stytch 6.4.0 → 9.8.0

data/lib/stytch/project.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+# !!!
+# WARNING: This file is autogenerated
+# Only modify code within MANUAL() sections
+# or your changes may be overwritten later!
+# !!!
+
+require_relative 'request_helper'
+
+module Stytch
+  class Project
+    include Stytch::RequestHelper
+
+    def initialize(connection)
+      @connection = connection
+    end
+
+    def metrics
+      headers = {}
+      query_params = {}
+      request = request_with_query_params('/v1/projects/metrics', query_params)
+      get_request(request, headers)
+    end
+  end
+end

data/lib/stytch/rbac_local.rb

@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+
+require_relative 'errors'
+require_relative 'request_helper'
+
+module StytchB2B
+  class PolicyCache
+    def initialize(rbac_client:)
+      @rbac_client = rbac_client
+      @policy_last_update = 0
+      @cached_policy = nil
+    end
+
+    def reload_policy
+      @cached_policy = @rbac_client.policy['policy']
+      @policy_last_update = Time.now.to_i
+    end
+
+    def get_policy(invalidate: false)
+      reload_policy if invalidate || @cached_policy.nil? || @policy_last_update < Time.now.to_i - 300
+      @cached_policy
+    end
+
+    # Performs an authorization check against the project's policy and a set of roles. If the
+    # check succeeds, this method will return. If the check fails, a PermissionError
+    # will be raised. It's also possible for a TenancyError to be raised if the
+    # subject_org_id does not match the authZ request organization_id.
+    # authorization_check is an object with keys 'action', 'resource_id', and 'organization_id'
+    def perform_authorization_check(
+      subject_roles:,
+      subject_org_id:,
+      authorization_check:
+    )
+      request_org_id = authorization_check['organization_id']
+      raise Stytch::TenancyError.new(subject_org_id, request_org_id) if request_org_id != subject_org_id
+
+      policy = get_policy
+
+      for role in policy['roles']
+        next unless subject_roles.include?(role['role_id'])
+
+        for permission in role['permissions']
+          actions = permission['actions']
+          resource = permission['resource_id']
+          has_matching_action = actions.include?('*') || actions.include?(authorization_check['action'])
+          has_matching_resource = resource == authorization_check['resource_id']
+          if has_matching_action && has_matching_resource
+            # All good
+            return
+          end
+        end
+      end
+
+      # If we get here, we didn't find a matching permission
+      raise Stytch::PermissionError, authorization_check
+    end
+  end
+end

data/lib/stytch/request_helper.rb

@@ -2,29 +2,33 @@
 
 module Stytch
   module RequestHelper
-    def get_request(path)
+    def get_request(path, headers)
       @connection.get(
-        path
+        path,
+        headers
       ).body
     end
 
-    def post_request(path, payload)
+    def post_request(path, payload, headers)
       @connection.post(
         path,
-        payload
+        payload,
+        headers
       ).body
     end
 
-    def put_request(path, payload)
+    def put_request(path, payload, headers)
       @connection.put(
         path,
-        payload
+        payload,
+        headers
       ).body
     end
 
-    def delete_request(path)
+    def delete_request(path, headers)
       @connection.delete(
-        path
+        path,
+        headers
       ).body
     end
 

data/lib/stytch/sessions.rb

@@ -54,14 +54,17 @@ module Stytch
     def get(
       user_id:
     )
+      headers = {}
       query_params = {
         user_id: user_id
       }
       request = request_with_query_params('/v1/sessions', query_params)
-      get_request(request)
+      get_request(request, headers)
     end
 
