auth0 6.4.0 → 6.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c0ee008c469f95695eb60571f4ab79355846375df2cb681eb3bead53350eabdc
-  data.tar.gz: 274ca0c5c3ed5bd0ca1c064304a547b2133b3b8b57e086a8e721fc6db5f4ed4b
+  metadata.gz: 7e787d64726dfd6bfb46857e1e1d68df5c06cf088d71c998da367a0e9487be9f
+  data.tar.gz: 59a2130de04ac2c65e6129979de443daae5bd0215c4eb4cafb0650b13bde9095
 SHA512:
-  metadata.gz: 3fafaf658bcec42cbd757cba5b05e0f3a511f1065857cb30751e539e0e5b61c004861c337274d8146cb555e7500c16b7307ba6a9ac6d5b732f78af1adad387e9
-  data.tar.gz: 5c2d1b45e193299f235426a4ea46a6fb31082c48faa73e5959bda6f4daefb93ed68f935e1cbdb1f1912067ec50b943e89d65f48432d1eaf7618381fb49e79e43
+  metadata.gz: ed27130d281f1ff2cac53fa12d0eb1bb810b3f07c0ff73d89ef073725af9fbcb5e8796f4fabec90798e4aa23fefb94f96211551d5dc7d64aae8f72b3398d14f3
+  data.tar.gz: 184e6c27433b16e4e0fcbba7193ff3a758c0e2aaa5843d98495529394e1105267e369ef2b526b9c2135ab9e05e5778701cd9ab6bd4aab36bed58ab60bec3d470

data/.fern/metadata.json

@@ -1,5 +1,5 @@
 {
-  "cliVersion": "5.92.1",
+  "cliVersion": "5.166.0",
   "generatorName": "fernapi/fern-ruby-sdk",
   "generatorVersion": "1.24.1",
   "generatorConfig": {
@@ -10,9 +10,9 @@
     "offsetSemantics": "page-index",
     "useDefaultRequestParameterValues": true
   },
-  "originGitCommit": "d0c167e92ed941d977b98e76601bd970b0e5ecea",
+  "originGitCommit": "30874f917fa5eed3526d32a3bfd2ff024d36a4f4",
   "originGitCommitIsDirty": false,
   "invokedBy": "ci",
   "ciProvider": "github",
-  "sdkVersion": "6.3.1"
+  "sdkVersion": "6.5.1"
 }

