_i2X0PJjmXkREAiIw",
-        "body": {
-            "display_name": "Organization2"
-        },
-        "status": 200,
-        "response": {
-            "id": "org_i2X0PJjmXkREAiIw",
-            "display_name": "Organization2",
-            "name": "org2"
-        },
-        "rawHeaders": [],
-        "responseIsBinary": false
-    },
     {
         "scope": "https://deploy-cli-dev.eu.auth0.com:443",
         "method": "PATCH",
@@ -14485,15 +14348,16 @@
     },
     {
         "scope": "https://deploy-cli-dev.eu.auth0.com:443",
-        "method": "GET",
-        "path": "/api/v2/flows?page=0&per_page=100&include_totals=true",
-        "body": "",
+        "method": "PATCH",
+        "path": "/api/v2/organizations/org_i2X0PJjmXkREAiIw",
+        "body": {
+            "display_name": "Organization2"
+        },
         "status": 200,
         "response": {
-            "limit": 100,
-            "start": 0,
-            "total": 0,
-            "flows": []
+            "id": "org_i2X0PJjmXkREAiIw",
+            "display_name": "Organization2",
+            "name": "org2"
         },
         "rawHeaders": [],
         "responseIsBinary": false
@@ -14529,13 +14393,28 @@
                     "name": "Blank-form",
                     "flow_count": 0,
                     "created_at": "2024-11-26T11:58:18.187Z",
-                    "updated_at": "2025-04-10T08:53:56.028Z"
+                    "updated_at": "2025-05-27T11:32:08.928Z"
                 }
             ]
         },
         "rawHeaders": [],
         "responseIsBinary": false
     },
+    {
+        "scope": "https://deploy-cli-dev.eu.auth0.com:443",
+        "method": "GET",
+        "path": "/api/v2/flows?page=0&per_page=100&include_totals=true",
+        "body": "",
+        "status": 200,
+        "response": {
+            "limit": 100,
+            "start": 0,
+            "total": 0,
+            "flows": []
+        },
+        "rawHeaders": [],
+        "responseIsBinary": false
+    },
     {
         "scope": "https://deploy-cli-dev.eu.auth0.com:443",
         "method": "GET",
@@ -14600,7 +14479,7 @@
                 }
             },
             "created_at": "2024-11-26T11:58:18.187Z",
-            "updated_at": "2025-04-10T08:53:56.028Z"
+            "updated_at": "2025-05-27T11:32:08.928Z"
         },
         "rawHeaders": [],
         "responseIsBinary": false
@@ -14725,7 +14604,7 @@
                 }
             },
             "created_at": "2024-11-26T11:58:18.187Z",
-            "updated_at": "2025-04-10T09:01:16.032Z"
+            "updated_at": "2025-05-27T13:48:10.419Z"
         },
         "rawHeaders": [],
         "responseIsBinary": false
diff --git a/test/tools/utils.test.js b/test/tools/utils.test.js
index 99a4159..7c6b515 100644
--- a/test/tools/utils.test.js
+++ b/test/tools/utils.test.js
@@ -711,3 +711,160 @@ describe('#isForbiddenFeatureError', () => {
     expect(utils.isForbiddenFeatureError(error, resourceType)).to.be.false;
   });
 });
+
+describe('#maskSecretAtPath', () => {
+  it('should mask a secret at a simple path', () => {
+    const obj = { secret: 'sensitive_value' };
+
+    utils.maskSecretAtPath({
+      resourceTypeName: 'connections',
+      maskedKeyName: 'oauth2',
+      maskOnObj: obj,
+      keyJsonPath: 'secret',
+    });
+
+    expect(obj.secret).to.equal('##CONNECTIONS_OAUTH2_SECRET##');
+  });
+
+  it('should mask a secret at a nested path', () => {
+    const obj = {
+      config: {
+        credentials: {
+          client_secret: 'sensitive_secret',
+        },
+      },
+    };
+
+    utils.maskSecretAtPath({
+      resourceTypeName: 'connections',
+      maskedKeyName: 'samlp',
+      maskOnObj: obj,
+      keyJsonPath: 'config.credentials.client_secret',
+    });
+
+    expect(obj.config.credentials.client_secret).to.equal('##CONNECTIONS_SAMLP_SECRET##');
+  });
+
+  it('should not modify object if path does not exist', () => {
+    const obj = { other_field: 'value' };
