openai 0.89.0 → 0.91.0

data/rbi/openai/models/beta/agents/vaults/credential_auth_create_param.rbi

@@ -0,0 +1,293 @@
+# typed: strong
+
+module OpenAI
+  module Models
+
+    module Beta
+
+      module Agents
+
+        module Vaults
+
+          # Authentication credentials for an MCP server used by agent tools.
+          module CredentialAuthCreateParam
+            extend OpenAI::Internal::Type::Union
+
+            Variants = T.type_alias do
+              T.any(
+                OpenAI::Beta::Agents::Vaults::CredentialAuthCreateParam::McpOauth,
+                OpenAI::Beta::Agents::Vaults::CredentialAuthCreateParam::StaticBearer
+              )
+            end
+
+            class McpOauth < OpenAI::Internal::Type::BaseModel
+              OrHash = T.type_alias do
+                T.any(
+                  OpenAI::Beta::Agents::Vaults::CredentialAuthCreateParam::McpOauth,
+                  OpenAI::Internal::AnyHash
+                )
+              end
+
+              # A write-only OAuth access token; never returned by credential resources.
+              sig { returns(String) }
+              attr_accessor :access_token
+
+              # The HTTPS MCP server URL authorized by this credential.
+              sig { returns(String) }
+              attr_accessor :mcp_server_url
+
+              # The type of the object. Always `mcp_oauth`.
+              sig { returns(Symbol) }
+              attr_accessor :type
+
+              # When the OAuth access token expires, as an RFC 3339 timestamp, if known.
+              sig { returns(T.nilable(String)) }
+              attr_accessor :expires_at
+
+              # Configuration for refreshing the access token of an MCP OAuth credential.
+              sig { returns(T.nilable(OpenAI::Beta::Agents::Vaults::CredentialAuthCreateParam::McpOauth::Refresh)) }
+              attr_reader :refresh
+
+              sig {
+                params(
+                  refresh: T.nilable(OpenAI::Beta::Agents::Vaults::CredentialAuthCreateParam::McpOauth::Refresh::OrHash)
+                )
+                  .void
+              }
+              attr_writer :refresh
+
+              # An OAuth credential for an HTTPS MCP destination.
+              sig do
+                params(
+
+                  access_token: String,
+
+                  mcp_server_url: String,
+
+                  expires_at: T.nilable(String),
+
+                  refresh: T.nilable(OpenAI::Beta::Agents::Vaults::CredentialAuthCreateParam::McpOauth::Refresh::OrHash),
+
+                  type: Symbol
+                )
+                  .returns(T.attached_class)
+              end
+              def self.new(
+
+                # A write-only OAuth access token; never returned by credential resources.
+                access_token:,
+
+                # The HTTPS MCP server URL authorized by this credential.
+                mcp_server_url:,
+
+                # When the OAuth access token expires, as an RFC 3339 timestamp, if known.
+                expires_at: nil,
+
+                # Configuration for refreshing the access token of an MCP OAuth credential.
+                refresh: nil,
+
+                # The type of the object. Always `mcp_oauth`.
+
+                type: :mcp_oauth
+              )
+              end
+
+              sig do
+                override.returns(
+                  {
+                    access_token: String,
+                    mcp_server_url: String,
+                    type: Symbol,
+                    expires_at: T.nilable(String),
+                    refresh: T.nilable(OpenAI::Beta::Agents::Vaults::CredentialAuthCreateParam::McpOauth::Refresh)
+                  }
+                )
+              end
+              def to_hash
+              end
+
+              class Refresh < OpenAI::Internal::Type::BaseModel
+                OrHash = T.type_alias do
+                  T.any(
+                    OpenAI::Beta::Agents::Vaults::CredentialAuthCreateParam::McpOauth::Refresh,
+                    OpenAI::Internal::AnyHash
+                  )
+                end
+
+                # The OAuth client ID used when requesting a new access token.
+                sig { returns(String) }
+                attr_accessor :client_id
+
+                # The refresh token to store. This secret is never returned in credential
+                # resources.
+                sig { returns(String) }
+                attr_accessor :refresh_token
+
+                # The HTTPS OAuth token endpoint used to exchange the refresh token for a new
+                # access token.
