clerk-sdk-ruby 8.0.0 → 8.0.1

data/lib/clerk/models/operations/updateoauthapplication_requestbody.rb

@@ -21,24 +21,27 @@ module Clerk
         #
         # @deprecated true: This will be removed in a future release, please migrate away from it as soon as possible.
         field :callback_url, Crystalline::Nilable.new(::String), { 'format_json': { 'letter_case': ::Clerk::Utils.field_name('callback_url') } }
+        # Replace the application's complete built-in and custom scope ceiling. Provide scope keys as a space-delimited string. Custom keys must exist in the instance OAuth scope catalog. Required built-in scopes, such as `offline_access`, must be included in the replacement set, otherwise the request is rejected. Omit this field to leave all scope assignments unchanged.
+        field :scopes, Crystalline::Nilable.new(::String), { 'format_json': { 'letter_case': ::Clerk::Utils.field_name('scopes') } }
         # True to enable a consent screen to display in the authentication flow. This cannot be disabled for dynamically registered OAuth Applications.
         field :consent_screen_enabled, Crystalline::Nilable.new(Crystalline::Boolean.new), { 'format_json': { 'letter_case': ::Clerk::Utils.field_name('consent_screen_enabled') } }
         # True to require the Proof Key of Code Exchange (PKCE) flow.
         field :pkce_required, Crystalline::Nilable.new(Crystalline::Boolean.new), { 'format_json': { 'letter_case': ::Clerk::Utils.field_name('pkce_required') } }
+        # True to enable the OAuth Device Authorization Grant for this application. Enabling requires the new OAuth IdP and a reachable device verification page. Omit this field to leave the setting unchanged.
+        field :device_authorization_grant_enabled, Crystalline::Nilable.new(Crystalline::Boolean.new), { 'format_json': { 'letter_case': ::Clerk::Utils.field_name('device_authorization_grant_enabled') } }
         # If true, this client is public and you can use the Proof Key of Code Exchange (PKCE) flow.
         field :public, Crystalline::Nilable.new(Crystalline::Boolean.new), { 'format_json': { 'letter_case': ::Clerk::Utils.field_name('public') } }
-        # Define the allowed scopes for the new OAuth applications that dictate the user payload of the OAuth user info endpoint. Available scopes are `profile`, `email`, `public_metadata`, `private_metadata`. Provide the requested scopes as a string, separated by spaces.
-        field :scopes, Crystalline::Nilable.new(::String), { 'format_json': { 'letter_case': ::Clerk::Utils.field_name('scopes') } }
 
         
-        def initialize(name: nil, redirect_uris: nil, callback_url: nil, consent_screen_enabled: nil, pkce_required: nil, public: nil, scopes: 'profile email')
+        def initialize(name: nil, redirect_uris: nil, callback_url: nil, scopes: nil, consent_screen_enabled: nil, pkce_required: nil, device_authorization_grant_enabled: nil, public: nil)
           @name = name
           @redirect_uris = redirect_uris
           @callback_url = callback_url
+          @scopes = scopes
           @consent_screen_enabled = consent_screen_enabled
           @pkce_required = pkce_required
+          @device_authorization_grant_enabled = device_authorization_grant_enabled
           @public = public
-          @scopes = scopes
         end
 
         
@@ -47,10 +50,11 @@ module Clerk
           return false unless @name == other.name
           return false unless @redirect_uris == other.redirect_uris
           return false unless @callback_url == other.callback_url
+          return false unless @scopes == other.scopes
           return false unless @consent_screen_enabled == other.consent_screen_enabled
           return false unless @pkce_required == other.pkce_required
+          return false unless @device_authorization_grant_enabled == other.device_authorization_grant_enabled
           return false unless @public == other.public
-          return false unless @scopes == other.scopes
           true
         end
       end

data/lib/clerk/models/operations/updateoauthapplication_requestbody.rbi

@@ -14,12 +14,14 @@ class Clerk::Models::Operations::UpdateOAuthApplicationRequestBody
   def redirect_uris=(str_); end
   def callback_url(); end
   def callback_url=(str_); end
+  def scopes(); end
+  def scopes=(str_); end
   def consent_screen_enabled(); end
   def consent_screen_enabled=(str_); end
   def pkce_required(); end
   def pkce_required=(str_); end
+  def device_authorization_grant_enabled(); end
+  def device_authorization_grant_enabled=(str_); end
   def public(); end
   def public=(str_); end
-  def scopes(); end
-  def scopes=(str_); end
 end

