workos 10.0.0 → 10.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ae1955beb480140b9d2077fc53a2bfc640f2f16eafd98e19f0d786c80772fd6f
-  data.tar.gz: aa84bb04105d0279fa37ed0230839cc1b2c9e2b462643e49f4478a78fff1c4e4
+  metadata.gz: 4ed7a1c92c327c1fe2a2f2a582be522670e33f085ca6b7b44f8cb3c968e231bf
+  data.tar.gz: d78826116d38974783cb835dd51890b7aa98dbb2fab67a4a9bc00b8e691c3f0b
 SHA512:
-  metadata.gz: b8a6150249b80f0908f74faa1425257036944f6b7d1a2a9950575d9a1d4116a42d5cbd97180702810b318cc736bdc3ac72d1ab283ff35bb04482bec1d19244f9
-  data.tar.gz: 330aada99bb23953b0914de7fd0dc9f23a60dc3203568d68e805e1fd5c7ff6217a53dbd3b24ca2e0989dcf684e4cc97598ea5a158b43daeef314c407ab8898c6
+  metadata.gz: fa5d2429aa5a63556852efadafb0c01cd2d9d26500513cbe520d4501fb8ade808423a7245f302726d295c24b4a9f7714c280a955964b5bf401bdc2d17be18b9e
+  data.tar.gz: 061b36f82c50b4a2e5c0f8ba94777f1dac191ceddc3206683d472f28775979a10161bd926cf902c618cfddb22bce50f5706bee986a7088dc7678af2dcfe6a59e

data/.claude/CLAUDE.md

@@ -0,0 +1,38 @@
+# WorkOS Ruby SDK — Agent Context
+
+Most code in this repository is **auto-generated**. It is emitted by the
+oagen pipeline from the WorkOS OpenAPI spec. It is not hand-written here,
+and most bugs in it cannot be fixed here.
+
+## The generation pipeline
+
+| Repo | Role |
+| --- | --- |
+| [workos/openapi-spec](https://github.com/workos/openapi-spec) | Source of truth for the API surface (the OpenAPI spec, exported by the WorkOS API) and the orchestration entrypoint for all SDK generation |
+| [workos/oagen](https://github.com/workos/oagen) | The generator engine (spec → IR → code) |
+| [workos/oagen-emitters](https://github.com/workos/oagen-emitters) | The per-language emitters, including the Ruby emitter that produces this repo's code |
+
+Regeneration runs from a checkout of `openapi-spec`, never from this repo:
+
+```bash
+npm run sdk:generate -- --lang ruby --output workos-ruby
+```
+
+## Generated vs. hand-maintained code
+
+- Generated files begin with the header `# This file is auto-generated by oagen. Do not edit.` — treat them as build artifacts.
+- Hand-maintained code is fenced with `@oagen-ignore-start` / `@oagen-ignore-end` markers, or lives in files marked `@oagen-ignore-file`. Only this code is editable in this repo.
+
+## Where to fix an issue
+
+| Symptom | Fix it in |
+| --- | --- |
+| Wrong or missing endpoint, field, type, or enum value | [workos/openapi-spec](https://github.com/workos/openapi-spec) (or the WorkOS API that exports the spec) |
+| Generated Ruby code is broken or un-idiomatic | [workos/oagen-emitters](https://github.com/workos/oagen-emitters) |
+| Generator behavior: naming, IR, pagination, compat checks | [workos/oagen](https://github.com/workos/oagen) |
+| Code inside `@oagen-ignore` fences or ignore-marked files | This repo — edit normally |
+
+Don't hand-edit a file that has the generated header — the next
+`sdk:generate` run silently overwrites it. Instead, fix the emitter or the
+spec upstream and regenerate. If a requested fix lands in a generated file,
+say so and point at the upstream repo rather than patching it here.

data/.last-synced-sha

@@ -1 +1 @@
-f40851a620a1ba0badec95e80faac475382c8dd0
+ae3ebbb08d9b4bf9b2391558e820b7eb6f511fb9

data/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "10.0.0"
+  ".": "10.1.0"
 }

data/AGENTS.md

@@ -0,0 +1 @@
+.claude/CLAUDE.md

data/CHANGELOG.md

@@ -1,5 +1,36 @@
 # Changelog
 
+## [10.1.0](https://github.com/workos/workos-ruby/compare/v10.0.0...v10.1.0) (2026-07-28)
+
+### Features
+
+* replace hand-written URL builders with generated ones ([b162486](https://github.com/workos/workos-ruby/commit/b1624866137d8364dda1726b0302b70bed00a75c))
+
+* [#531](https://github.com/workos/workos-ruby/pull/531) fix(generated): regenerate from spec
+
+  **Features**
+  * **[pipes](https://workos.com/docs/reference/pipes)**:
+    * Added `config` to `DataIntegrationsGetDataIntegrationAuthorizeUrlRequest`
+    * Added `client_credentials` to `DataIntegrationAuthMethods`
+    * Added `client_credentials` to `DataIntegrationsListResponseDataAuthMethods`
+    * Added `client_credentials` to `DataIntegrationsListResponseDataConnectedAccountAuthMethod`
+    * Added `config` to Pipes models
+  * **[connect](https://workos.com/docs/reference/workos-connect/standalone)**:
+    * Added `client_credentials` to `ConnectedAccountAuthMethod`
+
+  **Fixes**
+  * **[user_management](https://workos.com/docs/reference/authkit/user)**:
+    * Changed errors for endpoint `POST /user_management/invitations`
+    * Changed errors for endpoint `POST /user_management/invitations/{id}/resend`
+    * Changed errors for endpoint `POST /user_management/magic_auth`
+    * Changed errors for endpoint `POST /user_management/authenticate`
+
+* [#532](https://github.com/workos/workos-ruby/pull/532) fix(generated): regenerate from spec
+
+  **Fixes**
+  * **[sso](https://workos.com/docs/reference/sso)**:
+    * Removed `callback_endpoint` from `Connection`
+
 ## [10.0.0](https://github.com/workos/workos-ruby/compare/v9.5.0...v10.0.0) (2026-07-22)
 
