Changelog

10.4.0 (2026-09-18)

Features

  • Add optional jwt_issuer option for session token validation (#552) (841bf57)

  • #550 fix(generated): regenerate from spec

    Features

    • pipes:
      • Added connected_account_id to DataIntegrationsVendCredentialsRequest
      • Added connected_account_id to DataIntegrationsGetUserTokenRequest
      • Added parameter UserManagementDataProviders.getUserDataInstallation.connected_account_id
      • Changed errors for endpoint GET /user_management/users/{user_id}/connected_accounts/{slug}
      • Added parameter UserManagementDataProviders.updateUserDataInstallation.connected_account_id
      • Changed errors for endpoint PUT /user_management/users/{user_id}/connected_accounts/{slug}
      • Added parameter UserManagementDataProviders.deleteUserDataInstallation.connected_account_id
      • Changed errors for endpoint DELETE /user_management/users/{user_id}/connected_accounts/{slug}
      • Added connected_accounts to DataIntegrationsListResponseData
      • Changed errors for endpoint PUT /data-integrations/{slug}
      • Changed errors for endpoint PUT /data-integrations/{slug}/api-key
      • Changed errors for endpoint PUT /data-integrations/{slug}/client-credentials
      • Changed errors for endpoint POST /data-integrations/{slug}/credentials
      • Changed errors for endpoint POST /data-integrations/{provider}/token

  • #553 feat(generated): regenerate from spec (4 changes)

    Features

    • admin_portal:
      • Changed the format of PortalLinkResponse.link
    • agents:
      • Added parameter AgentsSessions.list.organization_id
      • Changed the format of ClaimViewResponse.user_code
      • Changed the format of AgentAdminValidateCredentialRequest.credential
    • api_keys:
      • Changed the format of ValidateApiKey.value
      • Changed the format of OrganizationApiKeyWithValue.value
      • Changed the format of UserApiKeyWithValue.value
    • multi_factor_auth:
      • Changed the format of AuthenticationChallenge.code
      • Changed the format of AuthenticationFactorEnrolledTotp.secret
      • Changed the format of AuthenticationFactorEnrolledTotp.qr_code
      • Changed the format of AuthenticationFactorEnrolledTotp.uri
      • Changed the format of AuthenticationChallengesVerifyRequest.code
    • pipes:
      • Added supports_multiple_connections to DataIntegrationsVendCredentialsRequest
      • Added supports_multiple_connections to DataIntegrationsGetUserTokenRequest
      • Added parameter UserManagementDataProviders.getUserDataInstallation.supports_multiple_connections
      • Added parameter UserManagementDataProviders.updateUserDataInstallation.supports_multiple_connections
      • Added parameter UserManagementDataProviders.deleteUserDataInstallation.supports_multiple_connections
      • Added parameter UserManagementDataProviders.getUserDataIntegrations.supports_multiple_connections
      • Added enum PipesOwnership
      • Added user to CreateDataIntegrationOwnership
      • Added user to DataIntegrationOwnership
      • Added endpoint GET /data-integrations/{slug}/organization
      • Added endpoint PUT /data-integrations/{slug}/organization
      • Added endpoint DELETE /data-integrations/{slug}/organization
      • Added parameter Pipes.listDataIntegrations.ownership
      • Changed errors for endpoint GET /data-integrations
      • Changed errors for endpoint PUT /user_management/users/{user_id}/connected_accounts/{slug}
      • Changed errors for endpoint DELETE /user_management/users/{user_id}/connected_accounts/{slug}
      • Changed the format of DataIntegrationCredentialsResponseCredential.value
      • Added connection_owner to DataIntegrationsUpsertApiKeyRequest
      • Added connection_owner to DataIntegrationsUpsertClientCredentialsRequest
      • Added enum DataIntegrationsUpsertApiKeyRequestConnectionOwner
      • Added enum DataIntegrationsUpsertClientCredentialsRequestConnectionOwner
      • Added model AccountSelectionRequiredError
      • Added connected_account_id to DataIntegrationsUpsertApiKeyRequest
      • Added connected_account_id to DataIntegrationsUpsertClientCredentialsRequest
      • Added ownership to CreateDataIntegration
      • Added ownership to DataIntegration
      • Added connection_owner to DataIntegrationsVendCredentialsRequest
      • Added connection_owner to DataIntegrationsGetUserTokenRequest
      • Added enum CreateDataIntegrationOwnership
      • Added enum DataIntegrationOwnership
      • Added enum DataIntegrationsVendCredentialsRequestConnectionOwner
      • Added enum DataIntegrationsGetUserTokenRequestConnectionOwner
      • Changed errors for endpoint POST /data-integrations/{slug}/credentials
      • Changed errors for endpoint POST /data-integrations/{provider}/token
    • sso:
      • Changed the format of CreateConnectionKeyPair.key
      • Changed the format of TokenQuery.code
      • Changed the format of SSOLogoutAuthorizeResponse.logout_url
    • user_management:
      • Added model CreateAuthkitOAuthResource
      • Added model AuthkitOAuthResource
      • Added service UserManagementAuthkitOAuthResources
      • Changed the format of DeviceAuthorizationResponse.verification_uri_complete
      • Changed the format of VerifyEmailAddress.code
      • Changed the format of ConfirmEmailChange.code
      • Changed the format of MagicAuth.code
      • Changed the format of UserInvite.accept_invitation_url
      • Changed the format of EmailVerification.code
      • Changed the format of PasswordReset.password_reset_url
      • Changed the format of AuthenticateResponse.authkit_authorization_code
      • Changed the format of DeviceAuthorizationResponse.device_code
      • Changed the format of DeviceAuthorizationResponse.user_code
      • Changed the format of AuthorizationCodeSessionAuthenticateRequest.code
      • Changed the format of AuthorizationCodeSessionAuthenticateRequest.code_verifier
      • Changed the format of MagicAuthCodeSessionAuthenticateRequest.code
      • Changed the format of EmailVerificationCodeSessionAuthenticateRequest.code
      • Changed the format of MfaTotpSessionAuthenticateRequest.code
      • Changed the format of RadarEmailChallengeCodeSessionAuthenticateRequest.code
      • Changed the format of RadarSmsChallengeCodeSessionAuthenticateRequest.code
      • Changed the format of DeviceCodeSessionAuthenticateRequest.device_code
      • Changed the format of Invitation.accept_invitation_url
      • Changed the format of MagicAuthSendMagicAuthCodeAndReturnResponse.code
    • radar:
      • Changed the format of RadarChallenge.code
    • vault:
      • Changed the format of CreateObjectRequest.value
      • Changed the format of VaultObject.value
      • Changed the format of UpdateObjectRequest.value

