workos 10.0.0 → 10.2.0

data/rbi/workos/sso.rbi

@@ -40,6 +40,32 @@ module WorkOS
     end
     def delete_connection(id:, request_options:); end
 
+    sig do
+      params(
+        redirect_uri: String,
+        provider_scopes: T.nilable(T::Array[String]),
+        provider_query_params: T.nilable(T::Hash[String, String]),
+        client_id: T.nilable(String),
+        domain: T.nilable(String),
+        provider: T.nilable(String),
+        state: T.nilable(String),
+        connection: T.nilable(String),
+        organization: T.nilable(String),
+        domain_hint: T.nilable(String),
+        login_hint: T.nilable(String),
+        nonce: T.nilable(String),
+        prompt: T.nilable(String)
+      ).returns(String)
+    end
+    def get_authorization_url(redirect_uri:, provider_scopes:, provider_query_params:, client_id:, domain:, provider:, state:, connection:, organization:, domain_hint:, login_hint:, nonce:, prompt:); end
+
+    sig do
+      params(
+        token: String
+      ).returns(String)
+    end
+    def get_logout_url(token:); end
+
     sig do
       params(
         profile_id: String,

data/rbi/workos/update_user.rbi

@@ -75,6 +75,12 @@ module WorkOS
     sig { params(value: T.nilable(String)).returns(T.nilable(String)) }
     def password_hash_type=(value); end
 
+    sig { returns(T.nilable(String)) }
+    def password_salt_position; end
+
+    sig { params(value: T.nilable(String)).returns(T.nilable(String)) }
+    def password_salt_position=(value); end
+
     sig { returns(T::Hash[Symbol, T.untyped]) }
     def to_h; end
 

data/rbi/workos/user_management.rbi

@@ -25,13 +25,17 @@ module WorkOS
       sig { returns(String) }
       def password_hash_type; end
 
+      sig { returns(T.nilable(String)) }
+      def password_salt_position; end
+
       sig do
         params(
           password_hash: String,
-          password_hash_type: String
+          password_hash_type: String,
+          password_salt_position: T.nilable(String)
         ).returns(WorkOS::UserManagement::PasswordHashed)
       end
-      def self.new(password_hash:, password_hash_type:); end
+      def self.new(password_hash:, password_hash_type:, password_salt_position:); end
     end
 
     sig { params(client: WorkOS::BaseClient).void }
@@ -62,6 +66,28 @@ module WorkOS
     end
     def create_authenticate(client_id:, grant_type:, code:, client_secret:, code_verifier:, invitation_token:, ip_address:, device_id:, user_agent:, signals_id:, request_options:); end
 
+    sig do
+      params(
+        redirect_uri: String,
+        code_challenge_method: T.nilable(String),
+        code_challenge: T.nilable(String),
+        domain_hint: T.nilable(String),
+        connection_id: T.nilable(String),
+        provider_query_params: T.nilable(T::Hash[String, String]),
+        provider_scopes: T.nilable(T::Array[String]),
+        invitation_token: T.nilable(String),
+        max_age: T.nilable(Integer),
+        screen_hint: T.nilable(String),
+        login_hint: T.nilable(String),
+        provider: T.nilable(String),
+        prompt: T.nilable(String),
+        state: T.nilable(String),
+        organization_id: T.nilable(String),
+        client_id: T.nilable(String)
+      ).returns(String)
+    end
+    def get_authorization_url(redirect_uri:, code_challenge_method:, code_challenge:, domain_hint:, connection_id:, provider_query_params:, provider_scopes:, invitation_token:, max_age:, screen_hint:, login_hint:, provider:, prompt:, state:, organization_id:, client_id:); end
+
     sig do
       params(
         client_id: String,
@@ -90,6 +116,14 @@ module WorkOS
     end
     def get_radar_challenge(id:, request_options:); end
 