+                sig { returns(String) }
+                attr_accessor :token_endpoint
+
+                # How the OAuth client authenticates to the token endpoint.
+                sig {
+                  returns(
+                    T.any(
+                      OpenAI::Beta::Agents::Vaults::McpOauthTokenEndpointAuthCreateParam::None,
+                      OpenAI::Beta::Agents::Vaults::McpOauthTokenEndpointAuthCreateParam::ClientSecretBasic,
+                      OpenAI::Beta::Agents::Vaults::McpOauthTokenEndpointAuthCreateParam::ClientSecretPost
+                    )
+                  )
+                }
+                attr_accessor :token_endpoint_auth
+
+                # The resource URI to send to the OAuth token endpoint during refresh, if
+                # required.
+                sig { returns(T.nilable(String)) }
+                attr_accessor :resource
+
+                # Space-separated OAuth scopes to request during refresh, if required.
+                sig { returns(T.nilable(String)) }
+                attr_accessor :scope
+
+                # Configuration for refreshing the access token of an MCP OAuth credential.
+                sig do
+                  params(
+
+                    client_id: String,
+
+                    refresh_token: String,
+
+                    token_endpoint: String,
+
+                    token_endpoint_auth: T.any(
+                      OpenAI::Beta::Agents::Vaults::McpOauthTokenEndpointAuthCreateParam::None::OrHash,
+                      OpenAI::Beta::Agents::Vaults::McpOauthTokenEndpointAuthCreateParam::ClientSecretBasic::OrHash,
+                      OpenAI::Beta::Agents::Vaults::McpOauthTokenEndpointAuthCreateParam::ClientSecretPost::OrHash
+                    ),
+
+                    resource: T.nilable(String),
+
+                    scope: T.nilable(String)
+                  )
+                    .returns(T.attached_class)
+                end
+                def self.new(
+
+                  # The OAuth client ID used when requesting a new access token.
+                  client_id:,
+
+                  # The refresh token to store. This secret is never returned in credential
+                  # resources.
+                  refresh_token:,
+
+                  # The HTTPS OAuth token endpoint used to exchange the refresh token for a new
+                  # access token.
+                  token_endpoint:,
+
+                  # How the OAuth client authenticates to the token endpoint.
+                  token_endpoint_auth:,
+
+                  # The resource URI to send to the OAuth token endpoint during refresh, if
+                  # required.
+                  resource: nil,
+
+                  # Space-separated OAuth scopes to request during refresh, if required.
+
+                  scope: nil
+                )
+                end
+
+                sig do
+                  override.returns(
+                    {
+                      client_id: String,
+                      refresh_token: String,
+                      token_endpoint: String,
+                      token_endpoint_auth: T.any(
+                        OpenAI::Beta::Agents::Vaults::McpOauthTokenEndpointAuthCreateParam::None,
+                        OpenAI::Beta::Agents::Vaults::McpOauthTokenEndpointAuthCreateParam::ClientSecretBasic,
+                        OpenAI::Beta::Agents::Vaults::McpOauthTokenEndpointAuthCreateParam::ClientSecretPost
+                      ),
+                      resource: T.nilable(String),
+                      scope: T.nilable(String)
+                    }
+                  )
+                end
+                def to_hash
+                end
+
+              end
+            end
+
+            class StaticBearer < OpenAI::Internal::Type::BaseModel
+              OrHash = T.type_alias do
+                T.any(
+                  OpenAI::Beta::Agents::Vaults::CredentialAuthCreateParam::StaticBearer,
+                  OpenAI::Internal::AnyHash
+                )
+              end
+
+              # The bearer token to store. This secret is never returned in credential
+              # resources.
+              sig { returns(String) }
+              attr_accessor :token
+
+              # The HTTPS MCP server URL authorized by this credential.
+              sig { returns(String) }
+              attr_accessor :mcp_server_url
+
+              # The type of the object. Always `static_bearer`.
+              sig { returns(Symbol) }
+              attr_accessor :type
+
+              # A bearer token for an MCP server, without automatic OAuth refresh.
+              sig do
+                params(
+
+                  token: String,
+
+                  mcp_server_url: String,
+
+                  type: Symbol
+                )
+                  .returns(T.attached_class)
+              end
+              def self.new(
+
+                # The bearer token to store. This secret is never returned in credential
+                # resources.
