auth0 6.4.0 → 6.6.0

data/lib/auth0/client_profiles/types/update_client_profile_request_content.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module Auth0
+  module ClientProfiles
+    module Types
+      class UpdateClientProfileRequestContent < Internal::Types::Model
+        field :id, -> { String }, optional: false, nullable: false
+
+        field :name, -> { String }, optional: true, nullable: false
+
+        field :description, -> { String }, optional: true, nullable: false
+
+        field :client_configuration, -> { Auth0::Types::ClientProfileClientConfiguration }, optional: true, nullable: false
+
+        field :apply_policy, -> { Auth0::Types::ClientProfileApplyPolicy }, optional: true, nullable: false
+      end
+    end
+  end
+end

data/lib/auth0/clients/client.rb

@@ -54,6 +54,7 @@ module Auth0
       # @option params [Boolean, nil] :is_first_party
       # @option params [String, nil] :app_type
       # @option params [String, nil] :external_client_id
+      # @option params [String, nil] :agent_id
       # @option params [String, nil] :q
       #
       # @example
@@ -67,6 +68,7 @@ module Auth0
       #     is_first_party: true,
       #     app_type: "app_type",
       #     external_client_id: "external_client_id",
+      #     agent_id: "agent_id",
       #     q: "q"
       #   )
       #
@@ -83,6 +85,7 @@ module Auth0
         query_params["is_first_party"] = params[:is_first_party] if params.key?(:is_first_party)
         query_params["app_type"] = params[:app_type] if params.key?(:app_type)
         query_params["external_client_id"] = params[:external_client_id] if params.key?(:external_client_id)
+        query_params["agent_id"] = params[:agent_id] if params.key?(:agent_id)
         query_params["q"] = params[:q] if params.key?(:q)
 
         Auth0::Internal::OffsetItemIterator.new(
@@ -257,6 +260,87 @@ module Auth0
         end
       end
 
+      # Search clients using SCIM or Lucene filter syntax with low-latency, eventually consistent results.
+      # Use the parser parameter to specify "scim" or "lucene" syntax (default: "lucene").
+      # This endpoint provides an alternative to the standard GET /clients endpoint with better performance
+      # for complex queries. Results may not reflect recent updates immediately.
+      #
+      # - This endpoint only supports `read:clients` and `read:client_summary` scopes. The `read:client_keys` and
+      # `read:client_credentials` scopes are not supported.
+      # - The following fields are never returned by this endpoint:
+      #   - `client_secret`
+      #   - `encryption_key`
+      #   - `signing_keys`
+      #   - `owners`
+      #   - `addons`
+      #
+      # @param request_options [Hash]
+      # @param params [Hash]
+      # @option request_options [String] :base_url
+      # @option request_options [Hash{String => Object}] :additional_headers
+      # @option request_options [Hash{String => Object}] :additional_query_parameters
+      # @option request_options [Hash{String => Object}] :additional_body_parameters
+      # @option request_options [Integer] :timeout_in_seconds
+      # @option params [String, nil] :q
+      # @option params [Auth0::Types::SearchParserEnum, nil] :parser
+      # @option params [String, nil] :fields
+      # @option params [Boolean, nil] :include_fields
+      # @option params [Integer, nil] :take
+      # @option params [String, nil] :from
+      # @option params [Auth0::Types::ClientSortFieldEnum, nil] :sort
+      #
+      # @example
+      #   client.clients.search(
+      #     q: "q",
+      #     parser: "scim",
+      #     fields: "fields",
+      #     include_fields: true,
+      #     take: 1,
+      #     from: "from",
+      #     sort: "name"
+      #   )
+      #
+      # @return [Auth0::Types::SearchClientsResponseContent]
+      def search(request_options: {}, **params)
+        params = Auth0::Internal::Types::Utils.normalize_keys(params)
+        query_params = {}
+        query_params["q"] = params[:q] if params.key?(:q)
+        query_params["parser"] = params[:parser] if params.key?(:parser)
+        query_params["fields"] = params[:fields] if params.key?(:fields)
+        query_params["include_fields"] = params[:include_fields] if params.key?(:include_fields)
+        query_params["take"] = params.fetch(:take, 50)
+        query_params["from"] = params[:from] if params.key?(:from)
+        query_params["sort"] = params[:sort] if params.key?(:sort)
+
+        Auth0::Internal::CursorItemIterator.new(
+          cursor_field: :next_,
+          item_field: :clients,
+          initial_cursor: query_params["from"]
+        ) do |next_cursor|
+          query_params["from"] = next_cursor
+          request = Auth0::Internal::JSON::Request.new(
+            base_url: request_options[:base_url],
+            method: "GET",
+            path: "clients/search",
+            query: query_params,
+            request_options: request_options
+          )
+          begin
+            response = @client.send(request)
+          rescue Net::HTTPRequestTimeout
+            raise Auth0::Errors::TimeoutError
+          end
+          code = response.code.to_i
+          if code.between?(200, 299)
+            parsed_response = (response.body.to_s.empty? ? nil : Auth0::Types::SearchClientsResponseContent.load(response.body))
+            [parsed_response, response]
+          else
+            error_class = Auth0::Errors::ResponseError.subclass_for_code(code)
+            raise error_class.new(response.body, code: code)
+          end
+        end
+      end
+
       # Retrieve client details by ID. Clients are SSO connections or Applications linked with your Auth0 tenant. A list
       # of fields to include or exclude may also be specified.
       # For more information, read [Applications in Auth0](https://www.auth0.com/docs/get-started/applications) and

