descope 1.0.7 → 1.2.0

data/README.md

@@ -31,12 +31,63 @@ descope_client = Descope::Client.new(
 )
 ```
 
+### Auth Management Key
+
+Authentication methods whose public access has been disabled can still be used by providing an
+auth management key. When set, it is sent along with every authentication request.
+
+Create one in the [Descope Console](https://app.descope.com/settings/company/managementkeys) with
+either the `Authentication` or `Full Access` scope on the project or company.
+
+```ruby
+# Initialized after setting the DESCOPE_PROJECT_ID and DESCOPE_AUTH_MANAGEMENT_KEY env vars
+descope_client = Descope::Client.new({})
+
+# ** Or directly **
+descope_client = Descope::Client.new(
+  {
+    project_id: '<project_id>',
+    auth_management_key: ENV['AUTH_MGMT_KEY']
+  }
+)
+```
+
+**Note**: the auth management key can, and probably should, be a different management key than the
+one provided for [management API usage](#setup-1). The auth management key is never sent on
+management requests, and the management key is never sent on authentication requests.
+
+### Request timeout
+
+Every request is bounded by a 60 second timeout, matching the other Descope server SDKs. Raise it
+for calls that legitimately take longer, such as `export_project` on a large project:
+
+```ruby
+descope_client = Descope::Client.new(
+  {
+    project_id: '<project_id>',
+    timeout_seconds: 180
+  }
+)
+```
+
 ### Important Logging note
 You may pass `log_level: 'debug'` to the client config or use `DESCOPE_LOG_LEVEL` env var.
-Be aware that only the management key is truncated, and the JWT responses are printed on debug
+Be aware that everything after the project ID in the `Authorization` header is masked, but the JWT
+responses are printed on debug
 
 Do not run with log level debug on Production!
 
+### Logging
+
+You can customize logging behavior:
+
+```ruby
+# Use your application's logger
+descope_client = Descope::Client.new(
+  project_id: '<project_id>',
+  logger: Rails.logger  # or any Logger-compatible object
+)
+```
 
 ## Authentication Methods
 These sections show how to use the SDK to perform various authentication/authorization functions:
@@ -161,6 +212,33 @@ pending_ref = res['pendingRef'] # Used to poll for a valid session
 masked_email = res['maskedEmail'] # The email that the message was sent to in a masked format
 ```
 
+The same three calls are available over SMS, as `enchanted_link_sign_up_with_phone`,
+`enchanted_link_sign_in_with_phone` and `enchanted_link_sign_up_or_in_with_phone`. The `login_id` is
+a phone number, and the response carries `maskedPhone` instead of `maskedEmail`.
+
+```ruby
+res = descope_client.enchanted_link_sign_up_or_in_with_phone(
+    login_id: '+11111111111',
+    uri: 'https://myapp.com/verify-enchanted-link', # Set redirect URI here or via console
+    template_id: 'my-text-template-id' # Optional, selects a specific text template
+)
+link_identifier = res['linkId'] # Matches the identifier at the start of the SMS, so the user can confirm it
+pending_ref = res['pendingRef'] # Used to poll for a valid session
+masked_phone = res['maskedPhone'] # The phone number that the message was sent to in a masked format
+```
+
+An existing user's phone number can be updated with an enchanted link sent over SMS, using the
+refresh token of their active session:
+
+```ruby
+res = descope_client.enchanted_link_update_user_phone(
+    login_id: 'someone@example.com',
+    phone: '+11111111111',
+    uri: 'https://myapp.com/verify-enchanted-link',
+    refresh_token: refresh_token
+)
+```
+
 After sending the link, you must poll to receive a valid session using the `pending_ref` from
 the previous step. A valid session will be returned only after the user clicks the right link.
 
@@ -493,6 +571,8 @@ in nature. Please use responsibly.
 
 To use the management API you'll need a `Management Key` along with your `Project ID`.