data/.fern/replay.lock

@@ -1,58 +1,22 @@
 # DO NOT EDIT MANUALLY - Managed by Fern Replay
 version: "1.0"
 generations:
-  - commit_sha: 78ff190749feb3803b4e9629d57294e4b09d3ead
-    tree_hash: c3e180060dcea59de5c4290a242c66639e5cecff
-    timestamp: 2026-07-14T04:31:08.668Z
+  - commit_sha: 1af018d42213a5a5a4a5857b8ee326c968405184
+    tree_hash: 26cc3589bfbfef3bd26972743969ea67451c2a23
+    timestamp: 2026-10-27T11:22:31.372Z
     cli_version: unknown
     generator_versions: {}
-  - commit_sha: 6caf043a4469185ba0f690eb2da7c6889138f4d7
-    tree_hash: dbc1a9fac4f5566751f2760dc8e1191d47892bd5
-    timestamp: 2026-07-14T04:31:09.152Z
-    cli_version: unknown
-    generator_versions:
-      fernapi/fern-ruby-sdk: 1.13.1
-  - commit_sha: 428032101d1791fe97573af36427e664fe4e1e88
-    tree_hash: 231d5c443ba4120855bd439d858060fc178043cd
-    timestamp: 2026-07-15T09:11:13.405Z
-    cli_version: unknown
-    generator_versions:
-      fernapi/fern-ruby-sdk: 1.13.1
-  - commit_sha: d8a88028849ce519e8fdc20765c78e367f372110
-    tree_hash: 3e4eff170915344776a2c1e921a378a13c54afd1
-    timestamp: 2026-07-21T07:06:12.329Z
-    cli_version: unknown
-    generator_versions:
-      fernapi/fern-ruby-sdk: 1.17.8
-  - commit_sha: ff82f16a518e8ee51b23570ed1a303f3c070ff02
-    tree_hash: 6b4ba82c8dbe3556b6c8e7dd4f7c4d32671aa12a
-    timestamp: 2026-08-04T06:22:44.311Z
-    cli_version: unknown
-    generator_versions:
-      fernapi/fern-ruby-sdk: 1.17.8
-  - commit_sha: 1cfe82c679b6122773317ebd41bff24b09388b3d
-    tree_hash: a7034ef350a9bfaa17781b64316723f688b91e18
-    timestamp: 2026-08-19T06:07:50.024Z
-    cli_version: unknown
-    generator_versions:
-      fernapi/fern-ruby-sdk: 1.17.8
-  - commit_sha: 78116dc530cd08317c9323863f3127c2fdec29ee
-    tree_hash: d0d935e417bf22e33c1c1eb9c6c43371d35907c0
-    timestamp: 2026-09-02T09:27:17.154Z
-    cli_version: unknown
-    generator_versions:
-      fernapi/fern-ruby-sdk: 1.17.8
-  - commit_sha: 83074ed870797568e512cc7f0fb71dc679cdd7f4
-    tree_hash: cbc5c6ccd2dfd5be3b5d68f7bc45a51e62fa6704
-    timestamp: 2026-09-15T12:33:08.051Z
+  - commit_sha: 1f0cde99ca7fdddcfc5635a1f41bf51a7efe863c
+    tree_hash: 781e4e5affb287da31d3713a3f16811228a7ada7
+    timestamp: 2026-10-27T11:30:28.609Z
     cli_version: unknown
     generator_versions:
       fernapi/fern-ruby-sdk: 1.24.1
-  - commit_sha: ddd12c1ca38e6c93db2c1d30e4194a2ecbca03ba
-    tree_hash: fa2bf11afbbd64aff874ac158dfaf67412ee73d7
-    timestamp: 2026-09-29T05:46:29.187Z
+  - commit_sha: c4b1c95e4e0668d2c42aaa0a4c5c5ab1e8a642f8
+    tree_hash: d37708b9770790ac5501ab5c8a3a038868cd45d1
+    timestamp: 2026-11-04T03:49:40.588Z
     cli_version: unknown
     generator_versions:
       fernapi/fern-ruby-sdk: 1.24.1
-current_generation: ddd12c1ca38e6c93db2c1d30e4194a2ecbca03ba
+current_generation: c4b1c95e4e0668d2c42aaa0a4c5c5ab1e8a642f8
 patches: []

data/.version

@@ -1 +1 @@
-v6.4.0
+v6.6.0

data/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Change Log
 
+## [v6.6.0](https://github.com/auth0/ruby-auth0/tree/v6.6.0) (2026-11-04)
+[Full Changelog](https://github.com/auth0/ruby-auth0/compare/v6.5.0...v6.6.0)
+
+**Added**
+- feat!: add Portals, Client agent_id and agent subject claims, and wrap Consent Signing Keys list response [\#824](https://github.com/auth0/ruby-auth0/pull/824) ([fern-api[bot]](https://github.com/apps/fern-api))
+- feat: add Consent Signing Keys, OTP Settings, Resource Server type and Management tenant_domain, and remove Captcha Policies [\#821](https://github.com/auth0/ruby-auth0/pull/821) ([fern-api[bot]](https://github.com/apps/fern-api))
+- feat: expose Management API rate limit info via a client callback [\#774](https://github.com/auth0/ruby-auth0/pull/774) ([ProdigyTom](https://github.com/ProdigyTom))
+
+## [v6.5.0](https://github.com/auth0/ruby-auth0/tree/v6.5.0) (2026-10-14)
+[Full Changelog](https://github.com/auth0/ruby-auth0/compare/v6.4.0...v6.5.0)
+
+**Added**
+- feat: add Client Profiles, Captcha Policies, and client and client grant search, and remove update_status from experiments and feature flags [\#812](https://github.com/auth0/ruby-auth0/pull/812) ([fern-api[bot]](https://github.com/apps/fern-api))
+
+**Fixed**
+- fix: preserve false values in model fields [\#811](https://github.com/auth0/ruby-auth0/pull/811) ([kishore7snehil](https://github.com/kishore7snehil))
+
 ## [v6.4.0](https://github.com/auth0/ruby-auth0/tree/v6.4.0) (2026-09-30)
 [Full Changelog](https://github.com/auth0/ruby-auth0/compare/v6.3.0...v6.4.0)
 