    Fixes

    • pipes:
      • Removed userland_user from CreateDataIntegrationOwnership
      • Removed userland_user from DataIntegrationOwnership
      • Changed errors for endpoint POST /user_management/users/{user_id}/connected_accounts/{slug}
      • Changed errors for endpoint PUT /data-integrations/{slug}/api-key
      • Changed errors for endpoint PUT /data-integrations/{slug}/client-credentials
      • Changed errors for endpoint POST /data-integrations/{slug}/credentials
      • Changed errors for endpoint POST /data-integrations/{provider}/token
      • Changed errors for endpoint GET /user_management/users/{user_id}/connected_accounts/{slug}
      • Changed errors for endpoint PUT /user_management/users/{user_id}/connected_accounts/{slug}
      • Changed errors for endpoint DELETE /user_management/users/{user_id}/connected_accounts/{slug}
      • Changed the type of DataIntegrationInstallation.user_id

  • #556 fix(generated): regenerate from spec (1 change)

    Features

    • multi_factor_auth:
      • Changed errors for endpoint POST /auth/factors/{id}/challenge
    • pipes:
      • Added connection_owner to DataIntegrationsListResponseData
      • Added enum DataIntegrationsListResponseDataConnectionOwner
      • Added connection_role to DataIntegrationsListResponseDataConnectedAccount
      • Added account_identifier to DataIntegrationsListResponseDataConnectedAccount
      • Added account_display_name to DataIntegrationsListResponseDataConnectedAccount
      • Added enum DataIntegrationsListResponseDataConnectedAccountConnectionRole
      • Added connection_role to DataIntegrationInstallation
      • Added account_identifier to DataIntegrationInstallation
      • Added account_display_name to DataIntegrationInstallation
      • Added enum DataIntegrationInstallationConnectionRole
      • Added connection_owner to DataIntegrationsGetDataIntegrationAuthorizeUrlRequest
      • Added enum DataIntegrationsGetDataIntegrationAuthorizeUrlRequestConnectionOwner
      • Added the organization connected-account operations on Pipes: client.pipes.get_organization_connected_account, create_organization_connected_account, update_organization_connected_account, delete_organization_connected_account, list_organization_data_providers
    • connect:
      • Added connection_role to ConnectedAccount
      • Added account_identifier to ConnectedAccount
      • Added account_display_name to ConnectedAccount
      • Added enum ConnectedAccountConnectionRole
    • webhooks:
      • Added pipes.account_connection.add_failed to CreateWebhookEndpointEvents
      • Added pipes.account_connection.connected to CreateWebhookEndpointEvents
      • Added pipes.account_connection.connection_failed to CreateWebhookEndpointEvents
      • Added pipes.account_connection.disconnected to CreateWebhookEndpointEvents
      • Added pipes.account_connection.reauthorization_needed to CreateWebhookEndpointEvents
      • Added pipes.account_connection.add_failed to UpdateWebhookEndpointEvents
      • Added pipes.account_connection.connected to UpdateWebhookEndpointEvents
      • Added pipes.account_connection.connection_failed to UpdateWebhookEndpointEvents
      • Added pipes.account_connection.disconnected to UpdateWebhookEndpointEvents
      • Added pipes.account_connection.reauthorization_needed to UpdateWebhookEndpointEvents

    Fixes

  • #557 fix(generated): regenerate from spec (1 change)

    Fixes

10.3.0 (2026-09-01)

  • #546 feat(generated)!: regenerate from spec (5 changes)

    ⚠️ Breaking

    • agents:
      • Removed service Agents
    • sso:
      • Removed model TokenBody
      • Removed enum TokenBodyGrantType
      • Removed model TokenQuery
      • Changed parameter SSO.token.grant_type

