stytch 10.42.0 → 11.1.0

data/lib/stytch/b2b_sso.rb

@@ -178,7 +178,7 @@ module StytchB2B
     # locale::
     #   If the Member needs to complete an MFA step, and the Member has a phone number, this endpoint will pre-emptively send a one-time passcode (OTP) to the Member's phone number. The locale argument will be used to determine which language to use when sending the passcode.
     #
-    # Parameter is a [IETF BCP 47 language tag](https://www.w3.org/International/articles/language-tags/), e.g. `"en"`.
+    # Parameter is an [IETF BCP 47 language tag](https://www.w3.org/International/articles/language-tags/), e.g. `"en"`.
     #
     # Currently supported languages are English (`"en"`), Spanish (`"es"`), and Brazilian Portuguese (`"pt-br"`); if no value is provided, the copy defaults to English.
     #
@@ -239,6 +239,9 @@ module StytchB2B
     # member_device::
     #   If a valid `telemetry_id` was passed in the request and the [Fingerprint Lookup API](https://stytch.com/docs/fraud/api/fingerprint-lookup) returned results, the `member_device` response field will contain information about the member's device attributes.
     #   The type of this field is nilable +DeviceInfo+ (+object+).
+    # intermediate_session_token_expires_at::
+    #   (no documentation yet)
+    #   The type of this field is nilable +String+.
     def authenticate(
       sso_token:,
       pkce_code_verifier: nil,
@@ -335,7 +338,7 @@ module StytchB2B
       #   The HTTP status code of the response. Stytch follows standard HTTP response status code patterns, e.g. 2XX values equate to success, 3XX values are redirects, 4XX are client errors, and 5XX are server errors.
       #   The type of this field is +Integer+.
       # connection::
-      #   The `OIDC Connection` object affected by this API call. See the [OIDC Connection Object](https://stytch.com/docs/b2b/api/oidc-connection-object) for complete response field details.
+      #   The [OIDC Connection Object](https://stytch.com/docs/b2b/api/oidc-connection-object).
       #   The type of this field is nilable +OIDCConnection+ (+object+).
       #
       # == Method Options:
@@ -426,7 +429,7 @@ module StytchB2B
       #   The HTTP status code of the response. Stytch follows standard HTTP response status code patterns, e.g. 2XX values equate to success, 3XX values are redirects, 4XX are client errors, and 5XX are server errors.
       #   The type of this field is +Integer+.
       # connection::
-      #   The `OIDC Connection` object affected by this API call. See the [OIDC Connection Object](https://stytch.com/docs/b2b/api/oidc-connection-object) for complete response field details.
+      #   The [OIDC Connection Object](https://stytch.com/docs/b2b/api/oidc-connection-object).
       #   The type of this field is nilable +OIDCConnection+ (+object+).
       # warning::
       #   If it is not possible to resolve the well-known metadata document from the OIDC issuer, this field will explain what went wrong if the request is successful otherwise. In other words, even if the overall request succeeds, there could be relevant warnings related to the connection update.
@@ -595,7 +598,7 @@ module StytchB2B
       #   The HTTP status code of the response. Stytch follows standard HTTP response status code patterns, e.g. 2XX values equate to success, 3XX values are redirects, 4XX are client errors, and 5XX are server errors.
       #   The type of this field is +Integer+.
       # connection::
-      #   The `SAML Connection` object affected by this API call. See the [SAML Connection Object](https://stytch.com/docs/b2b/api/saml-connection-object) for complete response field details.
+      #   The [SAML Connection Object](https://stytch.com/docs/b2b/api/saml-connection-object)
       #   The type of this field is nilable +SAMLConnection+ (+object+).
       #
       # == Method Options:
@@ -691,7 +694,7 @@ module StytchB2B
       #   The HTTP status code of the response. Stytch follows standard HTTP response status code patterns, e.g. 2XX values equate to success, 3XX values are redirects, 4XX are client errors, and 5XX are server errors.
       #   The type of this field is +Integer+.
       # connection::
-      #   The `SAML Connection` object affected by this API call. See the [SAML Connection Object](https://stytch.com/docs/b2b/api/saml-connection-object) for complete response field details.
+      #   The [SAML Connection Object](https://stytch.com/docs/b2b/api/saml-connection-object)
       #   The type of this field is nilable +SAMLConnection+ (+object+).
       #
       # == Method Options:
@@ -766,7 +769,7 @@ module StytchB2B
       #   The HTTP status code of the response. Stytch follows standard HTTP response status code patterns, e.g. 2XX values equate to success, 3XX values are redirects, 4XX are client errors, and 5XX are server errors.
       #   The type of this field is +Integer+.
       # connection::
-      #   The `SAML Connection` object affected by this API call. See the [SAML Connection Object](https://stytch.com/docs/b2b/api/saml-connection-object) for complete response field details.
+      #   The [SAML Connection Object](https://stytch.com/docs/b2b/api/saml-connection-object)
       #   The type of this field is nilable +SAMLConnection+ (+object+).
       #
       # == Method Options:
@@ -941,7 +944,7 @@ module StytchB2B
       #   The HTTP status code of the response. Stytch follows standard HTTP response status code patterns, e.g. 2XX values equate to success, 3XX values are redirects, 4XX are client errors, and 5XX are server errors.
       #   The type of this field is +Integer+.
       # connection::
-      #   The `External Connection` object affected by this API call. See the [External Connection Object](https://stytch.com/docs/b2b/api/external-connection-object) for complete response field details.
+      #   The [External Connection Object](https://stytch.com/docs/b2b/api/external-connection-object).
       #   The type of this field is nilable +Connection+ (+object+).
       #
       # == Method Options:
@@ -1001,7 +1004,7 @@ module StytchB2B
       #   The HTTP status code of the response. Stytch follows standard HTTP response status code patterns, e.g. 2XX values equate to success, 3XX values are redirects, 4XX are client errors, and 5XX are server errors.
       #   The type of this field is +Integer+.
       # connection::
-      #   The `External Connection` object affected by this API call. See the [External Connection Object](https://stytch.com/docs/b2b/api/external-connection-object) for complete response field details.
+      #   The [External Connection Object](https://stytch.com/docs/b2b/api/external-connection-object).
       #   The type of this field is nilable +Connection+ (+object+).
       #
       # == Method Options:

data/lib/stytch/connected_apps.rb

@@ -92,6 +92,9 @@ module Stytch
       # bypass_consent_for_offline_access::
       #   Valid for first party clients only. If true, the client does not need to request explicit user consent for the `offline_access` scope.
       #   The type of this field is nilable +Boolean+.
+      # id_token_template_content::
+      #   (no documentation yet)
+      #   The type of this field is nilable +String+.
       #
       # == Returns:
       # An object with the following fields:
@@ -115,7 +118,8 @@ module Stytch
         access_token_template_content: nil,
         post_logout_redirect_urls: nil,
         logo_url: nil,
-        bypass_consent_for_offline_access: nil
+        bypass_consent_for_offline_access: nil,
+        id_token_template_content: nil
       )
         headers = {}
         request = {}
@@ -129,6 +133,7 @@ module Stytch
         request[:post_logout_redirect_urls] = post_logout_redirect_urls unless post_logout_redirect_urls.nil?
         request[:logo_url] = logo_url unless logo_url.nil?
         request[:bypass_consent_for_offline_access] = bypass_consent_for_offline_access unless bypass_consent_for_offline_access.nil?
+        request[:id_token_template_content] = id_token_template_content unless id_token_template_content.nil?
 
         put_request("/v1/connected_apps/clients/#{client_id}", request, headers)
       end
@@ -232,6 +237,9 @@ module Stytch
       # bypass_consent_for_offline_access::
       #   Valid for first party clients only. If true, the client does not need to request explicit user consent for the `offline_access` scope.
       #   The type of this field is nilable +Boolean+.
+      # id_token_template_content::
+      #   (no documentation yet)
+      #   The type of this field is nilable +String+.
       #
       # == Returns:
       # An object with the following fields:
@@ -255,7 +263,8 @@ module Stytch
         access_token_template_content: nil,
         post_logout_redirect_urls: nil,
         logo_url: nil,
-        bypass_consent_for_offline_access: nil
+        bypass_consent_for_offline_access: nil,
+        id_token_template_content: nil
       )
         headers = {}
         request = {
@@ -271,6 +280,7 @@ module Stytch
         request[:post_logout_redirect_urls] = post_logout_redirect_urls unless post_logout_redirect_urls.nil?
         request[:logo_url] = logo_url unless logo_url.nil?
         request[:bypass_consent_for_offline_access] = bypass_consent_for_offline_access unless bypass_consent_for_offline_access.nil?
+        request[:id_token_template_content] = id_token_template_content unless id_token_template_content.nil?
 
         post_request('/v1/connected_apps/clients', request, headers)
       end

data/lib/stytch/m2m.rb

@@ -289,9 +289,9 @@ module Stytch
         post_request('/v1/m2m/clients/search', request, headers)
       end
 
-      # Updates an existing M2M Client. You can use this endpoint to activate or deactivate a M2M Client by changing its `status`. A deactivated M2M Client will not be allowed to perform future token exchange flows until it is reactivated.
+      # Updates an existing M2M Client. You can use this endpoint to activate or deactivate an M2M Client by changing its `status`. A deactivated M2M Client will not be allowed to perform future token exchange flows until it is reactivated.
       #
-      # **Important:** Deactivating a M2M Client will not invalidate any existing JWTs issued to the client, only prevent it from receiving new ones.
+      # **Important:** Deactivating an M2M Client will not invalidate any existing JWTs issued to the client, only prevent it from receiving new ones.
       # To protect more-sensitive routes, pass a lower `max_token_age` value when[authenticating the token](https://stytch.com/docs/b2b/api/authenticate-m2m-token)[authenticating the token](https://stytch.com/docs/api/authenticate-m2m-token).
       #
       # == Parameters:
@@ -346,7 +346,7 @@ module Stytch
 
       # Deletes the M2M Client.
       #
-      # **Important:** Deleting a M2M Client will not invalidate any existing JWTs issued to the client, only prevent it from receiving new ones.
+      # **Important:** Deleting an M2M Client will not invalidate any existing JWTs issued to the client, only prevent it from receiving new ones.
       # To protect more-sensitive routes, pass a lower `max_token_age` value when[authenticating the token](https://stytch.com/docs/b2b/api/authenticate-m2m-token)[authenticating the token](https://stytch.com/docs/api/authenticate-m2m-token).
       #
       # == Parameters:

data/lib/stytch/magic_links.rb

@@ -126,12 +126,22 @@ module Stytch
       post_request('/v1/magic_links/authenticate', request, headers)
     end
 