+    sig do
+      params(
+        session_id: String,
+        return_to: T.nilable(String)
+      ).returns(String)
+    end
+    def get_logout_url(session_id:, return_to:); end
+
     sig do
       params(
         session_id: String,

data/rbi/workos/waitlist_user.rbi

@@ -39,6 +39,12 @@ module WorkOS
     sig { params(value: T.nilable(String)).returns(T.nilable(String)) }
     def approved_at=(value); end
 
+    sig { returns(T.nilable(String)) }
+    def waitlist_id; end
+
+    sig { params(value: T.nilable(String)).returns(T.nilable(String)) }
+    def waitlist_id=(value); end
+
     sig { returns(String) }
     def created_at; end
 

data/test/workos/test_authkit_helpers.rb

@@ -26,19 +26,21 @@ class AuthKitHelpersTest < Minitest::Test
     assert_equal "/user_management/authorize", parsed.path
   end
 
-  def test_get_authorization_url_requires_client_id
+  def test_get_authorization_url_omits_client_id_when_unconfigured
     client = WorkOS::Client.new(api_key: "k", client_id: nil)
-    err = assert_raises(ArgumentError) do
-      client.user_management.get_authorization_url(redirect_uri: "x", provider: "GoogleOAuth")
-    end
-    assert_match(/client_id is required/, err.message)
+    url = client.user_management.get_authorization_url(redirect_uri: "x", provider: "GoogleOAuth")
+    params = URI.decode_www_form(URI.parse(url).query).to_h
+    refute params.key?("client_id")
   end
 
-  def test_get_authorization_url_requires_provider_or_connection_or_org
-    err = assert_raises(ArgumentError) do
-      @um.get_authorization_url(redirect_uri: "x")
-    end
-    assert_match(/provider, connection_id, or organization_id required/, err.message)
+  def test_get_authorization_url_explicit_client_id_overrides_configured
+    url = @um.get_authorization_url(
+      redirect_uri: "https://app.example.com/cb",
+      provider: "GoogleOAuth",
+      client_id: "client_override"
+    )
+    params = URI.decode_www_form(URI.parse(url).query).to_h
+    assert_equal "client_override", params["client_id"]
   end
 
   # H10
@@ -57,6 +59,16 @@ class AuthKitHelpersTest < Minitest::Test
     assert_equal expected_challenge, params["code_challenge"]
   end
 
+  def test_get_authorization_url_with_pkce_forwards_client_id_override
+    url, _verifier, _state = @um.get_authorization_url_with_pkce(
+      redirect_uri: "https://app.example.com/cb",
+      provider: "GoogleOAuth",
+      client_id: "client_override"
+    )
+    params = URI.decode_www_form(URI.parse(url).query).to_h
+    assert_equal "client_override", params["client_id"]
+  end
+
   # H11
   def test_authenticate_with_code_pkce_posts_correct_body
     stub = stub_request(:post, "https://api.workos.com/user_management/authenticate")

data/test/workos/test_events.rb

@@ -14,13 +14,13 @@ class EventsTest < Minitest::Test
   def test_list_events_returns_expected_result
     stub_request(:get, %r{\Ahttps://api\.workos\.com/events(\?|\z)})
       .to_return(body: '{"data": [], "list_metadata": {}}', status: 200)
-    result = @client.events.list_events
+    result = @client.events.list_events(events: ["stub"])
     assert_kind_of WorkOS::Types::ListStruct, result
   end
 
   # Parameterized authentication error tests (one per endpoint).
   [
-    {name: :list_events, verb: :get, url: %r{\Ahttps://api\.workos\.com/events(\?|\z)}}
+    {name: :list_events, verb: :get, url: %r{\Ahttps://api\.workos\.com/events(\?|\z)}, args: {events: ["stub"]}}
   ].each do |spec|
     define_method("test_#{spec[:name]}_raises_authentication_error_on_401") do
       stub_request(spec[:verb], spec[:url])

data/test/workos/test_pipes.rb

@@ -60,6 +60,13 @@ class PipesTest < Minitest::Test
     refute_nil result
   end
 