+    const originalObj = { ...obj };
+
+    utils.maskSecretAtPath({
+      resourceTypeName: 'connections',
+      maskedKeyName: 'oauth2',
+      maskOnObj: obj,
+      keyJsonPath: 'non_existent_path',
+    });
+
+    expect(obj).to.deep.equal(originalObj);
+  });
+
+  it('should sanitize resource type name with special characters', () => {
+    const obj = { token: 'secret_token' };
+
+    utils.maskSecretAtPath({
+      resourceTypeName: 'log-streams',
+      maskedKeyName: 'http',
+      maskOnObj: obj,
+      keyJsonPath: 'token',
+    });
+
+    expect(obj.token).to.equal('##LOG_STREAMS_HTTP_SECRET##');
+  });
+
+  it('should sanitize masked key name with special characters', () => {
+    const obj = { apiKey: 'secret_key' };
+
+    utils.maskSecretAtPath({
+      resourceTypeName: 'logStreams',
+      maskedKeyName: 'custom-http-2.0',
+      maskOnObj: obj,
+      keyJsonPath: 'apiKey',
+    });
+
+    expect(obj.apiKey).to.equal('##LOGSTREAMS_CUSTOM_HTTP_2_0_SECRET##');
+  });
+
+  it('should handle numeric values in path', () => {
+    const obj = {
+      items: [{ secret: 'first_secret' }, { secret: 'second_secret' }],
+    };
+
+    utils.maskSecretAtPath({
+      resourceTypeName: 'rules',
+      maskedKeyName: 'webhook',
+      maskOnObj: obj,
+      keyJsonPath: 'items.0.secret',
+    });
+
+    expect(obj.items[0].secret).to.equal('##RULES_WEBHOOK_SECRET##');
+    expect(obj.items[1].secret).to.equal('second_secret'); // Should remain unchanged
+  });
+
+  it('should handle deeply nested paths', () => {
+    const obj = {
+      level1: {
+        level2: {
+          level3: {
+            level4: {
+              secret_value: 'deeply_nested_secret',
+            },
+          },
+        },
+      },
+    };
+
+    utils.maskSecretAtPath({
+      resourceTypeName: 'actions',
+      maskedKeyName: 'login',
+      maskOnObj: obj,
+      keyJsonPath: 'level1.level2.level3.level4.secret_value',
+    });
+
+    expect(obj.level1.level2.level3.level4.secret_value).to.equal('##ACTIONS_LOGIN_SECRET##');
+  });
+
+  it('should return the modified object', () => {
+    const obj = { token: 'secret_token' };
+
+    const result = utils.maskSecretAtPath({
+      resourceTypeName: 'hooks',
+      maskedKeyName: 'post_login',
+      maskOnObj: obj,
+      keyJsonPath: 'token',
+    });
+
+    expect(result).to.equal(obj);
+    expect(result.token).to.equal('##HOOKS_POST_LOGIN_SECRET##');
+  });
+
+  it('should handle empty strings in resource and key names', () => {
+    const obj = { secret: 'value' };
+
+    utils.maskSecretAtPath({
+      resourceTypeName: '',
+      maskedKeyName: '',
+      maskOnObj: obj,
+      keyJsonPath: 'secret',
+    });
+
+    expect(obj.secret).to.equal('##__SECRET##');
+  });
+
+  it('should handle array objects', () => {
+    const obj = {
+      configs: [{ auth_token: 'token1' }, { auth_token: 'token2' }, { auth_token: 'token3' }],
+    };
+
+    utils.maskSecretAtPath({
+      resourceTypeName: 'phoneProviders',
+      maskedKeyName: 'twilio',
+      maskOnObj: obj,
+      keyJsonPath: 'configs.1.auth_token',
+    });
+
+    expect(obj.configs[0].auth_token).to.equal('token1');
+    expect(obj.configs[1].auth_token).to.equal('##PHONEPROVIDERS_TWILIO_SECRET##');
+    expect(obj.configs[2].auth_token).to.equal('token3');
+  });
+});
diff --git a/test/utils.js b/test/utils.js
index a2ea589..1910742 100644
--- a/test/utils.js
+++ b/test/utils.js
@@ -14,16 +14,10 @@ export const localDir = 'local';
 export const testDataDir = path.resolve(localDir, 'testData');
 
 export function mockPagedData(params, key, data) {
-  return params?.include_totals
-    ? {
-      data: {
-        [key]: data,
-        total: data?.length || 0,
-      },
-    }
-    : {
-      data,
-    };
+  if (params && params.include_totals) {
+    return { data: { [key]: data, total: data.length || 0 } };
+  }
+  return { data };
 }
 
 export function mockMgmtClient() {