 Create one in the [Descope Console](https://app.descope.com/settings/company/managementkeys).
+This key is used only for management functions - to reach authentication methods whose public
+access has been disabled, use the [Auth Management Key](#auth-management-key) instead.
 
 ```ruby
 require 'descope'
@@ -1258,6 +1338,160 @@ resp["apps"].each do |app|
 end
 ```
 
+### Manage Third Party Applications
+
+You can create, update, patch, delete or load third party (OIDC) applications, and manage their secrets and consents:
+
+```ruby
+# Create a third party application (response includes the generated id and secret)
+resp = descope_client.create_application(
+  name: "My third party app",
+  login_page_url: "https://dummy.com/login"
+)
+id = resp["id"]
+
+# Update (overrides all fields) or patch (only given fields)
+descope_client.update_application(id: id, name: "Updated name", login_page_url: "https://dummy.com/login")
+descope_client.patch_application(id: id, name: "Patched name")
+
+# Load one / all applications
+descope_client.load_application(id)
+descope_client.load_all_applications
+
+# Manage the application secret
+descope_client.get_application_secret(id)
+descope_client.rotate_application_secret(id)
+
+# Delete consents for the application
+descope_client.delete_consents(app_id: id, user_ids: ["U123"])
+
+# Application deletion cannot be undone. Use carefully.
+descope_client.delete_application(id)
+```
+
+### Manage Management Keys
+
+Create and manage management keys for a project:
+
+```ruby
+# Response includes the key metadata and the one-time cleartext value
+resp = descope_client.create_management_key(
+  name: "CI key",
+  description: "used by CI",
+  expires_in: 0, # 0 = no expiration (seconds)
+  permitted_ips: ["1.2.3.4/32"]
+)
+
+descope_client.update_management_key(id: "key-id", name: "renamed CI key")
+descope_client.get_management_key(id: "key-id")
+descope_client.search_management_keys(status: "active")
+descope_client.delete_management_key(id: "key-id")
+```
+
+### Manage Engines
+
+```ruby
+resp = descope_client.create_engine(name: "my-engine") # secret returned only here and on rotate
+descope_client.update_engine(id: resp["id"], name: "renamed-engine")
+descope_client.load_engine(id: resp["id"])
+descope_client.load_all_engines
+descope_client.rotate_engine_secret(id: resp["id"])
+descope_client.delete_engine(id: resp["id"])
+```
+
+### Manage Descopers
+
+```ruby
+descope_client.create_descoper([{ loginId: "admin@descope.com", roleNames: ["Descoper"] }])
+descope_client.update_descoper(id: "U123", attributes: { name: "Admin" })
+descope_client.get_descoper(id: "U123")
+descope_client.search_descopers
+descope_client.delete_descoper(id: "U123")
+```
+
+### Manage Lists
+
+Manage allow/deny lists of IPs and text values:
+
+```ruby
+list = descope_client.create_list(name: "blocklist", type: "ip")
+descope_client.update_list(id: list["id"], name: "blocklist", type: "ip")
+descope_client.load_list(list["id"])
+descope_client.load_list_by_name("blocklist")
+descope_client.load_all_lists
+descope_client.import_lists(lists: [{ name: "blocklist", type: "ip", data: ["1.2.3.4"] }])
+
+# IP entries
+descope_client.list_add_ips(id: list["id"], ips: ["1.2.3.4"])
+descope_client.list_remove_ips(id: list["id"], ips: ["1.2.3.4"])