data/lib/clerk/models/operations/updateorganization_requestbody.rb

@@ -22,17 +22,21 @@ module Clerk
         field :max_allowed_memberships, Crystalline::Nilable.new(::Integer), { 'format_json': { 'letter_case': ::Clerk::Utils.field_name('max_allowed_memberships') } }
         # If true, an admin can delete this organization with the Frontend API.
         field :admin_delete_enabled, Crystalline::Nilable.new(Crystalline::Boolean.new), { 'format_json': { 'letter_case': ::Clerk::Utils.field_name('admin_delete_enabled') } }
+        # Whether this organization can configure self-serve enterprise SSO.
+        # Requires the instance to have the self-serve SSO entitlement enabled.
+        field :self_serve_sso_enabled, Crystalline::Nilable.new(Crystalline::Boolean.new), { 'format_json': { 'letter_case': ::Clerk::Utils.field_name('self_serve_sso_enabled') } }
         # A custom date/time denoting _when_ the organization was created, specified in RFC3339 format (e.g. `2012-10-20T07:15:20.902Z`).
         field :created_at, Crystalline::Nilable.new(::String), { 'format_json': { 'letter_case': ::Clerk::Utils.field_name('created_at') } }
         # The key of the [role set](https://clerk.com/docs/guides/organizations/control-access/role-sets) to assign to this organization.
         field :role_set_key, Crystalline::Nilable.new(::String), { 'format_json': { 'letter_case': ::Clerk::Utils.field_name('role_set_key') } }
 
         
-        def initialize(name: nil, slug: nil, max_allowed_memberships: nil, admin_delete_enabled: nil, created_at: nil, role_set_key: nil)
+        def initialize(name: nil, slug: nil, max_allowed_memberships: nil, admin_delete_enabled: nil, self_serve_sso_enabled: nil, created_at: nil, role_set_key: nil)
           @name = name
           @slug = slug
           @max_allowed_memberships = max_allowed_memberships
           @admin_delete_enabled = admin_delete_enabled
+          @self_serve_sso_enabled = self_serve_sso_enabled
           @created_at = created_at
           @role_set_key = role_set_key
         end
@@ -44,6 +48,7 @@ module Clerk
           return false unless @slug == other.slug
           return false unless @max_allowed_memberships == other.max_allowed_memberships
           return false unless @admin_delete_enabled == other.admin_delete_enabled
+          return false unless @self_serve_sso_enabled == other.self_serve_sso_enabled
           return false unless @created_at == other.created_at
           return false unless @role_set_key == other.role_set_key
           true

data/lib/clerk/models/operations/updateorganization_requestbody.rbi

@@ -16,6 +16,8 @@ class Clerk::Models::Operations::UpdateOrganizationRequestBody
   def max_allowed_memberships=(str_); end
   def admin_delete_enabled(); end
   def admin_delete_enabled=(str_); end
+  def self_serve_sso_enabled(); end
+  def self_serve_sso_enabled=(str_); end
   def created_at(); end
   def created_at=(str_); end
   def role_set_key(); end

data/lib/clerk/models/operations/updatescimdirectory_request.rb

@@ -12,7 +12,7 @@ module Clerk
         
         include Crystalline::MetadataFields
 
-        # The ID of the SCIM directory to update
+        # The ID of the directory to update
         field :scim_directory_id, ::String, { 'path_param': { 'field_name': 'scim_directory_id', 'style': 'simple', 'explode': false } }
 
         field :body, Crystalline::Nilable.new(Models::Operations::UpdateSCIMDirectoryRequestBody), { 'request': { 'media_type': 'application/json' } }

data/lib/clerk/models/operations/updatescimdirectory_requestbody.rb

@@ -12,16 +12,16 @@ module Clerk
         
         include Crystalline::MetadataFields
 
-        # A human-friendly name for the SCIM directory.
+        # A human-friendly name for the directory.
         field :name, Crystalline::Nilable.new(::String), { 'format_json': { 'letter_case': ::Clerk::Utils.field_name('name') } }
-        # Whether the SCIM directory is enabled.
+        # Whether the directory is enabled.
         field :enabled, Crystalline::Nilable.new(Crystalline::Boolean.new), { 'format_json': { 'letter_case': ::Clerk::Utils.field_name('enabled') } }
-        # The identity provider for this SCIM directory.
+        # The identity provider for this directory.
         field :provider, Crystalline::Nilable.new(::String), { 'format_json': { 'letter_case': ::Clerk::Utils.field_name('provider') } }
         # Attribute-to-SCIM-path entries to merge into the directory's attribute mapping.
         # Set a key to `null` to remove it from the mapping.
         field :attribute_mapping, Crystalline::Nilable.new(Crystalline::Hash.new(Symbol, ::String)), { 'format_json': { 'letter_case': ::Clerk::Utils.field_name('attribute_mapping') } }
-        # Whether group-to-role mapping is enabled for this SCIM directory.
+        # Whether group-to-role mapping is enabled for this directory.
         field :group_role_mapping_enabled, Crystalline::Nilable.new(Crystalline::Boolean.new), { 'format_json': { 'letter_case': ::Clerk::Utils.field_name('group_role_mapping_enabled') } }
 
         

data/lib/clerk/models/operations/updatescimdirectory_response.rb

@@ -18,7 +18,7 @@ module Clerk
         field :status_code, ::Integer
         # Raw HTTP response; suitable for custom response parsing
         field :raw_response, ::Faraday::Response
-        # A SCIM directory
+        # A directory
         field :scim_directory, Crystalline::Nilable.new(Models::Components::SCIMDirectory)
 
