workos 10.2.1 → 10.4.0

data/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "10.2.1"
+  ".": "10.4.0"
 }

data/.ruby-version

@@ -1 +1 @@
-3.4.9
+3.4.10

data/CHANGELOG.md

@@ -1,5 +1,333 @@
 # Changelog
 
+## [10.4.0](https://github.com/workos/workos-ruby/compare/v10.3.0...v10.4.0) (2026-09-18)
+
+### Features
+
+* Add optional jwt_issuer option for session token validation ([#552](https://github.com/workos/workos-ruby/issues/552)) ([841bf57](https://github.com/workos/workos-ruby/commit/841bf57ed103bf8f1d1a079f7a0d70edb9e7a854))
+
+* [#550](https://github.com/workos/workos-ruby/pull/550) fix(generated): regenerate from spec
+
+  **Features**
+  * **[pipes](https://workos.com/docs/reference/pipes)**:
+    * Added `connected_account_id` to `DataIntegrationsVendCredentialsRequest`
+    * Added `connected_account_id` to `DataIntegrationsGetUserTokenRequest`
+    * Added parameter `UserManagementDataProviders.getUserDataInstallation.connected_account_id`
+    * Changed errors for endpoint `GET /user_management/users/{user_id}/connected_accounts/{slug}`
+    * Added parameter `UserManagementDataProviders.updateUserDataInstallation.connected_account_id`
+    * Changed errors for endpoint `PUT /user_management/users/{user_id}/connected_accounts/{slug}`
+    * Added parameter `UserManagementDataProviders.deleteUserDataInstallation.connected_account_id`
+    * Changed errors for endpoint `DELETE /user_management/users/{user_id}/connected_accounts/{slug}`
+    * Added `connected_accounts` to `DataIntegrationsListResponseData`
+    * Changed errors for endpoint `PUT /data-integrations/{slug}`
+    * Changed errors for endpoint `PUT /data-integrations/{slug}/api-key`
+    * Changed errors for endpoint `PUT /data-integrations/{slug}/client-credentials`
+    * Changed errors for endpoint `POST /data-integrations/{slug}/credentials`
+    * Changed errors for endpoint `POST /data-integrations/{provider}/token`
+
+* [#553](https://github.com/workos/workos-ruby/pull/553) feat(generated): regenerate from spec (4 changes)
+
+  **Features**
+  * **[admin_portal](https://workos.com/docs/reference/admin-portal)**:
+    * Changed the format of `PortalLinkResponse.link`
+  * **[agents](https://workos.com/docs/reference/agents)**:
+    * Added parameter `AgentsSessions.list.organization_id`
+    * Changed the format of `ClaimViewResponse.user_code`
+    * Changed the format of `AgentAdminValidateCredentialRequest.credential`
+  * **[api_keys](https://workos.com/docs/reference/authkit/api-keys)**:
+    * Changed the format of `ValidateApiKey.value`
+    * Changed the format of `OrganizationApiKeyWithValue.value`
+    * Changed the format of `UserApiKeyWithValue.value`
+  * **[multi_factor_auth](https://workos.com/docs/reference/authkit/mfa)**:
+    * Changed the format of `AuthenticationChallenge.code`
+    * Changed the format of `AuthenticationFactorEnrolledTotp.secret`
+    * Changed the format of `AuthenticationFactorEnrolledTotp.qr_code`
+    * Changed the format of `AuthenticationFactorEnrolledTotp.uri`
+    * Changed the format of `AuthenticationChallengesVerifyRequest.code`
+  * **[pipes](https://workos.com/docs/reference/pipes)**:
+    * Added `supports_multiple_connections` to `DataIntegrationsVendCredentialsRequest`
+    * Added `supports_multiple_connections` to `DataIntegrationsGetUserTokenRequest`
+    * Added parameter `UserManagementDataProviders.getUserDataInstallation.supports_multiple_connections`
+    * Added parameter `UserManagementDataProviders.updateUserDataInstallation.supports_multiple_connections`
+    * Added parameter `UserManagementDataProviders.deleteUserDataInstallation.supports_multiple_connections`
+    * Added parameter `UserManagementDataProviders.getUserDataIntegrations.supports_multiple_connections`
+    * Added enum `PipesOwnership`
+    * Added `user` to `CreateDataIntegrationOwnership`
+    * Added `user` to `DataIntegrationOwnership`
+    * Added endpoint `GET /data-integrations/{slug}/organization`
+    * Added endpoint `PUT /data-integrations/{slug}/organization`
+    * Added endpoint `DELETE /data-integrations/{slug}/organization`
+    * Added parameter `Pipes.listDataIntegrations.ownership`
+    * Changed errors for endpoint `GET /data-integrations`
+    * Changed errors for endpoint `PUT /user_management/users/{user_id}/connected_accounts/{slug}`
+    * Changed errors for endpoint `DELETE /user_management/users/{user_id}/connected_accounts/{slug}`