+descope_client.list_check_ip(id: list["id"], ip: "1.2.3.4")
+
+# Text entries
+descope_client.list_add_texts(id: list["id"], texts: ["blocked"])
+descope_client.list_remove_texts(id: list["id"], texts: ["blocked"])
+descope_client.list_check_text(id: list["id"], text: "blocked")
+# Check up to 100 texts in one call: exists if any of them is in the list, or only if all are with match_all: true
+descope_client.list_check_texts(id: list["id"], texts: ["blocked", "other"])
+descope_client.list_check_texts(id: list["id"], texts: ["blocked", "other"], match_all: true)
+
+descope_client.clear_list(id: list["id"])
+descope_client.delete_list(id: list["id"])
+```
+
+### Manage JWT Templates
+
+```ruby
+descope_client.create_jwt_template(template: { name: "my-template", authSchema: "default" })
+descope_client.update_jwt_template(template: { id: "T123", name: "my-template" })
+descope_client.list_jwt_templates
+descope_client.load_jwt_template(id: "T123")
+descope_client.delete_jwt_template(id: "T123")
+```
+
+### Manage Scope Claim Mapping
+
+Manage the project-wide OIDC scope-to-claim mapping:
+
+```ruby
+descope_client.set_scope_claim_mapping(mappings: [{ scope: "email", claims: ["email"] }])
+descope_client.get_scope_claim_mapping
+descope_client.delete_scope_claim_mapping
+```
+
+### Query SSO Groups
+
+Query the SSO groups synced to a project's tenant:
+
+```ruby
+descope_client.load_all_groups(tenant_id: "T123")
+descope_client.load_all_groups_for_members(tenant_id: "T123", user_ids: ["U123"], login_ids: ["a@b.com"])
+descope_client.load_all_group_members(tenant_id: "T123", group_id: "G123")
+```
+
+### Manage FGA (Fine-Grained Authorization)
+
+Manage a fine-grained authorization schema and relations:
+
+```ruby
+# Save/load the schema (schema is a DSL string)
+descope_client.fga_save_schema(schema: "model\n  schema 1.1\ntype user")
+descope_client.fga_load_schema
+
+# Create, delete and check relations
+tuples = [{ resource: "doc1", resourceType: "document", relation: "owner", target: "u1", targetType: "user" }]
+descope_client.fga_create_relations(tuples: tuples)
+descope_client.fga_check(tuples: tuples)
+descope_client.fga_delete_relations(tuples: tuples)
+```
+
+### Analytics
+
+Search project analytics:
+
+```ruby
+descope_client.analytics_search(from_ts: 1700000000000, to_ts: 1700086400000, group_by_action: true)
+```
+
 
 ## API Rate Limits
 
@@ -1295,6 +1529,15 @@ You can find various usage examples in the [examples folder](https://github.com/
 bundle install
 ```
 
+### Environment variables
+
+```bash
+export DESCOPE_PROJECT_ID=<ProjectID>
+export DESCOPE_MANAGEMENT_KEY=<ManagementKey>
+# Optional, only needed for authentication methods with disabled public access
+export DESCOPE_AUTH_MANAGEMENT_KEY=<AuthManagementKey>
+```
+
 ### Run tests
 
 Running all tests:

data/examples/ruby-on-rails-api/descope/package-lock.json

@@ -73,6 +73,7 @@
       "version": "10.0.4",
       "resolved": "https://registry.npmjs.org/immer/-/immer-10.0.4.tgz",
       "integrity": "sha512-cuBuGK40P/sk5IzWa9QPUaAdvPHjkk1c+xYsd9oZw+YQQEV+10G0P5uMpGctZZKnyQ+ibRO08bD25nWLmYi2pw==",
+      "peer": true,
       "funding": {
         "type": "opencollective",
         "url": "https://opencollective.com/immer"
@@ -152,6 +153,7 @@
       "version": "10.0.4",
       "resolved": "https://registry.npmjs.org/immer/-/immer-10.0.4.tgz",