-    # Create an Embeddable Magic Link token for a User. Access to this endpoint is restricted. To enable it, please send us a note at support@stytch.com.
+    # Create an Embeddable Magic Link token for a User.
     #
-    # ### Next steps
-    # Send the returned `token` value to the end user in a link which directs to your application. When the end user follows your link, collect the token, and call [Authenticate Magic Link](https://stytch.com/docs/api/authenticate-magic-link) to complete authentication.
+    # ### Important usage notes
     #
-    # **Note:** Authenticating an Embeddable Magic Link token will **not** result in any of the Stytch User's factors (email address or phone number) being marked as verified, as Stytch cannot confirm where the user received the token.
+    # Carefully review the following notes before using Embeddable Magic Links:
+    #
+    # * Embeddable Magic Link tokens are **sensitive values**. You should handle and store them securely.
+    # * Authenticating an Embeddable Magic Link token will not mark any of a user's delivery factors (email address or phone number) as verified, since we cannot confirm how the token was sent to the user.
+    # * Embeddable Magic Links are only available in our Consumer API, and not our B2B API.
+    #
+    # When sending Embeddable Magic Links via email:
+    #
+    # * Deliverability is paramount. Carefully test your email copy to ensure it reaches your users' inboxes. Small changes can result in your emails being sent to spam.
+    # * In some cases, email security bots may follow links within incoming emails before your users open them. This consumes the Embeddable Magic Link token, preventing the user from logging in when they later click the link. Our Email Magic Links product automatically prevents this (details [here](https://stytch.com/docs/consumer-auth/authentication/magic-links/redirect-routing)). However, when sending your own emails containing Embeddable Magic Links, you'll be responsible for detecting and stopping bot traffic using tools like CAPTCHA or [Device Fingerprinting](https://stytch.com/docs/fraud-risk/device-fingerprinting/overview).
+    #
+    # We also recommend checking out our [Trusted Auth Tokens](https://stytch.com/docs/consumer-auth/authentication/trusted-auth-tokens/overview) product, which is available in both our Consumer and B2B APIs and can be a better fit for some use cases.
     #
     # == Parameters:
     # user_id::
@@ -193,7 +203,7 @@ module Stytch
       #   The email address of the User to send the Magic Link to.
       #   The type of this field is +String+.
       # login_template_id::
-      #   Use a custom template for login emails. By default, it will use your default email template. The template must be a template using our built-in customizations or a custom HTML email for Magic links - Login.
+      #   Use a custom template for login emails. By default, it will use your default email template. Templates can be added in the [Stytch dashboard](https://stytch.com/dashboard/templates) using our built-in customization options or custom HTML templates with type “Magic links - Login”.
       #   The type of this field is nilable +String+.
       # attributes::
       #   Provided attributes to help with fraud detection. These values are pulled and passed into Stytch endpoints by your application.
@@ -223,7 +233,7 @@ module Stytch
       #   The `session_jwt` of the user to associate the email with.
       #   The type of this field is nilable +String+.
       # locale::
-      #   Used to determine which language to use when sending the user this delivery method. Parameter is a [IETF BCP 47 language tag](https://www.w3.org/International/articles/language-tags/), e.g. `"en"`.
+      #   Used to determine which language to use when sending the user this delivery method. Parameter is an [IETF BCP 47 language tag](https://www.w3.org/International/articles/language-tags/), e.g. `"en"`.
       #
       # Currently supported languages are English (`"en"`), Spanish (`"es"`), French (`"fr"`) and Brazilian Portuguese (`"pt-br"`); if no value is provided, the copy defaults to English.
       #
@@ -231,7 +241,7 @@ module Stytch
       #
       #   The type of this field is nilable +SendRequestLocale+ (string enum).
       # signup_template_id::
-      #   Use a custom template for sign-up emails. By default, it will use your default email template. The template must be a template using our built-in customizations or a custom HTML email for Magic links - Sign-up.