+                token:,
+
+                # The HTTPS MCP server URL authorized by this credential.
+                mcp_server_url:,
+
+                # The type of the object. Always `static_bearer`.
+
+                type: :static_bearer
+              )
+              end
+
+              sig do
+                override.returns(
+                  {token: String, mcp_server_url: String, type: Symbol}
+                )
+              end
+              def to_hash
+              end
+
+            end
+
+            sig { override.returns(T::Array[OpenAI::Beta::Agents::Vaults::CredentialAuthCreateParam::Variants]) }
+            def self.variants
+            end
+
+          end
+
+        end
+
+      end
+
+    end
+
+  end
+end

data/rbi/openai/models/beta/agents/vaults/credential_auth_rotate_param.rbi

@@ -0,0 +1,252 @@
+# typed: strong
+
+module OpenAI
+  module Models
+
+    module Beta
+
+      module Agents
+
+        module Vaults
+
+          # Updates to a vault credential without changing its authentication method or MCP
+          # server.
+          module CredentialAuthRotateParam
+            extend OpenAI::Internal::Type::Union
+
+            Variants = T.type_alias do
+              T.any(
+                OpenAI::Beta::Agents::Vaults::CredentialAuthRotateParam::McpOauth,
+                OpenAI::Beta::Agents::Vaults::CredentialAuthRotateParam::StaticBearer
+              )
+            end
+
+            class McpOauth < OpenAI::Internal::Type::BaseModel
+              OrHash = T.type_alias do
+                T.any(
+                  OpenAI::Beta::Agents::Vaults::CredentialAuthRotateParam::McpOauth,
+                  OpenAI::Internal::AnyHash
+                )
+              end
+
+              # The type of the object. Always `mcp_oauth`.
+              sig { returns(Symbol) }
+              attr_accessor :type
+
+              # A write-only replacement OAuth access token.
+              sig { returns(T.nilable(String)) }
+              attr_accessor :access_token
+
+              # The replacement expiry as an RFC 3339 timestamp, or `null` to clear it. Omitting
+              # this field preserves the expiry unless a new access token is supplied, in which
+              # case the expiry is cleared.
+              sig { returns(T.nilable(String)) }
+              attr_accessor :expires_at
+
+              # Updates to an MCP credential's existing OAuth refresh configuration.
+              sig { returns(T.nilable(OpenAI::Beta::Agents::Vaults::CredentialAuthRotateParam::McpOauth::Refresh)) }
+              attr_reader :refresh
+
+              sig {
+                params(
+                  refresh: T.nilable(OpenAI::Beta::Agents::Vaults::CredentialAuthRotateParam::McpOauth::Refresh::OrHash)
+                )
+                  .void
+              }
+              attr_writer :refresh
+
+              # Rotate an OAuth credential for an HTTPS MCP destination.
+              sig do
+                params(
+
+                  access_token: T.nilable(String),
+
+                  expires_at: T.nilable(String),
+
+                  refresh: T.nilable(OpenAI::Beta::Agents::Vaults::CredentialAuthRotateParam::McpOauth::Refresh::OrHash),
+
+                  type: Symbol
+                )
+                  .returns(T.attached_class)
+              end
+              def self.new(
+
+                # A write-only replacement OAuth access token.
+                access_token: nil,
+
+                # The replacement expiry as an RFC 3339 timestamp, or `null` to clear it. Omitting
+                # this field preserves the expiry unless a new access token is supplied, in which
+                # case the expiry is cleared.
+                expires_at: nil,
+
+                # Updates to an MCP credential's existing OAuth refresh configuration.
+                refresh: nil,
+
+                # The type of the object. Always `mcp_oauth`.
+
+                type: :mcp_oauth
+              )
+              end
+
+              sig do
+                override.returns(
+                  {
+                    type: Symbol,
+                    access_token: T.nilable(String),
+                    expires_at: T.nilable(String),
+                    refresh: T.nilable(OpenAI::Beta::Agents::Vaults::CredentialAuthRotateParam::McpOauth::Refresh)
+                  }
+                )
+              end
+              def to_hash
+              end
+
+              class Refresh < OpenAI::Internal::Type::BaseModel
+                OrHash = T.type_alias do
+                  T.any(
+                    OpenAI::Beta::Agents::Vaults::CredentialAuthRotateParam::McpOauth::Refresh,
+                    OpenAI::Internal::AnyHash
+                  )
+                end
+
+                # The replacement refresh token. Omit or pass `null` to keep the stored token.