+  def test_update_data_integration_client_credentials_returns_expected_result
+    stub_request(:put, %r{\Ahttps://api\.workos\.com/data-integrations/stub/client-credentials(\?|\z)})
+      .to_return(body: "{}", status: 200)
+    result = @client.pipes.update_data_integration_client_credentials(slug: "stub", user_id: "stub", client_id: "stub", client_secret: "stub")
+    refute_nil result
+  end
+
   def test_create_data_integration_credential_returns_expected_result
     stub_request(:post, %r{\Ahttps://api\.workos\.com/data-integrations/stub/credentials(\?|\z)})
       .to_return(body: "{}", status: 200)
@@ -118,6 +125,7 @@ class PipesTest < Minitest::Test
     {name: :delete_data_integration, verb: :delete, url: %r{\Ahttps://api\.workos\.com/data-integrations/stub(\?|\z)}, args: {slug: "stub"}},
     {name: :update_data_integration_api_key, verb: :put, url: %r{\Ahttps://api\.workos\.com/data-integrations/stub/api-key(\?|\z)}, args: {slug: "stub", user_id: "stub", secret: "stub"}},
     {name: :authorize_data_integration, verb: :post, url: %r{\Ahttps://api\.workos\.com/data-integrations/stub/authorize(\?|\z)}, args: {slug: "stub", user_id: "stub"}},
+    {name: :update_data_integration_client_credentials, verb: :put, url: %r{\Ahttps://api\.workos\.com/data-integrations/stub/client-credentials(\?|\z)}, args: {slug: "stub", user_id: "stub", client_id: "stub", client_secret: "stub"}},
     {name: :create_data_integration_credential, verb: :post, url: %r{\Ahttps://api\.workos\.com/data-integrations/stub/credentials(\?|\z)}, args: {slug: "stub", user_id: "stub"}},
     {name: :get_access_token, verb: :post, url: %r{\Ahttps://api\.workos\.com/data-integrations/stub/token(\?|\z)}, args: {provider: "stub", user_id: "stub"}},
     {name: :get_user_connected_account, verb: :get, url: %r{\Ahttps://api\.workos\.com/user_management/users/stub/connected_accounts/stub(\?|\z)}, args: {user_id: "stub", slug: "stub"}},

data/test/workos/test_pipes_model_round_trip.rb

@@ -49,8 +49,6 @@ class PipesModelRoundTripTest < Minitest::Test
     json = model.to_h
     assert_kind_of Hash, json
     assert_equal fixture["name"], json[:name]
-    assert_equal fixture["authorization_url"], json[:authorization_url]
-    assert_equal fixture["token_url"], json[:token_url]
     fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
   end
 
@@ -61,6 +59,7 @@ class PipesModelRoundTripTest < Minitest::Test
       "enabled" => true,
       "scopes" => nil,
       "auth_methods" => [],
+      "config" => {},
       "credentials" => {},
       "api_key" => {},
       "custom_provider" => {}
@@ -133,8 +132,9 @@ class PipesModelRoundTripTest < Minitest::Test
       "scopes" => nil,
       "redirect_uri" => "stub",
       "auth_methods" => [],
-      "credentials" => {},
+      "credentials" => nil,
       "installation" => nil,
+      "config" => {},
       "custom_provider" => nil,
       "created_at" => "stub",
       "updated_at" => "stub"
@@ -197,6 +197,9 @@ class PipesModelRoundTripTest < Minitest::Test
       "scopes" => [],
       "auth_method" => "stub",
       "api_key_last_4" => nil,
+      "client_id" => nil,
+      "client_secret_last_4" => nil,
+      "config" => {},
       "state" => "stub",
       "created_at" => "stub",
       "updated_at" => "stub"
@@ -364,7 +367,8 @@ class PipesModelRoundTripTest < Minitest::Test
     fixture = {
       "user_id" => "stub",
       "organization_id" => "stub",
-      "return_to" => "stub"
+      "return_to" => "stub",
+      "config" => {}
     }
     model = WorkOS::DataIntegrationsGetDataIntegrationAuthorizeUrlRequest.new(fixture.to_json)
     json = model.to_h
@@ -373,6 +377,23 @@ class PipesModelRoundTripTest < Minitest::Test
     fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
   end
 