data/EXAMPLES.md

@@ -166,6 +166,26 @@ management.roles.create(name: 'admin', description: 'Administrator')
 management.organizations.list(take: 20)
 ```
 
+## Rate Limit Monitoring
+
+Pass a `rate_limit_handler` when building an `Auth0::Client` to observe Auth0's `x-ratelimit-*` headers, without changing the return value of your calls. It covers Management API calls and the Authentication API calls made through the client's HTTP layer (it is not available on `Auth0::Management` directly):
+
+```ruby
+client = Auth0::Client.new(
+  domain: ENV['AUTH0_RUBY_DOMAIN'],
+  client_id: ENV['AUTH0_RUBY_CLIENT_ID'],
+  client_secret: ENV['AUTH0_RUBY_CLIENT_SECRET'],
+  rate_limit_handler: lambda do |rate_limit|
+    # rate_limit.limit / rate_limit.remaining (Integers), rate_limit.reset (UTC Time)
+    Rails.logger.info("Auth0 rate limit: #{rate_limit.remaining}/#{rate_limit.limit}, resets at #{rate_limit.reset}")
+  end
+)
+
+client.users.get(id: 'auth0|123456') # handler fires with this response's rate limit
+```
+
+The handler is invoked on every response, including the `429`s that trigger an automatic retry. An error raised inside the handler is caught (and warned) so it never breaks the request.
+
 ## Organizations
 
 [Organizations](https://auth0.com/docs/organizations) is a set of features that provide better support for developers who build and maintain SaaS and Business-to-Business (B2B) applications.

data/README.md

@@ -104,6 +104,7 @@ client = Auth0::Client.new(
 | `management_timeout` | Float | Timeout in seconds for Management API calls. | `60` |
 | `management_max_retries` | Integer | Maximum retries for Management API calls. | `2` |
 | `management_additional_headers` | Hash | Additional HTTP headers for Management API calls. | `nil` |
+| `rate_limit_handler` | `#call` | Callback for [rate-limit monitoring](#rate-limit-monitoring). | `nil` |
 
 #### Accessing the Management Client Directly
 
@@ -283,6 +284,23 @@ client.users.list(
 )
 ```
 
+### Rate Limit Monitoring
+
+Auth0 returns `x-ratelimit-limit`, `x-ratelimit-remaining`, and `x-ratelimit-reset` headers on API responses. Pass a `rate_limit_handler` when building an `Auth0::Client` to be notified of this data, so you can monitor how close you are to the limit (for example, emit a metric and alert before you run out). It covers Management API calls and the Authentication API calls made through the client's HTTP layer (the JWKS fetch used by `validate_id_token` goes through a separate object and is not reported). It is not available on `Auth0::Management` directly.
+
+```ruby
+client = Auth0::Client.new(
+  domain: ENV['AUTH0_RUBY_DOMAIN'],
+  client_id: ENV['AUTH0_RUBY_CLIENT_ID'],
+  client_secret: ENV['AUTH0_RUBY_CLIENT_SECRET'],
+  rate_limit_handler: lambda do |rate_limit|
+    StatsD.gauge('auth0.rate_limit.remaining', rate_limit.remaining) if rate_limit.remaining
+  end
+)
+```
+
+The handler receives an object with `#limit`, `#remaining` (Integers), and `#reset` (a UTC `Time`). Each is `nil` when the corresponding header is absent or non-numeric. It is invoked on every response, including the `429`s that trigger an automatic retry, so you can observe the point at which the limit was reached. The return value of your API call is unchanged, and an exception raised inside the handler is caught (and warned) so it can never break a request.
+
 ### Errors
 