+                # This secret is never returned in resources.
+                sig { returns(T.nilable(String)) }
+                attr_accessor :refresh_token
+
+                # Replacement space-separated OAuth scopes for refresh requests. Omit to keep the
+                # scopes, or pass `null` to stop sending a scope parameter.
+                sig { returns(T.nilable(String)) }
+                attr_accessor :scope
+
+                # Client-secret updates that preserve the credential's OAuth authentication
+                # method.
+                sig {
+                  returns(
+                    T.nilable(
+                      T.any(
+                        OpenAI::Beta::Agents::Vaults::McpOauthTokenEndpointAuthRotateParam::ClientSecretBasic,
+                        OpenAI::Beta::Agents::Vaults::McpOauthTokenEndpointAuthRotateParam::ClientSecretPost
+                      )
+                    )
+                  )
+                }
+                attr_accessor :token_endpoint_auth
+
+                # Updates to an MCP credential's existing OAuth refresh configuration.
+                sig do
+                  params(
+
+                    refresh_token: T.nilable(String),
+
+                    scope: T.nilable(String),
+
+                    token_endpoint_auth: T.nilable(
+                      T.any(
+                        OpenAI::Beta::Agents::Vaults::McpOauthTokenEndpointAuthRotateParam::ClientSecretBasic::OrHash,
+                        OpenAI::Beta::Agents::Vaults::McpOauthTokenEndpointAuthRotateParam::ClientSecretPost::OrHash
+                      )
+                    )
+                  )
+                    .returns(T.attached_class)
+                end
+                def self.new(
+
+                  # The replacement refresh token. Omit or pass `null` to keep the stored token.
+                  # This secret is never returned in resources.
+                  refresh_token: nil,
+
+                  # Replacement space-separated OAuth scopes for refresh requests. Omit to keep the
+                  # scopes, or pass `null` to stop sending a scope parameter.
+                  scope: nil,
+
+                  # Client-secret updates that preserve the credential's OAuth authentication
+                  # method.
+
+                  token_endpoint_auth: nil
+                )
+                end
+
+                sig do
+                  override.returns(
+                    {
+                      refresh_token: T.nilable(String),
+                      scope: T.nilable(String),
+                      token_endpoint_auth: T.nilable(
+                        T.any(
+                          OpenAI::Beta::Agents::Vaults::McpOauthTokenEndpointAuthRotateParam::ClientSecretBasic,
+                          OpenAI::Beta::Agents::Vaults::McpOauthTokenEndpointAuthRotateParam::ClientSecretPost
+                        )
+                      )
+                    }
+                  )
+                end
+                def to_hash
+                end
+
+              end
+            end
+
+            class StaticBearer < OpenAI::Internal::Type::BaseModel
+              OrHash = T.type_alias do
+                T.any(
+                  OpenAI::Beta::Agents::Vaults::CredentialAuthRotateParam::StaticBearer,
+                  OpenAI::Internal::AnyHash
+                )
+              end
+
+              # The replacement bearer token. This secret is never returned in credential
+              # resources.
+              sig { returns(String) }
+              attr_accessor :token
+
+              # The type of the object. Always `static_bearer`.
+              sig { returns(Symbol) }
+              attr_accessor :type
+
+              # Replace the bearer token for the credential's MCP server.
+              sig do
+                params(
+
+                  token: String,
+
+                  type: Symbol
+                )
+                  .returns(T.attached_class)
+              end
+              def self.new(
+
+                # The replacement bearer token. This secret is never returned in credential
+                # resources.
+                token:,
+
+                # The type of the object. Always `static_bearer`.