 ### Bug Fixes

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    workos (10.0.0)
+    workos (10.1.0)
       jwt (~> 3.1)
       logger (~> 1.7)
       zeitwerk (~> 2.6)
@@ -153,7 +153,7 @@ CHECKSUMS
   unicode-emoji (4.2.0) sha256=519e69150f75652e40bf736106cfbc8f0f73aa3fb6a65afe62fefa7f80b0f80f
   webmock (3.26.2) sha256=774556f2ea6371846cca68c01769b2eac0d134492d21f6d0ab5dd643965a4c90
   webrick (1.9.2) sha256=beb4a15fc474defed24a3bda4ffd88a490d517c9e4e6118c3edce59e45864131
-  workos (10.0.0)
+  workos (10.1.0)
   yard (0.9.44) sha256=eb087e9b631ccd887b049f303d489963945452d5e2a7eb49a5a74a7cf6887f28
   yard-markdown (0.7.1) sha256=06c378632dfe7ba053be9ba469eb4701aa0470e36bcf7e5546f353eb90c1bfd1
   zeitwerk (2.7.5) sha256=d8da92128c09ea6ec62c949011b00ed4a20242b255293dd66bf41545398f73dd

data/lib/workos/pipes/create_data_integration.rb

@@ -10,6 +10,7 @@ module WorkOS
       enabled: :enabled,
       scopes: :scopes,
       auth_methods: :auth_methods,
+      config: :config,
       credentials: :credentials,
       api_key: :api_key,
       custom_provider: :custom_provider
@@ -21,6 +22,7 @@ module WorkOS
       :enabled,
       :scopes,
       :auth_methods,
+      :config,
       :credentials,
       :api_key,
       :custom_provider
@@ -32,6 +34,7 @@ module WorkOS
       @enabled = hash[:enabled]
       @scopes = hash[:scopes] || []
       @auth_methods = hash[:auth_methods] || []
+      @config = hash[:config] || {}
       @credentials = hash[:credentials] ? WorkOS::DataIntegrationCredentialsInput.new(hash[:credentials]) : nil
       @api_key = hash[:api_key] ? WorkOS::ApiKeyInstallation.new(hash[:api_key]) : nil
       @custom_provider = hash[:custom_provider] ? WorkOS::CustomProviderDefinition.new(hash[:custom_provider]) : nil

data/lib/workos/pipes/data_integration.rb

@@ -17,6 +17,7 @@ module WorkOS
       auth_methods: :auth_methods,
       credentials: :credentials,
       installation: :installation,
+      config: :config,
       custom_provider: :custom_provider,
       created_at: :created_at,
       updated_at: :updated_at
@@ -35,6 +36,7 @@ module WorkOS
       :auth_methods,
       :credentials,
       :installation,
+      :config,
       :custom_provider,
       :created_at,
       :updated_at
@@ -53,6 +55,7 @@ module WorkOS
       @auth_methods = hash[:auth_methods] || []
       @credentials = hash[:credentials] ? WorkOS::DataIntegrationCredential.new(hash[:credentials]) : nil
       @installation = hash[:installation] ? WorkOS::DataIntegrationInstallation.new(hash[:installation]) : nil
+      @config = hash[:config] || {}
       @custom_provider = hash[:custom_provider] ? WorkOS::DataIntegrationCustomProvider.new(hash[:custom_provider]) : nil
       @created_at = hash[:created_at]
       @updated_at = hash[:updated_at]

data/lib/workos/pipes/data_integrations_get_data_integration_authorize_url_request.rb

@@ -7,19 +7,22 @@ module WorkOS
     HASH_ATTRS = {
       user_id: :user_id,
       organization_id: :organization_id,
-      return_to: :return_to
+      return_to: :return_to,
+      config: :config
     }.freeze
 
     attr_accessor \
       :user_id,
       :organization_id,
-      :return_to
+      :return_to,
+      :config
 
     def initialize(json)
       hash = self.class.normalize(json)
       @user_id = hash[:user_id]
       @organization_id = hash[:organization_id]
       @return_to = hash[:return_to]
+      @config = hash[:config] || {}
     end
   end
 end

data/lib/workos/pipes.rb

@@ -60,6 +60,7 @@ module WorkOS
     # @param enabled [Boolean, nil] Whether the Data Integration is enabled. Defaults to `false`.
     # @param scopes [Array<String>, nil] The OAuth scopes to request for the Data Integration. Defaults to the provider's configured scopes when omitted.
     # @param auth_methods [Array<WorkOS::Types::CreateDataIntegrationAuthMethods>, nil] How accounts authenticate with the provider. Defaults to `["oauth"]`. Use `["api_key"]` to declare an API key integration; `credentials` is then not required and keys are supplied per-tenant (optionally via `api_key` on this request).
+    # @param config [Hash{String => String}, nil] Provider-specific config values (e.g. a Snowflake `account_identifier`), keyed by the config field. Only fields the built-in provider declares are accepted.
     # @param credentials [WorkOS::DataIntegrationCredentialsInput, nil] The OAuth credentials to configure for the Data Integration. Required for OAuth integrations; omit when `auth_methods` is `["api_key"]`.
     # @param api_key [WorkOS::ApiKeyInstallation, nil] An optional API key to install for the first tenant on an `api_key` integration. Omit to declare a keyless integration; tenants can be added later via the per-installation API key path.
     # @param custom_provider [WorkOS::CustomProviderDefinition, nil] The OAuth definition for a custom provider. Supply this to define a custom provider; omit it to create an integration for a built-in provider.
@@ -71,6 +72,7 @@ module WorkOS
       enabled: nil,
       scopes: WorkOS::OMIT,
       auth_methods: nil,
+      config: nil,
       credentials: nil,
       api_key: nil,
       custom_provider: nil,
@@ -80,6 +82,7 @@ module WorkOS
         "provider" => provider,
         "enabled" => enabled,
         "auth_methods" => auth_methods,
+        "config" => config,
         "credentials" => credentials,
         "api_key" => api_key,
         "custom_provider" => custom_provider
@@ -210,6 +213,7 @@ module WorkOS
     # @param user_id [String] The ID of the user to authorize.
     # @param organization_id [String, nil] An organization ID to scope the authorization to a specific organization.
     # @param return_to [String, nil] The URL to redirect the user to after authorization.
+    # @param config [Hash{String => String}, nil] Connect-time config values for the provider-declared `installation`-scope fields (e.g. a Zendesk `subdomain`), keyed by the config field. Only fields the provider declares may be supplied, and required fields must be provided unless already pinned on the integration.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
     # @return [WorkOS::DataIntegrationAuthorizeUrlResponse]
     def authorize_data_integration(
@@ -217,12 +221,14 @@ module WorkOS
       user_id:,
       organization_id: nil,
       return_to: nil,
+      config: nil,
       request_options: {}
     )
       body = {
         "user_id" => user_id,
         "organization_id" => organization_id,
-        "return_to" => return_to
+        "return_to" => return_to,
+        "config" => config
       }.compact
       response = @client.request(
         method: :post,