-    # Authenticate a session token and retrieve associated session data. If `session_duration_minutes` is included, update the lifetime of the session to be that many minutes from now. All timestamps are formatted according to the RFC 3339 standard and are expressed in UTC, e.g. `2021-12-29T12:33:09Z`. This endpoint requires exactly one `session_jwt` or `session_token` as part of the request. If both are included you will receive a `too_many_session_arguments` error.
+    # Authenticate a session token or session JWT and retrieve associated session data. If `session_duration_minutes` is included, update the lifetime of the session to be that many minutes from now. All timestamps are formatted according to the RFC 3339 standard and are expressed in UTC, e.g. `2021-12-29T12:33:09Z`. This endpoint requires exactly one `session_jwt` or `session_token` as part of the request. If both are included, you will receive a `too_many_session_arguments` error.
+    #
+    # You may provide a JWT that needs to be refreshed and is expired according to its `exp` claim. A new JWT will be returned if both the signature and the underlying Session are still valid. See our [How to use Stytch Session JWTs](https://stytch.com/docs/guides/sessions/using-jwts) guide for more information.
     #
     # == Parameters:
     # session_token::
@@ -108,13 +111,14 @@ module Stytch
       session_jwt: nil,
       session_custom_claims: nil
     )
+      headers = {}
       request = {}
       request[:session_token] = session_token unless session_token.nil?
       request[:session_duration_minutes] = session_duration_minutes unless session_duration_minutes.nil?
       request[:session_jwt] = session_jwt unless session_jwt.nil?
       request[:session_custom_claims] = session_custom_claims unless session_custom_claims.nil?
 
-      post_request('/v1/sessions/authenticate', request)
+      post_request('/v1/sessions/authenticate', request, headers)
     end
 
     # Revoke a Session, immediately invalidating all of its session tokens. You can revoke a session in three ways: using its ID, or using one of its session tokens, or one of its JWTs. This endpoint requires exactly one of those to be included in the request. It will return an error if multiple are present.
@@ -143,15 +147,90 @@ module Stytch
       session_token: nil,
       session_jwt: nil
     )
+      headers = {}
       request = {}
       request[:session_id] = session_id unless session_id.nil?
       request[:session_token] = session_token unless session_token.nil?
       request[:session_jwt] = session_jwt unless session_jwt.nil?
 
-      post_request('/v1/sessions/revoke', request)
+      post_request('/v1/sessions/revoke', request, headers)
     end
 
-    # Get the JSON Web Key Set (JWKS) for a Stytch Project.
+    # Migrate a session from an external OIDC compliant endpoint. Stytch will call the external UserInfo endpoint defined in your Stytch Project settings in the [Dashboard](/dashboard), and then perform a lookup using the `session_token`. If the response contains a valid email address, Stytch will attempt to match that email address with an existing User and create a Stytch Session. You will need to create the user before using this endpoint.
+    #
+    # == Parameters:
+    # session_token::
+    #   The authorization token Stytch will pass in to the external userinfo endpoint.
+    #   The type of this field is +String+.
+    # session_duration_minutes::
+    #   Set the session lifetime to be this many minutes from now. This will start a new session if one doesn't already exist,
+    #   returning both an opaque `session_token` and `session_jwt` for this session. Remember that the `session_jwt` will have a fixed lifetime of
+    #   five minutes regardless of the underlying session duration, and will need to be refreshed over time.
+    #
+    #   This value must be a minimum of 5 and a maximum of 527040 minutes (366 days).
+    #
+    #   If a `session_token` or `session_jwt` is provided then a successful authentication will continue to extend the session this many minutes.
