onelogin 1.7.0 → 1.9.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: db38cae3acb3c8a5810159344a5e088b9e2b52467831e865b625462b470d6340
-  data.tar.gz: b40ec7f43940358e3e2014a1075074778afd6d1d4263b3fa1ea2a6b78853e55e
+  metadata.gz: '0887ddcbf97b6c873d5547842d27822f35b7e4eeefa4c78285ed2828c0cf546b'
+  data.tar.gz: 5a59b6e4c2ff4605775a8473931ed82183d9f434d455a559214828cd612c1988
 SHA512:
-  metadata.gz: d0e8f95dc8d30b514d1a0427b64364a2389a548057d643bda94a2a58cf6c44dc3bf33240b7d1d660ad5ff8c09595b4e4e1e7f7ad6382a5aa54fd044209219cda
-  data.tar.gz: bafb58f70a588457fc592dd397c54069a87245df8d332d56369c36bb6842d3a1fb4e5cfa9250e0b346dc335f288f99a0e6a4fdc3f9fa0960413349155c8647c7
+  metadata.gz: 01b0e196b7f431a2d6e04a1b64757a4b0224b0a5b34e3b17ee6c829f642e6b321305d6ebe15dee6dae44fd15b92f64555927522994c469f7f8ba2a1964ccfb10
+  data.tar.gz: 2595a8b6f36f9a446e991baa18b66e37c9f2ac21687a43d7ca6f0c1dfa1b5c515a7edf8c9d57f3e64874d7690d79d807af31c3f689842fc21fda936bd8fd2b52

data/.github/workflows/test.yml

@@ -9,7 +9,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        ruby: ['3.0', '3.1', '3.2', '3.3']
+        ruby: ['3.2', '3.3', '3.4']
 
     steps:
       - name: Checkout

data/README.md

@@ -3,9 +3,15 @@
 This SDK will let you execute all the API methods, version/1, described
 at https://developers.onelogin.com/api-docs/1/getting-started/dev-overview.
 
-The toolkit is hosted on github. You can download it from:
+The toolkit is hosted on GitHub. You can download it from:
 * Lastest release: https://github.com/onelogin/onelogin-ruby-sdk/releases/latest
-* Master repo: https://github.com/onelogin/onelogin-ruby-sdk/tree/master
+* Main repo: https://github.com/onelogin/onelogin-ruby-sdk/tree/main
+
+
+## Support
+
+OneLogin by One Identity open source projects are supported through [OneLogin GitHub issues](https://github.com/onelogin/onelogin-ruby-sdk/issues). This includes all scripts, plugins, SDKs, modules, code snippets or other solutions. For assistance with any OneLogin by One Identity GitHub project, please raise a new Issue on the [OneLogin GitHub issues](https://github.com/onelogin/onelogin-ruby-sdk/issues) page. Requests for assistance made through official One Identity Support will be referred back to GitHub where those requests can benefit all users.
+
 
 
 ## Installation
@@ -27,7 +33,17 @@ Or install it yourself as:
 
 ### Dependencies
 
+* Ruby >= 3.2
 * httparty
+* nokogiri
+
+Ruby 3.2 is the lowest version on which `nokogiri` resolves to a release with
+no known security advisories — below it, the newest installable `nokogiri` is
+still affected by a critical one.
+
+On an older Ruby, `bundle install` resolves to the most recent release that
+still supports it rather than failing, so existing builds keep working. You
+just stop receiving updates until you upgrade Ruby.
 