data/lib/workos/pipes_provider/configure_data_integration_body.rb

@@ -8,14 +8,16 @@ module WorkOS
       enabled: :enabled,
       scopes: :scopes,
       client_id: :client_id,
-      client_secret: :client_secret
+      client_secret: :client_secret,
+      config: :config
     }.freeze
 
     attr_accessor \
       :enabled,
       :scopes,
       :client_id,
-      :client_secret
+      :client_secret,
+      :config
 
     def initialize(json)
       hash = self.class.normalize(json)
@@ -23,6 +25,7 @@ module WorkOS
       @scopes = hash[:scopes] || []
       @client_id = hash[:client_id]
       @client_secret = hash[:client_secret]
+      @config = hash[:config] || {}
     end
   end
 end

data/lib/workos/pipes_provider/data_integration_configuration_response.rb

@@ -12,6 +12,7 @@ module WorkOS
       name: :name,
       enabled: :enabled,
       scopes: :scopes,
+      config: :config,
       created_at: :created_at,
       updated_at: :updated_at,
       credentials: :credentials
@@ -25,6 +26,7 @@ module WorkOS
       :name,
       :enabled,
       :scopes,
+      :config,
       :created_at,
       :updated_at,
       :credentials
@@ -38,6 +40,7 @@ module WorkOS
       @name = hash[:name]
       @enabled = hash[:enabled]
       @scopes = hash[:scopes] || []
+      @config = hash[:config] || {}
       @created_at = hash[:created_at]
       @updated_at = hash[:updated_at]
       @credentials = hash[:credentials] ? WorkOS::DataIntegrationCredentials.new(hash[:credentials]) : nil

data/lib/workos/pipes_provider.rb

@@ -36,6 +36,7 @@ module WorkOS
     # @param scopes [Array<String>, nil] The OAuth scopes to request for the organization. Pass `null` to inherit the provider scopes.
     # @param client_id [String, nil] The OAuth client ID of the organization's own application. Must be provided together with `client_secret`, and only for providers whose credentials are supplied by the organization.
     # @param client_secret [String, nil] The OAuth client secret of the organization's own application. Must be provided together with `client_id`.
+    # @param config [Hash{String => String}, nil] Provider-specific config values to set for the organization, keyed by config field. Only fields the provider declares are accepted, and each value must match that field's pattern. Accepted only for providers whose credentials are organization-managed; for shared or custom credential providers, config belongs on the integration itself (via the data-integrations API) and supplying it here is rejected.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
     # @return [WorkOS::DataIntegrationConfigurationResponse]
     def update_organization_data_integration_configuration(
@@ -45,12 +46,14 @@ module WorkOS
       scopes: WorkOS::OMIT,
       client_id: nil,
       client_secret: nil,
+      config: nil,
       request_options: {}
     )
       body = {
         "enabled" => enabled,
         "client_id" => client_id,
-        "client_secret" => client_secret
+        "client_secret" => client_secret,
+        "config" => config
       }.compact
       body["scopes"] = scopes unless scopes.equal?(WorkOS::OMIT)
       response = @client.request(

data/lib/workos/sso/connection.rb

@@ -13,7 +13,6 @@ module WorkOS
       state: :state,
       status: :status,
       domains: :domains,
-      callback_endpoint: :callback_endpoint,
       created_at: :created_at,
       updated_at: :updated_at
     }.freeze
@@ -29,7 +28,6 @@ module WorkOS
       :name,
       :state,
       :domains,
-      :callback_endpoint,
       :created_at,
       :updated_at
 
@@ -50,7 +48,6 @@ module WorkOS
       @state = hash[:state]
       @status = hash[:status]
       @domains = (hash[:domains] || []).map { |item| item ? WorkOS::ConnectionDomain.new(item) : nil }
-      @callback_endpoint = hash[:callback_endpoint]
       @created_at = hash[:created_at]
       @updated_at = hash[:updated_at]
     end

data/lib/workos/sso.rb

@@ -3,6 +3,7 @@
 # This file is auto-generated by oagen. Do not edit.
 
 require "json"
+require "uri"
 
 module WorkOS
   class SSO
@@ -106,6 +107,74 @@ module WorkOS
       nil
     end
 