+      #   Use a custom template for sign-up emails. By default, it will use your default email template. Templates can be added in the [Stytch dashboard](https://stytch.com/dashboard/templates) using our built-in customization options or custom HTML templates with type “Magic links - Sign-up”.
       #   The type of this field is nilable +String+.
       #
       # == Returns:
@@ -305,10 +315,10 @@ module Stytch
       #   Set the expiration for the sign-up email magic link, in minutes. By default, it expires in 1 week. The minimum expiration is 5 minutes and the maximum is 7 days (10080 mins).
       #   The type of this field is nilable +Integer+.
       # login_template_id::
-      #   Use a custom template for login emails. By default, it will use your default email template. The template must be a template using our built-in customizations or a custom HTML email for Magic links - Login.
+      #   Use a custom template for login emails. By default, it will use your default email template. Templates can be added in the [Stytch dashboard](https://stytch.com/dashboard/templates) using our built-in customization options or custom HTML templates with type “Magic links - Login”.
       #   The type of this field is nilable +String+.
       # signup_template_id::
-      #   Use a custom template for sign-up emails. By default, it will use your default email template. The template must be a template using our built-in customizations or a custom HTML email for Magic links - Sign-up.
+      #   Use a custom template for sign-up emails. By default, it will use your default email template. Templates can be added in the [Stytch dashboard](https://stytch.com/dashboard/templates) using our built-in customization options or custom HTML templates with type “Magic links - Sign-up”.
       #   The type of this field is nilable +String+.
       # attributes::
       #   Provided attributes to help with fraud detection. These values are pulled and passed into Stytch endpoints by your application.
@@ -324,7 +334,7 @@ module Stytch
       #   A base64url encoded SHA256 hash of a one time secret used to validate that the request starts and ends on the same device.
       #   The type of this field is nilable +String+.
       # locale::
-      #   Used to determine which language to use when sending the user this delivery method. Parameter is a [IETF BCP 47 language tag](https://www.w3.org/International/articles/language-tags/), e.g. `"en"`.
+      #   Used to determine which language to use when sending the user this delivery method. Parameter is an [IETF BCP 47 language tag](https://www.w3.org/International/articles/language-tags/), e.g. `"en"`.
       #
       # Currently supported languages are English (`"en"`), Spanish (`"es"`), French (`"fr"`) and Brazilian Portuguese (`"pt-br"`); if no value is provided, the copy defaults to English.
       #
@@ -390,7 +400,7 @@ module Stytch
       #   The email address of the User to send the invite Magic Link to.
       #   The type of this field is +String+.
       # invite_template_id::
-      #   Use a custom template for invite emails. By default, it will use your default email template. The template must be a template using our built-in customizations or a custom HTML email for Magic links - Invite.
+      #   Use a custom template for invite emails. By default, it will use your default email template. Templates can be added in the [Stytch dashboard](https://stytch.com/dashboard/templates) using our built-in customization options or custom HTML templates with type “Magic links - Invite”.
       #   The type of this field is nilable +String+.
       # attributes::
       #   Provided attributes to help with fraud detection. These values are pulled and passed into Stytch endpoints by your application.
@@ -405,7 +415,7 @@ module Stytch
       #   Set the expiration for the email magic link, in minutes. By default, it expires in 1 hour. The minimum expiration is 5 minutes and the maximum is 7 days (10080 mins).
       #   The type of this field is nilable +Integer+.
       # locale::
-      #   Used to determine which language to use when sending the user this delivery method. Parameter is a [IETF BCP 47 language tag](https://www.w3.org/International/articles/language-tags/), e.g. `"en"`.
+      #   Used to determine which language to use when sending the user this delivery method. Parameter is an [IETF BCP 47 language tag](https://www.w3.org/International/articles/language-tags/), e.g. `"en"`.
       #
       # Currently supported languages are English (`"en"`), Spanish (`"es"`), French (`"fr"`) and Brazilian Portuguese (`"pt-br"`); if no value is provided, the copy defaults to English.
       #