 ## Getting started
 
@@ -43,6 +59,7 @@ If you don't have an account you can [sign up for a free developer account here]
 |max_results| Optional: Defaults to 1000  |
 |timeout| Optional: Defaults to 60 (requires httparty > 0.16.2) |
 |token_expiration_buffer| Optional: Non-negative number of seconds before token expiration to trigger a refresh. Set to `0` to disable. Defaults to 30 |
+|api_version| Optional: `1` or `2`. Calls that API version from every method that supports it. See [API versions](#api-versions) |
 
 ```ruby
 require 'onelogin'
@@ -142,6 +159,34 @@ client = OneLogin::Api::Client.new(
 client.get_events.map {|event| event.id}
 ```
 
+### API versions
+
+Each method calls one version of the OneLogin API by default, and that default
+doesn't change. Pass `api_version: 2` to move the methods below to API v2:
+
+```ruby
+client = OneLogin::Api::Client.new(
+    client_id: '',
+    client_secret:'',
+    api_version: 2
+)
+```
+
+`get_users`, `get_user`, `get_user_apps`, `create_user`, `update_user`,
+`delete_user`, `get_roles` and `get_role` support both versions. Every other method
+keeps its default version, whatever `api_version` says.
+`OneLogin::Api::Client::API_VERSIONS` lists the versions each method supports.
+
+Under v2 they return the same models, filled from v2's responses. Two differences
+show through:
+
+- v2 lists fewer fields per user than v1. Under v2, `get_users` leaves `role_ids`
+  and `custom_attributes` empty, for example. `get_user` fills them.
+- `App#login_id` from `get_user_apps` is the login's numeric id in v2, where v1
+  gives the username used to sign in. v2 fills the `provisioning_enabled`,
+  `provisioning_state` and `provisioning_status` fields rather than `provisioned`
+  and `personal`.
+
 
 
 ### Available Methods
@@ -167,17 +212,42 @@ query_parameters = {
 }
 users_filtered2 = client.get_users(query_parameters)
 
-# Get Users with limit
+# Get Users with a page size of 3.
+#
+# `limit` is the API's page size, not a cap on the total. To stop after a
+# fixed number of results use `take`, or set `max_results` on the client.
 query_parameters = {
     limit: 3
 }
-users_filtered_limited = client.get_users(query_parameters)
+users_paged_by_three = client.get_users(query_parameters)
+
+# Stop after 3 users regardless of page size
+first_three = client.get_users.take(3)
 
 # Only return the firstname and email fields for each user
 client.get_users(fields: 'email,firstname').each do |user|
     puts "#{user.firstname} - #{user.email}"
 end
 
+# Sort server-side with the sort parameter. Prefix with - to reverse.
+# Sorting happens in the API, so you do not need to fetch every user and
+# sort client-side.
+query_parameters = {
+    sort: '+id'
+}
+users_sorted = client.get_users(query_parameters)
+
+# Ten least recently active users.
+#
+# `sort` is applied by the API. `limit` sets the page size so the request
+# itself only fetches ten rows, and `take` stops the cursor after ten so it
+# does not page any further.
+#
+# Use both: `limit` alone does not cap the total, because the cursor keeps
+# following pages until they run out or `max_results` is reached, and `take`
+# alone still transfers a full default-sized page and discards the extra.
+least_recently_active = client.get_users(sort: '+last_login', limit: 10).take(10)
+
 # Get User by id
 user = client.get_user(users_filtered.first.id)
 user_mfa = client.get_user(users_filtered2.first.id)
@@ -515,4 +585,4 @@ The gem is available as open source under the terms of the [MIT License](http://
 
 ## Code of Conduct
 
-Everyone interacting in the OneLogin Ruby Sdk project’s codebases, issue trackers, chat rooms and mailing lists is expected to follow the [code of conduct](https://github.com/onelogin/onelogin-ruby-sdk/blob/master/CODE_OF_CONDUCT.md).
+Everyone interacting in the OneLogin Ruby Sdk project’s codebases, issue trackers, chat rooms and mailing lists is expected to follow the [code of conduct](https://github.com/onelogin/onelogin-ruby-sdk/blob/main/CODE_OF_CONDUCT.md).