+    # Initiate SSO
+    # Builds the URL client-side; no HTTP request is made.
+    # @param provider_scopes [Array<String>, nil] Additional scopes to request from the identity provider. Applicable when using OAuth or OpenID Connect connections.
+    # @param provider_query_params [Hash{String => String}, nil] Key/value pairs of query parameters to pass to the OAuth provider. Only applicable when using OAuth connections.
+    # @param client_id [String, nil] The unique identifier of the WorkOS environment client. Defaults to the client's configured client_id.
+    # @param domain [String, nil] Deprecated. Use `connection` or `organization` instead. Used to initiate SSO for a connection by domain. The domain must be associated with a connection in your WorkOS environment.
+    # @param provider [WorkOS::Types::SSOProvider, nil] Used to initiate OAuth authentication with various providers.
+    # @param redirect_uri [String] Where to redirect the user after they complete the authentication process. You must use one of the redirect URIs configured via the [Redirects](https://dashboard.workos.com/redirects) page on the dashboard.
+    # @param state [String, nil] An optional parameter that can be used to encode arbitrary information to help restore application state between redirects. If included, the redirect URI received from WorkOS will contain the exact `state` that was passed.
+    # @param connection [String, nil] Used to initiate SSO for a connection. The value should be a WorkOS connection ID. You can persist the WorkOS connection ID with application user or team identifiers. WorkOS will use the connection indicated by the connection parameter to direct the user to the corresponding IdP for authentication.
+    # @param organization [String, nil] Used to initiate SSO for an organization. The value should be a WorkOS organization ID. You can persist the WorkOS organization ID with application user or team identifiers. WorkOS will use the organization ID to determine the appropriate connection and the IdP to direct the user to for authentication.
+    # @param domain_hint [String, nil] Can be used to pre-fill the domain field when initiating authentication with Microsoft OAuth or with a Google SAML connection type.
+    # @param login_hint [String, nil] Can be used to pre-fill the username/email address field of the IdP sign-in page for the user, if you know their username ahead of time. Currently supported for OAuth, OpenID Connect, Okta, Entra ID, and custom SAML connections.
+    # @param nonce [String, nil] A random string generated by the client that is used to mitigate replay attacks.
+    # @param prompt [String, nil] If set to `login`, forces re-authentication at the identity provider. For supported SAML providers this sets `ForceAuthn="true"` in the SAML request; providers that don't support it are unaffected.
+    # @return [String]
+    def get_authorization_url(
+      redirect_uri:,
+      provider_scopes: nil,
+      provider_query_params: nil,
+      client_id: nil,
+      domain: nil,
+      provider: nil,
+      state: nil,
+      connection: nil,
+      organization: nil,
+      domain_hint: nil,
+      login_hint: nil,
+      nonce: nil,
+      prompt: nil
+    )
+      params = {
+        "provider_scopes" => provider_scopes,
+        "provider_query_params" => provider_query_params,
+        "client_id" => client_id,
+        "domain" => domain,
+        "provider" => provider,
+        "redirect_uri" => redirect_uri,
+        "state" => state,
+        "connection" => connection,
+        "organization" => organization,
+        "domain_hint" => domain_hint,
+        "login_hint" => login_hint,
+        "nonce" => nonce,
+        "prompt" => prompt
+      }.compact
+      params["provider_scopes"] = provider_scopes.join(",") unless provider_scopes.nil?
+      params["provider_query_params"] = JSON.generate(provider_query_params) unless provider_query_params.nil?
+      params["response_type"] = "code"
+      params["client_id"] = @client.client_id if !params.key?("client_id") && !@client.client_id.nil?
+      uri = URI.join(@client.base_url, "/sso/authorize")
+      uri.query = URI.encode_www_form(params) unless params.empty?
+      uri.to_s
+    end
+
+    # Logout Redirect
+    # Builds the URL client-side; no HTTP request is made.
+    # @param token [String] The logout token returned from the [Logout Authorize](https://workos.com/docs/reference/sso/logout/authorize) endpoint.
+    # @return [String]
+    def get_logout_url(token:)
+      params = {
+        "token" => token
+      }
+      uri = URI.join(@client.base_url, "/sso/logout")
+      uri.query = URI.encode_www_form(params) unless params.empty?
+      uri.to_s
+    end
+
     # Logout Authorize
     # @param profile_id [String] The unique ID of the profile to log out.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
@@ -171,32 +240,10 @@ module WorkOS
     end
 
     # @oagen-ignore-start — non-spec helpers (hand-maintained)
-    # H14 — Build an SSO authorization URL (client-side, no HTTP call).
-    # Overrides the generated method which incorrectly hits the API.
-    def get_authorization_url(redirect_uri:, client_id: nil, state: nil, connection: nil,
-      organization: nil, provider: nil, domain_hint: nil,
-      login_hint: nil, nonce: nil, provider_scopes: nil,
-      provider_query_params: nil, **)
-      cid = client_id || @client.client_id
-      raise ArgumentError, "client_id is required (set on Client or pass explicitly)" if cid.nil? || cid.empty?
-      params = {
-        "client_id" => cid,
-        "redirect_uri" => redirect_uri,
-        "response_type" => "code",
-        "state" => state,
-        "connection" => connection,
-        "organization" => organization,
-        "provider" => provider,
-        "domain_hint" => domain_hint,
-        "login_hint" => login_hint,
-        "nonce" => nonce
-      }.compact
-      params["provider_scopes"] = Array(provider_scopes).join(",") if provider_scopes
-      if provider_query_params.is_a?(Hash) && !provider_query_params.empty?
-        params["provider_query_params"] = JSON.generate(provider_query_params)
-      end
-      build_url("/sso/authorize", params)
-    end
+    # H14 (sso_authorization_url) is provided by the generated
+    # `get_authorization_url` url-builder method, which accepts an optional
+    # per-call `client_id` override falling back to the client's configured
+    # value; no hand-maintained override is needed here.
 