    Features

    • agents:
      • Added model AgentBlueprint
      • Added model AgentInstance
      • Added model AgentToken
      • Added model AgentInstanceSession
      • Added model AgentBlueprintInvocableBy
      • Added model AgentBlueprintSessionSetting
      • Added model AgentBlueprintsCreateRequest
      • Added model AgentBlueprintsCreateRequestInvocableBy
      • Added model AgentBlueprintsCreateRequestSessionSetting
      • Added model AgentBlueprintsUpdateRequest
      • Added model AgentBlueprintsUpdateRequestInvocableBy
      • Added model AgentBlueprintsUpdateRequestSessionSetting
      • Added model AgentBlueprintsTokenMintTokenRequest
      • Added enum AgentInstanceType
      • Added enum AgentInstanceSessionStatus
      • Added enum AgentBlueprintsTokenMintTokenRequestType
    • agents_blueprints:
      • Added service AgentsBlueprints
    • agents_blueprints_tokens:
      • Added service AgentsBlueprintsTokens
    • agents_instances:
      • Added service AgentsInstances
    • agents_registrations:
      • Added service AgentsRegistrations
    • agents_sessions:
      • Added service AgentsSessions
    • organizations:
      • Added retention_period to UpdateAuditLogsRetention
      • Made UpdateAuditLogsRetention.retention_period_in_days optional
      • Added enum UpdateAuditLogsRetentionRetentionPeriod
      • Added model CreateItContact
      • Added model InviteItContact
      • Added model ItContact
      • Added model ItContactList
      • Added model ItContactListListMetadata
      • Added enum InviteItContactIntents
      • Added service OrganizationsItContacts
    • platform_teams:
      • Added model CreateTeam
      • Added model Team
      • Added enum TeamProductionState
      • Added service PlatformTeams
    • sso:
      • Added model TokenQuery
      • Added enum TokenQueryGrantType
      • Added model CreateConnectionKeyPair
      • Added model CreateConnectionSAMLOptions
      • Added model CreateConnectionOidcOptions
      • Added model CreateConnectionStandardAttributes
      • Added model CreateConnectionAttributeMaps
      • Added model CreateConnection
      • Added model PatchConnectionSAMLOptions
      • Added model PatchConnectionOidcOptions
      • Added model PatchConnectionStandardAttributes
      • Added model PatchConnectionAttributeMaps
      • Added model PatchConnection
      • Added model CreateSAMLIdpSigningCertificate
      • Added model SAMLIdpSigningCertificate
      • Added model SAMLIdpSigningCertificateList
      • Added model SAMLSpEncryptionCertificate
      • Added model SAMLSpEncryptionCertificateList
      • Added model SAMLSpSigningCertificate
      • Added enum CreateConnectionOidcOptionsIdTokenSignatureAlgorithm
      • Added enum PatchConnectionOidcOptionsIdTokenSignatureAlgorithm
      • Added endpoint POST /connections
      • Added endpoint GET /connections/{connectionId}/saml_idp_signing_certs
      • Added endpoint POST /connections/{connectionId}/saml_idp_signing_certs
      • Added endpoint DELETE /connections/{connectionId}/saml_idp_signing_certs/{certificateId}
      • Added endpoint GET /connections/{connectionId}/saml_sp_encryption_certs
      • Added endpoint POST /connections/{connectionId}/saml_sp_encryption_certs
      • Added endpoint DELETE /connections/{connectionId}/saml_sp_encryption_certs/{certificateId}
      • Added endpoint GET /connections/{connectionId}/saml_sp_signing_cert
      • Added endpoint POST /connections/{connectionId}/saml_sp_signing_cert
      • Added endpoint DELETE /connections/{connectionId}/saml_sp_signing_cert/{certificateId}
      • Added endpoint PATCH /connections/{id}
      • Added model TokenBody
      • Added enum TokenBodyGrantType
      • Added enum SSOGrantType
      • Changed required status for parameter SSO.token.code
    • user_management:
      • Added enum CreateConnectionOidcOptionsTokenAuthenticationMethod
      • Added enum PatchConnectionOidcOptionsTokenAuthenticationMethod
      • Added model EmailCompletionSessionAuthenticateRequest
      • Added model CreateWaitlistEntry
      • Added model Waitlist
      • Added model WaitlistEntry
      • Added enum WaitlistEntryState
      • Added enum UserManagementWaitlistsState
      • Added service UserManagementWaitlists
    • webhooks:
      • Added agent.instance.created to CreateWebhookEndpointEvents
      • Added agent.instance.deleted to CreateWebhookEndpointEvents
      • Added agent.instance.session.created to CreateWebhookEndpointEvents
      • Added agent.instance.session.revoked to CreateWebhookEndpointEvents
      • Added agent.instance.created to UpdateWebhookEndpointEvents
      • Added agent.instance.deleted to UpdateWebhookEndpointEvents
      • Added agent.instance.session.created to UpdateWebhookEndpointEvents
      • Added agent.instance.session.revoked to UpdateWebhookEndpointEvents
      • Added agent.blueprint.created to CreateWebhookEndpointEvents
      • Added agent.blueprint.deleted to CreateWebhookEndpointEvents
      • Added agent.blueprint.updated to CreateWebhookEndpointEvents
      • Added agent.blueprint.created to UpdateWebhookEndpointEvents
      • Added agent.blueprint.deleted to UpdateWebhookEndpointEvents
      • Added agent.blueprint.updated to UpdateWebhookEndpointEvents

    Fixes

    • sso:
      • Changed request body of SSO.token from TokenBody to TokenQuery
      • Removed DiscordOAuth from ConnectionType
      • Removed GrokOAuth from ConnectionType
      • Removed XOAuth from ConnectionType
      • Removed DiscordOAuth from ProfileConnectionType
      • Removed GrokOAuth from ProfileConnectionType
      • Removed XOAuth from ProfileConnectionType
      • Removed DiscordOAuth from ConnectionsConnectionType
      • Removed GrokOAuth from ConnectionsConnectionType
      • Removed XOAuth from ConnectionsConnectionType
      • Changed request body of SSO.token from TokenQuery to TokenBody
    • user_management:
      • Changed request body for UserManagementAuthentication.authenticate
      • Changed errors for endpoint POST /user_management/authenticate
      • Removed DiscordOAuth from AuthenticateResponseAuthenticationMethod
      • Removed GrokOAuth from AuthenticateResponseAuthenticationMethod
      • Removed XOAuth from AuthenticateResponseAuthenticationMethod
      • Removed DiscordOAuth from UserIdentitiesGetItemProvider
      • Removed GrokOAuth from UserIdentitiesGetItemProvider
      • Removed XOAuth from UserIdentitiesGetItemProvider
      • Changed errors for endpoint DELETE /user_management/users/{id}