data/examples/Gemfile.lock

@@ -1,19 +1,23 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    httparty (0.18.0)
-      mime-types (~> 3.0)
+    bigdecimal (4.1.2)
+    csv (3.3.6)
+    httparty (0.24.2)
+      csv
+      mini_mime (>= 1.0.0)
       multi_xml (>= 0.5.2)
-    mime-types (3.3.1)
-      mime-types-data (~> 3.2015)
-    mime-types-data (3.2020.0425)
-    mini_portile2 (2.4.0)
-    multi_xml (0.6.0)
-    nokogiri (1.10.9)
-      mini_portile2 (~> 2.4.0)
-    onelogin (1.6.0)
+    mini_mime (1.1.5)
+    mini_portile2 (2.8.9)
+    multi_xml (0.9.1)
+      bigdecimal (>= 3.1, < 5)
+    nokogiri (1.19.4)
+      mini_portile2 (~> 2.8.2)
+      racc (~> 1.4)
+    onelogin (1.7.0)
       httparty (>= 0.13.7)
       nokogiri (>= 1.6.3.1)
+    racc (1.8.1)
 
 PLATFORMS
   ruby
@@ -22,4 +26,4 @@ DEPENDENCIES
   onelogin
 
 BUNDLED WITH
-   2.1.4
+   2.6.9

data/examples/events-to-csv.rb

@@ -52,11 +52,15 @@ OptionParser.new do |opts|
   end
 end.parse!
 
+counter = 0
+limit = options[:limit] || 1000
+
 # Fetch the events
 client = OneLogin::Api::Client.new(
   client_id: 'ONELOGIN_CLIENT_ID_GOES_HERE',
   client_secret: 'ONELOGIN_CLIENT_SECRET_GOES_HERE',
-  region: 'us'
+  region: 'us',
+  max_results: limit
 )
 
 attribute_names = ['id', 'created_at', 'account_id', 'user_id', 'user_name', 'event_type_id',
@@ -66,9 +70,6 @@ attribute_names = ['id', 'created_at', 'account_id', 'user_id', 'user_name', 'ev
                   'operation_name', 'directory_sync_run_id', 'directory_id', 'resolution', 'client_id',
                   'resource_type_id', 'error_description', 'risk_score', 'risk_reasons', 'risk_cookie_id', 'browser_fingerprint']
 
-counter = 0
-limit = options[:limit] || 1000
-
 # We remove limit from options parsed to the api as we want to fetch
 # the max number of records possible and then use the cursor that is
 # built into the ruby sdk to limit the results

data/lib/onelogin/api/apiexception.rb

@@ -1,6 +1,9 @@
 module OneLogin
   module Api
     class ApiException < Exception
+      # HTTP status (or API status code) the exception was raised for.
+      attr_reader :code
+
       def initialize(message, code)
         super(message)
         @code = code

data/lib/onelogin/api/client.rb

@@ -21,6 +21,7 @@ module OneLogin
 
       attr_accessor :client_id, :client_secret, :region
       attr_accessor :user_agent, :error, :error_description, :error_attribute
+      attr_reader :api_version
 
       NOKOGIRI_OPTIONS = Nokogiri::XML::ParseOptions::STRICT |
                          Nokogiri::XML::ParseOptions::NONET
@@ -32,6 +33,9 @@ module OneLogin
       #
       # @param config [Hash] Client Id, Client Secret and Region
       #
+      # Pass api_version to call that API version from every method that
+      # supports it (see API_VERSIONS). Other methods keep their default.
+      #
       def initialize(config)
         options = Hash[config.map { |(k, v)| [k.to_sym, v] }]
 
@@ -40,6 +44,7 @@ module OneLogin
         @region = options[:region] || 'us'
         @max_results = options[:max_results] || 1000
         @token_expiration_buffer = normalize_expiration_buffer(options[:token_expiration_buffer])
+        @api_version = normalize_api_version(options[:api_version])
 
         if options[:timeout] and defined? self.class.default_timeout
           self.class.default_timeout options[:timeout]
@@ -60,6 +65,28 @@ module OneLogin
         raise ArgumentError, 'client_id & client_secret are required' unless @client_id && @client_secret
       end
 