+  def test_data_integrations_upsert_client_credentials_request_round_trip
+    fixture = {
+      "user_id" => "stub",
+      "organization_id" => "stub",
+      "client_id" => "stub",
+      "client_secret" => "stub",
+      "config" => {}
+    }
+    model = WorkOS::DataIntegrationsUpsertClientCredentialsRequest.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["user_id"], json[:user_id]
+    assert_equal fixture["client_id"], json[:client_id]
+    assert_equal fixture["client_secret"], json[:client_secret]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
   def test_data_integrations_vend_credentials_request_round_trip
     fixture = {
       "user_id" => "stub",
@@ -406,6 +427,9 @@ class PipesModelRoundTripTest < Minitest::Test
       "scopes" => [],
       "auth_method" => "stub",
       "api_key_last_4" => nil,
+      "client_id" => nil,
+      "client_secret_last_4" => nil,
+      "config" => {},
       "state" => "stub",
       "created_at" => "stub",
       "updated_at" => "stub",

data/test/workos/test_pipes_provider_model_round_trip.rb

@@ -32,6 +32,7 @@ class PipesProviderModelRoundTripTest < Minitest::Test
       "name" => "stub",
       "enabled" => true,
       "scopes" => nil,
+      "config" => {},
       "created_at" => "stub",
       "updated_at" => "stub",
       "credentials" => {}
@@ -65,7 +66,8 @@ class PipesProviderModelRoundTripTest < Minitest::Test
       "enabled" => true,
       "scopes" => nil,
       "client_id" => "stub",
-      "client_secret" => "stub"
+      "client_secret" => "stub",
+      "config" => {}
     }
     model = WorkOS::ConfigureDataIntegrationBody.new(fixture.to_json)
     json = model.to_h

data/test/workos/test_shared_model_round_trip.rb

@@ -181,6 +181,7 @@ class SharedModelRoundTripTest < Minitest::Test
       "email" => "stub",
       "state" => "stub",
       "approved_at" => nil,
+      "waitlist_id" => nil,
       "created_at" => "stub",
       "updated_at" => "stub"
     }
@@ -507,6 +508,34 @@ class SharedModelRoundTripTest < Minitest::Test
     fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
   end
 
+  def test_agent_registration_refreshed_round_trip
+    fixture = {
+      "object" => "event",
+      "id" => "stub",
+      "event" => "agent.registration.refreshed",
+      "data" => {},
+      "created_at" => "stub",
+      "context" => {}
+    }
+    model = WorkOS::AgentRegistrationRefreshed.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["id"], json[:id]
+    assert_equal fixture["created_at"], json[:created_at]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_agent_registration_refreshed_data_round_trip
+    fixture = {
+      "agent_registration_id" => "stub"
+    }
+    model = WorkOS::AgentRegistrationRefreshedData.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["agent_registration_id"], json[:agent_registration_id]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
   def test_agent_registration_revoked_round_trip
     fixture = {
       "object" => "event",

data/test/workos/test_sso_model_round_trip.rb

@@ -31,7 +31,6 @@ class SsoModelRoundTripTest < Minitest::Test
       "state" => "stub",
       "status" => "stub",
       "domains" => [],
-      "callback_endpoint" => "stub",
       "created_at" => "stub",
       "updated_at" => "stub"
     }

data/test/workos/test_user_management.rb

@@ -163,7 +163,7 @@ class UserManagementTest < Minitest::Test
   def test_authenticate_with_radar_sms_challenge_returns_expected_result
     stub_request(:post, %r{\Ahttps://api\.workos\.com/user_management/authenticate(\?|\z)})
       .to_return(body: "{}", status: 200)
-    result = @client.user_management.authenticate_with_radar_sms_challenge(code: "stub", verification_id: "stub", phone_number: "stub", pending_authentication_token: "stub")
+    result = @client.user_management.authenticate_with_radar_sms_challenge(code: "stub", pending_authentication_token: "stub")
     refute_nil result
   end
 