data/lib/auth0/clients/types/create_client_request_content.rb

@@ -108,6 +108,8 @@ module Auth0
 
         field :anonymous_sessions, -> { Auth0::Types::CreateAnonymousSessions }, optional: true, nullable: false
 
+        field :enforce_anon_session_transfer_network_binding, -> { Auth0::Types::ClientAnonymousSessionTransferNetworkBindingEnum }, optional: true, nullable: false
+
         field :third_party_security_mode, -> { Auth0::Types::ClientThirdPartySecurityModeEnum }, optional: true, nullable: false
 
         field :redirection_policy, -> { Auth0::Types::ClientRedirectionPolicyEnum }, optional: true, nullable: false
@@ -120,6 +122,8 @@ module Auth0
 
         field :async_approval_notification_channels, -> { Internal::Types::Array[Auth0::Types::AsyncApprovalNotificationsChannelsEnum] }, optional: true, nullable: false
 
+        field :agent_id, -> { String }, optional: true, nullable: false
+
         field :oidc_support, -> { Auth0::Types::ClientOidcSupportPost }, optional: true, nullable: false
       end
     end

data/lib/auth0/clients/types/list_clients_request_parameters.rb

@@ -22,6 +22,8 @@ module Auth0
 
         field :external_client_id, -> { String }, optional: true, nullable: false
 
+        field :agent_id, -> { String }, optional: true, nullable: false
+
         field :q, -> { String }, optional: true, nullable: false
       end
     end

data/lib/auth0/clients/types/search_clients_request_parameters.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+module Auth0
+  module Clients
+    module Types
+      class SearchClientsRequestParameters < Internal::Types::Model
+        field :q, -> { String }, optional: true, nullable: false
+
+        field :parser, -> { Auth0::Types::SearchParserEnum }, optional: true, nullable: false
+
+        field :fields, -> { String }, optional: true, nullable: false
+
+        field :include_fields, -> { Internal::Types::Boolean }, optional: true, nullable: false
+
+        field :take, -> { Integer }, optional: true, nullable: false
+
+        field :from, -> { String }, optional: true, nullable: false
+
+        field :sort, -> { Auth0::Types::ClientSortFieldEnum }, optional: true, nullable: false
+      end
+    end
+  end
+end

data/lib/auth0/clients/types/update_client_request_content.rb

@@ -68,6 +68,8 @@ module Auth0
 
         field :anonymous_sessions, -> { Auth0::Types::UpdateAnonymousSessions }, optional: true, nullable: false
 
+        field :enforce_anon_session_transfer_network_binding, -> { Auth0::Types::ClientAnonymousSessionTransferNetworkBindingEnum }, optional: true, nullable: false
+
         field :form_template, -> { String }, optional: true, nullable: false
 
         field :addons, -> { Auth0::Types::ClientAddons }, optional: true, nullable: false
@@ -121,6 +123,10 @@ module Auth0
         field :third_party_security_mode, -> { Auth0::Types::ClientThirdPartySecurityModeEnum }, optional: true, nullable: false
 
         field :redirection_policy, -> { Auth0::Types::ClientRedirectionPolicyEnum }, optional: true, nullable: false
+
+        field :agent_id, -> { String }, optional: true, nullable: false
+
+        field :oidc_support, -> { Auth0::Types::ClientOidcSupportPatch }, optional: true, nullable: false
       end
     end
   end

data/lib/auth0/connections/keys/client.rb

@@ -11,7 +11,7 @@ module Auth0
           @client = client
         end
 
-        # Gets the connection keys for the Okta or OIDC connection strategy.
+        # Gets the connection keys for the Okta, OIDC, or SAML (samlp) connection strategy.
         #
         # @param request_options [Hash]
         # @param params [Hash]
@@ -48,9 +48,9 @@ module Auth0
           end
         end
 