  • #549 fix(generated): regenerate from spec

    Features

    • agents:
      • Made AgentBlueprintsCreateRequest.session_settings optional
      • Added model AgentTokenValidation
      • Added model AgentBlueprintsTokenValidateTokenRequest
    • agents_blueprints_tokens:
      • Added endpoint POST /agents/blueprints/{agent_blueprint_id}/tokens/validate

10.2.1 (2026-08-20)

Bug Fixes

  • explicitly evict connections if request does not complete as success (e792414)

10.2.0 (2026-08-11)

  • #533 feat(generated)!: regenerate from spec (2 changes)

    ⚠️ Breaking

    • events:
      • Changed required status for parameter Events.list.events

    Features

    • groups:
      • Added parameter Groups.list.search
    • connect:
      • Added client_id to ConnectedAccount
      • Added client_secret_last_4 to ConnectedAccount
      • Added config to ConnectedAccount
    • pipes:
      • Added client_id to DataIntegrationsListResponseDataConnectedAccount
      • Added client_secret_last_4 to DataIntegrationsListResponseDataConnectedAccount
      • Added config to DataIntegrationsListResponseDataConnectedAccount
      • Changed errors for endpoint POST /data-integrations/{slug}/credentials
      • Made CustomProviderDefinition.authorization_url optional
      • Made CustomProviderDefinition.token_url optional
      • Added model DataIntegrationsUpsertClientCredentialsRequest
      • Added client_credentials to CreateDataIntegrationAuthMethods
      • Added endpoint PUT /data-integrations/{slug}/client-credentials
    • sso:
      • Added XOAuth to ConnectionType
      • Added XOAuth to ProfileConnectionType
      • Added XOAuth to ConnectionsConnectionType
      • Added GrokOAuth to ConnectionType
      • Added GrokOAuth to ProfileConnectionType
      • Added GrokOAuth to ConnectionsConnectionType
    • user_management:
      • Changed errors for endpoint DELETE /user_management/users/{id}
      • Added password_salt_position to CreateUser
      • Added password_salt_position to UpdateUser
      • Made RadarSmsChallengeCodeSessionAuthenticateRequest.verification_id optional
      • Made RadarSmsChallengeCodeSessionAuthenticateRequest.phone_number optional
      • Added enum CreateUserPasswordSaltPosition
      • Added enum UpdateUserPasswordSaltPosition
      • Added XOAuth to AuthenticateResponseAuthenticationMethod
      • Added XOAuth to UserIdentitiesGetItemProvider
      • Added GrokOAuth to AuthenticateResponseAuthenticationMethod
      • Added GrokOAuth to UserIdentitiesGetItemProvider
    • webhooks:
      • Added agent.registration.refreshed to CreateWebhookEndpointEvents
      • Added agent.registration.refreshed to UpdateWebhookEndpointEvents

    Fixes

    • pipes:
      • Changed the type of DataIntegration.credentials
    • user_management:
      • Changed errors for endpoint POST /user_management/authenticate
      • Changed errors for endpoint POST /user_management/users
      • Changed errors for endpoint PUT /user_management/users/{id}

10.1.0 (2026-07-28)

Features

  • replace hand-written URL builders with generated ones (b162486)

  • #531 fix(generated): regenerate from spec

    Features

    • pipes:
      • Added config to DataIntegrationsGetDataIntegrationAuthorizeUrlRequest
      • Added client_credentials to DataIntegrationAuthMethods
      • Added client_credentials to DataIntegrationsListResponseDataAuthMethods
      • Added client_credentials to DataIntegrationsListResponseDataConnectedAccountAuthMethod
      • Added config to Pipes models
    • connect:
      • Added client_credentials to ConnectedAccountAuthMethod

    Fixes

    • user_management:
      • Changed errors for endpoint POST /user_management/invitations
      • Changed errors for endpoint POST /user_management/invitations/{id}/resend
      • Changed errors for endpoint POST /user_management/magic_auth
      • Changed errors for endpoint POST /user_management/authenticate

  • #532 fix(generated): regenerate from spec

    Fixes

    • sso:
      • Removed callback_endpoint from Connection

10.0.0 (2026-07-22)

Bug Fixes

  • Preserve explicit nil in request bodies as JSON null (#522) (5b06e32)

  • #524 feat(generated)!: regenerate from spec (3 changes)