       "integrity": "sha512-cuBuGK40P/sk5IzWa9QPUaAdvPHjkk1c+xYsd9oZw+YQQEV+10G0P5uMpGctZZKnyQ+ibRO08bD25nWLmYi2pw==",
+      "peer": true,
       "funding": {
         "type": "opencollective",
         "url": "https://opencollective.com/immer"
@@ -223,6 +225,7 @@
       "version": "10.0.4",
       "resolved": "https://registry.npmjs.org/immer/-/immer-10.0.4.tgz",
       "integrity": "sha512-cuBuGK40P/sk5IzWa9QPUaAdvPHjkk1c+xYsd9oZw+YQQEV+10G0P5uMpGctZZKnyQ+ibRO08bD25nWLmYi2pw==",
+      "peer": true,
       "funding": {
         "type": "opencollective",
         "url": "https://opencollective.com/immer"
@@ -721,6 +724,7 @@
       "resolved": "https://registry.npmjs.org/@popperjs/core/-/core-2.11.8.tgz",
       "integrity": "sha512-P1st0aksCrn9sGZhp8GMYwBnQsbvAWsZAX44oXNNvLHGqAOcoVxmjZiohstwQ7SqKnbR47akdNi+uleWD8+g6A==",
       "license": "MIT",
+      "peer": true,
       "funding": {
         "type": "opencollective",
         "url": "https://opencollective.com/popperjs"
@@ -736,6 +740,7 @@
       "version": "2.2.3",
       "resolved": "https://registry.npmjs.org/@reduxjs/toolkit/-/toolkit-2.2.3.tgz",
       "integrity": "sha512-76dll9EnJXg4EVcI5YNxZA/9hSAmZsFqzMmNRHvIlzw2WS/twfcVX3ysYrWGJMClwEmChQFC4yRq74tn6fdzRA==",
+      "peer": true,
       "dependencies": {
         "immer": "^10.0.3",
         "redux": "^5.0.1",
@@ -775,8 +780,7 @@
     "node_modules/@types/prop-types": {
       "version": "15.7.11",
       "resolved": "https://registry.npmjs.org/@types/prop-types/-/prop-types-15.7.11.tgz",
-      "integrity": "sha512-ga8y9v9uyeiLdpKddhxYQkxNDrfvuPrlFb0N1qnZZByvcElJaXthF1UhvCh9TLWJBEHeNtdnbysW7Y6Uq8CVng==",
-      "peer": true
+      "integrity": "sha512-ga8y9v9uyeiLdpKddhxYQkxNDrfvuPrlFb0N1qnZZByvcElJaXthF1UhvCh9TLWJBEHeNtdnbysW7Y6Uq8CVng=="
     },
     "node_modules/@types/react": {
       "version": "18.2.48",
@@ -792,8 +796,7 @@
     "node_modules/@types/scheduler": {
       "version": "0.16.8",
       "resolved": "https://registry.npmjs.org/@types/scheduler/-/scheduler-0.16.8.tgz",
-      "integrity": "sha512-WZLiwShhwLRmeV6zH+GkbOFT6Z6VklCItrDioxUnv+u4Ll+8vKeFySoFyK/0ctcRpOmwAicELfmys1sDc/Rw+A==",
-      "peer": true
+      "integrity": "sha512-WZLiwShhwLRmeV6zH+GkbOFT6Z6VklCItrDioxUnv+u4Ll+8vKeFySoFyK/0ctcRpOmwAicELfmys1sDc/Rw+A=="
     },
     "node_modules/abbrev": {
       "version": "1.1.1",
@@ -864,9 +867,9 @@
       "license": "MIT"
     },
     "node_modules/brace-expansion": {
-      "version": "1.1.11",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz",
-      "integrity": "sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==",
+      "version": "1.1.12",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
+      "integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^1.0.0",
@@ -916,8 +919,7 @@
     "node_modules/csstype": {
       "version": "3.1.3",
       "resolved": "https://registry.npmjs.org/csstype/-/csstype-3.1.3.tgz",
-      "integrity": "sha512-M1uQkMl8rQK/szD0LNhtqxIPLpimGm8sOBwU7lLnCpSbTyY3yeU1Vc7l4KT5zT4s/yOxHH5O7tIuuLOCnLADRw==",
-      "peer": true
+      "integrity": "sha512-M1uQkMl8rQK/szD0LNhtqxIPLpimGm8sOBwU7lLnCpSbTyY3yeU1Vc7l4KT5zT4s/yOxHH5O7tIuuLOCnLADRw=="
     },
     "node_modules/debug": {
       "version": "4.3.4",
@@ -1241,6 +1243,7 @@
       "resolved": "https://registry.npmjs.org/react/-/react-18.2.0.tgz",