+      # Normalize caller-supplied parameter hashes to string keys.
+      #
+      # The README and examples use symbol keys, but the required-parameter
+      # checks below look them up as strings. `to_json` already serializes both
+      # forms identically, so only the validation ever disagreed.
+      #
+      # Anything that isn't a Hash becomes an empty one so the required-parameter
+      # guards still fire and report the missing attribute, rather than blowing
+      # up on has_key? and surfacing as a generic 500.
+      #
+      # An already-string-keyed hash is returned untouched, so existing callers
+      # keep the exact object they passed - including Hash subclasses with their
+      # own to_json.
+      #
+      def stringify_param_keys(params)
+        return {} unless params.is_a?(Hash)
+        return params if params.keys.all? { |key| key.is_a?(String) }
+
+        params.each_with_object({}) { |(key, value), out| out[key.to_s] = value }
+      end
+      private :stringify_param_keys
+
       # Coerce the configured refresh buffer into a non-negative Integer.
       #
       # ENV-backed configs hand this over as a String, and a negative buffer
@@ -83,6 +110,40 @@ module OneLogin
       end
       private :normalize_expiration_buffer
 
+      # Coerce the configured API version into one the SDK can call.
+      #
+      # nil leaves every method on its default version. Anything else must be a
+      # version at least one method supports, so a typo fails here instead of
+      # quietly calling the defaults. Only Integers and Strings convert:
+      # Integer() would truncate 1.9 to 1.
+      #
+      def normalize_api_version(value)
+        return nil if value.nil?
+
+        version = begin
+          Integer(value) if value.is_a?(Integer) || value.is_a?(String)
+        rescue ArgumentError
+          nil
+        end
+
+        supported = API_VERSIONS.values.flatten.uniq.sort
+        unless supported.include?(version)
+          raise ArgumentError, "api_version must be one of #{supported.join(', ')}, got #{value.inspect}"
+        end
+
+        version
+      end
+      private :normalize_api_version
+
+      # The API version a method calls: the configured api_version when the
+      # method supports it, otherwise the method's default.
+      #
+      def api_version_for(method)
+        versions = API_VERSIONS.fetch(method)
+        versions.include?(@api_version) ? @api_version : versions.first
+      end
+      private :api_version_for
+
       # Clean any previous error registered at the client.
       #
       def clean_error
@@ -373,14 +434,16 @@ module OneLogin
         prepare_token
 
         begin
+          version = api_version_for(:get_users)
           options = {
             model: OneLogin::Api::Models::User,
             headers: authorized_headers,
             max_results: @max_results,
-            params: params
+            params: params,
+            api_version: version
           }
 
-          return Cursor.new(self, url_for(GET_USERS_URL), options)
+          return Cursor.new(self, url_for(GET_USERS_URL, version: version), options)
 
         rescue Exception => e
           @error = '500'
@@ -409,7 +472,8 @@ module OneLogin
             return
           end
 
-          url = url_for(GET_USER_URL, user_id)
+          version = api_version_for(:get_user)
+          url = url_for(GET_USER_URL, user_id, version: version)
 
           response = self.class.get(
             url,
@@ -418,7 +482,9 @@ module OneLogin
 
           if response.code == 200
             json_data = JSON.parse(response.body)
-            if json_data && json_data['data']
+            if version == 2
+              return OneLogin::Api::Models::User.new(json_data) if json_data.is_a?(Hash)
+            elsif json_data && json_data['data']
               return OneLogin::Api::Models::User.new(json_data['data'][0])
             end
           else
@@ -452,13 +518,15 @@ module OneLogin
             return
           end
 
+          version = api_version_for(:get_user_apps)
           options = {
             model: OneLogin::Api::Models::App,
             headers: authorized_headers,
-            max_results: @max_results
+            max_results: @max_results,
+            api_version: version
           }
 