         

data/lib/clerk/models/operations/updateuser_requestbody.rb

@@ -72,7 +72,7 @@ module Clerk
         field :create_organizations_limit, Crystalline::Nilable.new(::Integer), { 'format_json': { 'letter_case': ::Clerk::Utils.field_name('create_organizations_limit') } }
         # A custom date/time denoting _when_ the user signed up to the application.
         field :created_at, Crystalline::Nilable.new(::String), { 'format_json': { 'letter_case': ::Clerk::Utils.field_name('created_at') } }
-        # When set to `true`, the user will bypass client trust checks during sign-in.
+        # When set to `true`, the user will bypass Device Trust checks during sign-in.
         field :bypass_client_trust, Crystalline::Nilable.new(Crystalline::Boolean.new), { 'format_json': { 'letter_case': ::Clerk::Utils.field_name('bypass_client_trust') } }
         # If set to `true`, the user will be notified that their primary email address has changed.
         # By default, no notification is sent.

data/lib/clerk/models/operations.rb

@@ -15,6 +15,8 @@ module Clerk
       autoload :AdjustOrganizationBillingCreditBalanceResponse, 'clerk/models/operations/adjustorganizationbillingcreditbalance_response.rb'
       autoload :AdjustUserBillingCreditBalanceRequest, 'clerk/models/operations/adjustuserbillingcreditbalance_request.rb'
       autoload :AdjustUserBillingCreditBalanceResponse, 'clerk/models/operations/adjustuserbillingcreditbalance_response.rb'
+      autoload :ApplyBillingSubscriptionItemDiscountRequest, 'clerk/models/operations/applybillingsubscriptionitemdiscount_request.rb'
+      autoload :ApplyBillingSubscriptionItemDiscountResponse, 'clerk/models/operations/applybillingsubscriptionitemdiscount_response.rb'
       autoload :AssignPermissionToOrganizationRoleRequest, 'clerk/models/operations/assignpermissiontoorganizationrole_request.rb'
       autoload :AssignPermissionToOrganizationRoleResponse, 'clerk/models/operations/assignpermissiontoorganizationrole_response.rb'
       autoload :AttemptEmailAddressVerificationRequestBody, 'clerk/models/operations/attemptemailaddressverification_requestbody.rb'
@@ -46,6 +48,12 @@ module Clerk
       autoload :CreateBulkInvitationsTemplateSlug, 'clerk/models/operations/createbulkinvitations_template_slug.rb'
       autoload :CreateBulkWaitlistEntriesRequestBody, 'clerk/models/operations/createbulkwaitlistentries_requestbody.rb'
       autoload :CreateBulkWaitlistEntriesResponse, 'clerk/models/operations/createbulkwaitlistentries_response.rb'
+      autoload :CreateDirectoryGroupRoleMappingRequestBody, 'clerk/models/operations/createdirectorygrouprolemapping_requestbody.rb'
+      autoload :CreateDirectoryGroupRoleMappingRequest, 'clerk/models/operations/createdirectorygrouprolemapping_request.rb'
+      autoload :CreateDirectoryGroupRoleMappingResponse, 'clerk/models/operations/createdirectorygrouprolemapping_response.rb'
+      autoload :CreateDirectoryGroupRoleMapping, 'clerk/models/operations/createdirectory_group_role_mapping.rb'
+      autoload :CreateDirectoryRequest, 'clerk/models/operations/createdirectory_request.rb'
+      autoload :CreateDirectoryResponse, 'clerk/models/operations/createdirectory_response.rb'
       autoload :CreateEmailAddressRequest, 'clerk/models/operations/createemailaddress_request.rb'
       autoload :CreateEmailAddressResponse, 'clerk/models/operations/createemailaddress_response.rb'
       autoload :CreateEnterpriseConnectionTestRunRequest, 'clerk/models/operations/createenterpriseconnectiontestrun_request.rb'
@@ -109,6 +117,7 @@ module Clerk
       autoload :CreateSAMLConnectionProvider2, 'clerk/models/operations/createsamlconnection_provider_2.rb'
       autoload :CreateSAMLConnectionRequest, 'clerk/models/operations/createsamlconnection_request.rb'
       autoload :CreateSAMLConnectionResponse, 'clerk/models/operations/createsamlconnection_response.rb'
+      autoload :CreateSCIMDirectoryGroupRoleMapping, 'clerk/models/operations/createscimdirectory_group_role_mapping.rb'
       autoload :CreateSCIMDirectoryRequest, 'clerk/models/operations/createscimdirectory_request.rb'
       autoload :CreateSCIMDirectoryResponse, 'clerk/models/operations/createscimdirectory_response.rb'
       autoload :CreateSCIMGroupRoleMappingRequestBody, 'clerk/models/operations/createscimgrouprolemapping_requestbody.rb'
@@ -139,6 +148,10 @@ module Clerk
       autoload :DeleteBackupCodeResponse, 'clerk/models/operations/deletebackupcode_response.rb'
       autoload :DeleteBlocklistIdentifierRequest, 'clerk/models/operations/deleteblocklistidentifier_request.rb'
       autoload :DeleteBlocklistIdentifierResponse, 'clerk/models/operations/deleteblocklistidentifier_response.rb'
+      autoload :DeleteDirectoryGroupRoleMappingRequest, 'clerk/models/operations/deletedirectorygrouprolemapping_request.rb'
+      autoload :DeleteDirectoryGroupRoleMappingResponse, 'clerk/models/operations/deletedirectorygrouprolemapping_response.rb'
+      autoload :DeleteDirectoryRequest, 'clerk/models/operations/deletedirectory_request.rb'