    Features

    • agents:
      • Added model ClaimViewResponse
      • Added model ClaimViewResponseOrganization
      • Added model AgentAdminLinkClaimAttemptToExternalUserRequest
      • Added model AgentAdminLinkClaimAttemptToExternalUserRequestUser
      • Added enum ClaimViewResponseStatus
      • Added endpoint PATCH /agents/claims/attempts
      • Added model AgentRegistration
      • Added model AgentCredentialValidation
      • Added model AgentRegistrationAgentIdentity
      • Added model AgentRegistrationClaim
      • Added model AgentAdminValidateCredentialRequest
      • Added model AgentRegistrationClaimClaimCompletion
      • Added enum AgentRegistrationStatus
      • Added enum AgentRegistrationKind
      • Added enum AgentAdminValidateCredentialRequestType
      • Added service Agents
    • api_keys:
      • Added agent_registration_id to ApiKeyValidationResponse
    • connect:
      • Added enum ApplicationsRegistrationTypes
      • Added parameter Applications.list.registration_types
    • directory_sync:
      • Added parameter DirectoryUsers.list.idp_id
      • Added parameter DirectoryUsers.list.email
    • organizations:
      • Added model OrganizationAuthorizedConnectApplicationList
      • Added model OrganizationAuthorizedConnectApplicationListData
      • Added model OrganizationAuthorizedConnectApplicationListListMetadata
      • Added service OrganizationsAuthorizedApplications
    • pipes:
      • Added model DataIntegrationInstallation
      • Added auth_methods to CreateDataIntegration
      • Added api_key to CreateDataIntegration
      • Added api_key to UpdateDataIntegration
      • Added auth_methods to DataIntegration
      • Added installation to DataIntegration
      • Added enum CreateDataIntegrationAuthMethods
      • Added enum DataIntegrationAuthMethods
      • Added model DataIntegrationCredentialsResponse
      • Added model DataIntegrationCredentialsResponseCredential
      • Added model DataIntegrationsUpsertApiKeyRequest
      • Added model DataIntegrationsVendCredentialsRequest
      • Added enum DataIntegrationCredentialsResponseError
      • Added endpoint PUT /data-integrations/{slug}/api-key
      • Added endpoint POST /data-integrations/{slug}/credentials
    • sso:
      • Added parameter SSO.authorize.prompt
    • user_management:
      • Added ssha256 to CreateUserPasswordHashType
      • Added ssha256 to UpdateUserPasswordHashType
      • Added endpoint GET /user_management/radar_challenges/{id}
    • webhooks:
      • Added agent.registration.revoked to CreateWebhookEndpointEvents
      • Added agent.registration.revoked to UpdateWebhookEndpointEvents
      • Added agent.registration.deleted to CreateWebhookEndpointEvents
      • Added agent.registration.deleted to UpdateWebhookEndpointEvents
      • Added radar.challenge_created to CreateWebhookEndpointEvents
      • Added radar.challenge_created to UpdateWebhookEndpointEvents
      • Added agent.registration.expired to CreateWebhookEndpointEvents
      • Added agent.registration.expired to UpdateWebhookEndpointEvents
    • widgets:
      • Made WidgetSessionToken.organization_id optional

  • #527 feat(generated)!: regenerate from spec (5 changes)

    ⚠️ Breaking

    • admin_portal:
      • SDK surface change: Symbol "IntentOptions" was removed
    • connect:
      • SDK surface change: Symbol "ConnectedAccountDto" was removed
    • organization_domains:
      • SDK surface change: Symbol "DomainVerificationIntentOptions" was removed
    • pipes:
      • SDK surface change: Symbol "DataIntegrationCredentialsDto" was removed
    • sso:
      • SDK surface change: Symbol "SSOIntentOptions" was removed

9.5.0 (2026-07-06)

  • #514 fix(generated): regenerate from spec

    Features

    • user_management:
      • Added model UserRoleAssignmentSource
      • Added source to UserRoleAssignment
      • Added enum UserRoleAssignmentSourceType
      • Added parameter UserManagementAuthentication.authorize.max_age
      • Added endpoint GET /user_management/cors_origins
      • Added endpoint GET /user_management/redirect_uris

    Fixes

    • Restore mistakenly removed CreateMagicAuth logic from previous release

9.4.0 (2026-07-02)

  • #508 fix(generated): regenerate from spec

    Features

    • pipes:
      • Added model DataIntegrationCredentialsResponse
      • Added model DataIntegrationCredentialsResponseCredential
      • Added model DataIntegrationsUpsertApiKeyRequest
      • Added model DataIntegrationsVendCredentialsRequest
      • Added enum DataIntegrationCredentialsResponseError
      • Added endpoint PUT /data-integrations/{slug}/api-key
      • Added endpoint POST /data-integrations/{slug}/credentials

  • #510 fix(generated): regenerate from spec

    ⚠️ Breaking

    • user_management:
      • Removed model SessionReauthenticated
      • Removed model SessionReauthenticatedData
      • Removed model SessionReauthenticatedDataImpersonator
      • Removed enum SessionReauthenticatedDataAuthMethod
      • Removed enum SessionReauthenticatedDataStatus

    Features

    • webhooks:
      • Added agent.registration.created to CreateWebhookEndpointEvents
      • Added agent.registration.claim.attempt.created to CreateWebhookEndpointEvents
      • Added agent.registration.claim.completed to CreateWebhookEndpointEvents
      • Added agent.registration.credential.issued to CreateWebhookEndpointEvents
      • Added agent.registration.organization.switched to CreateWebhookEndpointEvents
      • Added authentication.reauthentication_succeeded to CreateWebhookEndpointEvents
      • Added agent.registration.created to UpdateWebhookEndpointEvents
      • Added agent.registration.claim.attempt.created to UpdateWebhookEndpointEvents
      • Added agent.registration.claim.completed to UpdateWebhookEndpointEvents
      • Added agent.registration.credential.issued to UpdateWebhookEndpointEvents
      • Added agent.registration.organization.switched to UpdateWebhookEndpointEvents
      • Added authentication.reauthentication_succeeded to UpdateWebhookEndpointEvents
    • webhooks:
      • Added session.reauthenticated to CreateWebhookEndpointEvents
      • Added session.reauthenticated to UpdateWebhookEndpointEvents
    • webhooks:
      • Added pipes.connected_account.connection_failed to CreateWebhookEndpointEvents
      • Added pipes.connected_account.connection_failed to UpdateWebhookEndpointEvents
    • user_management:
      • Added model UserRoleAssignmentSource
      • Added source to UserRoleAssignment
      • Added enum UserRoleAssignmentSourceType
      • Added parameter UserManagementAuthentication.authorize.max_age
      • Added endpoint GET /user_management/cors_origins
      • Added endpoint GET /user_management/redirect_uris
    • audit_logs:
      • Changed the format of AuditLogExportCreation.range_start
      • Changed the format of AuditLogExportCreation.range_end
    • audit_logs:
      • Added expired to AuditLogExportState