       "integrity": "sha512-/3IjMdb2L9QbBdWiW5e3P2/npwMBaU9mHCSCUzNln0ZCYbcfTsGbTJrU/kGemdH2IWmB2ioZ+zkxtmq6g09fGQ==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "loose-envify": "^1.1.0"
       },
@@ -1253,6 +1256,7 @@
       "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-18.2.0.tgz",
       "integrity": "sha512-6IMTriUmvsjHUjNtEDudZfuDQUoWXVxKHhlEGSk81n4YFS+r/Kl99wXiwlVXtPBtJenozv2P+hxDsw9eA7Xo6g==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "loose-envify": "^1.1.0",
         "scheduler": "^0.23.0"
@@ -1306,12 +1310,14 @@
     "node_modules/redux": {
       "version": "5.0.1",
       "resolved": "https://registry.npmjs.org/redux/-/redux-5.0.1.tgz",
-      "integrity": "sha512-M9/ELqF6fy8FwmkpnF0S3YKOqMyoWJ4+CS5Efg2ct3oY9daQvd/Pc71FpGZsVsbl3Cpb+IIcjBDUnnyBdQbq4w=="
+      "integrity": "sha512-M9/ELqF6fy8FwmkpnF0S3YKOqMyoWJ4+CS5Efg2ct3oY9daQvd/Pc71FpGZsVsbl3Cpb+IIcjBDUnnyBdQbq4w==",
+      "peer": true
     },
     "node_modules/redux-thunk": {
       "version": "3.1.0",
       "resolved": "https://registry.npmjs.org/redux-thunk/-/redux-thunk-3.1.0.tgz",
       "integrity": "sha512-NW2r5T6ksUKXCabzhL9z+h206HQw/NJkcLm1GPImRQ8IzfXwRGqjVhKJGauHirT0DAuyy6hjdnMZaRoAcy0Klw==",
+      "peer": true,
       "peerDependencies": {
         "redux": "^5.0.0"
       }

data/examples/ruby-on-rails-api/descope/yarn.lock

@@ -331,9 +331,9 @@ bootstrap@^5.3.3:
   integrity sha512-8HLCdWgyoMguSO9o+aH+iuZ+aht+mzW0u3HIMzVu7Srrpv7EBBxTnrFlSCskwdY1+EOFQSm7uMJhNQHkdPcmjg==
 
 brace-expansion@^1.1.7:
-  version "1.1.11"
-  resolved "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz"
-  integrity sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==
+  version "1.1.12"
+  resolved "https://registry.yarnpkg.com/brace-expansion/-/brace-expansion-1.1.12.tgz#ab9b454466e5a8cc3a187beaad580412a9c5b843"
+  integrity sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==
   dependencies:
     balanced-match "^1.0.0"
     concat-map "0.0.1"

data/lib/descope/api/v1/auth/enchantedlink.rb

@@ -17,7 +17,17 @@ module Descope
             validate_refresh_token_provided(login_options, refresh_token)
             body = enchanted_link_compose_signin_body(login_id, uri, login_options)
             uri = enchanted_link_compose_signin_url
-            post(uri, body, nil, refresh_token)
+            post(uri, body, {}, refresh_token)
+          end
+
+          def enchanted_link_sign_in_with_phone(login_id: nil, uri: nil, login_options: nil, provider_id: nil, template_id: nil, refresh_token: nil)
+            validate_login_id(login_id)
+            validate_refresh_token_provided(login_options, refresh_token)
+            body = enchanted_link_compose_signin_body(login_id, uri, login_options)
+            body[:providerId] = provider_id if provider_id
+            body[:templateId] = template_id if template_id
+            uri = enchanted_link_compose_signin_url(Descope::Mixins::Common::DeliveryMethod::SMS)
+            post(uri, body, {}, refresh_token)
           end
 
           def enchanted_link_sign_up(login_id: nil, uri: nil, user: {})
@@ -36,6 +46,23 @@ module Descope
             post(uri, body)
           end
 
+          def enchanted_link_sign_up_with_phone(login_id: nil, uri: nil, user: {}, provider_id: nil, template_id: nil)
+            method = Descope::Mixins::Common::DeliveryMethod::SMS