-        # Provision initial connection keys for Okta or OIDC connection strategies. This endpoint allows you to create
-        # keys before configuring the connection to use Private Key JWT authentication, enabling zero-downtime
-        # transitions.
+        # Provision initial connection keys for Okta, OIDC, or SAML (samlp) connection strategies. This endpoint allows
+        # you to create keys before configuring the connection to use Private Key JWT authentication, enabling
+        # zero-downtime transitions.
         #
         # @param request_options [Hash]
         # @param params [Hash]
@@ -94,7 +94,7 @@ module Auth0
           end
         end
 
-        # Rotates the connection keys for the Okta or OIDC connection strategies.
+        # Rotates the connection keys for the Okta, OIDC, or SAML (samlp) connection strategies.
         #
         # @param request_options [Hash]
         # @param params [Hash]

data/lib/auth0/email_templates/client.rb

@@ -21,7 +21,14 @@ module Auth0
       # @option request_options [Integer] :timeout_in_seconds
       #
       # @example
-      #   client.email_templates.create(template: "verify_email")
+      #   client.email_templates.create(
+      #     template: "verify_email",
+      #     body: nil,
+      #     from: nil,
+      #     subject: nil,
+      #     syntax: nil,
+      #     enabled: nil
+      #   )
       #
       # @return [Auth0::Types::CreateEmailTemplateResponseContent]
       def create(request_options: {}, **params)
@@ -101,7 +108,12 @@ module Auth0
       # @example
       #   client.email_templates.set(
       #     template_name: "verify_email",
-      #     template: "verify_email"
+      #     template: "verify_email",
+      #     body: nil,
+      #     from: nil,
+      #     subject: nil,
+      #     syntax: nil,
+      #     enabled: nil
       #   )
       #
       # @return [Auth0::Types::SetEmailTemplateResponseContent]

data/lib/auth0/experimentation/experiments/client.rb

@@ -88,7 +88,8 @@ module Auth0
         #   client.experimentation.experiments.create(
         #     name: "name",
         #     feature_flag_id: "feature_flag_id",
-        #     authentication_flow: "authentication"
+        #     authentication_flow: "authentication",
+        #     allocation_strategy: "percentage"
         #   )
         #
         # @return [Auth0::Types::CreateExperimentResponseContent]
@@ -278,52 +279,6 @@ module Auth0
           end
         end
 
-        # Transitions an experiment through its lifecycle: draft → active, active → paused, paused → active,
-        # active/paused → completed. Activation runs full readiness validation.
-        #
-        # @param request_options [Hash]
-        # @param params [Auth0::Experimentation::Experiments::Types::UpdateExperimentStatusRequestContent]
-        # @option request_options [String] :base_url
-        # @option request_options [Hash{String => Object}] :additional_headers
-        # @option request_options [Hash{String => Object}] :additional_query_parameters
-        # @option request_options [Hash{String => Object}] :additional_body_parameters
-        # @option request_options [Integer] :timeout_in_seconds
-        # @option params [String] :id
-        #
-        # @example
-        #   client.experimentation.experiments.update_status(
-        #     id: "id",
-        #     status: "active"
-        #   )
-        #
-        # @return [Auth0::Types::UpdateExperimentStatusResponseContent]
-        def update_status(request_options: {}, **params)
-          params = Auth0::Internal::Types::Utils.normalize_keys(params)
-          request_data = Auth0::Experimentation::Experiments::Types::UpdateExperimentStatusRequestContent.new(params).to_h
-          non_body_param_names = %w[id]
-          body = request_data.except(*non_body_param_names)
-
-          request = Auth0::Internal::JSON::Request.new(
-            base_url: request_options[:base_url],
-            method: "POST",
-            path: "experimentation/experiments/#{URI.encode_uri_component(params[:id].to_s)}/status",
-            body: body,
-            request_options: request_options
-          )
-          begin
-            response = @client.send(request)
-          rescue Net::HTTPRequestTimeout
-            raise Auth0::Errors::TimeoutError
-          end
-          code = response.code.to_i
-          if code.between?(200, 299)
-            (response.body.to_s.empty? ? nil : Auth0::Types::UpdateExperimentStatusResponseContent.load(response.body))
-          else
-            error_class = Auth0::Errors::ResponseError.subclass_for_code(code)
-            raise error_class.new(response.body, code: code)
-          end
-        end
-
         # Checks whether an experiment is ready to be activated. Returns is_valid boolean and an errors array describing
         # any blockers. Read-only; no state is modified.
         #

data/lib/auth0/experimentation/experiments/types/create_experiment_request_content.rb