-          return Cursor.new(self, url_for(GET_APPS_FOR_USER_URL, user_id), options)
+          return Cursor.new(self, url_for(GET_APPS_FOR_USER_URL, user_id, version: version), options)
 
         rescue Exception => e
           @error = '500'
@@ -566,7 +634,8 @@ module OneLogin
         prepare_token
 
         begin
-          url = url_for(CREATE_USER_URL)
+          version = api_version_for(:create_user)
+          url = url_for(CREATE_USER_URL, version: version)
 
           response = self.class.post(
             url,
@@ -574,9 +643,12 @@ module OneLogin
             body: user_params.to_json
           )
 
-          if response.code == 200
+          # v1 answers a create with 200, v2 with 201 Created.
+          if response.code == (version == 2 ? 201 : 200)
             json_data = JSON.parse(response.body)
-            if json_data && json_data['data']
+            if version == 2
+              return OneLogin::Api::Models::User.new(json_data) if json_data.is_a?(Hash)
+            elsif json_data && json_data['data']
               return OneLogin::Api::Models::User.new(json_data['data'][0])
             end
           else
@@ -617,7 +689,8 @@ module OneLogin
             return
           end
 
-          url = url_for(UPDATE_USER_URL, user_id)
+          version = api_version_for(:update_user)
+          url = url_for(UPDATE_USER_URL, user_id, version: version)
 
           response = self.class.put(
             url,
@@ -627,7 +700,9 @@ module OneLogin
 
           if response.code == 200
             json_data = JSON.parse(response.body)
-            if json_data && json_data['data']
+            if version == 2
+              return OneLogin::Api::Models::User.new(json_data) if json_data.is_a?(Hash)
+            elsif json_data && json_data['data']
               return OneLogin::Api::Models::User.new(json_data['data'][0])
             end
           else
@@ -1047,14 +1122,18 @@ module OneLogin
             return
           end
 
-          url = url_for(DELETE_USER_URL, user_id)
+          version = api_version_for(:delete_user)
+          url = url_for(DELETE_USER_URL, user_id, version: version)
 
           response = self.class.delete(
             url,
             headers: authorized_headers
           )
 
-          if response.code == 200
+          # v2 confirms a delete with an empty 204 rather than a status body.
+          if version == 2 && response.code == 204
+            return true
+          elsif version == 1 && response.code == 200
             return handle_operation_response(response)
           else
             @error = response.code.to_s
@@ -1141,6 +1220,8 @@ module OneLogin
         begin
           url = url_for(SESSION_LOGIN_TOKEN_URL)
 
+          query_params = stringify_param_keys(query_params)
+
           if query_params.nil? || !query_params.has_key?('username_or_email') || !query_params.has_key?('password') || !query_params.has_key?('subdomain')
             raise "username_or_email, password and subdomain are required parameters"
           end
@@ -1366,7 +1447,12 @@ module OneLogin
         begin
           url = url_for(CREATE_APP_URL)
 
-          unless app_params.has_key?('connector_id') || app_params['connector_id'].to_s.empty?
+          app_params = stringify_param_keys(app_params)
+
+          # Was `unless has_key? || value.empty?`, which is true in every case,
+          # so the check never fired and an app could be created with no
+          # connector_id at all.
+          if !app_params.has_key?('connector_id') || app_params['connector_id'].to_s.empty?
             @error = '400'
             @error_description = "connector_id is required"
             @error_attribute = "connector_id"
@@ -1592,14 +1678,16 @@ module OneLogin
         prepare_token
 
         begin
+          version = api_version_for(:get_roles)
           options = {
             model: OneLogin::Api::Models::Role,
             headers: authorized_headers,
             max_results: @max_results,
-            params: params
+            params: params,
+            api_version: version
           }
 