     # H15 — SSO authorization URL with auto-generated PKCE pair + state.
     # Returns [url, code_verifier, state].

data/lib/workos/types/connected_account_auth_method.rb

@@ -7,7 +7,8 @@ module WorkOS
     class ConnectedAccountAuthMethod
       OAUTH = "oauth"
       API_KEY = "api_key"
-      ALL = [OAUTH, API_KEY].freeze
+      CLIENT_CREDENTIALS = "client_credentials"
+      ALL = [OAUTH, API_KEY, CLIENT_CREDENTIALS].freeze
     end
   end
 end

data/lib/workos/types/create_data_integration_auth_methods.rb

@@ -4,6 +4,10 @@
 
 module WorkOS
   module Types
-    CreateDataIntegrationAuthMethods = ConnectedAccountAuthMethod
+    class CreateDataIntegrationAuthMethods
+      OAUTH = "oauth"
+      API_KEY = "api_key"
+      ALL = [OAUTH, API_KEY].freeze
+    end
   end
 end

data/lib/workos/user_management.rb

@@ -3,6 +3,7 @@
 # This file is auto-generated by oagen. Do not edit.
 
 require "json"
+require "uri"
 
 module WorkOS
   class UserManagement
@@ -515,6 +516,70 @@ module WorkOS
       WorkOS::AuthenticateResponse.new(response.body)
     end
 
+    # Get an authorization URL
+    # Builds the URL client-side; no HTTP request is made.
+    # @param code_challenge_method [String, nil] The only valid PKCE code challenge method is `"S256"`. Required when specifying a `code_challenge`.
+    # @param code_challenge [String, nil] Code challenge derived from the code verifier used for the PKCE flow.
+    # @param domain_hint [String, nil] A domain hint for SSO connection lookup.
+    # @param connection_id [String, nil] The ID of an SSO connection to use for authentication.
+    # @param provider_query_params [Hash{String => String}, nil] Key/value pairs of query parameters to pass to the OAuth provider.
+    # @param provider_scopes [Array<String>, nil] Additional OAuth scopes to request from the identity provider.
+    # @param invitation_token [String, nil] A token representing a user invitation to redeem during authentication.
+    # @param max_age [Integer, nil] Maximum allowable elapsed time, in seconds, since the user last actively authenticated. If the last authentication is older than this value, the user is prompted to re-authenticate; a value of `0` forces re-authentication. Only supported when the provider is `authkit`.
+    # @param screen_hint [WorkOS::Types::UserManagementAuthenticationScreenHint, nil] Used to specify which screen to display when the provider is `authkit`.
+    # @param login_hint [String, nil] A hint to the authorization server about the login identifier the user might use.
+    # @param provider [WorkOS::Types::UserManagementAuthenticationProvider, nil] The OAuth provider to authenticate with (e.g., GoogleOAuth, MicrosoftOAuth, GitHubOAuth).
+    # @param prompt [String, nil] Controls the authentication flow behavior for the user.
+    # @param state [String, nil] An opaque value used to maintain state between the request and the callback.
+    # @param organization_id [String, nil] The ID of the organization to authenticate the user against.
+    # @param redirect_uri [String] The callback URI where the authorization code will be sent after authentication.
+    # @param client_id [String, nil] The unique identifier of the WorkOS environment client. Defaults to the client's configured client_id.
+    # @return [String]
+    def get_authorization_url(
+      redirect_uri:,
+      code_challenge_method: nil,
+      code_challenge: nil,
+      domain_hint: nil,
+      connection_id: nil,
+      provider_query_params: nil,
+      provider_scopes: nil,
+      invitation_token: nil,
+      max_age: nil,
+      screen_hint: nil,
+      login_hint: nil,
+      provider: nil,
+      prompt: nil,
+      state: nil,
+      organization_id: nil,
+      client_id: nil
+    )
+      params = {
+        "code_challenge_method" => code_challenge_method,
+        "code_challenge" => code_challenge,
+        "domain_hint" => domain_hint,
+        "connection_id" => connection_id,
+        "provider_query_params" => provider_query_params,
+        "provider_scopes" => provider_scopes,
+        "invitation_token" => invitation_token,
+        "max_age" => max_age,
+        "screen_hint" => screen_hint,
+        "login_hint" => login_hint,
+        "provider" => provider,
+        "prompt" => prompt,
+        "state" => state,
+        "organization_id" => organization_id,
+        "redirect_uri" => redirect_uri,
+        "client_id" => client_id
+      }.compact
+      params["provider_query_params"] = JSON.generate(provider_query_params) unless provider_query_params.nil?
+      params["provider_scopes"] = provider_scopes.join(",") unless provider_scopes.nil?
+      params["response_type"] = "code"
+      params["client_id"] = @client.client_id if !params.key?("client_id") && !@client.client_id.nil?
+      uri = URI.join(@client.base_url, "/user_management/authorize")
+      uri.query = URI.encode_www_form(params) unless params.empty?
+      uri.to_s
+    end
+
     # Get device authorization URL
     # @param client_id [String] The WorkOS client ID for your application.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
@@ -592,6 +657,24 @@ module WorkOS
       result
     end
 
+    # Logout
+    # Builds the URL client-side; no HTTP request is made.
+    # @param session_id [String] The ID of the session. This can be extracted from the `sid` claim of the access token.
+    # @param return_to [String, nil] The URL to redirect the user to after logout.
+    # @return [String]
+    def get_logout_url(
+      session_id:,
+      return_to: nil
+    )
+      params = {
+        "session_id" => session_id,
+        "return_to" => return_to
+      }.compact
+      uri = URI.join(@client.base_url, "/user_management/sessions/logout")
+      uri.query = URI.encode_www_form(params) unless params.empty?
+      uri.to_s
+    end
+
     # Revoke Session
     # @param session_id [String] The ID of the session to revoke. This can be extracted from the `sid` claim of the access token.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
@@ -1690,32 +1773,10 @@ module WorkOS
       URI.join(base, "/sso/jwks/#{WorkOS::Util.encode_path(cid)}").to_s
     end
 
-    # H09 — Build an AuthKit authorization URL (client-side, no HTTP call).
-    # Overrides the generated get_authorization_url which hits the API.
-    def get_authorization_url(redirect_uri:, client_id: nil, provider: nil, connection_id: nil,
-      organization_id: nil, domain_hint: nil, login_hint: nil,
-      state: nil, screen_hint: nil, code_challenge: nil,
-      code_challenge_method: nil, prompt: nil, **)
-      cid = client_id || @client.client_id
-      raise ArgumentError, "client_id is required (set on Client or pass explicitly)" if cid.nil? || cid.empty?
-      raise ArgumentError, "provider, connection_id, or organization_id required" if provider.nil? && connection_id.nil? && organization_id.nil?
-      params = {
-        "client_id" => cid,
-        "redirect_uri" => redirect_uri,
-        "response_type" => "code",
-        "provider" => provider,
-        "connection_id" => connection_id,
-        "organization_id" => organization_id,
-        "domain_hint" => domain_hint,
-        "login_hint" => login_hint,
-        "state" => state,
-        "screen_hint" => screen_hint,
-        "code_challenge" => code_challenge,
-        "code_challenge_method" => code_challenge_method,
-        "prompt" => prompt
-      }.compact
-      build_url("/user_management/authorize", params)
-    end
+    # H09 (authkit_authorization_url) is provided by the generated
+    # `get_authorization_url` url-builder method, which accepts an optional
+    # per-call `client_id` override falling back to the client's configured
+    # value; no hand-maintained override is needed here.
 