 Management API errors use the `Auth0::Errors` namespace:

data/examples/ruby-api/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: ../..
   specs:
-    auth0 (6.4.0)
+    auth0 (6.6.0)
       addressable (~> 2.8)
       jwt (>= 2.7, < 4.0)
       rest-client (~> 2.1)

data/lib/auth0/attack_protection/brute_force_protection/types/update_brute_force_settings_request_content.rb

@@ -13,6 +13,8 @@ module Auth0
 
           field :mode, -> { Auth0::Types::BruteForceProtectionModeEnum }, optional: true, nullable: false
 
+          field :form_submission_mode, -> { Auth0::Types::BruteForceProtectionFormSubmissionModeEnum }, optional: true, nullable: false
+
           field :max_attempts, -> { Integer }, optional: true, nullable: false
         end
       end

data/lib/auth0/auth_client.rb

@@ -85,14 +85,39 @@ module Auth0
     def management
       current_token = get_token
       if @_management.nil? || @_management_token != current_token
-        @_management_token = current_token
         opts = { token: current_token, base_url: "#{@base_uri}/api/v2" }
         opts[:timeout] = @management_timeout if @management_timeout
         opts[:max_retries] = @management_max_retries if @management_max_retries
         opts[:headers] = @management_additional_headers if @management_additional_headers
-        @_management = Auth0::Management.new(**opts)
+        management = Auth0::Management.new(**opts)
+        # Attach before caching so a failed attach doesn't leave a handler-less
+        # management cached (the next call would then skip the rebuild).
+        attach_rate_limit_handler(management)
+        @_management = management
+        @_management_token = current_token
       end
       @_management
     end
+
+    private
+
+    # Attaches the configured rate limit handler to the management client's raw
+    # client. Fails loudly rather than silently skipping, so a future change to
+    # the generated client's internals surfaces instead of quietly disabling it.
+    # @param management [Auth0::Management]
+    # @return [void]
+    # @raise [Auth0::Exception] if the management client exposes no compatible raw client
+    def attach_rate_limit_handler(management)
+      return if @rate_limit_handler.nil?
+
+      raw_client = management.instance_variable_get(:@raw_client)
+      unless raw_client.respond_to?(:rate_limit_handler=)
+        raise Auth0::Exception,
+              "Unable to attach rate_limit_handler: the management client does not expose a compatible raw client. " \
+              "This likely means the ruby-auth0 internals changed. Please report it."
+      end
+
+      raw_client.rate_limit_handler = @rate_limit_handler
+    end
   end
 end

data/lib/auth0/client.rb

@@ -4,12 +4,20 @@ module Auth0
   class Management
     # @param token [String]
     # @param base_url [String, nil]
+    # @param tenant_domain [String, nil] Tenant domain, such as "example.auth0.com", used to build the base URL.
     # @param timeout [Float, nil] Request timeout in seconds.
-    # @param max_retries [Integer, nil] Maximum number of request retries.
+    # @param max_retries [Integer] Maximum number of request retries, defaults to 2.
     # @param headers [Hash, nil] Additional headers to include in requests.
     #
     # @return [void]
-    def initialize(token:, base_url: nil, timeout: nil, max_retries: nil, headers: nil)
+    def initialize(token:, base_url: nil, tenant_domain: nil, timeout: nil, max_retries: 2, headers: nil)
+      unless tenant_domain.nil?
+        environment_url_templates = {
+          Auth0::Environment::DEFAULT => "https://#{tenant_domain}/api/v2"
+        }
+        base_url = base_url.nil? ? "https://#{tenant_domain}/api/v2" : environment_url_templates.fetch(base_url, base_url)
+      end
+
       raw_client_opts = {
         base_url: base_url || Auth0::Environment::DEFAULT,
         headers: {
@@ -43,6 +51,11 @@ module Auth0
       @client_grants ||= Auth0::ClientGrants::Client.new(client: @raw_client)
     end
 