+    * Changed the format of `DataIntegrationCredentialsResponseCredential.value`
+    * Added `connection_owner` to `DataIntegrationsUpsertApiKeyRequest`
+    * Added `connection_owner` to `DataIntegrationsUpsertClientCredentialsRequest`
+    * Added enum `DataIntegrationsUpsertApiKeyRequestConnectionOwner`
+    * Added enum `DataIntegrationsUpsertClientCredentialsRequestConnectionOwner`
+    * Added model `AccountSelectionRequiredError`
+    * Added `connected_account_id` to `DataIntegrationsUpsertApiKeyRequest`
+    * Added `connected_account_id` to `DataIntegrationsUpsertClientCredentialsRequest`
+    * Added `ownership` to `CreateDataIntegration`
+    * Added `ownership` to `DataIntegration`
+    * Added `connection_owner` to `DataIntegrationsVendCredentialsRequest`
+    * Added `connection_owner` to `DataIntegrationsGetUserTokenRequest`
+    * Added enum `CreateDataIntegrationOwnership`
+    * Added enum `DataIntegrationOwnership`
+    * Added enum `DataIntegrationsVendCredentialsRequestConnectionOwner`
+    * Added enum `DataIntegrationsGetUserTokenRequestConnectionOwner`
+    * Changed errors for endpoint `POST /data-integrations/{slug}/credentials`
+    * Changed errors for endpoint `POST /data-integrations/{provider}/token`
+  * **[sso](https://workos.com/docs/reference/sso)**:
+    * Changed the format of `CreateConnectionKeyPair.key`
+    * Changed the format of `TokenQuery.code`
+    * Changed the format of `SSOLogoutAuthorizeResponse.logout_url`
+  * **[user_management](https://workos.com/docs/reference/authkit/user)**:
+    * Added model `CreateAuthkitOAuthResource`
+    * Added model `AuthkitOAuthResource`
+    * Added service `UserManagementAuthkitOAuthResources`
+    * Changed the format of `DeviceAuthorizationResponse.verification_uri_complete`
+    * Changed the format of `VerifyEmailAddress.code`
+    * Changed the format of `ConfirmEmailChange.code`
+    * Changed the format of `MagicAuth.code`
+    * Changed the format of `UserInvite.accept_invitation_url`
+    * Changed the format of `EmailVerification.code`
+    * Changed the format of `PasswordReset.password_reset_url`
+    * Changed the format of `AuthenticateResponse.authkit_authorization_code`
+    * Changed the format of `DeviceAuthorizationResponse.device_code`
+    * Changed the format of `DeviceAuthorizationResponse.user_code`
+    * Changed the format of `AuthorizationCodeSessionAuthenticateRequest.code`
+    * Changed the format of `AuthorizationCodeSessionAuthenticateRequest.code_verifier`
+    * Changed the format of `MagicAuthCodeSessionAuthenticateRequest.code`
+    * Changed the format of `EmailVerificationCodeSessionAuthenticateRequest.code`
+    * Changed the format of `MfaTotpSessionAuthenticateRequest.code`
+    * Changed the format of `RadarEmailChallengeCodeSessionAuthenticateRequest.code`
+    * Changed the format of `RadarSmsChallengeCodeSessionAuthenticateRequest.code`
+    * Changed the format of `DeviceCodeSessionAuthenticateRequest.device_code`
+    * Changed the format of `Invitation.accept_invitation_url`
+    * Changed the format of `MagicAuthSendMagicAuthCodeAndReturnResponse.code`
+  * **[radar](https://workos.com/docs/reference/radar)**:
+    * Changed the format of `RadarChallenge.code`
+  * **[vault](https://workos.com/docs/reference/vault)**:
+    * Changed the format of `CreateObjectRequest.value`
+    * Changed the format of `VaultObject.value`
+    * Changed the format of `UpdateObjectRequest.value`
+
+  **Fixes**
+  * **[pipes](https://workos.com/docs/reference/pipes)**:
+    * Removed `userland_user` from `CreateDataIntegrationOwnership`
+    * Removed `userland_user` from `DataIntegrationOwnership`
+    * Changed errors for endpoint `POST /user_management/users/{user_id}/connected_accounts/{slug}`
+    * Changed errors for endpoint `PUT /data-integrations/{slug}/api-key`
+    * Changed errors for endpoint `PUT /data-integrations/{slug}/client-credentials`
+    * Changed errors for endpoint `POST /data-integrations/{slug}/credentials`
+    * Changed errors for endpoint `POST /data-integrations/{provider}/token`
+    * Changed errors for endpoint `GET /user_management/users/{user_id}/connected_accounts/{slug}`
+    * Changed errors for endpoint `PUT /user_management/users/{user_id}/connected_accounts/{slug}`
+    * Changed errors for endpoint `DELETE /user_management/users/{user_id}/connected_accounts/{slug}`
+    * Changed the type of `DataIntegrationInstallation.user_id`
+