    Fixes

    • admin_portal:
      • Removed intent_options from GenerateLink
    • webhooks:
      • Removed session.reauthenticated from CreateWebhookEndpointEvents
      • Removed session.reauthenticated from UpdateWebhookEndpointEvents

  • #512 feat(generated): regenerate from spec (1 change)

    Features

    • pipes:
      • Added model DataIntegrationCredentialsDto
      • Added model CustomProviderDefinition
      • Added model CreateDataIntegration
      • Added model UpdateCustomProviderDefinition
      • Added model UpdateDataIntegration
      • Added model DataIntegration
      • Added model DataIntegrationList
      • Added model DataIntegrationListListMetadata
      • Added model DataIntegrationCredential
      • Added model DataIntegrationCustomProvider
      • Added enum DataIntegrationCredentialsType
      • Added enum CustomProviderDefinitionAuthenticateVia
      • Added enum UpdateCustomProviderDefinitionAuthenticateVia
      • Added enum DataIntegrationState
      • Added enum DataIntegrationCredentialType
      • Added enum DataIntegrationCustomProviderAuthenticateVia
      • Added endpoint GET /data-integrations
      • Added endpoint POST /data-integrations
      • Added endpoint GET /data-integrations/{slug}
      • Added endpoint PUT /data-integrations/{slug}
      • Added endpoint DELETE /data-integrations/{slug}
      • Added endpoint POST /user_management/users/{user_id}/connected_accounts/{slug}
      • Added endpoint PUT /user_management/users/{user_id}/connected_accounts/{slug}

  • #513 feat(generated): regenerate from spec (2 changes)

    Features

    • user_management:
      • Added model SendRadarSmsChallenge
      • Added model SendRadarSmsChallengeResponse
      • Added model UrnWorkosOAuthGrantTypeRadarEmailChallengeCodeSessionAuthenticateRequest
      • Added model UrnWorkosOAuthGrantTypeRadarSmsChallengeCodeSessionAuthenticateRequest
      • Added model MagicAuthSendMagicAuthCodeAndReturnResponse
      • Added model UserCreateResponse
      • Added ip_address to CreateMagicCodeAndReturn
      • Added user_agent to CreateMagicCodeAndReturn
      • Added radar_auth_attempt_id to CreateMagicCodeAndReturn
      • Added signals_id to CreateMagicCodeAndReturn
      • Added ip_address to CreateUser
      • Added user_agent to CreateUser
      • Added signals_id to CreateUser
      • Added signals_id to AuthorizationCodeSessionAuthenticateRequest
      • Added signals_id to PasswordSessionAuthenticateRequest
      • Added radar_auth_attempt_id to PasswordSessionAuthenticateRequest
      • Added radar_auth_attempt_id to UrnWorkosOAuthGrantTypeMagicAuthCodeSessionAuthenticateRequest
      • Added endpoint POST /user_management/radar_challenges
    • radar:
      • Added signals_id to RadarStandaloneAssessRequest

    Fixes

    • user_management:
      • Changed request body for UserManagementAuthentication.authenticate
      • Changed response of UserManagementUsers.create from User to UserCreateResponse
      • Changed response of UserManagementMagicAuth.sendMagicAuthCodeAndReturn from MagicAuth to MagicAuthSendMagicAuthCodeAndReturnResponse

9.3.0 (2026-06-30)

9.2.0 (2026-06-18)

  • #501 feat(generated)!: regenerate from spec (12 changes)

    Features

    • authorization:
      • Added model ReplaceGroupRoleAssignmentEntry
      • Added model ReplaceGroupRoleAssignments
      • Added model DeleteGroupRoleAssignmentsByCriteria
      • Added endpoint POST /authorization/groups/{group_id}/role_assignments
      • Added endpoint PUT /authorization/groups/{group_id}/role_assignments
      • Added endpoint DELETE /authorization/groups/{group_id}/role_assignments
      • Added endpoint GET /authorization/groups/{group_id}/role_assignments/{role_assignment_id}
      • Added endpoint DELETE /authorization/groups/{group_id}/role_assignments/{role_assignment_id}
    • client:
      • Added model ClientApiToken
      • Added model ClientApiTokenResponse
      • Added service Client
    • connect:
      • Added auth_method to ConnectedAccount
      • Added api_key_last_4 to ConnectedAccount
      • Added enum ConnectedAccountAuthMethod
    • groups:
      • Added model CreateGroupRoleAssignment
      • Added model GroupRoleAssignment
      • Added model GroupRoleAssignmentList
      • Added model GroupRoleAssignmentResource
    • organization_membership:
      • Added model UserOrganizationMembershipList
      • Added model UserOrganizationMembershipListListMetadata
    • pipes:
      • Added model DataIntegrationCredentials
      • Added model DataIntegrationConfigurationResponse
      • Added model DataIntegrationConfigurationListResponse
      • Added model ConfigureDataIntegrationBody
      • Added auth_methods to DataIntegrationsListResponseData
      • Added auth_method to DataIntegrationsListResponseDataConnectedAccount
      • Added api_key_last_4 to DataIntegrationsListResponseDataConnectedAccount
      • Added enum DataIntegrationCredentialsCredentialsType
      • Added enum DataIntegrationsListResponseDataAuthMethods
      • Added enum DataIntegrationsListResponseDataConnectedAccountAuthMethod
      • Added service PipesProvider
    • user_management:
      • Added model UserInviteList
      • Added model UserInviteListListMetadata
      • Made AuthorizationCodeSessionAuthenticateRequest.client_secret optional
      • Made RefreshTokenSessionAuthenticateRequest.client_secret optional
    • widgets:
      • Added widgets:pipes:manage to WidgetSessionTokenScopes