+      autoload :DeleteDirectoryResponse, 'clerk/models/operations/deletedirectory_response.rb'
       autoload :DeleteDomainRequest, 'clerk/models/operations/deletedomain_request.rb'
       autoload :DeleteDomainResponse, 'clerk/models/operations/deletedomain_response.rb'
       autoload :DeleteEmailAddressRequest, 'clerk/models/operations/deleteemailaddress_request.rb'
@@ -212,6 +225,8 @@ module Clerk
       autoload :GetCommerceSubscriptionItemListRequest, 'clerk/models/operations/getcommercesubscriptionitemlist_request.rb'
       autoload :GetCommerceSubscriptionItemListResponse, 'clerk/models/operations/getcommercesubscriptionitemlist_response.rb'
       autoload :GetCommerceSubscriptionItemListStatus, 'clerk/models/operations/getcommercesubscriptionitemlist_status.rb'
+      autoload :GetDirectoryRequest, 'clerk/models/operations/getdirectory_request.rb'
+      autoload :GetDirectoryResponse, 'clerk/models/operations/getdirectory_response.rb'
       autoload :GetEmailAddressRequest, 'clerk/models/operations/getemailaddress_request.rb'
       autoload :GetEmailAddressResponse, 'clerk/models/operations/getemailaddress_response.rb'
       autoload :GetEnterpriseConnectionRequest, 'clerk/models/operations/getenterpriseconnection_request.rb'
@@ -250,6 +265,8 @@ module Clerk
       autoload :GetPublicInterstitialResponse, 'clerk/models/operations/getpublicinterstitial_response.rb'
       autoload :GetRedirectURLRequest, 'clerk/models/operations/getredirecturl_request.rb'
       autoload :GetRedirectURLResponse, 'clerk/models/operations/getredirecturl_response.rb'
+      autoload :GetReverificationRequest, 'clerk/models/operations/getreverification_request.rb'
+      autoload :GetReverificationResponse, 'clerk/models/operations/getreverification_response.rb'
       autoload :GetRoleSetRequest, 'clerk/models/operations/getroleset_request.rb'
       autoload :GetRoleSetResponse, 'clerk/models/operations/getroleset_response.rb'
       autoload :GetSAMLConnectionRequest, 'clerk/models/operations/getsamlconnection_request.rb'
@@ -289,6 +306,10 @@ module Clerk
       autoload :ListAllowlistIdentifiersRequest, 'clerk/models/operations/listallowlistidentifiers_request.rb'
       autoload :ListAllowlistIdentifiersResponse, 'clerk/models/operations/listallowlistidentifiers_response.rb'
       autoload :ListBlocklistIdentifiersResponse, 'clerk/models/operations/listblocklistidentifiers_response.rb'
+      autoload :ListDirectoriesRequest, 'clerk/models/operations/listdirectories_request.rb'
+      autoload :ListDirectoriesResponse, 'clerk/models/operations/listdirectories_response.rb'
+      autoload :ListDirectoryGroupRoleMappingsRequest, 'clerk/models/operations/listdirectorygrouprolemappings_request.rb'
+      autoload :ListDirectoryGroupRoleMappingsResponse, 'clerk/models/operations/listdirectorygrouprolemappings_response.rb'
       autoload :ListDomainsResponse, 'clerk/models/operations/listdomains_response.rb'
       autoload :ListEnterpriseConnectionTestRunsRequest, 'clerk/models/operations/listenterpriseconnectiontestruns_request.rb'
       autoload :ListEnterpriseConnectionTestRunsResponse, 'clerk/models/operations/listenterpriseconnectiontestruns_response.rb'
@@ -332,6 +353,8 @@ module Clerk
       autoload :ListSCIMDirectoriesResponse, 'clerk/models/operations/listscimdirectories_response.rb'
       autoload :ListSCIMGroupRoleMappingsRequest, 'clerk/models/operations/listscimgrouprolemappings_request.rb'
       autoload :ListSCIMGroupRoleMappingsResponse, 'clerk/models/operations/listscimgrouprolemappings_response.rb'
+      autoload :ListUserBiometricCredentialsRequest, 'clerk/models/operations/listuserbiometriccredentials_request.rb'
+      autoload :ListUserBiometricCredentialsResponse, 'clerk/models/operations/listuserbiometriccredentials_response.rb'
       autoload :ListUserTrustedDevicesRequest, 'clerk/models/operations/listusertrusteddevices_request.rb'
       autoload :ListUserTrustedDevicesResponse, 'clerk/models/operations/listusertrusteddevices_response.rb'
       autoload :ListWaitlistEntriesRequest, 'clerk/models/operations/listwaitlistentries_request.rb'
@@ -355,11 +378,17 @@ module Clerk
       autoload :RefreshSessionResponse, 'clerk/models/operations/refreshsession_response.rb'
       autoload :RejectWaitlistEntryRequest, 'clerk/models/operations/rejectwaitlistentry_request.rb'
       autoload :RejectWaitlistEntryResponse, 'clerk/models/operations/rejectwaitlistentry_response.rb'
+      autoload :RemoveBillingSubscriptionItemDiscountRequest, 'clerk/models/operations/removebillingsubscriptionitemdiscount_request.rb'
+      autoload :RemoveBillingSubscriptionItemDiscountResponse, 'clerk/models/operations/removebillingsubscriptionitemdiscount_response.rb'
       autoload :RemovePermissionFromOrganizationRoleRequest, 'clerk/models/operations/removepermissionfromorganizationrole_request.rb'
       autoload :RemovePermissionFromOrganizationRoleResponse, 'clerk/models/operations/removepermissionfromorganizationrole_response.rb'
       autoload :RemoveUserPasswordRequestBody, 'clerk/models/operations/removeuserpassword_requestbody.rb'