     # H10 — AuthKit authorization URL with auto-generated PKCE + state.
     # Returns [url, code_verifier, state].
@@ -1773,24 +1834,9 @@ module WorkOS
     # `authenticate_with_device_code` method (wraps /user_management/authenticate);
     # no hand-maintained override is needed here.
 
-    # Build the AuthKit logout redirect URL (client-side, no HTTP call).
-    # @param session_id [String] The session ID (from the `sid` claim of the access token).
-    # @param return_to [String, nil] URL to redirect the user to after session revocation.
-    # @return [String]
-    def get_logout_url(session_id:, return_to: nil)
-      params = {"session_id" => session_id}
-      params["return_to"] = return_to if return_to
-      build_url("/user_management/sessions/logout", params)
-    end
-
-    private
-
-    def build_url(path, params)
-      base = @client.base_url
-      uri = URI.join(base, path)
-      uri.query = URI.encode_www_form(params)
-      uri.to_s
-    end
+    # The AuthKit logout redirect URL is provided by the generated
+    # `get_logout_url` url-builder method; no hand-maintained override is
+    # needed here.
     # @oagen-ignore-end
   end
 end

data/lib/workos/version.rb

@@ -2,5 +2,5 @@
 
 # @oagen-ignore-file
 module WorkOS
-  VERSION = "10.0.0"
+  VERSION = "10.1.0"
 end

data/rbi/workos/configure_data_integration_body.rbi

@@ -33,6 +33,12 @@ module WorkOS
     sig { params(value: T.nilable(String)).returns(T.nilable(String)) }
     def client_secret=(value); end
 
+    sig { returns(T.nilable(T::Hash[String, String])) }
+    def config; end
+
+    sig { params(value: T.nilable(T::Hash[String, String])).returns(T.nilable(T::Hash[String, String])) }
+    def config=(value); end
+
     sig { returns(T::Hash[Symbol, T.untyped]) }
     def to_h; end
 

data/rbi/workos/connection.rbi

@@ -57,12 +57,6 @@ module WorkOS
     sig { params(value: T::Array[WorkOS::ConnectionDomain]).returns(T::Array[WorkOS::ConnectionDomain]) }
     def domains=(value); end
 
-    sig { returns(T.nilable(String)) }
-    def callback_endpoint; end
-
-    sig { params(value: T.nilable(String)).returns(T.nilable(String)) }
-    def callback_endpoint=(value); end
-
     sig { returns(String) }
     def created_at; end
 

data/rbi/workos/create_data_integration.rbi

@@ -39,6 +39,12 @@ module WorkOS
     sig { params(value: T.nilable(T::Array[String])).returns(T.nilable(T::Array[String])) }
     def auth_methods=(value); end
 
+    sig { returns(T.nilable(T::Hash[String, String])) }
+    def config; end
+
+    sig { params(value: T.nilable(T::Hash[String, String])).returns(T.nilable(T::Hash[String, String])) }
+    def config=(value); end
+
     sig { returns(T.nilable(WorkOS::DataIntegrationCredentialsInput)) }
     def credentials; end
 

data/rbi/workos/data_integration.rbi

@@ -81,6 +81,12 @@ module WorkOS
     sig { params(value: T.nilable(WorkOS::DataIntegrationInstallation)).returns(T.nilable(WorkOS::DataIntegrationInstallation)) }
     def installation=(value); end
 
+    sig { returns(T::Hash[String, String]) }
+    def config; end
+
+    sig { params(value: T::Hash[String, String]).returns(T::Hash[String, String]) }
+    def config=(value); end
+
     sig { returns(T.nilable(WorkOS::DataIntegrationCustomProvider)) }
     def custom_provider; end
 

data/rbi/workos/data_integration_configuration_response.rbi

@@ -51,6 +51,12 @@ module WorkOS
     sig { params(value: T.nilable(T::Array[String])).returns(T.nilable(T::Array[String])) }
     def scopes=(value); end
 
+    sig { returns(T::Hash[String, String]) }
+    def config; end
+
+    sig { params(value: T::Hash[String, String]).returns(T::Hash[String, String]) }
+    def config=(value); end
+
     sig { returns(String) }
     def created_at; end
 

data/rbi/workos/data_integrations_get_data_integration_authorize_url_request.rbi

@@ -27,6 +27,12 @@ module WorkOS
     sig { params(value: T.nilable(String)).returns(T.nilable(String)) }
     def return_to=(value); end
 
+    sig { returns(T.nilable(T::Hash[String, String])) }
+    def config; end
+
+    sig { params(value: T.nilable(T::Hash[String, String])).returns(T.nilable(T::Hash[String, String])) }
+    def config=(value); end
+
     sig { returns(T::Hash[Symbol, T.untyped]) }
     def to_h; end
 

data/rbi/workos/pipes.rbi

@@ -27,13 +27,14 @@ module WorkOS
         enabled: T.nilable(T::Boolean),
         scopes: T.nilable(T::Array[String]),
         auth_methods: T.nilable(T::Array[String]),
+        config: T.nilable(T::Hash[String, String]),
         credentials: T.nilable(WorkOS::DataIntegrationCredentialsInput),
         api_key: T.nilable(WorkOS::ApiKeyInstallation),
         custom_provider: T.nilable(WorkOS::CustomProviderDefinition),
         request_options: T::Hash[Symbol, T.untyped]
       ).returns(WorkOS::DataIntegration)
     end
-    def create_data_integration(provider:, description:, enabled:, scopes:, auth_methods:, credentials:, api_key:, custom_provider:, request_options:); end
+    def create_data_integration(provider:, description:, enabled:, scopes:, auth_methods:, config:, credentials:, api_key:, custom_provider:, request_options:); end
 