    Fixes

    • organization_membership:
      • Changed response of UserManagementOrganizationMembership.list from UserOrganizationMembership to UserOrganizationMembershipList
    • user_management:
      • Changed response of UserManagementInvitations.list from UserInvite to UserInviteList

9.1.0 (2026-06-17)

Bug Fixes

  • #495 feat(generated): regenerate from spec (8 changes)

    Features

    • api_keys:
      • Added model ExpireApiKey
      • Added model ApiKeyUpdated
      • Added model ApiKeyUpdatedData
      • Added model ApiKeyUpdatedDataOwner
      • Added model UserApiKeyUpdatedDataOwner
      • Added model ApiKeyUpdatedDataPreviousAttribute
      • Added endpoint POST /api_keys/{id}/expire
    • audit_logs:
      • Added Snowflake to AuditLogConfigurationLogStreamType
    • connect:
      • Added name to UserObject
    • directory_sync:
      • Added model DsyncTokenCreated
      • Added model DsyncTokenCreatedData
      • Added model DsyncTokenRevoked
      • Added model DsyncTokenRevokedData
    • user_management:
      • Added name to user management models
    • webhooks:
      • Added api_key.updated to CreateWebhookEndpointEvents
      • Added api_key.updated to UpdateWebhookEndpointEvents

9.0.0 (2026-05-26)

Bug Fixes

  • ci: extract version from PR title in changelog inline step (93768a1)

  • #491 feat(generated)!: regenerate from spec (9 changes)

    ⚠️ Breaking

    • organization_membership: Migrate organization membership to dedicated service
      • Moved organization membership methods from UserManagement to new OrganizationMembershipService class
      • Methods create_organization_membership, get_organization_membership, update_organization_membership, delete_organization_membership, deactivate_organization_membership, reactivate_organization_membership, list_organization_memberships, and list_organization_membership_groups now accessed via client.organization_membership instead of client.user_management
      • Removed UserManagement::RoleSingle and UserManagement::RoleMultiple data classes (moved to OrganizationMembershipService)
    • api_keys: Add expires_at field to API key models
      • Added expires_at optional field to ApiKey, OrganizationApiKey, OrganizationApiKeyWithValue, UserApiKey, and UserApiKeyWithValue models
      • Added expires_at field to CreateOrganizationApiKey and CreateUserApiKey request models
      • Updated create_organization_api_key and create_user_api_key methods to accept expires_at parameter
    • radar: Remove device_fingerprint and bot_score fields from Radar
      • Removed device_fingerprint and bot_score parameters from Radar.create_attempt method
      • Removed device_fingerprint and bot_score fields from RadarStandaloneAssessRequest model
      • Updated enum values in RadarStandaloneAssessRequestAction: removed LOGIN, SIGNUP, SIGN_UP_2, SIGN_IN_2, SIGN_IN_3, SIGN_UP_3; standardized to SIGN_UP and SIGN_IN
      • Removed CREDENTIAL_STUFFING and IP_SIGN_UP_RATE_LIMIT from RadarStandaloneResponseControl enum
    • audit_logs: Refactor audit logs models and type names
      • Merged AuditLogSchemaJson fields into AuditLogSchema; removed AuditLogSchemaJson class
      • Added new AuditLogSchemaInput class (write-side schema without read-only fields)
      • Renamed AuditLogSchemaJsonActor to AuditLogSchemaActorInput
      • Renamed AuditLogSchemaJsonTarget to AuditLogSchemaTargetInput
      • Removed AuditLogActionJson; AuditLogAction now extends BaseModel
      • Renamed AuditLogExportJson to AuditLogExport (now extends BaseModel)
      • Renamed AuditLogsRetentionJson to AuditLogsRetention (now extends BaseModel)
      • Removed AuditLogExportJsonState type; replaced with AuditLogExportState
      • Updated list_actions method return type from AuditLogActionJson to AuditLogAction
      • Updated create_export and get_export method return types from AuditLogExportJson to AuditLogExport
    • webhooks: Rename WebhookEndpointJson to WebhookEndpoint
      • Renamed WebhookEndpointJson to WebhookEndpoint
      • Updated list_webhook_endpoints, create_webhook_endpoint, and update_webhook_endpoint method return types
      • WebhookEndpointStatus is now an alias for UpdateWebhookEndpointStatus (no longer a standalone class); removed WebhookEndpointJsonStatus alias
      • Updated WebhookEndpoint to extend BaseModel for consistency
    • authorization: Add filtering parameters to authorization list methods
      • Added resource_id, resource_external_id, resource_type_slug filter parameters to list_role_assignments method
      • Added role_slug filter parameter to list_role_assignments_for_resource_by_external_id and list_role_assignments_for_resource methods
      • Removed search parameter from list_resources method