       autoload :RemoveUserPasswordRequest, 'clerk/models/operations/removeuserpassword_request.rb'
       autoload :RemoveUserPasswordResponse, 'clerk/models/operations/removeuserpassword_response.rb'
+      autoload :ReplaceDirectoryGroupRoleMappingsRequestBody, 'clerk/models/operations/replacedirectorygrouprolemappings_requestbody.rb'
+      autoload :ReplaceDirectoryGroupRoleMappingsMapping, 'clerk/models/operations/replacedirectorygrouprolemappings_mapping.rb'
+      autoload :ReplaceDirectoryGroupRoleMappingsRequest, 'clerk/models/operations/replacedirectorygrouprolemappings_request.rb'
+      autoload :ReplaceDirectoryGroupRoleMappingsResponse, 'clerk/models/operations/replacedirectorygrouprolemappings_response.rb'
       autoload :ReplaceOrganizationMetadataRequestBody, 'clerk/models/operations/replaceorganizationmetadata_requestbody.rb'
       autoload :ReplaceOrganizationMetadataRequest, 'clerk/models/operations/replaceorganizationmetadata_request.rb'
       autoload :ReplaceOrganizationMetadataResponse, 'clerk/models/operations/replaceorganizationmetadata_response.rb'
@@ -370,6 +399,7 @@ module Clerk
       autoload :ReplaceRoleSetRequest, 'clerk/models/operations/replaceroleset_request.rb'
       autoload :ReplaceRoleSetResponse, 'clerk/models/operations/replaceroleset_response.rb'
       autoload :ReplaceSCIMGroupRoleMappingsRequestBody, 'clerk/models/operations/replacescimgrouprolemappings_requestbody.rb'
+      autoload :ReplaceSCIMGroupRoleMappingsMapping, 'clerk/models/operations/replacescimgrouprolemappings_mapping.rb'
       autoload :ReplaceSCIMGroupRoleMappingsRequest, 'clerk/models/operations/replacescimgrouprolemappings_request.rb'
       autoload :ReplaceSCIMGroupRoleMappingsResponse, 'clerk/models/operations/replacescimgrouprolemappings_response.rb'
       autoload :ReplaceUserEmailAddressRequestBody, 'clerk/models/operations/replaceuseremailaddress_requestbody.rb'
@@ -403,8 +433,12 @@ module Clerk
       autoload :RevokeSessionResponse, 'clerk/models/operations/revokesession_response.rb'
       autoload :RevokeSignInTokenRequest, 'clerk/models/operations/revokesignintoken_request.rb'
       autoload :RevokeSignInTokenResponse, 'clerk/models/operations/revokesignintoken_response.rb'
+      autoload :RevokeUserBiometricCredentialRequest, 'clerk/models/operations/revokeuserbiometriccredential_request.rb'
+      autoload :RevokeUserBiometricCredentialResponse, 'clerk/models/operations/revokeuserbiometriccredential_response.rb'
       autoload :RevokeUserTrustedDeviceRequest, 'clerk/models/operations/revokeusertrusteddevice_request.rb'
       autoload :RevokeUserTrustedDeviceResponse, 'clerk/models/operations/revokeusertrusteddevice_response.rb'
+      autoload :RotateDirectoryAPIKeyRequest, 'clerk/models/operations/rotatedirectoryapikey_request.rb'
+      autoload :RotateDirectoryAPIKeyResponse, 'clerk/models/operations/rotatedirectoryapikey_response.rb'
       autoload :RotateMachineSecretKeyRequestBody, 'clerk/models/operations/rotatemachinesecretkey_requestbody.rb'
       autoload :RotateMachineSecretKeyRequest, 'clerk/models/operations/rotatemachinesecretkey_request.rb'
       autoload :RotateMachineSecretKeyResponse, 'clerk/models/operations/rotatemachinesecretkey_response.rb'
@@ -429,6 +463,9 @@ module Clerk
       autoload :UnlockUserResponse, 'clerk/models/operations/unlockuser_response.rb'
       autoload :UnsetUserPasswordCompromisedRequest, 'clerk/models/operations/unsetuserpasswordcompromised_request.rb'
       autoload :UnsetUserPasswordCompromisedResponse, 'clerk/models/operations/unsetuserpasswordcompromised_response.rb'
+      autoload :UpdateDirectoryRequestBody, 'clerk/models/operations/updatedirectory_requestbody.rb'
+      autoload :UpdateDirectoryRequest, 'clerk/models/operations/updatedirectory_request.rb'
+      autoload :UpdateDirectoryResponse, 'clerk/models/operations/updatedirectory_response.rb'
       autoload :UpdateDomainRequestBody, 'clerk/models/operations/updatedomain_requestbody.rb'
       autoload :UpdateDomainRequest, 'clerk/models/operations/updatedomain_request.rb'
       autoload :UpdateDomainResponse, 'clerk/models/operations/updatedomain_response.rb'
@@ -610,10 +647,8 @@ module Clerk
       autoload :GetM2MTokensObject, 'clerk/models/operations/getm2mtokens_object.rb'
       autoload :GetM2MTokensRequest, 'clerk/models/operations/getm2mtokens_request.rb'
       autoload :GetM2MTokensResponse, 'clerk/models/operations/getm2mtokens_response.rb'
-      autoload :GroupRoleMapping, 'clerk/models/operations/group_role_mapping.rb'
       autoload :IncludeInvalid, 'clerk/models/operations/include_invalid.rb'
       autoload :M2mToken, 'clerk/models/operations/m2m_token.rb'
-      autoload :Mapping, 'clerk/models/operations/mapping.rb'
       autoload :OnBehalfOf, 'clerk/models/operations/on_behalf_of.rb'
       autoload :Permissions, 'clerk/models/operations/permissions.rb'
       autoload :PhoneNumberIdentificationStatus, 'clerk/models/operations/phone_number_identification_status.rb'