+
+            unless adjust_and_verify_delivery_method(method, login_id, user)
+              raise Descope::ArgumentException.new(
+                'Invalid delivery method',
+                code: 400
+              )
+            end
+
+            body = enchanted_link_compose_signup_body(login_id, uri, user, method)
+            body[:providerId] = provider_id if provider_id
+            body[:templateId] = template_id if template_id
+            uri = enchanted_link_compose_signup_url(method)
+            post(uri, body)
+          end
+
           def enchanted_link_sign_up_or_in(login_id: nil, uri: nil, login_options: nil)
             # @see https://docs.descope.com/api/openapi/enchantedlink/operation/SignUpOrInEnchantedLinkEmail/
             body = enchanted_link_compose_signin_body(login_id, uri, login_options)
@@ -43,6 +70,14 @@ module Descope
             post(uri, body)
           end
 
+          def enchanted_link_sign_up_or_in_with_phone(login_id: nil, uri: nil, login_options: nil, provider_id: nil, template_id: nil)
+            body = enchanted_link_compose_signin_body(login_id, uri, login_options)
+            body[:providerId] = provider_id if provider_id
+            body[:templateId] = template_id if template_id
+            uri = enchanted_link_compose_sign_up_or_in_url(Descope::Mixins::Common::DeliveryMethod::SMS)
+            post(uri, body)
+          end
+
           def enchanted_link_update_user_email(login_id: nil, email: nil, uri: nil, add_to_login_ids: nil, on_merge_use_existing: nil, provider_id: nil, template_id: nil, template_options: nil, refresh_token: nil)
             validate_login_id(login_id)
             validate_token_not_empty(refresh_token)
@@ -59,6 +94,22 @@ module Descope
             post(uri, body, {}, refresh_token)
           end
 
+          def enchanted_link_update_user_phone(login_id: nil, phone: nil, uri: nil, add_to_login_ids: nil, on_merge_use_existing: nil, provider_id: nil, template_id: nil, template_options: nil, refresh_token: nil)
+            validate_login_id(login_id)
+            validate_token_not_empty(refresh_token)
+            validate_phone(Descope::Mixins::Common::DeliveryMethod::SMS, phone)
+
+            body = enchanted_link_compose_update_user_phone_body(
+              login_id, phone, add_to_login_ids, on_merge_use_existing
+            )
+            body[:redirectUrl] = uri
+            body[:providerId] = provider_id if provider_id
+            body[:templateId] = template_id if template_id
+            body[:templateOptions] = template_options if template_options
+            uri = compose_url(UPDATE_USER_PHONE_ENCHANTEDLINK_PATH, Descope::Mixins::Common::DeliveryMethod::SMS)
+            post(uri, body, {}, refresh_token)
+          end
+
           def enchanted_link_verify_token(token = nil)
             validate_token_not_empty(token)
             post(VERIFY_ENCHANTEDLINK_AUTH_PATH, { token: })
@@ -97,19 +148,23 @@ module Descope
             body
           end
 
-          def enchanted_link_compose_signin_url
-            compose_url(SIGN_IN_AUTH_ENCHANTEDLINK_PATH, Descope::Mixins::Common::DeliveryMethod::EMAIL)
+          def enchanted_link_compose_signin_url(method = nil)
+            method = Descope::Mixins::Common::DeliveryMethod::EMAIL if method.nil?