+    # @return [Auth0::ClientProfiles::Client]
+    def client_profiles
+      @client_profiles ||= Auth0::ClientProfiles::Client.new(client: @raw_client)
+    end
+
     # @return [Auth0::Clients::Client]
     def clients
       @clients ||= Auth0::Clients::Client.new(client: @raw_client)
@@ -138,6 +151,11 @@ module Auth0
       @organizations ||= Auth0::Organizations::Client.new(client: @raw_client)
     end
 
+    # @return [Auth0::Portals::Client]
+    def portals
+      @portals ||= Auth0::Portals::Client.new(client: @raw_client)
+    end
+
     # @return [Auth0::Prompts::Client]
     def prompts
       @prompts ||= Auth0::Prompts::Client.new(client: @raw_client)

data/lib/auth0/client_grants/client.rb

@@ -122,6 +122,78 @@ module Auth0
         end
       end
 
+      # Search client grants using SCIM or Lucene filter syntax with low-latency, eventually consistent results. Use the
+      # parser parameter to specify "scim" or "lucene" syntax (default: "lucene"). This endpoint provides an alternative
+      # to the standard GET /client-grants endpoint with better performance for complex queries.
+      # Results may not reflect recent updates immediately.
+      #
+      # @param request_options [Hash]
+      # @param params [Hash]
+      # @option request_options [String] :base_url
+      # @option request_options [Hash{String => Object}] :additional_headers
+      # @option request_options [Hash{String => Object}] :additional_query_parameters
+      # @option request_options [Hash{String => Object}] :additional_body_parameters
+      # @option request_options [Integer] :timeout_in_seconds
+      # @option params [String, nil] :q
+      # @option params [Auth0::Types::SearchParserEnum, nil] :parser
+      # @option params [String, nil] :fields
+      # @option params [Boolean, nil] :include_fields
+      # @option params [Integer, nil] :take
+      # @option params [String, nil] :from
+      # @option params [Auth0::Types::ClientGrantSortFieldEnum, nil] :sort
+      #
+      # @example
+      #   client.client_grants.search(
+      #     q: "q",
+      #     parser: "scim",
+      #     fields: "fields",
+      #     include_fields: true,
+      #     take: 1,
+      #     from: "from",
+      #     sort: "audience"
+      #   )
+      #
+      # @return [Auth0::Types::SearchClientGrantsResponseContent]
+      def search(request_options: {}, **params)
+        params = Auth0::Internal::Types::Utils.normalize_keys(params)
+        query_params = {}
+        query_params["q"] = params[:q] if params.key?(:q)
+        query_params["parser"] = params[:parser] if params.key?(:parser)
+        query_params["fields"] = params[:fields] if params.key?(:fields)
+        query_params["include_fields"] = params[:include_fields] if params.key?(:include_fields)
+        query_params["take"] = params.fetch(:take, 50)
+        query_params["from"] = params[:from] if params.key?(:from)
+        query_params["sort"] = params[:sort] if params.key?(:sort)
+
+        Auth0::Internal::CursorItemIterator.new(
+          cursor_field: :next_,
+          item_field: :client_grants,
+          initial_cursor: query_params["from"]
+        ) do |next_cursor|
+          query_params["from"] = next_cursor
+          request = Auth0::Internal::JSON::Request.new(
+            base_url: request_options[:base_url],
+            method: "GET",
+            path: "client-grants/search",
+            query: query_params,
+            request_options: request_options
+          )
+          begin
+            response = @client.send(request)
+          rescue Net::HTTPRequestTimeout
+            raise Auth0::Errors::TimeoutError
+          end
+          code = response.code.to_i
+          if code.between?(200, 299)
+            parsed_response = (response.body.to_s.empty? ? nil : Auth0::Types::SearchClientGrantsResponseContent.load(response.body))
+            [parsed_response, response]
+          else
+            error_class = Auth0::Errors::ResponseError.subclass_for_code(code)
+            raise error_class.new(response.body, code: code)
+          end
+        end
+      end
+
       # Retrieve a single [client
       # grant](https://auth0.com/docs/get-started/applications/application-access-to-apis-client-grants), including the
       # scopes associated with the application/API pair.