data/lib/stytch/otps.rb

@@ -161,7 +161,7 @@ module Stytch
       #   Provided attributes to help with fraud detection. These values are pulled and passed into Stytch endpoints by your application.
       #   The type of this field is nilable +Attributes+ (+object+).
       # locale::
-      #   Used to determine which language to use when sending the user this delivery method. Parameter is a [IETF BCP 47 language tag](https://www.w3.org/International/articles/language-tags/), e.g. `"en"`.
+      #   Used to determine which language to use when sending the user this delivery method. Parameter is an [IETF BCP 47 language tag](https://www.w3.org/International/articles/language-tags/), e.g. `"en"`.
       #
       # Currently supported languages are English (`"en"`), Spanish (`"es"`), French (`"fr"`) and Brazilian Portuguese (`"pt-br"`); if no value is provided, the copy defaults to English.
       #
@@ -246,7 +246,7 @@ module Stytch
       #         an account for them.
       #   The type of this field is nilable +Boolean+.
       # locale::
-      #   Used to determine which language to use when sending the user this delivery method. Parameter is a [IETF BCP 47 language tag](https://www.w3.org/International/articles/language-tags/), e.g. `"en"`.
+      #   Used to determine which language to use when sending the user this delivery method. Parameter is an [IETF BCP 47 language tag](https://www.w3.org/International/articles/language-tags/), e.g. `"en"`.
       #
       # Currently supported languages are English (`"en"`), Spanish (`"es"`), French (`"fr"`) and Brazilian Portuguese (`"pt-br"`); if no value is provided, the copy defaults to English.
       #
@@ -324,7 +324,7 @@ module Stytch
       #   Provided attributes to help with fraud detection. These values are pulled and passed into Stytch endpoints by your application.
       #   The type of this field is nilable +Attributes+ (+object+).
       # locale::
-      #   Used to determine which language to use when sending the user this delivery method. Parameter is a [IETF BCP 47 language tag](https://www.w3.org/International/articles/language-tags/), e.g. `"en"`.
+      #   Used to determine which language to use when sending the user this delivery method. Parameter is an [IETF BCP 47 language tag](https://www.w3.org/International/articles/language-tags/), e.g. `"en"`.
       #
       # Currently supported languages are English (`"en"`), Spanish (`"es"`), French (`"fr"`) and Brazilian Portuguese (`"pt-br"`); if no value is provided, the copy defaults to English.
       #
@@ -405,7 +405,7 @@ module Stytch
       #         an account for them.
       #   The type of this field is nilable +Boolean+.
       # locale::
-      #   Used to determine which language to use when sending the user this delivery method. Parameter is a [IETF BCP 47 language tag](https://www.w3.org/International/articles/language-tags/), e.g. `"en"`.
+      #   Used to determine which language to use when sending the user this delivery method. Parameter is an [IETF BCP 47 language tag](https://www.w3.org/International/articles/language-tags/), e.g. `"en"`.
       #
       # Currently supported languages are English (`"en"`), Spanish (`"es"`), French (`"fr"`) and Brazilian Portuguese (`"pt-br"`); if no value is provided, the copy defaults to English.
       #
@@ -476,7 +476,7 @@ module Stytch
       #   Provided attributes to help with fraud detection. These values are pulled and passed into Stytch endpoints by your application.
       #   The type of this field is nilable +Attributes+ (+object+).
       # locale::
-      #   Used to determine which language to use when sending the user this delivery method. Parameter is a [IETF BCP 47 language tag](https://www.w3.org/International/articles/language-tags/), e.g. `"en"`.
+      #   Used to determine which language to use when sending the user this delivery method. Parameter is an [IETF BCP 47 language tag](https://www.w3.org/International/articles/language-tags/), e.g. `"en"`.
       #
       # Currently supported languages are English (`"en"`), Spanish (`"es"`), French (`"fr"`) and Brazilian Portuguese (`"pt-br"`); if no value is provided, the copy defaults to English.
       #
@@ -493,10 +493,10 @@ module Stytch
       #   The `session_jwt` associated with a User's existing Session.
       #   The type of this field is nilable +String+.
       # login_template_id::
-      #   Use a custom template for login emails. By default, it will use your default email template. The template must be a template using our built-in customizations or a custom HTML email for OTP - Login.
+      #   Use a custom template for login emails. By default, it will use your default email template. Templates can be added in the [Stytch dashboard](https://stytch.com/dashboard/templates) using our built-in customization options or custom HTML templates with type “OTP - Login”.
       #   The type of this field is nilable +String+.
       # signup_template_id::
-      #   Use a custom template for sign-up emails. By default, it will use your default email template. The template must be a template using our built-in customizations or a custom HTML email for OTP - Sign-up.
+      #   Use a custom template for sign-up emails. By default, it will use your default email template. Templates can be added in the [Stytch dashboard](https://stytch.com/dashboard/templates) using our built-in customization options or custom HTML templates with type “OTP - Sign-up”.
       #   The type of this field is nilable +String+.
       #
       # == Returns:
@@ -564,7 +564,7 @@ module Stytch
       #         an account for them.
       #   The type of this field is nilable +Boolean+.
       # locale::
-      #   Used to determine which language to use when sending the user this delivery method. Parameter is a [IETF BCP 47 language tag](https://www.w3.org/International/articles/language-tags/), e.g. `"en"`.
+      #   Used to determine which language to use when sending the user this delivery method. Parameter is an [IETF BCP 47 language tag](https://www.w3.org/International/articles/language-tags/), e.g. `"en"`.
       #
       # Currently supported languages are English (`"en"`), Spanish (`"es"`), French (`"fr"`) and Brazilian Portuguese (`"pt-br"`); if no value is provided, the copy defaults to English.
       #
@@ -572,10 +572,10 @@ module Stytch
       #
       #   The type of this field is nilable +LoginOrCreateRequestLocale+ (string enum).
       # login_template_id::
-      #   Use a custom template for login emails. By default, it will use your default email template. The template must be a template using our built-in customizations or a custom HTML email for Magic links - Login.
+      #   Use a custom template for login emails. By default, it will use your default email template. Templates can be added in the [Stytch dashboard](https://stytch.com/dashboard/templates) using our built-in customization options or custom HTML templates with type “Magic links - Login”.
       #   The type of this field is nilable +String+.
       # signup_template_id::
-      #   Use a custom template for sign-up emails. By default, it will use your default email template. The template must be a template using our built-in customizations or a custom HTML email for Magic links - Sign-up.
+      #   Use a custom template for sign-up emails. By default, it will use your default email template. Templates can be added in the [Stytch dashboard](https://stytch.com/dashboard/templates) using our built-in customization options or custom HTML templates with type “Magic links - Sign-up”.
       #   The type of this field is nilable +String+.
       #
       # == Returns:

data/lib/stytch/passwords.rb

@@ -242,7 +242,7 @@ module Stytch
     #   Globally unique UUID that is returned with every API call. This value is important to log for debugging purposes; we may ask for this value to help identify a specific API call when helping you debug an issue.
     #   The type of this field is +String+.
     # valid_password::
-    #   Returns `true` if the password passes our password validation. We offer two validation options, [zxcvbn](https://stytch.com/docs/guides/passwords/strength-policy) is the default option which offers a high level of sophistication. We also offer [LUDS](https://stytch.com/docs/guides/passwords/strength-policy). If an email address is included in the call we also require that the password hasn't been compromised using built-in breach detection powered by [HaveIBeenPwned](https://haveibeenpwned.com/).
+    #   Returns `true` if the password passes our password validation. We offer two validation options, [zxcvbn](https://stytch.com/docs/guides/passwords/strength-policy) is the default option which offers a high level of sophistication. We also offer [LUDS](https://stytch.com/docs/guides/passwords/strength-policy) which is less sophisticated but easier to understand. If an email address is included in the call we also require that the password hasn't been compromised using built-in breach detection powered by [HaveIBeenPwned](https://haveibeenpwned.com/).
     #   The type of this field is +Boolean+.
     # score::
     #   The score of the password determined by [zxcvbn](https://github.com/dropbox/zxcvbn). Values will be between 1 and 4, a 3 or greater is required to pass validation.
@@ -254,7 +254,7 @@ module Stytch
     #   The strength policy type enforced, either `zxcvbn` or `luds`.
     #   The type of this field is +String+.
     # breach_detection_on_create::
-    #   Will return `true` if breach detection will be evaluated. By default this option is enabled. This option can be disabled by contacting [support@stytch.com](mailto:support@stytch.com?subject=Password%20strength%20configuration). If this value is `false` then `breached_password` will always be `false` as well.
+    #   Will return `true` if breach detection will be evaluated. By default this option is enabled. This option can be disabled in the [dashboard](https://stytch.com/dashboard/password-strength-config#breach-detection). If this value is `false` then `breached_password` will always be `false` as well.
     #   The type of this field is +Boolean+.
     # status_code::
     #   The HTTP status code of the response. Stytch follows standard HTTP response status code patterns, e.g. 2XX values equate to success, 3XX values are redirects, 4XX are client errors, and 5XX are server errors.
@@ -411,11 +411,9 @@ module Stytch
       #   The email of the User that requested the password reset.
       #   The type of this field is +String+.
       # reset_password_redirect_url::
-      #   The url that the user clicks from the password reset email to finish the reset password flow.
-      #   This should be a url that your app receives and parses before showing your app's reset password page.
-      #   After the user submits a new password to your app, it should send an API request to complete the password reset process.
-      #   If this value is not passed, the default reset password redirect URL that you set in your Dashboard is used.
-      #   If you have not set a default reset password redirect URL, an error is returned.
+      #   The URL that the User is redirected to from the reset password magic link. This URL should display your application's reset password page.
+      #   Before rendering the reset page, extract the `token` from the query parameters. On the reset page, collect the new password and complete the flow by calling the corresponding Password Reset by Email endpoint.
+      #   If this parameter is not specified, the default Reset Password redirect URL configured in the Dashboard will be used. If you have not set a default Reset Password redirect URL, an error is returned.
       #   The type of this field is nilable +String+.
       # reset_password_expiration_minutes::
       #   Set the expiration for the password reset, in minutes. By default, it expires in 30 minutes.
@@ -433,7 +431,7 @@ module Stytch
       #       After Users are redirected to the login redirect URL, your application should retrieve the `token` value from the URL parameters and call the [Magic Link Authenticate endpoint](https://stytch.com/docs/api/authenticate-magic-link) to log the User in without requiring a password reset. If this value is not provided, your project's default login redirect URL will be used. If you have not set a default login redirect URL, an error will be returned.
       #   The type of this field is nilable +String+.
       # locale::
-      #   Used to determine which language to use when sending the user this delivery method. Parameter is a [IETF BCP 47 language tag](https://www.w3.org/International/articles/language-tags/), e.g. `"en"`.
+      #   Used to determine which language to use when sending the user this delivery method. Parameter is an [IETF BCP 47 language tag](https://www.w3.org/International/articles/language-tags/), e.g. `"en"`.
       #
       # Currently supported languages are English (`"en"`), Spanish (`"es"`), French (`"fr"`) and Brazilian Portuguese (`"pt-br"`); if no value is provided, the copy defaults to English.
       #
@@ -442,7 +440,7 @@ module Stytch
       #   The type of this field is nilable +ResetStartRequestLocale+ (string enum).
       # reset_password_template_id::
       #   Use a custom template for password reset emails. By default, it will use your default email template.
-      #   The template must be a template using our built-in customizations or a custom HTML email for Passwords - Password reset.
+      #   Templates can be added in the [Stytch dashboard](https://stytch.com/dashboard/templates) using our built-in customization options or custom HTML templates with type “Passwords - Password reset”.
       #   The type of this field is nilable +String+.
       #
       # == Returns:

data/lib/stytch/rbac_local.rb

@@ -9,6 +9,10 @@ module Stytch
       @rbac_client = rbac_client
       @policy_last_update = 0
       @cached_policy = nil
+      @cached_org_policies = {}
+      # TTL, in seconds, before a cached policy is considered stale
+      # and should be refreshed. Amounts to 5 minutes.
+      @cache_ttl = 300
     end
 
     def reload_policy
@@ -16,11 +20,27 @@ module Stytch
       @policy_last_update = Time.now.to_i
     end
 
+    def reload_org_policy(organization_id:)
+      @cached_org_policies[organization_id] = CachedOrgPolicy.new(
+        org_policy: @rbac_client.organizations.get_org_policy(organization_id: organization_id)
+      )
+    end
+
     def get_policy(invalidate: false)
-      reload_policy if invalidate || @cached_policy.nil? || @policy_last_update < Time.now.to_i - 300
+      reload_policy if invalidate || @cached_policy.nil? || @policy_last_update < Time.now.to_i - @cache_ttl
       @cached_policy
     end
 