-          return Cursor.new(self, url_for(GET_ROLES_URL), options)
+          return Cursor.new(self, url_for(GET_ROLES_URL, version: version), options)
 
         rescue Exception => e
           @error = '500'
@@ -1628,7 +1716,8 @@ module OneLogin
             return
           end
 
-          url = url_for(GET_ROLE_URL, role_id)
+          version = api_version_for(:get_role)
+          url = url_for(GET_ROLE_URL, role_id, version: version)
 
           response = self.class.get(
             url,
@@ -1637,7 +1726,9 @@ module OneLogin
 
           if response.code == 200
             json_data = JSON.parse(response.body)
-            if json_data && json_data['data']
+            if version == 2
+              return OneLogin::Api::Models::Role.new(json_data) if json_data.is_a?(Hash)
+            elsif json_data && json_data['data']
               return OneLogin::Api::Models::Role.new(json_data['data'][0])
             end
           else

data/lib/onelogin/api/cursor.rb

@@ -25,6 +25,7 @@ class Cursor
     @params = options[:params] || {}
     @max_results = options[:max_results]
     @container = options[:container] || 'data'
+    @api_version = options[:api_version]
 
     @collection = []
     @after_cursor = options.fetch(:after_cursor, nil)
@@ -53,19 +54,24 @@ class Cursor
   private
 
   def fetch_next_page
+    return fetch_next_v2_page if @api_version == 2
+
     @params = @params.merge(after_cursor: @after_cursor) if @after_cursor
     @client.prepare_token
 
     response = @client.class.get(
       @url,
-      headers: @headers,
+      headers: request_headers,
       query: @params
     )
 
     json = response.parsed_response
 
-    if json.nil?
-      raise OneLogin::Api::ApiException.new("Response could not be parsed", 500)
+    # HTTParty picks its parser from Content-Type, so a gateway or proxy error
+    # page comes back as a String and every has_key? below would blow up with a
+    # NoMethodError instead of a usable ApiException.
+    if json.nil? || !json.is_a?(Hash)
+      raise OneLogin::Api::ApiException.new("Response could not be parsed", response.code)
     elsif !json.has_key?(@container) && json.has_key?('status') && json["status"]["error"] == true
       raise OneLogin::Api::ApiException.new(extract_error_message_from_response(response), json["status"]["code"])
     elsif !json.has_key?(@container) && json.has_key?('statusCode')
@@ -88,6 +94,43 @@ class Cursor
     end
   end
 
+  # v2 returns a bare array and puts the next page's cursor in the After-Cursor
+  # header, which is absent on the last page. The cursor already encodes the
+  # filters and page size, and the API rejects a cursor sent alongside limit or
+  # page, so follow-up requests send the cursor alone.
+  def fetch_next_v2_page
+    @client.prepare_token
+
+    response = @client.class.get(
+      @url,
+      headers: request_headers,
+      query: @after_cursor ? { cursor: @after_cursor } : @params
+    )
+
+    results = response.parsed_response
+
+    unless response.code == 200 && results.is_a?(Array)
+      message = results.is_a?(Hash) ? extract_error_message_from_response(response) : "Response could not be parsed"
+      raise OneLogin::Api::ApiException.new(message, response.code)
+    end
+
+    @collection += if results_remaining < results.size
+      results.slice(0, results_remaining)
+    else
+      results
+    end
+
+    @after_cursor = response.headers['after-cursor']
+    @last_cursor_empty = @after_cursor.nil? || @after_cursor.empty?
+  end
+
+  # The headers were built when the cursor was, and prepare_token may have
+  # refreshed the token since: a cursor enumerated later, or one whose pages
+  # outlive the token. Take the current token from the client.
+  def request_headers
+    @headers.merge(@client.authorized_headers)
+  end
+
   def after_cursor(json)
     value = nil
     if json.has_key?('pagination')

data/lib/onelogin/api/models/app.rb

@@ -6,15 +6,22 @@ module OneLogin
 
         attr_accessor :id, :name, :icon, :provisioned
         attr_accessor :extension, :login_id, :personal
+        attr_accessor :provisioning_enabled, :provisioning_state, :provisioning_status
 