@@ -15,7 +15,7 @@ module Auth0
 
           field :default_config, -> { Auth0::Types::DefaultConfigEnum }, optional: true, nullable: false
 
-          field :allocation_strategy, -> { Auth0::Types::AllocationStrategyEnum }, optional: true, nullable: false
+          field :allocation_strategy, -> { Auth0::Types::AllocationStrategyEnum }, optional: false, nullable: false
 
           field :allocations, -> { Internal::Types::Array[Auth0::Types::AllocationRequestItem] }, optional: true, nullable: false
 

data/lib/auth0/experimentation/experiments/types/update_experiment_request_parameters.rb

@@ -18,6 +18,8 @@ module Auth0
           field :default_config, -> { Auth0::Types::DefaultConfigEnum }, optional: true, nullable: false
 
           field :levels, -> { Internal::Types::Array[Integer] }, optional: true, nullable: false
+
+          field :status, -> { Auth0::Types::ExperimentTransitionStatusEnum }, optional: true, nullable: false
         end
       end
     end

data/lib/auth0/experimentation/feature_flags/client.rb

@@ -225,51 +225,6 @@ module Auth0
           end
         end
 
-        # Transitions a feature flag through its lifecycle states: draft → active, draft → archived, active → archived.
-        #
-        # @param request_options [Hash]
-        # @param params [Auth0::Experimentation::FeatureFlags::Types::UpdateFeatureFlagStatusRequestContent]
-        # @option request_options [String] :base_url
-        # @option request_options [Hash{String => Object}] :additional_headers
-        # @option request_options [Hash{String => Object}] :additional_query_parameters
-        # @option request_options [Hash{String => Object}] :additional_body_parameters
-        # @option request_options [Integer] :timeout_in_seconds
-        # @option params [String] :id
-        #
-        # @example
-        #   client.experimentation.feature_flags.update_status(
-        #     id: "id",
-        #     status: "draft"
-        #   )
-        #
-        # @return [Auth0::Types::UpdateFeatureFlagStatusResponseContent]
-        def update_status(request_options: {}, **params)
-          params = Auth0::Internal::Types::Utils.normalize_keys(params)
-          request_data = Auth0::Experimentation::FeatureFlags::Types::UpdateFeatureFlagStatusRequestContent.new(params).to_h
-          non_body_param_names = %w[id]
-          body = request_data.except(*non_body_param_names)
-
-          request = Auth0::Internal::JSON::Request.new(
-            base_url: request_options[:base_url],
-            method: "POST",
-            path: "experimentation/feature-flags/#{URI.encode_uri_component(params[:id].to_s)}/status",
-            body: body,
-            request_options: request_options
-          )
-          begin
-            response = @client.send(request)
-          rescue Net::HTTPRequestTimeout
-            raise Auth0::Errors::TimeoutError
-          end
-          code = response.code.to_i
-          if code.between?(200, 299)
-            (response.body.to_s.empty? ? nil : Auth0::Types::UpdateFeatureFlagStatusResponseContent.load(response.body))
-          else
-            error_class = Auth0::Errors::ResponseError.subclass_for_code(code)
-            raise error_class.new(response.body, code: code)
-          end
-        end
-
         # @return [Auth0::Variations::Client]
         def variations
           @variations ||= Auth0::Experimentation::FeatureFlags::Variations::Client.new(client: @client)

data/lib/auth0/experimentation/feature_flags/types/update_feature_flag_request_content.rb