+    def get_org_policy(organization_id:, invalidate: false)
+      is_missing = @cached_org_policies[organization_id].nil?
+      is_stale = !is_missing && @cached_org_policies[organization_id].last_update < Time.now.to_i - @cache_ttl
+      reload_org_policy(organization_id: organization_id) if invalidate || is_missing || is_stale
+
+      return { 'roles' => [] } if @cached_org_policies[organization_id].nil?
+
+      @cached_org_policies[organization_id].org_policy
+    end
+
     # Performs an authorization check against the project's policy and a set of roles. If the
     # check succeeds, this method will return. If the check fails, a PermissionError
     # will be raised. It's also possible for a TenancyError to be raised if the
@@ -34,19 +54,18 @@ module Stytch
       raise Stytch::TenancyError.new(subject_org_id, authorization_check['organization_id']) if subject_org_id != authorization_check['organization_id']
 
       policy = get_policy
+      org_policy = get_org_policy(organization_id: subject_org_id)
+      all_roles = policy['roles'].concat(org_policy['roles'])
 
-      for role in policy['roles']
+      return if all_roles.any? do |role|
         next unless subject_roles.include?(role['role_id'])
 
-        for permission in role['permissions']
+        role['permissions'].any? do |permission|
           actions = permission['actions']
           resource = permission['resource_id']
           has_matching_action = actions.include?('*') || actions.include?(authorization_check['action'])
           has_matching_resource = resource == authorization_check['resource_id']
-          if has_matching_action && has_matching_resource
-            # All good
-            return
-          end
+          has_matching_action && has_matching_resource
         end
       end
 
@@ -64,17 +83,15 @@ module Stytch
       policy = get_policy
 
       # For consumer authorization, we check roles without tenancy validation
-      for role in policy['roles']
+      return if policy['roles'].any? do |role|
         next unless subject_roles.include?(role['role_id'])
 
-        for permission in role['permissions']
+        role['permissions'].any? do |permission|
           actions = permission['actions']
           resource = permission['resource_id']
           has_matching_action = actions.include?('*') || actions.include?(authorization_check['action'])
           has_matching_resource = resource == authorization_check['resource_id']
-          if has_matching_action && has_matching_resource
-            return # Permission granted
-          end
+          has_matching_action && has_matching_resource
         end
       end
 
@@ -98,19 +115,17 @@ module Stytch
       resource_id = authorization_check['resource_id']
 
       # Check if any of the token scopes grant permission for this action/resource
-      for scope_obj in policy['scopes']
+      return if policy['scopes'].any? do |scope_obj|
         scope_name = scope_obj['scope']
         next unless token_scopes.include?(scope_name)
 
         # Check if this scope grants permission for the requested action/resource
-        for permission in scope_obj['permissions']
+        scope_obj['permissions'].any? do |permission|
           actions = permission['actions']
           resource = permission['resource_id']
           has_matching_action = actions.include?('*') || actions.include?(action)
           has_matching_resource = resource == resource_id
-          if has_matching_action && has_matching_resource
-            return # Permission granted
-          end
+          has_matching_action && has_matching_resource
         end
       end
 
@@ -118,4 +133,13 @@ module Stytch
       raise Stytch::PermissionError, authorization_check
     end
   end
+
+  class CachedOrgPolicy
+    def initialize(org_policy:)
+      @org_policy = org_policy['org_policy']
+      @last_update = Time.now.to_i
+    end
+
+    attr_reader :org_policy, :last_update
+  end
 end

data/lib/stytch/sessions.rb

@@ -234,8 +234,6 @@ module Stytch
     # Use this endpoint to exchange a Connected Apps Access Token back into a Stytch Session for the underlying User.
     # This session can be used with the Stytch SDKs and APIs.
     #
-    # The Session returned will be the same Session that was active in your application (the authorizing party) during the initial authorization flow.
-    #
     # The Access Token must contain the `full_access` scope (only available to First Party clients) and must not be more than 5 minutes old. Access Tokens may only be exchanged a single time.
     #
     # == Parameters:

data/lib/stytch/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Stytch
-  VERSION = '10.42.0'
+  VERSION = '11.1.0'
 end