+    #
+    #   If the `session_duration_minutes` parameter is not specified, a Stytch session will not be created.
+    #   The type of this field is nilable +Integer+.
+    # session_custom_claims::
+    #   Add a custom claims map to the Session being authenticated. Claims are only created if a Session is initialized by providing a value in `session_duration_minutes`. Claims will be included on the Session object and in the JWT. To update a key in an existing Session, supply a new value. To delete a key, supply a null value.
+    #
+    #   Custom claims made with reserved claims ("iss", "sub", "aud", "exp", "nbf", "iat", "jti") will be ignored. Total custom claims size cannot exceed four kilobytes.
+    #   The type of this field is nilable +object+.
+    #
+    # == Returns:
+    # An object with the following fields:
+    # request_id::
+    #   Globally unique UUID that is returned with every API call. This value is important to log for debugging purposes; we may ask for this value to help identify a specific API call when helping you debug an issue.
+    #   The type of this field is +String+.
+    # user_id::
+    #   The unique ID of the affected User.
+    #   The type of this field is +String+.
+    # session_token::
+    #   A secret token for a given Stytch Session.
+    #   The type of this field is +String+.
+    # session_jwt::
+    #   The JSON Web Token (JWT) for a given Stytch Session.
+    #   The type of this field is +String+.
+    # user::
+    #   The `user` object affected by this API call. See the [Get user endpoint](https://stytch.com/docs/api/get-user) for complete response field details.
+    #   The type of this field is +User+ (+object+).
+    # status_code::
+    #   (no documentation yet)
+    #   The type of this field is +Integer+.
+    # session::
+    #   If you initiate a Session, by including `session_duration_minutes` in your authenticate call, you'll receive a full Session object in the response.
+    #
+    #   See [GET sessions](https://stytch.com/docs/api/session-get) for complete response fields.
+    #
+    #   The type of this field is nilable +Session+ (+object+).
+    def migrate(
+      session_token:,
+      session_duration_minutes: nil,
+      session_custom_claims: nil
+    )
+      headers = {}
+      request = {
+        session_token: session_token
+      }
+      request[:session_duration_minutes] = session_duration_minutes unless session_duration_minutes.nil?
+      request[:session_custom_claims] = session_custom_claims unless session_custom_claims.nil?
+
+      post_request('/v1/sessions/migrate', request, headers)
+    end
+
+    # Get the JSON Web Key Set (JWKS) for a project.
+    #
+    # JWKS are rotated every ~6 months. Upon rotation, new JWTs will be signed using the new key set, and both key sets will be returned by this endpoint for a period of 1 month.
+    #
+    # JWTs have a set lifetime of 5 minutes, so there will be a 5 minute period where some JWTs will be signed by the old JWKS, and some JWTs will be signed by the new JWKS. The correct JWKS to use for validation is determined by matching the `kid` value of the JWT and JWKS.
+    #
+    # If you're using one of our [backend SDKs](https://stytch.com/docs/sdks), the JWKS roll will be handled for you.
+    #
+    # If you're using your own JWT validation library, many have built-in support for JWKS rotation, and you'll just need to supply this API endpoint. If not, your application should decide which JWKS to use for validation by inspecting the `kid` value.
+    #
+    # See our [How to use Stytch Session JWTs](https://stytch.com/docs/guides/sessions/using-jwts) guide for more information.
     #
     # == Parameters:
     # project_id::
@@ -172,9 +251,10 @@ module Stytch
     def get_jwks(
       project_id:
     )
+      headers = {}
       query_params = {}
       request = request_with_query_params("/v1/sessions/jwks/#{project_id}", query_params)
-      get_request(request)
+      get_request(request, headers)
     end
 