@@ -12,6 +12,8 @@ module Auth0
           field :description, -> { String }, optional: true, nullable: false
 
           field :parameters, -> { Internal::Types::Hash[String, Auth0::Types::FeatureFlagConfigParam] }, optional: true, nullable: false
+
+          field :status, -> { Auth0::Types::FeatureFlagStatusEnum }, optional: true, nullable: false
         end
       end
     end

data/lib/auth0/experimentation/segments/client.rb

@@ -23,12 +23,14 @@ module Auth0
         # @option params [String, nil] :from
         # @option params [Integer, nil] :take
         # @option params [Auth0::Types::SegmentTypeFilterEnum, nil] :type
+        # @option params [Auth0::Types::SegmentStatusEnum, nil] :status
         #
         # @example
         #   client.experimentation.segments.list(
         #     from: "from",
         #     take: 1,
-        #     type: "auth0"
+        #     type: "auth0",
+        #     status: "active"
         #   )
         #
         # @return [Auth0::Types::ListSegmentsResponseContent]
@@ -38,6 +40,7 @@ module Auth0
           query_params["from"] = params[:from] if params.key?(:from)
           query_params["take"] = params.fetch(:take, 50)
           query_params["type"] = params[:type] if params.key?(:type)
+          query_params["status"] = params[:status] if params.key?(:status)
 
           Auth0::Internal::CursorItemIterator.new(
             cursor_field: :next_,

data/lib/auth0/experimentation/segments/types/list_segments_request_parameters.rb

@@ -10,6 +10,8 @@ module Auth0
           field :take, -> { Integer }, optional: true, nullable: false
 
           field :type, -> { Auth0::Types::SegmentTypeFilterEnum }, optional: true, nullable: false
+
+          field :status, -> { Auth0::Types::SegmentStatusEnum }, optional: true, nullable: false
         end
       end
     end

data/lib/auth0/experimentation/segments/types/update_segment_request_content.rb

@@ -12,6 +12,8 @@ module Auth0
           field :description, -> { String }, optional: true, nullable: false
 
           field :rules, -> { Internal::Types::Array[Auth0::Types::SegmentRule] }, optional: true, nullable: false
+
+          field :status, -> { Auth0::Types::SegmentStatusEnum }, optional: true, nullable: false
         end
       end
     end

data/lib/auth0/internal/http/rate_limit.rb

@@ -0,0 +1,103 @@
+# frozen_string_literal: true
+
+module Auth0
+  module Internal
+    module Http
+      # Rate limit information parsed from the `x-ratelimit-*` headers Auth0
+      # returns on API responses.
+      #
+      # @see https://auth0.com/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy
+      class RateLimit
+        # @return [Integer, nil] the maximum number of requests allowed in the current window
+        attr_reader :limit
+        # @return [Integer, nil] the number of requests remaining in the current window
+        attr_reader :remaining
+        # @return [Time, nil] the UTC time at which the current window resets
+        attr_reader :reset
+
+        # @param limit [Integer, nil]
+        # @param remaining [Integer, nil]
+        # @param reset [Time, nil]
+        def initialize(limit:, remaining:, reset:)
+          @limit = limit
+          @remaining = remaining
+          @reset = reset
+        end
+
+        # Build from an object that exposes headers via `#[]` using the HTTP
+        # header name (e.g. a `Net::HTTPResponse`, whose `#[]` is
+        # case-insensitive). Used by the Management API (RawClient) path.
+        #
+        # @param response [#[]] responds to `[]` with header access
+        # @return [Auth0::Internal::Http::RateLimit]
+        def self.from_http_response(response)
+          build(
+            response["x-ratelimit-limit"],
+            response["x-ratelimit-remaining"],
+            response["x-ratelimit-reset"]
+          )
+        end
+
+        # Build from a plain headers hash (e.g. RestClient's, whose keys are
+        # symbols like `:x_ratelimit_remaining`). Keys are matched
+        # case-insensitively and dash/underscore-agnostically. Used by the
+        # Authentication API (HTTPProxy) path.
+        #
+        # @param headers [Hash, nil]
+        # @return [Auth0::Internal::Http::RateLimit]
+        def self.from_headers(headers)
+          normalized = (headers || {}).each_with_object({}) do |(key, value), acc|
+            acc[key.to_s.downcase.tr("-", "_")] = value
+          end
+
+          build(
+            normalized["x_ratelimit_limit"],
+            normalized["x_ratelimit_remaining"],
+            normalized["x_ratelimit_reset"]
+          )
+        end
+
+        # Invokes the handler with the given rate limit. A handler error must
+        # never break the caller's request, so it is rescued and warned rather
+        # than raised. Parsing happens before this call, so a parsing bug is not
+        # misattributed to the handler.
+        #
+        # @param handler [#call, nil] the configured rate limit handler
+        # @param rate_limit [Auth0::Internal::Http::RateLimit]
+        # @return [void]
+        def self.deliver(handler, rate_limit)
+          return if handler.nil?
+
+          handler.call(rate_limit)
+        rescue StandardError => e
+          warn "[auth0] rate_limit_handler raised #{e.class}: #{e.message}"
+        end
+
+        # @param limit [String, nil] raw `x-ratelimit-limit` value
+        # @param remaining [String, nil] raw `x-ratelimit-remaining` value
+        # @param reset [String, nil] raw `x-ratelimit-reset` value
+        # @return [Auth0::Internal::Http::RateLimit]
+        def self.build(limit, remaining, reset)
+          reset_epoch = to_integer(reset)
+
+          new(
+            limit: to_integer(limit),
+            remaining: to_integer(remaining),
+            reset: reset_epoch.nil? ? nil : Time.at(reset_epoch).utc
+          )
+        end
+        private_class_method :build
+
+        # Parse an integer header value, returning nil for blank or non-numeric
+        # input (so a malformed header is never silently reported as 0).
+        #
+        # @param value [String, nil] the raw header value
+        # @return [Integer, nil]
+        def self.to_integer(value)
+          Integer(value.to_s.strip, exception: false)
+        end
+        private_class_method :to_integer
+      end
+    end
+  end
+end