data/lib/stytch/webauthn.rb

@@ -20,9 +20,11 @@ module Stytch
     #
     # To optimize for Passkeys, set the `return_passkey_credential_options` field to `true`.
     #
-    # After calling this endpoint, the browser will need to call [navigator.credentials.create()](https://www.w3.org/TR/webauthn-2/#sctn-createCredential) with the data from [public_key_credential_creation_options](https://w3c.github.io/webauthn/#dictionary-makecredentialoptions) passed to the [navigator.credentials.create()](https://www.w3.org/TR/webauthn-2/#sctn-createCredential) request via the public key argument. We recommend using the `create()` wrapper provided by the webauthn-json library.
+    # After calling this endpoint, the browser will need to call [navigator.credentials.create()](https://www.w3.org/TR/webauthn-2/#sctn-createCredential) with the data from [public_key_credential_creation_options](https://w3c.github.io/webauthn/#dictionary-makecredentialoptions) passed to the [navigator.credentials.create()](https://www.w3.org/TR/webauthn-2/#sctn-createCredential) request via the public key argument.
     #
-    # If you are not using the [webauthn-json](https://github.com/github/webauthn-json) library, the `public_key_credential_creation_options` will need to be converted to a suitable public key by unmarshalling the JSON, base64 decoding the user ID field, and converting user ID and the challenge fields into an array buffer.
+    # When using built-in browser methods like `navigator.credentials.create()`, set the `use_base64_url_encoding` option to `true`.
+    #
+    # See our [WebAuthn setup guide](https://stytch.com/docs/guides/webauthn/api) for additional usage instructions and example code.
     #
     # == Parameters:
     # user_id::
@@ -51,7 +53,7 @@ module Stytch
     #   (no documentation yet)
     #   The type of this field is nilable +String+.
     # use_base64_url_encoding::
-    #   (no documentation yet)
+    #   If true, values in the `public_key_credential_creation_options` will be base64 URL encoded. Set this option to true when using built-in browser methods like `navigator.credentials.create` and `navigator.credentials.get`.
     #   The type of this field is nilable +Boolean+.
     #
     # == Returns:
@@ -97,7 +99,7 @@ module Stytch
 
     # Complete the creation of a WebAuthn registration by passing the response from the [navigator.credentials.create()](https://www.w3.org/TR/webauthn-2/#sctn-createCredential) request to this endpoint as the `public_key_credential` parameter.
     #
-    # If the [webauthn-json](https://github.com/github/webauthn-json) library's `create()` method was used, the response can be passed directly to the [register endpoint](https://stytch.com/docs/api/webauthn-register). If not, some fields (the client data and the attestation object) from the [navigator.credentials.create()](https://www.w3.org/TR/webauthn-2/#sctn-createCredential) response will need to be converted from array buffers to strings and marshalled into JSON.
+    # See our [WebAuthn setup guide](https://stytch.com/docs/guides/webauthn/api) for additional usage instructions and example code.
     #
     # == Parameters:
     # user_id::
@@ -191,9 +193,11 @@ module Stytch
     #
     # To optimize for Passkeys, set the `return_passkey_credential_options` field to `true`.
     #
-    # After calling this endpoint, the browser will need to call [navigator.credentials.get()](https://www.w3.org/TR/webauthn-2/#sctn-getAssertion) with the data from `public_key_credential_request_options` passed to the [navigator.credentials.get()](https://www.w3.org/TR/webauthn-2/#sctn-getAssertion) request via the public key argument. We recommend using the `get()` wrapper provided by the webauthn-json library.
+    # After calling this endpoint, the browser will need to call [navigator.credentials.get()](https://www.w3.org/TR/webauthn-2/#sctn-getAssertion) with the data from `public_key_credential_request_options` passed to the [navigator.credentials.get()](https://www.w3.org/TR/webauthn-2/#sctn-getAssertion) request via the public key argument.
     #
-    # If you are not using the [webauthn-json](https://github.com/github/webauthn-json) library, `the public_key_credential_request_options` will need to be converted to a suitable public key by unmarshalling the JSON and converting some the fields to array buffers.
+    # When using built-in browser methods like `navigator.credentials.get()`, set the `use_base64_url_encoding` option to `true`.
+    #
+    # See our [WebAuthn setup guide](https://stytch.com/docs/guides/webauthn/api) for additional usage instructions and example code.
     #
     # == Parameters:
     # domain::
@@ -207,7 +211,7 @@ module Stytch
     #
     #   The type of this field is nilable +Boolean+.
     # use_base64_url_encoding::
-    #   (no documentation yet)
+    #   If true, values in the `public_key_credential_creation_options` will be base64 URL encoded. Set this option to true when using built-in browser methods like `navigator.credentials.create` and `navigator.credentials.get`.
     #   The type of this field is nilable +Boolean+.
     #
     # == Returns:
@@ -243,7 +247,7 @@ module Stytch
 
     # Complete the authentication of a Passkey or WebAuthn registration by passing the response from the [navigator.credentials.get()](https://www.w3.org/TR/webauthn-2/#sctn-getAssertion) request to the authenticate endpoint.
     #
-    # If the [webauthn-json](https://github.com/github/webauthn-json) library's `get()` method was used, the response can be passed directly to the [authenticate endpoint](https://stytch.com/docs/api/webauthn-authenticate). If not some fields from the [navigator.credentials.get()](https://www.w3.org/TR/webauthn-2/#sctn-getAssertion) response will need to be converted from array buffers to strings and marshalled into JSON.
+    # See our [WebAuthn setup guide](https://stytch.com/docs/guides/webauthn/api) for additional usage instructions and example code.
     #
     # == Parameters:
     # public_key_credential::

data/stytch.gemspec

@@ -29,6 +29,7 @@ Gem::Specification.new do |spec|
   spec.add_dependency 'json-jwt', '>= 1.13.0'
   spec.add_dependency 'jwt', '>= 2.3.0'
 
+  spec.add_development_dependency 'prism', '~> 1.8.0'
   spec.add_development_dependency 'rspec', '~> 3.11.0'
   spec.add_development_dependency 'rubocop', '1.64.1'
   spec.add_development_dependency 'rubocop-rspec', '2.24.0'