     # MANUAL(Sessions::authenticate_jwt)(SERVICE_METHOD)
@@ -186,12 +266,18 @@ module Stytch
     # If max_token_age_seconds is set and the JWT was issued (based on the "iat" claim) less than
     # max_token_age_seconds seconds ago, then just verify locally and don't call the API
     # To force remote validation for all tokens, set max_token_age_seconds to 0 or call authenticate()
+    # If max_token_age_seconds is not supplied 300 seconds will be used as the default.
+    # If clock_tolerance_seconds is not supplied 0 seconds will be used as the default.
     def authenticate_jwt(
       session_jwt,
       max_token_age_seconds: nil,
       session_duration_minutes: nil,
-      session_custom_claims: nil
+      session_custom_claims: nil,
+      clock_tolerance_seconds: nil
     )
+      max_token_age_seconds = 300 if max_token_age_seconds.nil?
+      clock_tolerance_seconds = 0 if clock_tolerance_seconds.nil?
+
       if max_token_age_seconds == 0
         return authenticate(
           session_jwt: session_jwt,
@@ -200,18 +286,18 @@ module Stytch
         )
       end
 
-      decoded_jwt = authenticate_jwt_local(session_jwt)
-      iat_time = Time.at(decoded_jwt['iat']).to_datetime
-      if iat_time + max_token_age_seconds >= Time.now
-        session = marshal_jwt_into_session(decoded_jwt)
-        { 'session' => session }
-      else
-        authenticate(
-          session_jwt: session_jwt,
-          session_duration_minutes: session_duration_minutes,
-          session_custom_claims: session_custom_claims
-        )
-      end
+      session = authenticate_jwt_local(
+        session_jwt,
+        max_token_age_seconds: max_token_age_seconds,
+        clock_tolerance_seconds: clock_tolerance_seconds
+      )
+      return session unless session.nil?
+
+      authenticate(
+        session_jwt: session_jwt,
+        session_duration_minutes: session_duration_minutes,
+        session_custom_claims: session_custom_claims
+      )
     rescue StandardError
       # JWT could not be verified locally. Check with the Stytch API.
       authenticate(
@@ -225,12 +311,22 @@ module Stytch
     # Uses the cached value to get the JWK but if it is unavailable, it calls the get_jwks()
     # function to get the JWK
     # This method never authenticates a JWT directly with the API
-    def authenticate_jwt_local(session_jwt)
+    # If max_token_age_seconds is not supplied 300 seconds will be used as the default.
+    # If clock_tolerance_seconds is not supplied 0 seconds will be used as the default.
+    def authenticate_jwt_local(session_jwt, max_token_age_seconds: nil, clock_tolerance_seconds: nil)
+      max_token_age_seconds = 300 if max_token_age_seconds.nil?
+      clock_tolerance_seconds = 0 if clock_tolerance_seconds.nil?
+
       issuer = 'stytch.com/' + @project_id
       begin
         decoded_token = JWT.decode session_jwt, nil, true,
-                                   { jwks: @jwks_loader, iss: issuer, verify_iss: true, aud: @project_id, verify_aud: true, algorithms: ['RS256'] }
-        decoded_token[0]
+                                   { jwks: @jwks_loader, iss: issuer, verify_iss: true, aud: @project_id, verify_aud: true, algorithms: ['RS256'], nbf_leeway: clock_tolerance_seconds }
+
+        session = decoded_token[0]
+        iat_time = Time.at(session['iat']).to_datetime
+        return nil unless iat_time + max_token_age_seconds >= Time.now
+
+        session = marshal_jwt_into_session(session)
       rescue JWT::InvalidIssuerError
         raise JWTInvalidIssuerError
       rescue JWT::InvalidAudError
@@ -240,6 +336,8 @@ module Stytch
       rescue JWT::IncorrectAlgorithm
         raise JWTIncorrectAlgorithmError
       end
+
+      session
     end
 
     def marshal_jwt_into_session(jwt)
@@ -251,15 +349,17 @@ module Stytch
       reserved_claims = ['aud', 'exp', 'iat', 'iss', 'jti', 'nbf', 'sub', stytch_claim]
       custom_claims = jwt.reject { |key, _| reserved_claims.include?(key) }
       {
-        'session_id' => jwt[stytch_claim]['id'],
-        'user_id' => jwt['sub'],
-        'started_at' => jwt[stytch_claim]['started_at'],
-        'last_accessed_at' => jwt[stytch_claim]['last_accessed_at'],
-        # For JWTs that include it, prefer the inner expires_at claim.
-        'expires_at' => expires_at,
-        'attributes' => jwt[stytch_claim]['attributes'],
-        'authentication_factors' => jwt[stytch_claim]['authentication_factors'],
-        'custom_claims' => custom_claims
+        'session' => {
+          'session_id' => jwt[stytch_claim]['id'],
+          'user_id' => jwt['sub'],
+          'started_at' => jwt[stytch_claim]['started_at'],
+          'last_accessed_at' => jwt[stytch_claim]['last_accessed_at'],
+          # For JWTs that include it, prefer the inner expires_at claim.
+          'expires_at' => expires_at,
+          'attributes' => jwt[stytch_claim]['attributes'],
+          'authentication_factors' => jwt[stytch_claim]['authentication_factors'],
+          'custom_claims' => custom_claims
+        }
       }
     end
     # ENDMANUAL(Sessions::authenticate_jwt)

data/lib/stytch/totps.rb

@@ -23,7 +23,7 @@ module Stytch
     #   The `user_id` of an active user the TOTP registration should be tied to.
     #   The type of this field is +String+.
     # expiration_minutes::
-    #   The expiration for the TOTP instance. If the newly created TOTP is not authenticated within this time frame the TOTP will be unusable. Defaults to 60 (1 hour) with a minimum of 5 and a maximum of 1440.
+    #   The expiration for the TOTP instance. If the newly created TOTP is not authenticated within this time frame the TOTP will be unusable. Defaults to 1440 (1 day) with a minimum of 5 and a maximum of 1440.
     #   The type of this field is nilable +Integer+.
     #
     # == Returns:
@@ -56,12 +56,13 @@ module Stytch
       user_id:,
       expiration_minutes: nil
     )
+      headers = {}
       request = {
         user_id: user_id
       }
       request[:expiration_minutes] = expiration_minutes unless expiration_minutes.nil?
 