data/lib/clerk/openapiclient.rb

@@ -15,7 +15,7 @@ module Clerk
   class OpenAPIClient
     
 
-    attr_accessor :miscellaneous, :jwks, :clients, :email_addresses, :phone_numbers, :sessions, :email_sms_templates, :email_and_sms_templates, :templates, :users, :invitations, :organization_invitations, :allowlist_identifiers, :blocklist_identifiers, :beta_features, :actor_tokens, :domains, :instance_settings, :webhooks, :jwt_templates, :machines, :organizations, :organization_roles, :organization_memberships, :organization_domains, :proxy_checks, :redirect_urls, :sign_in_tokens, :sign_ups, :oauth_applications, :saml_connections, :enterprise_connections, :testing_tokens, :agent_tasks, :waitlist_entries, :billing, :organization_permissions, :role_sets, :scim_directories, :admin_portal_link_tokens, :api_keys, :m2m, :oauth_access_tokens
+    attr_accessor :miscellaneous, :jwks, :clients, :email_addresses, :phone_numbers, :sessions, :email_sms_templates, :email_and_sms_templates, :templates, :users, :invitations, :organization_invitations, :allowlist_identifiers, :blocklist_identifiers, :beta_features, :actor_tokens, :domains, :instance_settings, :webhooks, :jwt_templates, :machines, :organizations, :organization_roles, :organization_memberships, :organization_domains, :proxy_checks, :redirect_urls, :sign_in_tokens, :sign_ups, :oauth_applications, :saml_connections, :enterprise_connections, :testing_tokens, :agent_tasks, :waitlist_entries, :billing, :organization_permissions, :role_sets, :scim_directories, :directories, :admin_portal_link_tokens, :api_keys, :m2m, :oauth_access_tokens
 
     # Instantiates the SDK, configuring it with the provided parameters.
     #
@@ -104,6 +104,7 @@ module Clerk
       @organization_permissions = OrganizationPermissions.new(@sdk_configuration)
       @role_sets = RoleSets.new(@sdk_configuration)
       @scim_directories = ScimDirectories.new(@sdk_configuration)
+      @directories = Directories.new(@sdk_configuration)
       @admin_portal_link_tokens = AdminPortalLinkTokens.new(@sdk_configuration)
       @api_keys = APIKeys.new(@sdk_configuration)
       @m2m = M2m.new(@sdk_configuration)