+        # v2 renames icon to icon_url and replaces provisioned and personal with
+        # the provisioning_* fields. Its login_id is the numeric id of the
+        # user's login, where v1 gives the username used to sign in.
         def initialize(data)
           @id = data['id']
           @name = data['name']
-          @icon = data['icon']
+          @icon = data['icon'] || data['icon_url']
           @provisioned = data['provisioned']
           @extension = data['extension']
           @login_id = data['login_id']
           @personal = data['personal']
+          @provisioning_enabled = data['provisioning_enabled']
+          @provisioning_state = data['provisioning_state']
+          @provisioning_status = data['provisioning_status']
         end
       end
     end

data/lib/onelogin/api/models/user.rb

@@ -28,7 +28,8 @@ module OneLogin
           @samaccountname = data['samaccountname'].to_s
           @userprincipalname = data['userprincipalname'].to_s
           @group_id = data['group_id']? data['group_id'].to_i : nil
-          @role_ids = data['role_id']? data['role_id'] : []
+          # v1 calls it role_id, v2 role_ids.
+          @role_ids = data['role_id'] || data['role_ids'] || []
           @custom_attributes = data['custom_attributes'] ? data['custom_attributes'] : []
           @openid_name = data['openid_name'].to_s
           @locale_code = data['locale_code'].to_s

data/lib/onelogin/api/util/constants.rb

@@ -98,6 +98,24 @@ module OneLogin
         GET_USERS_ASSIGNED_TO_PRIVILEGE_URL = "https://api.%s.onelogin.com/api/1/privileges/%s/users"
         ASSIGN_USERS_TO_PRIVILEGE_URL = "https://api.%s.onelogin.com/api/1/privileges/%s/users"
         REMOVE_USER_FROM_PRIVILEGE_URL = "https://api.%s.onelogin.com/api/1/privileges/%s/users/%s"
+
+        # API versions each client method can call, keyed by method name.
+        #
+        # The first version is the default and matches the version in the
+        # method's URL constant. A method that isn't listed only calls the
+        # version in its URL constant. List a version here only once the method
+        # can parse that version's response: v1 and v2 use different envelopes.
+        API_VERSIONS = {
+          get_users: [1, 2],
+          get_user: [1, 2],
+          get_user_apps: [1, 2],
+          create_user: [1, 2],
+          update_user: [1, 2],
+          delete_user: [1, 2],
+          get_roles: [1, 2],
+          get_role: [1, 2]
+        }.transform_values(&:freeze).freeze
+
         VALID_ACTIONS = [
           "apps:List",
           "apps:Get",

data/lib/onelogin/api/util/parser.rb

@@ -6,7 +6,9 @@ module OneLogin
           message = ''
           content = JSON.parse(response.body)
           if content
-            if content.has_key?('status')
+            # v1 nests the error under a status object. Some v2 endpoints send
+            # status as the bare HTTP code, with the text in description.
+            if content['status'].is_a?(Hash)
               status = content['status']
               if status.has_key?('message')
                 if status['message'].instance_of?(Hash)
@@ -21,6 +23,8 @@ module OneLogin
               end
             elsif content.has_key?('message')
               message = content['message']
+            elsif content.has_key?('description')
+              message = content['description']
             elsif content.has_key?('name')
               message = content['name']
             end
@@ -31,7 +35,7 @@ module OneLogin
         def extract_error_attribute_from_response(response)
           attribute = nil
           content = JSON.parse(response.body)
-          if content && content.has_key?('status')
+          if content && content['status'].is_a?(Hash)
             status = content['status']
             if status.has_key?('message') && status['message'].instance_of?(Hash)
               if status['message'].has_key?('attribute')