+            compose_url(SIGN_IN_AUTH_ENCHANTEDLINK_PATH, method)
           end
 
-          def enchanted_link_compose_signup_url
-            compose_url(SIGN_UP_AUTH_ENCHANTEDLINK_PATH, Descope::Mixins::Common::DeliveryMethod::EMAIL)
+          def enchanted_link_compose_signup_url(method = nil)
+            method = Descope::Mixins::Common::DeliveryMethod::EMAIL if method.nil?
+            compose_url(SIGN_UP_AUTH_ENCHANTEDLINK_PATH, method)
           end
 
-          def enchanted_link_compose_sign_up_or_in_url
-            compose_url(SIGN_UP_OR_IN_AUTH_ENCHANTEDLINK_PATH, Descope::Mixins::Common::DeliveryMethod::EMAIL)
+          def enchanted_link_compose_sign_up_or_in_url(method = nil)
+            method = Descope::Mixins::Common::DeliveryMethod::EMAIL if method.nil?
+            compose_url(SIGN_UP_OR_IN_AUTH_ENCHANTEDLINK_PATH, method)
           end
 
-          def enchanted_link_compose_signup_body(login_id, uri, user)
+          def enchanted_link_compose_signup_body(login_id, uri, user, method = nil)
+            method = Descope::Mixins::Common::DeliveryMethod::EMAIL if method.nil?
             body = {
               loginId: login_id,
               redirectUrl: uri
@@ -118,7 +173,7 @@ module Descope
             unless user.nil? || user.empty?
               body[:user] = enchantedlink_user_compose_update_body(**user) unless user.empty?
 
-              method_str, val = get_login_id_by_method(method: Descope::Mixins::Common::DeliveryMethod::EMAIL, user:)
+              method_str, val = get_login_id_by_method(method:, user:)
               body[method_str.to_sym] = val
             end
 
@@ -137,6 +192,18 @@ module Descope
             body
           end
 
+          def enchanted_link_compose_update_user_phone_body(login_id, phone, add_to_login_ids, on_merge_use_existing)
+            body = {
+              loginId: login_id,
+              phone:
+            }
+
+            body[:addToLoginIDs] = add_to_login_ids if add_to_login_ids
+            body[:onMergeUseExisting] = on_merge_use_existing if on_merge_use_existing
+
+            body
+          end
+
 
           private
           def enchantedlink_user_compose_update_body(login_id: nil, name: nil, phone: nil, email: nil, given_name: nil, middle_name: nil, family_name: nil)

data/lib/descope/api/v1/management/access_key.rb

@@ -16,7 +16,8 @@ module Descope
             role_names ||= []
             key_tenants ||= []
             validate_tenants(key_tenants)
-            post(ACCESS_KEY_CREATE_PATH, access_key_compose_create_body(name, expire_time, role_names, key_tenants, custom_claims))
+            mgmt_post(ACCESS_KEY_CREATE_PATH,
+                      access_key_compose_create_body(name, expire_time, role_names, key_tenants, custom_claims))
           end
 
           def access_key_compose_create_body(name, expire_time, role_names, key_tenants, custom_claims)
@@ -34,7 +35,7 @@ module Descope
             # @param id [string] The access key id.
             # @see https://docs.descope.com/api/openapi/accesskeymanagement/operation/LoadAccessKey/
 
-            get(ACCESS_KEY_LOAD_PATH, { id: })
+            mgmt_get(ACCESS_KEY_LOAD_PATH, { id: })
           end
 
           def search_all_access_keys(tenant_ids = nil)
@@ -43,7 +44,7 @@ module Descope
             request_params = {
               tenantIds: tenant_ids
             }
-            post(ACCESS_KEYS_SEARCH_PATH, request_params)
+            mgmt_post(ACCESS_KEYS_SEARCH_PATH, request_params)
           end
 
           def update_access_key(id: nil, name: nil)
@@ -53,27 +54,27 @@ module Descope
               id:,
               name:
             }
-            post(ACCESS_KEY_UPDATE_PATH, request_params)
+            mgmt_post(ACCESS_KEY_UPDATE_PATH, request_params)
           end
 
           def deactivate_access_key(id)