data/lib/clerk/phonenumbers.rb

@@ -802,7 +802,15 @@ module Clerk
       # backend driving its own frontend can react on every attempt — an incorrect
       # or expired code is reported through the status, not as an error. Resubmitting
       # a verification whose code was already accepted is rejected with a
-      # `verification_already_verified` error. If the code
+      # `verification_already_verified` error. If the code for this verification
+      # could not be sent (the SMS provider refused or failed the send after
+      # prepare_verification had returned), the attempt is rejected with a
+      # `verification_code_not_sent` error and no attempt is counted; call
+      # prepare_verification again to send a new code. If too many codes have been
+      # checked for this phone number recently, the attempt is rejected with a
+      # `verification_code_too_many_attempts` error and no attempt is counted; the
+      # limit is per phone number, so wait for the `Retry-After` period rather than
+      # sending a new code. If the code
       # is correct and the phone number is not already verified, it is also marked
       # as verified as a side effect (just as it would be in a frontend verification
       # flow); an already verified phone number is left unchanged. It never creates
@@ -934,7 +942,7 @@ module Clerk
         else
           raise ::Clerk::Models::Errors::APIError.new(status_code: http_response.status, body: http_response.env.response_body, raw_response: http_response), 'Unknown content type received'
         end
-      elsif Utils.match_status_code(http_response.status, ['400', '401', '403', '404'])
+      elsif Utils.match_status_code(http_response.status, ['400', '401', '403', '404', '422', '429'])
         if Utils.match_content_type(content_type, 'application/json')
           http_response = @sdk_configuration.hooks.after_success(
             hook_ctx: SDKHooks::AfterSuccessHookContext.new(

data/lib/clerk/scimdirectories.rb

@@ -42,8 +42,8 @@ module Clerk
 
     
     def list(limit: nil, offset: nil, retries: nil, timeout_ms: nil, http_headers: nil)
-      # list - List all SCIM directories
-      # Returns a list of all SCIM directories for the instance.
+      # list - List all directories
+      # Returns a list of all directories for the instance.
       request = Models::Operations::ListSCIMDirectoriesRequest.new(
         limit: limit,
         offset: offset
@@ -184,8 +184,8 @@ module Clerk
 
     
     def create(request: nil, retries: nil, timeout_ms: nil, http_headers: nil)
-      # create - Create a SCIM directory
-      # Create a new SCIM directory for the instance.
+      # create - Create a directory
+      # Create a new directory for the instance.
       url, params = @sdk_configuration.get_server_details
       base_url = Utils.template_url(url, params)
       url = "#{base_url}/scim_directories"
@@ -331,8 +331,8 @@ module Clerk
 
     
     def get(scim_directory_id:, retries: nil, timeout_ms: nil, http_headers: nil)
-      # get - Retrieve a SCIM directory
-      # Returns the details of a SCIM directory.
+      # get - Retrieve a directory
+      # Returns the details of a directory.
       request = Models::Operations::GetSCIMDirectoryRequest.new(
         scim_directory_id: scim_directory_id
       )
@@ -475,8 +475,8 @@ module Clerk
 
     
     def update(scim_directory_id:, body: nil, retries: nil, timeout_ms: nil, http_headers: nil)
-      # update - Update a SCIM directory
-      # Updates a SCIM directory.
+      # update - Update a directory
+      # Updates a directory.
       request = Models::Operations::UpdateSCIMDirectoryRequest.new(
         scim_directory_id: scim_directory_id,
         body: body
@@ -631,8 +631,8 @@ module Clerk
 
     
     def delete(scim_directory_id:, retries: nil, timeout_ms: nil, http_headers: nil)
-      # delete - Delete a SCIM directory
-      # Deletes a SCIM directory and stops provisioning for it. SCIM requests authenticated
+      # delete - Delete a directory
+      # Deletes a directory and stops provisioning for it. SCIM requests authenticated
       # with the directory's API key are rejected afterwards.
       request = Models::Operations::DeleteSCIMDirectoryRequest.new(
         scim_directory_id: scim_directory_id
@@ -776,8 +776,8 @@ module Clerk
 
     
     def rotate_api_key(scim_directory_id:, retries: nil, timeout_ms: nil, http_headers: nil)
-      # rotate_api_key - Rotate a SCIM directory's API key
-      # Generates a new API key for the SCIM directory and returns it in the `api_key` field.
+      # rotate_api_key - Rotate a directory's API key
+      # Generates a new API key for the directory and returns it in the `api_key` field.
       # This is the only way to obtain the key after creation, so make sure to update it in
       # your identity provider. The previous key remains valid for a short grace period before
       # it expires.
@@ -895,7 +895,7 @@ module Clerk
         else
           raise ::Clerk::Models::Errors::APIError.new(status_code: http_response.status, body: http_response.env.response_body, raw_response: http_response), 'Unknown content type received'
         end
-      elsif Utils.match_status_code(http_response.status, ['401', '403', '404'])
+      elsif Utils.match_status_code(http_response.status, ['401', '403', '404', '422'])
         if Utils.match_content_type(content_type, 'application/json')
           http_response = @sdk_configuration.hooks.after_success(
             hook_ctx: SDKHooks::AfterSuccessHookContext.new(
@@ -924,7 +924,7 @@ module Clerk
     