@@ -171,7 +171,7 @@ class UserManagementTest < Minitest::Test
     stub_request(:post, %r{\Ahttps://api\.workos\.com/user_management/authenticate(\?|\z)})
       .to_return(body: '{"message": "Unauthorized"}', status: 401)
     assert_raises(WorkOS::AuthenticationError) do
-      @client.user_management.authenticate_with_radar_sms_challenge(code: "stub", verification_id: "stub", phone_number: "stub", pending_authentication_token: "stub")
+      @client.user_management.authenticate_with_radar_sms_challenge(code: "stub", pending_authentication_token: "stub")
     end
   end
 
@@ -262,9 +262,9 @@ class UserManagementTest < Minitest::Test
 
   def test_create_user_with_password_hashed_returns_expected_result
     stub_request(:post, %r{\Ahttps://api\.workos\.com/user_management/users(\?|\z)})
-      .with(body: hash_including("email" => "stub", "password_hash" => "stub", "password_hash_type" => "stub"))
+      .with(body: hash_including("email" => "stub", "password_hash" => "stub", "password_hash_type" => "stub", "password_salt_position" => "stub"))
       .to_return(body: "{}", status: 200)
-    result = @client.user_management.create_user(email: "stub", password: WorkOS::UserManagement::PasswordHashed.new(password_hash: "stub", password_hash_type: "stub"))
+    result = @client.user_management.create_user(email: "stub", password: WorkOS::UserManagement::PasswordHashed.new(password_hash: "stub", password_hash_type: "stub", password_salt_position: "stub"))
     refute_nil result
   end
 
@@ -292,9 +292,9 @@ class UserManagementTest < Minitest::Test
 
   def test_update_user_with_password_hashed_returns_expected_result
     stub_request(:put, %r{\Ahttps://api\.workos\.com/user_management/users/stub(\?|\z)})
-      .with(body: hash_including("password_hash" => "stub", "password_hash_type" => "stub"))
+      .with(body: hash_including("password_hash" => "stub", "password_hash_type" => "stub", "password_salt_position" => "stub"))
       .to_return(body: "{}", status: 200)
-    result = @client.user_management.update_user(id: "stub", password: WorkOS::UserManagement::PasswordHashed.new(password_hash: "stub", password_hash_type: "stub"))
+    result = @client.user_management.update_user(id: "stub", password: WorkOS::UserManagement::PasswordHashed.new(password_hash: "stub", password_hash_type: "stub", password_salt_position: "stub"))
     refute_nil result
   end
 