+
+                type: :static_bearer
+              )
+              end
+
+              sig do
+                override.returns(
+                  {token: String, type: Symbol}
+                )
+              end
+              def to_hash
+              end
+
+            end
+
+            sig { override.returns(T::Array[OpenAI::Beta::Agents::Vaults::CredentialAuthRotateParam::Variants]) }
+            def self.variants
+            end
+
+          end
+
+        end
+
+      end
+
+    end
+
+  end
+end

data/rbi/openai/models/beta/agents/vaults/credential_create_params.rbi

@@ -0,0 +1,99 @@
+# typed: strong
+
+module OpenAI
+  module Models
+
+    module Beta
+
+      module Agents
+
+        module Vaults
+
+          class CredentialCreateParams < OpenAI::Internal::Type::BaseModel
+
+            extend OpenAI::Internal::Type::RequestParameters::Converter
+            include OpenAI::Internal::Type::RequestParameters
+
+            OrHash = T.type_alias do
+              T.any(
+                OpenAI::Beta::Agents::Vaults::CredentialCreateParams,
+                OpenAI::Internal::AnyHash
+              )
+            end
+
+            sig { returns(String) }
+            attr_accessor :vault_id
+
+            # The authentication method and secret values to store for the MCP server.
+            sig {
+              returns(
+                T.any(
+                  OpenAI::Beta::Agents::Vaults::CredentialAuthCreateParam::McpOauth,
+                  OpenAI::Beta::Agents::Vaults::CredentialAuthCreateParam::StaticBearer
+                )
+              )
+            }
+            attr_accessor :auth
+
+            # The name is trimmed before storage. It must contain 1 to 256 UTF-8 bytes after
+            # trimming.
+            sig { returns(String) }
+            attr_accessor :name
+
+            sig do
+              params(
+
+                vault_id: String,
+
+                auth: T.any(
+                  OpenAI::Beta::Agents::Vaults::CredentialAuthCreateParam::McpOauth::OrHash,
+                  OpenAI::Beta::Agents::Vaults::CredentialAuthCreateParam::StaticBearer::OrHash
+                ),
+
+                name: String,
+
+                request_options: OpenAI::RequestOptions::OrHash
+              )
+                .returns(T.attached_class)
+            end
+            def self.new(
+
+              vault_id:,
+
+              # The authentication method and secret values to store for the MCP server.
+              auth:,
+
+              # The name is trimmed before storage. It must contain 1 to 256 UTF-8 bytes after
+              # trimming.
+              name:,
+
+              request_options: {}
+            )
+            end
+
+            sig do
+              override.returns(
+                {
+                  vault_id: String,
+                  auth: T.any(
+                    OpenAI::Beta::Agents::Vaults::CredentialAuthCreateParam::McpOauth,
+                    OpenAI::Beta::Agents::Vaults::CredentialAuthCreateParam::StaticBearer
+                  ),
+                  name: String,
+                  request_options: OpenAI::RequestOptions
+                }
+              )
+            end
+            def to_hash
+            end
+
+          end
+
+        end
+
+      end
+
+    end
+
+  end
+end

data/rbi/openai/models/beta/agents/vaults/credential_delete_params.rbi

@@ -0,0 +1,68 @@
+# typed: strong
+
+module OpenAI
+  module Models
+
+    module Beta
+
+      module Agents
+
+        module Vaults
+
+          class CredentialDeleteParams < OpenAI::Internal::Type::BaseModel
+
+            extend OpenAI::Internal::Type::RequestParameters::Converter
+            include OpenAI::Internal::Type::RequestParameters
+
+            OrHash = T.type_alias do
+              T.any(
+                OpenAI::Beta::Agents::Vaults::CredentialDeleteParams,
+                OpenAI::Internal::AnyHash
+              )
+            end
+
+            sig { returns(String) }
+            attr_accessor :vault_id
+
+            sig { returns(String) }
+            attr_accessor :credential_id
+
+            sig do
+              params(
+
+                vault_id: String,
+
+                credential_id: String,
+
+                request_options: OpenAI::RequestOptions::OrHash
+              )
+                .returns(T.attached_class)
+            end
+            def self.new(
+
+              vault_id:,
+
+              credential_id:,
+
+              request_options: {}
+            )
+            end
+
+            sig do
+              override.returns(
+                {vault_id: String, credential_id: String, request_options: OpenAI::RequestOptions}
+              )
+            end
+            def to_hash
+            end
+
+          end
+
+        end
+
+      end
+
+    end
+
+  end
+end