     def list_group_role_mappings(scim_directory_id:, retries: nil, timeout_ms: nil, http_headers: nil)
       # list_group_role_mappings - List SCIM group role mappings
-      # Returns the list of SCIM group to organization role mappings for a SCIM directory, ordered by precedence.
+      # Returns the list of SCIM group to organization role mappings for a directory, ordered by precedence.
       request = Models::Operations::ListSCIMGroupRoleMappingsRequest.new(
         scim_directory_id: scim_directory_id
       )
@@ -1068,8 +1068,9 @@ module Clerk
     
     def create_group_role_mapping(body:, scim_directory_id:, retries: nil, timeout_ms: nil, http_headers: nil)
       # create_group_role_mapping - Create a SCIM group role mapping
-      # Creates a new SCIM group to organization role mapping for a SCIM directory.
-      # Group role mapping must be enabled on the directory.
+      # Creates a new SCIM group to organization role mapping for a directory.
+      # Mappings can be created while group role mapping is disabled on the
+      # directory, but they only take effect once it is enabled.
       request = Models::Operations::CreateSCIMGroupRoleMappingRequest.new(
         scim_directory_id: scim_directory_id,
         body: body
@@ -1228,8 +1229,9 @@ module Clerk
       # replace_group_role_mappings - Replace SCIM group role mappings
       # Replaces the entire set of SCIM group role mappings for a directory. The position of
       # each item in the `mappings` array determines its precedence (the first item gets
-      # precedence 1). Passing an empty array removes all mappings. Group role mapping must be
-      # enabled on the directory.
+      # precedence 1). Passing an empty array removes all mappings. Mappings can be replaced
+      # while group role mapping is disabled on the directory, but they only take effect once
+      # it is enabled.
       request = Models::Operations::ReplaceSCIMGroupRoleMappingsRequest.new(
         scim_directory_id: scim_directory_id,
         body: body
@@ -1386,8 +1388,9 @@ module Clerk
     
     def delete_group_role_mapping(scim_directory_id:, mapping_id:, retries: nil, timeout_ms: nil, http_headers: nil)
       # delete_group_role_mapping - Delete a SCIM group role mapping
-      # Deletes a single SCIM group role mapping. Group role mapping must be enabled on the
-      # directory.
+      # Deletes a single SCIM group role mapping. Mappings can be deleted while group role
+      # mapping is disabled on the directory, but the change only takes effect once it is
+      # enabled.
       request = Models::Operations::DeleteSCIMGroupRoleMappingRequest.new(
         scim_directory_id: scim_directory_id,
         mapping_id: mapping_id

data/lib/clerk/sdk.rb

@@ -108,6 +108,10 @@ module Clerk
 
     private
 
+    # Decodes the `fea`/`o.per`/`o.fpm` triple of a v2 session token into
+    # `org:<feature>:<action>` permission strings. Anything that cannot be
+    # decoded with confidence is skipped rather than guessed at, so malformed
+    # claims can only ever narrow the permission set, never widen it.
     def compute_org_permissions_from_v2_token(claims)
       features    = claims['fea'] ? claims['fea'].split(',') : []
       permissions = claims['o']['per'] ? claims['o']['per'].split(',') : []
@@ -115,12 +119,28 @@ module Clerk
       org_permissions = []
 
       mappings.each_with_index do |mapping, i|
+        # Each mapping is positionally aligned to a feature. A mapping without a
+        # matching feature entry cannot be attributed to anything, so skip it.
+        next if features[i].nil?
+
         scope, feature = features[i].split(':')
 
+        next if scope.nil? || feature.nil? # malformed feature entry
         next if !scope.include?('o') # not an orgs-related permission
+        # Only a non-negative decimal integer is a valid mask. The backend builds
+        # these masks in a signed 64-bit integer, so an action at index 63
+        # overflows into a negative value whose binary representation is a minus
+        # sign followed by ones ("-111...1"); walking that string character by
+        # character would grant every one of those bits. Reject anything that is
+        # not a plain non-negative decimal, mirroring `decimalToBinaryBits` in
+        # @clerk/shared, which fails closed the same way.
+        next if !/\A\d+\z/.match?(mapping)
 
         mapping.to_i.to_s(2).reverse.each_char.each_with_index do |bit, j|
-          org_permissions << "org:#{feature}:#{permissions[j]}" if bit == '1'
+          next if bit != '1'
+          next if permissions[j].nil? # mask has more bits than the permission vocabulary
+
+          org_permissions << "org:#{feature}:#{permissions[j]}"
         end
       end
 

data/lib/clerk/sdkconfiguration.rb

@@ -76,9 +76,9 @@ module Clerk
       end
       @language = 'ruby'
       @openapi_doc_version = '2026-05-12'
-      @sdk_version = '8.0.0'
-      @gen_version = '2.928.0'
-      @user_agent = 'speakeasy-sdk/ruby 8.0.0 2.928.0 2026-05-12 clerk-sdk-ruby'
+      @sdk_version = '8.0.1'
+      @gen_version = '2.938.0'
+      @user_agent = 'speakeasy-sdk/ruby 8.0.1 2.938.0 2026-05-12 clerk-sdk-ruby'
     end