-      post_request('/v1/totps', request)
+      post_request('/v1/totps', request, headers)
     end
 
     # Authenticate a TOTP code entered by a user.
@@ -133,6 +134,7 @@ module Stytch
       session_jwt: nil,
       session_custom_claims: nil
     )
+      headers = {}
       request = {
         user_id: user_id,
         totp_code: totp_code
@@ -142,7 +144,7 @@ module Stytch
       request[:session_jwt] = session_jwt unless session_jwt.nil?
       request[:session_custom_claims] = session_custom_claims unless session_custom_claims.nil?
 
-      post_request('/v1/totps/authenticate', request)
+      post_request('/v1/totps/authenticate', request, headers)
     end
 
     # Retrieve the recovery codes for a TOTP instance tied to a User.
@@ -169,11 +171,12 @@ module Stytch
     def recovery_codes(
       user_id:
     )
+      headers = {}
       request = {
         user_id: user_id
       }
 
-      post_request('/v1/totps/recovery_codes', request)
+      post_request('/v1/totps/recovery_codes', request, headers)
     end
 
     # Authenticate a recovery code for a TOTP instance.
@@ -245,6 +248,7 @@ module Stytch
       session_jwt: nil,
       session_custom_claims: nil
     )
+      headers = {}
       request = {
         user_id: user_id,
         recovery_code: recovery_code
@@ -254,7 +258,7 @@ module Stytch
       request[:session_jwt] = session_jwt unless session_jwt.nil?
       request[:session_custom_claims] = session_custom_claims unless session_custom_claims.nil?
 
-      post_request('/v1/totps/recover', request)
+      post_request('/v1/totps/recover', request, headers)
     end
   end
 end

data/lib/stytch/users.rb

@@ -77,6 +77,7 @@ module Stytch
       trusted_metadata: nil,
       untrusted_metadata: nil
     )
+      headers = {}
       request = {}
       request[:email] = email unless email.nil?
       request[:name] = name unless name.nil?
@@ -86,7 +87,7 @@ module Stytch
       request[:trusted_metadata] = trusted_metadata unless trusted_metadata.nil?
       request[:untrusted_metadata] = untrusted_metadata unless untrusted_metadata.nil?
 
-      post_request('/v1/users', request)
+      post_request('/v1/users', request, headers)
     end
 
     # Get information about a specific User.
@@ -114,7 +115,7 @@ module Stytch
     #   An array of phone number objects linked to the User.
     #   The type of this field is list of +PhoneNumber+ (+object+).
     # webauthn_registrations::
-    #   An array that contains a list of all WebAuthn registrations for a given User in the Stytch API.
+    #   An array that contains a list of all Passkey or WebAuthn registrations for a given User in the Stytch API.
     #   The type of this field is list of +WebAuthnRegistration+ (+object+).
     # providers::
     #   An array of OAuth `provider` objects linked to the User.
@@ -149,9 +150,10 @@ module Stytch
     def get(
       user_id:
     )
+      headers = {}
       query_params = {}
       request = request_with_query_params("/v1/users/#{user_id}", query_params)
-      get_request(request)
+      get_request(request, headers)
     end
 
     # Search for Users within your Stytch Project. Submit an empty `query` in the request to return all Users.
@@ -186,17 +188,18 @@ module Stytch
       limit: nil,
       query: nil
     )
+      headers = {}
       request = {}
       request[:cursor] = cursor unless cursor.nil?
       request[:limit] = limit unless limit.nil?
       request[:query] = query unless query.nil?
 
-      post_request('/v1/users/search', request)
+      post_request('/v1/users/search', request, headers)
     end
 
     # Update a User's attributes.
     #
-    # **Note:** In order to add a new email address or phone number to an existing User object, pass the new email address or phone number into the respective `/send` endpoint for the authentication method of your choice. If you specify the existing User's `user_id` while calling the `/send` endpoint, the new email address or phone number will be added to the existing User object upon successful authentication. We require this process to guard against an account takeover vulnerability.
+    # **Note:** In order to add a new email address or phone number to an existing User object, pass the new email address or phone number into the respective `/send` endpoint for the authentication method of your choice. If you specify the existing User's `user_id` while calling the `/send` endpoint, the new, unverified email address or phone number will be added to the existing User object. If the user successfully authenticates within 5 minutes of the `/send` request, the new email address or phone number will be marked as verified and remain permanently on the existing Stytch User. Otherwise, it will be removed from the User object, and any subsequent login requests using that phone number will create a new User. We require this process to guard against an account takeover vulnerability.
     #
     # == Parameters:
     # user_id::
@@ -245,13 +248,14 @@ module Stytch
       trusted_metadata: nil,
       untrusted_metadata: nil
     )
+      headers = {}
       request = {}
       request[:name] = name unless name.nil?
       request[:attributes] = attributes unless attributes.nil?
       request[:trusted_metadata] = trusted_metadata unless trusted_metadata.nil?
       request[:untrusted_metadata] = untrusted_metadata unless untrusted_metadata.nil?
 