             # Deactivate an existing access key. IMPORTANT: This deactivated key will not be usable from this stage.
             # It will, however, persist, and can be activated again if needed.
             # @see https://docs.descope.com/api/openapi/accesskeymanagement/operation/DeactivateAccessKey/
-            post(ACCESS_KEY_DEACTIVATE_PATH, { id: })
+            mgmt_post(ACCESS_KEY_DEACTIVATE_PATH, { id: })
           end
 
           def activate_access_key(id)
             # Activate an existing access key. IMPORTANT: Only deactivated keys can be activated again,
             # and become usable once more. New access keys are active by default.
             # @see https://docs.descope.com/api/openapi/accesskeymanagement/operation/ActivateAccessKey/
-            post(ACCESS_KEY_ACTIVATE_PATH, { id: })
+            mgmt_post(ACCESS_KEY_ACTIVATE_PATH, { id: })
           end
 
           def delete_access_key(id)
             # Delete an existing access key. IMPORTANT: This action is irreversible. Use carefully.
             # @see https://docs.descope.com/api/openapi/accesskeymanagement/operation/DeleteAccessKey/
-            post(ACCESS_KEY_DELETE_PATH, { id: })
+            mgmt_post(ACCESS_KEY_DELETE_PATH, { id: })
           end
         end
       end

data/lib/descope/api/v1/management/analytics.rb

@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+
+module Descope
+  module Api
+    module V1
+      module Management
+        # Management API calls for analytics
+        module Analytics
+          include Descope::Api::V1::Management::Common
+
+          def analytics_search(
+            from_ts:,
+            to_ts:,
+            actions: nil,
+            excluded_actions: nil,
+            devices: nil,
+            methods: nil,
+            geos: nil,
+            tenants: nil,
+            group_by_action: false,
+            group_by_device: false,
+            group_by_method: false,
+            group_by_geo: false,
+            group_by_tenant: false,
+            group_by_referrer: false,
+            group_by_created: false
+          )
+            # Search project analytics based on given parameters
+            # from_ts (int): Retrieve records newer than given time in epoch milliseconds
+            # to_ts (int): Retrieve records older than given time in epoch milliseconds
+            # actions (Array): Optional list of actions to filter by
+            # excluded_actions (Array): Optional list of actions to exclude
+            # devices (Array): Optional list of devices to filter by
+            # methods (Array): Optional list of methods to filter by
+            # geos (Array): Optional list of geos to filter by. Geo is currently country code like "US", "IL", etc.
+            # tenants (Array): Optional list of tenants to filter by
+            # group_by_* (bool): Optional grouping flags for the returned analytics
+            request_params = {
+              from: from_ts,
+              to: to_ts,
+              groupByAction: group_by_action,
+              groupByDevice: group_by_device,
+              groupByMethod: group_by_method,
+              groupByGeo: group_by_geo,
+              groupByTenant: group_by_tenant,
+              groupByReferrer: group_by_referrer,
+              groupByCreated: group_by_created
+            }
+            request_params[:actions] = actions unless actions.nil?
+            request_params[:excludedActions] = excluded_actions unless excluded_actions.nil?
+            request_params[:devices] = devices unless devices.nil?
+            request_params[:methods] = methods unless methods.nil?
+            request_params[:geos] = geos unless geos.nil?
+            request_params[:tenants] = tenants unless tenants.nil?
+
+            mgmt_post(ANALYTICS_SEARCH_PATH, request_params)
+          end
+        end
+      end
+    end
+  end
+end