     sig do
       params(
@@ -82,10 +83,11 @@ module WorkOS
         user_id: String,
         organization_id: T.nilable(String),
         return_to: T.nilable(String),
+        config: T.nilable(T::Hash[String, String]),
         request_options: T::Hash[Symbol, T.untyped]
       ).returns(WorkOS::DataIntegrationAuthorizeUrlResponse)
     end
-    def authorize_data_integration(slug:, user_id:, organization_id:, return_to:, request_options:); end
+    def authorize_data_integration(slug:, user_id:, organization_id:, return_to:, config:, request_options:); end
 
     sig do
       params(

data/rbi/workos/pipes_provider.rbi

@@ -25,10 +25,11 @@ module WorkOS
         scopes: T.nilable(T::Array[String]),
         client_id: T.nilable(String),
         client_secret: T.nilable(String),
+        config: T.nilable(T::Hash[String, String]),
         request_options: T::Hash[Symbol, T.untyped]
       ).returns(WorkOS::DataIntegrationConfigurationResponse)
     end
-    def update_organization_data_integration_configuration(organization_id:, slug:, enabled:, scopes:, client_id:, client_secret:, request_options:); end
+    def update_organization_data_integration_configuration(organization_id:, slug:, enabled:, scopes:, client_id:, client_secret:, config:, request_options:); end
 
   end
 end

data/rbi/workos/sso.rbi

@@ -40,6 +40,32 @@ module WorkOS
     end
     def delete_connection(id:, request_options:); end
 
+    sig do
+      params(
+        redirect_uri: String,
+        provider_scopes: T.nilable(T::Array[String]),
+        provider_query_params: T.nilable(T::Hash[String, String]),
+        client_id: T.nilable(String),
+        domain: T.nilable(String),
+        provider: T.nilable(String),
+        state: T.nilable(String),
+        connection: T.nilable(String),
+        organization: T.nilable(String),
+        domain_hint: T.nilable(String),
+        login_hint: T.nilable(String),
+        nonce: T.nilable(String),
+        prompt: T.nilable(String)
+      ).returns(String)
+    end
+    def get_authorization_url(redirect_uri:, provider_scopes:, provider_query_params:, client_id:, domain:, provider:, state:, connection:, organization:, domain_hint:, login_hint:, nonce:, prompt:); end
+
+    sig do
+      params(
+        token: String
+      ).returns(String)
+    end
+    def get_logout_url(token:); end
+
     sig do
       params(
         profile_id: String,

data/rbi/workos/user_management.rbi

@@ -62,6 +62,28 @@ module WorkOS
     end
     def create_authenticate(client_id:, grant_type:, code:, client_secret:, code_verifier:, invitation_token:, ip_address:, device_id:, user_agent:, signals_id:, request_options:); end
 
+    sig do
+      params(
+        redirect_uri: String,
+        code_challenge_method: T.nilable(String),
+        code_challenge: T.nilable(String),
+        domain_hint: T.nilable(String),
+        connection_id: T.nilable(String),
+        provider_query_params: T.nilable(T::Hash[String, String]),
+        provider_scopes: T.nilable(T::Array[String]),
+        invitation_token: T.nilable(String),
+        max_age: T.nilable(Integer),
+        screen_hint: T.nilable(String),
+        login_hint: T.nilable(String),
+        provider: T.nilable(String),
+        prompt: T.nilable(String),
+        state: T.nilable(String),
+        organization_id: T.nilable(String),
+        client_id: T.nilable(String)
+      ).returns(String)
+    end
+    def get_authorization_url(redirect_uri:, code_challenge_method:, code_challenge:, domain_hint:, connection_id:, provider_query_params:, provider_scopes:, invitation_token:, max_age:, screen_hint:, login_hint:, provider:, prompt:, state:, organization_id:, client_id:); end
+
     sig do
       params(
         client_id: String,
@@ -90,6 +112,14 @@ module WorkOS
     end
     def get_radar_challenge(id:, request_options:); end
 
+    sig do
+      params(
+        session_id: String,
+        return_to: T.nilable(String)
+      ).returns(String)
+    end
+    def get_logout_url(session_id:, return_to:); end
+
     sig do
       params(
         session_id: String,

data/test/workos/test_authkit_helpers.rb

@@ -26,19 +26,21 @@ class AuthKitHelpersTest < Minitest::Test
     assert_equal "/user_management/authorize", parsed.path
   end
 
-  def test_get_authorization_url_requires_client_id
+  def test_get_authorization_url_omits_client_id_when_unconfigured
     client = WorkOS::Client.new(api_key: "k", client_id: nil)
-    err = assert_raises(ArgumentError) do
-      client.user_management.get_authorization_url(redirect_uri: "x", provider: "GoogleOAuth")
-    end
-    assert_match(/client_id is required/, err.message)
+    url = client.user_management.get_authorization_url(redirect_uri: "x", provider: "GoogleOAuth")
+    params = URI.decode_www_form(URI.parse(url).query).to_h
+    refute params.key?("client_id")
   end
 
-  def test_get_authorization_url_requires_provider_or_connection_or_org
-    err = assert_raises(ArgumentError) do
-      @um.get_authorization_url(redirect_uri: "x")
-    end
-    assert_match(/provider, connection_id, or organization_id required/, err.message)
+  def test_get_authorization_url_explicit_client_id_overrides_configured
+    url = @um.get_authorization_url(
+      redirect_uri: "https://app.example.com/cb",
+      provider: "GoogleOAuth",
+      client_id: "client_override"
+    )
+    params = URI.decode_www_form(URI.parse(url).query).to_h
+    assert_equal "client_override", params["client_id"]
   end
 