-      put_request("/v1/users/#{user_id}", request)
+      put_request("/v1/users/#{user_id}", request, headers)
     end
 
     # Exchange a user's email address or phone number for another.
@@ -292,11 +296,12 @@ module Stytch
       email_address: nil,
       phone_number: nil
     )
+      headers = {}
       request = {}
       request[:email_address] = email_address unless email_address.nil?
       request[:phone_number] = phone_number unless phone_number.nil?
 
-      put_request("/v1/users/#{user_id}/exchange_primary_factor", request)
+      put_request("/v1/users/#{user_id}/exchange_primary_factor", request, headers)
     end
 
     # Delete a User from Stytch.
@@ -320,7 +325,8 @@ module Stytch
     def delete(
       user_id:
     )
-      delete_request("/v1/users/#{user_id}")
+      headers = {}
+      delete_request("/v1/users/#{user_id}", headers)
     end
 
     # Delete an email from a User.
@@ -347,7 +353,8 @@ module Stytch
     def delete_email(
       email_id:
     )
-      delete_request("/v1/users/emails/#{email_id}")
+      headers = {}
+      delete_request("/v1/users/emails/#{email_id}", headers)
     end
 
     # Delete a phone number from a User.
@@ -374,7 +381,8 @@ module Stytch
     def delete_phone_number(
       phone_id:
     )
-      delete_request("/v1/users/phone_numbers/#{phone_id}")
+      headers = {}
+      delete_request("/v1/users/phone_numbers/#{phone_id}", headers)
     end
 
     # Delete a WebAuthn registration from a User.
@@ -401,7 +409,8 @@ module Stytch
     def delete_webauthn_registration(
       webauthn_registration_id:
     )
-      delete_request("/v1/users/webauthn_registrations/#{webauthn_registration_id}")
+      headers = {}
+      delete_request("/v1/users/webauthn_registrations/#{webauthn_registration_id}", headers)
     end
 
     # Delete a biometric registration from a User.
@@ -428,7 +437,8 @@ module Stytch
     def delete_biometric_registration(
       biometric_registration_id:
     )
-      delete_request("/v1/users/biometric_registrations/#{biometric_registration_id}")
+      headers = {}
+      delete_request("/v1/users/biometric_registrations/#{biometric_registration_id}", headers)
     end
 
     # Delete a TOTP from a User.
@@ -455,7 +465,8 @@ module Stytch
     def delete_totp(
       totp_id:
     )
-      delete_request("/v1/users/totps/#{totp_id}")
+      headers = {}
+      delete_request("/v1/users/totps/#{totp_id}", headers)
     end
 
     # Delete a crypto wallet from a User.
@@ -482,7 +493,8 @@ module Stytch
     def delete_crypto_wallet(
       crypto_wallet_id:
     )
-      delete_request("/v1/users/crypto_wallets/#{crypto_wallet_id}")
+      headers = {}
+      delete_request("/v1/users/crypto_wallets/#{crypto_wallet_id}", headers)
     end
 
     # Delete a password from a User.
@@ -509,7 +521,8 @@ module Stytch
     def delete_password(
       password_id:
     )
-      delete_request("/v1/users/passwords/#{password_id}")
+      headers = {}
+      delete_request("/v1/users/passwords/#{password_id}", headers)
     end
 
     # Delete an OAuth registration from a User.
@@ -536,7 +549,8 @@ module Stytch
     def delete_oauth_registration(
       oauth_user_registration_id:
     )
-      delete_request("/v1/users/oauth/#{oauth_user_registration_id}")
+      headers = {}
+      delete_request("/v1/users/oauth/#{oauth_user_registration_id}", headers)
     end
   end
 end

data/lib/stytch/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Stytch
-  VERSION = '6.4.0'
+  VERSION = '9.8.0'
 end