data/test/workos/test_user_management_model_round_trip.rb

@@ -126,7 +126,8 @@ class UserManagementModelRoundTripTest < Minitest::Test
       "signals_id" => "stub",
       "password" => nil,
       "password_hash" => "stub",
-      "password_hash_type" => "stub"
+      "password_hash_type" => "stub",
+      "password_salt_position" => "stub"
     }
     model = WorkOS::CreateUser.new(fixture.to_json)
     json = model.to_h
@@ -147,7 +148,8 @@ class UserManagementModelRoundTripTest < Minitest::Test
       "locale" => nil,
       "password" => "stub",
       "password_hash" => "stub",
-      "password_hash_type" => "stub"
+      "password_hash_type" => "stub",
+      "password_salt_position" => "stub"
     }
     model = WorkOS::UpdateUser.new(fixture.to_json)
     json = model.to_h
@@ -2356,8 +2358,6 @@ class UserManagementModelRoundTripTest < Minitest::Test
     assert_equal fixture["client_id"], json[:client_id]
     assert_equal fixture["client_secret"], json[:client_secret]
     assert_equal fixture["code"], json[:code]
-    assert_equal fixture["verification_id"], json[:verification_id]
-    assert_equal fixture["phone_number"], json[:phone_number]
     assert_equal fixture["pending_authentication_token"], json[:pending_authentication_token]
     fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: workos
 version: !ruby/object:Gem::Version
-  version: 10.0.0
+  version: 10.2.0
 platform: ruby
 authors:
 - WorkOS
@@ -128,6 +128,7 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- ".claude/CLAUDE.md"
 - ".github/CODEOWNERS"
 - ".github/pull_request_template.md"
 - ".github/workflows/block-generated-edits.yml"
@@ -144,6 +145,7 @@ files:
 - ".ruby-version"
 - ".standard.yml"
 - ".yardopts"
+- AGENTS.md
 - CHANGELOG.md
 - Gemfile
 - Gemfile.lock
@@ -440,6 +442,7 @@ files:
 - lib/workos/pipes/data_integrations_list_response_data.rb
 - lib/workos/pipes/data_integrations_list_response_data_connected_account.rb
 - lib/workos/pipes/data_integrations_upsert_api_key_request.rb
+- lib/workos/pipes/data_integrations_upsert_client_credentials_request.rb
 - lib/workos/pipes/data_integrations_vend_credentials_request.rb
 - lib/workos/pipes/update_custom_provider_definition.rb
 - lib/workos/pipes/update_data_integration.rb
@@ -477,6 +480,8 @@ files:
 - lib/workos/shared/agent_registration_expired_data.rb
 - lib/workos/shared/agent_registration_organization_switched.rb
 - lib/workos/shared/agent_registration_organization_switched_data.rb
+- lib/workos/shared/agent_registration_refreshed.rb
+- lib/workos/shared/agent_registration_refreshed_data.rb
 - lib/workos/shared/agent_registration_revoked.rb
 - lib/workos/shared/agent_registration_revoked_data.rb
 - lib/workos/shared/auth_method_mismatch_error.rb
@@ -572,6 +577,7 @@ files:
 - lib/workos/types/create_data_integration_auth_methods.rb
 - lib/workos/types/create_user_invite_options_locale.rb
 - lib/workos/types/create_user_password_hash_type.rb
+- lib/workos/types/create_user_password_salt_position.rb
 - lib/workos/types/create_webhook_endpoint_events.rb
 - lib/workos/types/custom_provider_definition_authenticate_via.rb
 - lib/workos/types/data_integration_access_token_response_error.rb
@@ -653,6 +659,7 @@ files:
 - lib/workos/types/sso_provider.rb
 - lib/workos/types/update_custom_provider_definition_authenticate_via.rb
 - lib/workos/types/update_user_password_hash_type.rb
+- lib/workos/types/update_user_password_salt_position.rb
 - lib/workos/types/update_webhook_endpoint_events.rb
 - lib/workos/types/update_webhook_endpoint_status.rb
 - lib/workos/types/user_identities_get_item_provider.rb
@@ -905,6 +912,8 @@ files:
 - rbi/workos/agent_registration_expired_data.rbi
 - rbi/workos/agent_registration_organization_switched.rbi
 - rbi/workos/agent_registration_organization_switched_data.rbi
+- rbi/workos/agent_registration_refreshed.rbi
+- rbi/workos/agent_registration_refreshed_data.rbi
 - rbi/workos/agent_registration_revoked.rbi
 - rbi/workos/agent_registration_revoked_data.rbi
 - rbi/workos/agents.rbi
@@ -1094,6 +1103,7 @@ files:
 - rbi/workos/data_integrations_list_response_data.rbi
 - rbi/workos/data_integrations_list_response_data_connected_account.rbi
 - rbi/workos/data_integrations_upsert_api_key_request.rbi
+- rbi/workos/data_integrations_upsert_client_credentials_request.rbi
 - rbi/workos/data_integrations_vend_credentials_request.rbi
 - rbi/workos/decrypt_request.rbi
 - rbi/workos/decrypt_response.rbi