data/lib/auth0/internal/http/raw_client.rb

@@ -3,6 +3,8 @@
 # This file was auto-generated by Fern from our API Definition.
 # Modified by Auth0 to use Auth0 telemetry format with dynamic versioning.
 
+require_relative "rate_limit"
+
 module Auth0
   module Internal
     module Http
@@ -20,14 +22,21 @@ module Auth0
         # @return [String] The base URL for requests
         attr_reader :base_url
 
+        # @return [#call, nil] Optional callback invoked with an
+        #   {Auth0::Internal::Http::RateLimit} after every response.
+        attr_accessor :rate_limit_handler
+
         # @param base_url [String] The base url for the request.
         # @param max_retries [Integer] The number of times to retry a failed request, defaults to 2.
         # @param timeout [Float] The timeout for the request, defaults to 60.0 seconds.
         # @param headers [Hash] The headers for the request.
-        def initialize(base_url:, max_retries: 2, timeout: 60.0, headers: {})
+        # @param rate_limit_handler [#call, nil] Optional callback invoked with the
+        #   parsed rate limit (from the `x-ratelimit-*` headers) after every response.
+        def initialize(base_url:, max_retries: 2, timeout: 60.0, headers: {}, rate_limit_handler: nil)
           @base_url = base_url
           @max_retries = max_retries
           @timeout = timeout
+          @rate_limit_handler = rate_limit_handler
 
           # Auth0 telemetry in standard format
           telemetry = {
@@ -45,7 +54,7 @@ module Auth0
         end
 
         # @param request [Auth0::Internal::Http::BaseRequest] The HTTP request.
-        # @return [HTTP::Response] The HTTP response.
+        # @return [Net::HTTPResponse] The HTTP response.
         def send(request)
           url = build_url(request)
           attempt = 0
@@ -67,6 +76,9 @@ module Auth0
 
             response = conn.request(http_request)
 
+            # Report rate limit on every response, including retried 429s.
+            RateLimit.deliver(@rate_limit_handler, RateLimit.from_http_response(response)) if @rate_limit_handler
+
             break unless should_retry?(response, attempt)
 
             delay = retry_delay(response, attempt)

data/lib/auth0/internal/types/model.rb

@@ -141,13 +141,22 @@ module Auth0
           values = Utils.symbolize_keys(values.dup)
 
           self.class.fields.each do |field_name, field|
-            value = values.delete(field.api_name.to_sym) || values.delete(field.api_name) || values.delete(field_name)
+            # key?/nil? checks keep an explicit `false`, and both keys are consumed so neither leaks into extra fields
+            value = nil
+            [field.api_name.to_sym, field_name].uniq.each do |key|
+              next unless values.key?(key)
 
-            field_value = value || (if field.literal?
-                                      field.value
-                                    elsif field.default
-                                      field.default
-                                    end)
+              candidate = values.delete(key)
+              value = candidate if value.nil?
+            end
+
+            field_value = if !value.nil?
+                            value
+                          elsif field.literal?
+                            field.value
+                          elsif !field.default.nil?
+                            field.default
+                          end
 
             @data[field_name] = Utils.coerce(field.type, field_value)
           end