   # H10
@@ -57,6 +59,16 @@ class AuthKitHelpersTest < Minitest::Test
     assert_equal expected_challenge, params["code_challenge"]
   end
 
+  def test_get_authorization_url_with_pkce_forwards_client_id_override
+    url, _verifier, _state = @um.get_authorization_url_with_pkce(
+      redirect_uri: "https://app.example.com/cb",
+      provider: "GoogleOAuth",
+      client_id: "client_override"
+    )
+    params = URI.decode_www_form(URI.parse(url).query).to_h
+    assert_equal "client_override", params["client_id"]
+  end
+
   # H11
   def test_authenticate_with_code_pkce_posts_correct_body
     stub = stub_request(:post, "https://api.workos.com/user_management/authenticate")

data/test/workos/test_pipes_model_round_trip.rb

@@ -61,6 +61,7 @@ class PipesModelRoundTripTest < Minitest::Test
       "enabled" => true,
       "scopes" => nil,
       "auth_methods" => [],
+      "config" => {},
       "credentials" => {},
       "api_key" => {},
       "custom_provider" => {}
@@ -135,6 +136,7 @@ class PipesModelRoundTripTest < Minitest::Test
       "auth_methods" => [],
       "credentials" => {},
       "installation" => nil,
+      "config" => {},
       "custom_provider" => nil,
       "created_at" => "stub",
       "updated_at" => "stub"
@@ -364,7 +366,8 @@ class PipesModelRoundTripTest < Minitest::Test
     fixture = {
       "user_id" => "stub",
       "organization_id" => "stub",
-      "return_to" => "stub"
+      "return_to" => "stub",
+      "config" => {}
     }
     model = WorkOS::DataIntegrationsGetDataIntegrationAuthorizeUrlRequest.new(fixture.to_json)
     json = model.to_h

data/test/workos/test_pipes_provider_model_round_trip.rb

@@ -32,6 +32,7 @@ class PipesProviderModelRoundTripTest < Minitest::Test
       "name" => "stub",
       "enabled" => true,
       "scopes" => nil,
+      "config" => {},
       "created_at" => "stub",
       "updated_at" => "stub",
       "credentials" => {}
@@ -65,7 +66,8 @@ class PipesProviderModelRoundTripTest < Minitest::Test
       "enabled" => true,
       "scopes" => nil,
       "client_id" => "stub",
-      "client_secret" => "stub"
+      "client_secret" => "stub",
+      "config" => {}
     }
     model = WorkOS::ConfigureDataIntegrationBody.new(fixture.to_json)
     json = model.to_h

data/test/workos/test_shared_model_round_trip.rb

@@ -16,39 +16,6 @@ class SharedModelRoundTripTest < Minitest::Test
     fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
   end
 
-  def test_object_summary_round_trip
-    fixture = {
-      "id" => "stub",
-      "name" => "stub",
-      "updated_at" => nil
-    }
-    model = WorkOS::ObjectSummary.new(fixture.to_json)
-    json = model.to_h
-    assert_kind_of Hash, json
-    assert_equal fixture["id"], json[:id]
-    assert_equal fixture["name"], json[:name]
-    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
-  end
-
-  def test_object_version_round_trip
-    fixture = {
-      "created_at" => "stub",
-      "current_version" => true,
-      "etag" => "stub",
-      "id" => "stub",
-      "size" => 1
-    }
-    model = WorkOS::ObjectVersion.new(fixture.to_json)
-    json = model.to_h
-    assert_kind_of Hash, json
-    assert_equal fixture["created_at"], json[:created_at]
-    assert_equal fixture["current_version"], json[:current_version]
-    assert_equal fixture["etag"], json[:etag]
-    assert_equal fixture["id"], json[:id]
-    assert_equal fixture["size"], json[:size]
-    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
-  end
-
   def test_connect_application_oauth_round_trip
     fixture = {
       "object" => "connect_application",
@@ -195,24 +162,6 @@ class SharedModelRoundTripTest < Minitest::Test
     fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
   end
 
-  def test_event_schema_round_trip
-    fixture = {
-      "object" => "event",
-      "id" => "stub",
-      "event" => "stub",
-      "data" => {},
-      "created_at" => "stub",
-      "context" => {}
-    }
-    model = WorkOS::EventSchema.new(fixture.to_json)
-    json = model.to_h
-    assert_kind_of Hash, json
-    assert_equal fixture["id"], json[:id]
-    assert_equal fixture["event"], json[:event]
-    assert_equal fixture["created_at"], json[:created_at]
-    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
-  end
-
   def test_agent_registration_claim_attempt_created_round_trip
     fixture = {
       "object" => "event",
@@ -838,17 +787,6 @@ class SharedModelRoundTripTest < Minitest::Test
     fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
   end
 
-  def test_event_list_list_metadata_round_trip
-    fixture = {
-      "after" => nil
-    }
-    model = WorkOS::EventListListMetadata.new(fixture.to_json)
-    json = model.to_h
-    assert_kind_of Hash, json
-    assert_nil json[:after]
-    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
-  end
-
   def test_event_context_google_analytics_session_round_trip
     fixture = {
       "containerId" => "stub",

data/test/workos/test_sso_model_round_trip.rb

@@ -31,7 +31,6 @@ class SsoModelRoundTripTest < Minitest::Test
       "state" => "stub",
       "status" => "stub",
       "domains" => [],
-      "callback_endpoint" => "stub",
       "created_at" => "stub",
       "updated_at" => "stub"
     }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: workos
 version: !ruby/object:Gem::Version
-  version: 10.0.0
+  version: 10.1.0
 platform: ruby
 authors:
 - WorkOS
@@ -128,6 +128,7 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- ".claude/CLAUDE.md"
 - ".github/CODEOWNERS"
 - ".github/pull_request_template.md"
 - ".github/workflows/block-generated-edits.yml"
@@ -144,6 +145,7 @@ files:
 - ".ruby-version"
 - ".standard.yml"
 - ".yardopts"
+- AGENTS.md
 - CHANGELOG.md
 - Gemfile
 - Gemfile.lock