    Features

    • vault: Add new Vault service with key-value operations
      • Added new Vault service class with methods: create_data_key, create_decrypt, create_rekey, list_kv, create_kv, get_name, get_kv, update_kv, delete_kv, list_kv_metadata, list_kv_versions
      • Added vault model classes: Actor, CreateDataKeyRequest, CreateDataKeyResponse, CreateObjectRequest, DecryptRequest, DecryptResponse, DeleteObjectResponse, ObjectModel, ObjectMetadata, ObjectSummary, ObjectVersion, ObjectWithoutValue, RekeyRequest, UpdateObjectRequest
      • Added VaultOrder enum for sorting operations
      • Added client.vault accessor to access the new service
    • pipes: Add Pipes connected account event models
      • Added PipeConnectedAccount model for representing connected accounts
      • Added three new event models: PipesConnectedAccountConnected, PipesConnectedAccountDisconnected, PipesConnectedAccountReauthorizationNeeded
      • Added PipeConnectedAccountState enum with CONNECTED and NEEDS_REAUTHORIZATION values
      • Added new webhook event types to CreateWebhookEndpointEvents and UpdateWebhookEndpointEvents
    • generated: Add Error and Actor shared models
      • Added Error model in shared module for error responses
      • Added Actor model in vault module representing user/actor information
      • Updated inflections to map 'object' to 'ObjectModel' to avoid conflicts

8.0.1 (2026-05-12)

Bug Fixes

  • harden session sealing, log redaction, and webhook tolerance checks (#482) (347fe1e)

8.0.0 (2026-05-06)

⚠ BREAKING CHANGES

  • authorization: Consolidate order enums to PaginationOrder
  • api_keys: Separate organization and user API key types
  • user_management: Consolidate order enums to PaginationOrder
  • vault: Add BYOK key deleted event and consolidate key provider enum
  • types: Consolidate pagination order enums
  • authorization: Rename RoleAssignment to UserRoleAssignment

Features

  • api_keys: Separate organization and user API key types (956386a)
  • authorization: Add new role assignment listing endpoints (956386a)
  • authorization: Consolidate order enums to PaginationOrder (956386a)
  • authorization: Rename RoleAssignment to UserRoleAssignment (956386a)
  • directory_sync: Add name field to directory users (956386a)
  • docs: publish YARD API docs + llms.txt to GitHub Pages (#480) (117eeac)
  • events: Add admin_portal source to event context actor (956386a)
  • sso: Add name field to SSO profile (956386a)
  • types: Consolidate pagination order enums (956386a)
  • user_management: Add get JWT template endpoint (956386a)
  • user_management: Add user API key management (956386a)
  • user_management: Add user field to membership and organization membership (956386a)
  • user_management: Consolidate order enums to PaginationOrder (956386a)
  • vault: Add BYOK key deleted event and consolidate key provider enum (956386a)

7.1.2 (2026-05-06)

Bug Fixes

  • decode legacy v6 sealed sessions on unseal (#479) (1d8b4aa)
  • replace parameter-group hashes with typed variant classes (#473) (a66c15b)
  • set canonical User-Agent header format (#476) (6728358)

7.1.1 (2026-04-29)

Bug Fixes

  • seal session client-side in Session#refresh (#470) (32662ab)

7.1.0 (2026-04-27)

Features

  • generated: update generated SDK from spec changes (#465) (6c145d2)

Bug Fixes

  • add ruby/setup-ruby to release-please workflow (aa5ebd0)
  • eagerly load configuration.rb to fix WorkOS.configure (#467) (eea391c)
  • remove stale URN-prefixed alias files breaking Zeitwerk (#466) (92b2aa5)
  • update Gemfile.lock in release-please PR and bump action pins (2aa0574)
  • update Zeitwerk autoload for inflections.rb (#460) (4fa1332)

7.0.0 (2026-04-20)

This is a major release that introduces a fully redesigned SDK architecture. The SDK is now generated from the WorkOS OpenAPI spec, bringing type safety, consistent interfaces, and improved developer ergonomics.

High-Level Changes

  • Client-centric architecture: The SDK now revolves around an instantiated WorkOS::Client rather than module-level service calls. All product areas are accessed through client methods (e.g., client.organizations, client.user_management, client.sso).

  • Generated request/response models: Typed models replace raw hashes. Response models no longer inherit from Hash — use accessor methods instead of bracket notation.

  • Per-request overrides: The new runtime supports request_options: for per-request API key, timeout, base URL, and retry overrides — useful for multi-tenant setups.

  • Minimum Ruby 3.3+: The minimum Ruby version has been raised to 3.3.

  • Renamed services and methods: Several top-level services were renamed (e.g., WorkOS::Portal → client.admin_portal, WorkOS::MFA → client.multi_factor_auth). Method signatures now use explicit keyword arguments.

  • Session management refactor: AuthKit session sealing, refresh, and authentication flows were overhauled with a dedicated SessionManager on the client instance.

  • New capabilities: Device code flow, public/PKCE clients, auto_paging_each pagination, and last_response observability on all responses.

Migration Guide

For detailed instructions on updating your application, see the v7 Migration Guide.

6.2.0 (2026-03-06)

Features

  • user-management: add directory_managed to OrganizationMembership (#446) (914d824)
  • user-management: add invitation accept endpoint (#448) (b5b4da1)

Bug Fixes

6.1.0 (2026-02-10)

Features

  • add support for totp_secret (#300) (c0a26bf)
  • Include Feature Flags decoded from the JWT in the payload of a Session (#386) (31a0e79)
  • workos-ruby: Add connection to authorization_url (#78) (c3a0e8e)

Bug Fixes

  • add invitation_token parameter to authentication methods (#438) (d24e3dc)