data/lib/auth0/client_grants/types/search_client_grants_request_parameters.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+module Auth0
+  module ClientGrants
+    module Types
+      class SearchClientGrantsRequestParameters < Internal::Types::Model
+        field :q, -> { String }, optional: true, nullable: false
+
+        field :parser, -> { Auth0::Types::SearchParserEnum }, optional: true, nullable: false
+
+        field :fields, -> { String }, optional: true, nullable: false
+
+        field :include_fields, -> { Internal::Types::Boolean }, optional: true, nullable: false
+
+        field :take, -> { Integer }, optional: true, nullable: false
+
+        field :from, -> { String }, optional: true, nullable: false
+
+        field :sort, -> { Auth0::Types::ClientGrantSortFieldEnum }, optional: true, nullable: false
+      end
+    end
+  end
+end

data/lib/auth0/client_profiles/client.rb

@@ -0,0 +1,233 @@
+# frozen_string_literal: true
+
+module Auth0
+  module ClientProfiles
+    class Client
+      # @param client [Auth0::Internal::Http::RawClient]
+      #
+      # @return [void]
+      def initialize(client:)
+        @client = client
+      end
+
+      # Retrieve a paginated list of client profiles for the tenant. Uses checkpoint pagination: pass the
+      # <code>next</code> cursor from a previous response as the <code>from</code> query parameter to retrieve the
+      # following page.
+      #
+      # @param request_options [Hash]
+      # @param params [Hash]
+      # @option request_options [String] :base_url
+      # @option request_options [Hash{String => Object}] :additional_headers
+      # @option request_options [Hash{String => Object}] :additional_query_parameters
+      # @option request_options [Hash{String => Object}] :additional_body_parameters
+      # @option request_options [Integer] :timeout_in_seconds
+      # @option params [String, nil] :from
+      # @option params [Integer, nil] :take
+      #
+      # @example
+      #   client.client_profiles.list(
+      #     from: "from",
+      #     take: 1
+      #   )
+      #
+      # @return [Auth0::Types::ListClientProfilesPaginatedResponseContent]
+      def list(request_options: {}, **params)
+        params = Auth0::Internal::Types::Utils.normalize_keys(params)
+        query_params = {}
+        query_params["from"] = params[:from] if params.key?(:from)
+        query_params["take"] = params.fetch(:take, 50)
+
+        Auth0::Internal::CursorItemIterator.new(
+          cursor_field: :next_,
+          item_field: :client_profiles,
+          initial_cursor: query_params["from"]
+        ) do |next_cursor|
+          query_params["from"] = next_cursor
+          request = Auth0::Internal::JSON::Request.new(
+            base_url: request_options[:base_url],
+            method: "GET",
+            path: "client-profiles",
+            query: query_params,
+            request_options: request_options
+          )
+          begin
+            response = @client.send(request)
+          rescue Net::HTTPRequestTimeout
+            raise Auth0::Errors::TimeoutError
+          end
+          code = response.code.to_i
+          if code.between?(200, 299)
+            parsed_response = (response.body.to_s.empty? ? nil : Auth0::Types::ListClientProfilesPaginatedResponseContent.load(response.body))
+            [parsed_response, response]
+          else
+            error_class = Auth0::Errors::ResponseError.subclass_for_code(code)
+            raise error_class.new(response.body, code: code)
+          end
+        end
+      end
+
+      # Create a client profile. At most one profile is allowed per tenant in this release; attempting to create a
+      # second returns <code>409 Conflict</code>. The profile governs Dynamic CIMD clients matched by its
+      # <code>apply_policy</code> at runtime.
+      #
+      # @param request_options [Hash]
+      # @param params [Auth0::ClientProfiles::Types::CreateClientProfileRequestContent]
+      # @option request_options [String] :base_url
+      # @option request_options [Hash{String => Object}] :additional_headers
+      # @option request_options [Hash{String => Object}] :additional_query_parameters
+      # @option request_options [Hash{String => Object}] :additional_body_parameters
+      # @option request_options [Integer] :timeout_in_seconds
+      #
+      # @example
+      #   client.client_profiles.create(
+      #     name: "name",
+      #     client_configuration: {},
+      #     apply_policy: {
+      #       external_metadata_type: "cimd",
+      #       external_metadata_created_by: "client"
+      #     }
+      #   )
+      #
+      # @return [Auth0::Types::ClientProfile]
+      def create(request_options: {}, **params)
+        params = Auth0::Internal::Types::Utils.normalize_keys(params)
+        request = Auth0::Internal::JSON::Request.new(
+          base_url: request_options[:base_url],
+          method: "POST",
+          path: "client-profiles",
+          body: Auth0::ClientProfiles::Types::CreateClientProfileRequestContent.new(params).to_h,
+          request_options: request_options
+        )
+        begin
+          response = @client.send(request)
+        rescue Net::HTTPRequestTimeout
+          raise Auth0::Errors::TimeoutError
+        end
+        code = response.code.to_i
+        if code.between?(200, 299)
+          (response.body.to_s.empty? ? nil : Auth0::Types::ClientProfile.load(response.body))
+        else
+          error_class = Auth0::Errors::ResponseError.subclass_for_code(code)
+          raise error_class.new(response.body, code: code)
+        end
+      end
+
+      # Retrieve a single client profile by its identifier. Returns <code>404</code> if no profile with the given ID
+      # exists for the tenant.
+      #
+      # @param request_options [Hash]
+      # @param params [Hash]
+      # @option request_options [String] :base_url
+      # @option request_options [Hash{String => Object}] :additional_headers
+      # @option request_options [Hash{String => Object}] :additional_query_parameters
+      # @option request_options [Hash{String => Object}] :additional_body_parameters
+      # @option request_options [Integer] :timeout_in_seconds
+      # @option params [Auth0::Types::ClientProfileID] :id
+      #
+      # @example
+      #   client.client_profiles.get(id: "id")
+      #
+      # @return [Auth0::Types::ClientProfile]
+      def get(request_options: {}, **params)
+        params = Auth0::Internal::Types::Utils.normalize_keys(params)
+        request = Auth0::Internal::JSON::Request.new(
+          base_url: request_options[:base_url],
+          method: "GET",
+          path: "client-profiles/#{URI.encode_uri_component(params[:id].to_s)}",
+          request_options: request_options
+        )
+        begin
+          response = @client.send(request)
+        rescue Net::HTTPRequestTimeout
+          raise Auth0::Errors::TimeoutError
+        end
+        code = response.code.to_i
+        if code.between?(200, 299)
+          (response.body.to_s.empty? ? nil : Auth0::Types::ClientProfile.load(response.body))
+        else
+          error_class = Auth0::Errors::ResponseError.subclass_for_code(code)
+          raise error_class.new(response.body, code: code)
+        end
+      end
+
+      # Delete a client profile. Idempotent: returns <code>204 No Content</code> whether or not a profile with the given
+      # ID existed. Deleting the profile removes fleet governance for matched clients immediately.
+      #
+      # @param request_options [Hash]
+      # @param params [Hash]
+      # @option request_options [String] :base_url
+      # @option request_options [Hash{String => Object}] :additional_headers
+      # @option request_options [Hash{String => Object}] :additional_query_parameters
+      # @option request_options [Hash{String => Object}] :additional_body_parameters
+      # @option request_options [Integer] :timeout_in_seconds
+      # @option params [Auth0::Types::ClientProfileID] :id
+      #
+      # @example
+      #   client.client_profiles.delete(id: "id")
+      #
+      # @return [untyped]
+      def delete(request_options: {}, **params)
+        params = Auth0::Internal::Types::Utils.normalize_keys(params)
+        request = Auth0::Internal::JSON::Request.new(
+          base_url: request_options[:base_url],
+          method: "DELETE",
+          path: "client-profiles/#{URI.encode_uri_component(params[:id].to_s)}",
+          request_options: request_options
+        )
+        begin
+          response = @client.send(request)
+        rescue Net::HTTPRequestTimeout
+          raise Auth0::Errors::TimeoutError
+        end
+        code = response.code.to_i
+        return if code.between?(200, 299)
+
+        error_class = Auth0::Errors::ResponseError.subclass_for_code(code)
+        raise error_class.new(response.body, code: code)
+      end
+
+      # Update a client profile. Supports partial updates at the top level (JSON Merge Patch); omitted top-level fields
+      # remain unchanged. Nested objects such as <code>client_configuration</code> must be supplied in full.
+      #
+      # @param request_options [Hash]
+      # @param params [Auth0::ClientProfiles::Types::UpdateClientProfileRequestContent]
+      # @option request_options [String] :base_url
+      # @option request_options [Hash{String => Object}] :additional_headers
+      # @option request_options [Hash{String => Object}] :additional_query_parameters
+      # @option request_options [Hash{String => Object}] :additional_body_parameters
+      # @option request_options [Integer] :timeout_in_seconds
+      # @option params [Auth0::Types::ClientProfileID] :id
+      #
+      # @example
+      #   client.client_profiles.update(id: "id")
+      #
+      # @return [Auth0::Types::ClientProfile]
+      def update(request_options: {}, **params)
+        params = Auth0::Internal::Types::Utils.normalize_keys(params)
+        request_data = Auth0::ClientProfiles::Types::UpdateClientProfileRequestContent.new(params).to_h
+        non_body_param_names = %w[id]
+        body = request_data.except(*non_body_param_names)
+
+        request = Auth0::Internal::JSON::Request.new(
+          base_url: request_options[:base_url],
+          method: "PATCH",
+          path: "client-profiles/#{URI.encode_uri_component(params[:id].to_s)}",
+          body: body,
+          request_options: request_options
+        )
+        begin
+          response = @client.send(request)
+        rescue Net::HTTPRequestTimeout
+          raise Auth0::Errors::TimeoutError
+        end
+        code = response.code.to_i
+        if code.between?(200, 299)
+          (response.body.to_s.empty? ? nil : Auth0::Types::ClientProfile.load(response.body))
+        else
+          error_class = Auth0::Errors::ResponseError.subclass_for_code(code)
+          raise error_class.new(response.body, code: code)
+        end
+      end
+    end
+  end
+end

data/lib/auth0/client_profiles/types/create_client_profile_request_content.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+module Auth0
+  module ClientProfiles
+    module Types
+      class CreateClientProfileRequestContent < Internal::Types::Model
+        field :name, -> { String }, optional: false, nullable: false
+
+        field :description, -> { String }, optional: true, nullable: false
+
+        field :client_configuration, -> { Auth0::Types::ClientProfileClientConfiguration }, optional: false, nullable: false
+
+        field :apply_policy, -> { Auth0::Types::ClientProfileApplyPolicy }, optional: false, nullable: false
+      end
+    end
+  end
+end

data/lib/auth0/client_profiles/types/list_client_profiles_request_parameters.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+module Auth0
+  module ClientProfiles
+    module Types
+      class ListClientProfilesRequestParameters < Internal::Types::Model
+        field :from, -> { String }, optional: true, nullable: false
+
+        field :take, -> { Integer }, optional: true, nullable: false
+      end
+    end
+  end
+end