+* [#556](https://github.com/workos/workos-ruby/pull/556) fix(generated): regenerate from spec (1 change)
+
+  **Features**
+  * **[multi_factor_auth](https://workos.com/docs/reference/authkit/mfa)**:
+    * Changed errors for endpoint `POST /auth/factors/{id}/challenge`
+  * **[pipes](https://workos.com/docs/reference/pipes)**:
+    * Added `connection_owner` to `DataIntegrationsListResponseData`
+    * Added enum `DataIntegrationsListResponseDataConnectionOwner`
+    * Added `connection_role` to `DataIntegrationsListResponseDataConnectedAccount`
+    * Added `account_identifier` to `DataIntegrationsListResponseDataConnectedAccount`
+    * Added `account_display_name` to `DataIntegrationsListResponseDataConnectedAccount`
+    * Added enum `DataIntegrationsListResponseDataConnectedAccountConnectionRole`
+    * Added `connection_role` to `DataIntegrationInstallation`
+    * Added `account_identifier` to `DataIntegrationInstallation`
+    * Added `account_display_name` to `DataIntegrationInstallation`
+    * Added enum `DataIntegrationInstallationConnectionRole`
+    * Added `connection_owner` to `DataIntegrationsGetDataIntegrationAuthorizeUrlRequest`
+    * Added enum `DataIntegrationsGetDataIntegrationAuthorizeUrlRequestConnectionOwner`
+    * Added the organization connected-account operations on `Pipes`: `client.pipes.get_organization_connected_account`, `create_organization_connected_account`, `update_organization_connected_account`, `delete_organization_connected_account`, `list_organization_data_providers`
+  * **[connect](https://workos.com/docs/reference/workos-connect/standalone)**:
+    * Added `connection_role` to `ConnectedAccount`
+    * Added `account_identifier` to `ConnectedAccount`
+    * Added `account_display_name` to `ConnectedAccount`
+    * Added enum `ConnectedAccountConnectionRole`
+  * **[webhooks](https://workos.com/docs/reference/webhooks)**:
+    * Added `pipes.account_connection.add_failed` to `CreateWebhookEndpointEvents`
+    * Added `pipes.account_connection.connected` to `CreateWebhookEndpointEvents`
+    * Added `pipes.account_connection.connection_failed` to `CreateWebhookEndpointEvents`
+    * Added `pipes.account_connection.disconnected` to `CreateWebhookEndpointEvents`
+    * Added `pipes.account_connection.reauthorization_needed` to `CreateWebhookEndpointEvents`
+    * Added `pipes.account_connection.add_failed` to `UpdateWebhookEndpointEvents`
+    * Added `pipes.account_connection.connected` to `UpdateWebhookEndpointEvents`
+    * Added `pipes.account_connection.connection_failed` to `UpdateWebhookEndpointEvents`
+    * Added `pipes.account_connection.disconnected` to `UpdateWebhookEndpointEvents`
+    * Added `pipes.account_connection.reauthorization_needed` to `UpdateWebhookEndpointEvents`
+
+  **Fixes**
+  * **[multi_factor_auth](https://workos.com/docs/reference/authkit/mfa)**:
+    * Changed errors for endpoint `POST /auth/factors/{id}/challenge`
+
+* [#557](https://github.com/workos/workos-ruby/pull/557) fix(generated): regenerate from spec (1 change)
+
+  **Fixes**
+  * **[multi_factor_auth](https://workos.com/docs/reference/authkit/mfa)**:
+    * Changed errors for endpoint `POST /auth/factors/{id}/challenge`
+
+## [10.3.0](https://github.com/workos/workos-ruby/compare/v10.2.1...v10.3.0) (2026-09-01)
+
+* [#546](https://github.com/workos/workos-ruby/pull/546) feat(generated)!: regenerate from spec (5 changes)
+
+  **⚠️ Breaking**
+  * **[agents](https://workos.com/docs/reference/agents)**:
+    * Removed service `Agents`
+  * **[sso](https://workos.com/docs/reference/sso)**:
+    * Removed model `TokenBody`
+    * Removed enum `TokenBodyGrantType`
+    * Removed model `TokenQuery`
+    * Changed parameter `SSO.token.grant_type`
+
+  **Features**
+  * **[agents](https://workos.com/docs/reference/agents)**:
+    * Added model `AgentBlueprint`
+    * Added model `AgentInstance`
+    * Added model `AgentToken`
+    * Added model `AgentInstanceSession`
+    * Added model `AgentBlueprintInvocableBy`
+    * Added model `AgentBlueprintSessionSetting`
+    * Added model `AgentBlueprintsCreateRequest`
+    * Added model `AgentBlueprintsCreateRequestInvocableBy`
+    * Added model `AgentBlueprintsCreateRequestSessionSetting`
+    * Added model `AgentBlueprintsUpdateRequest`
+    * Added model `AgentBlueprintsUpdateRequestInvocableBy`
+    * Added model `AgentBlueprintsUpdateRequestSessionSetting`
+    * Added model `AgentBlueprintsTokenMintTokenRequest`
+    * Added enum `AgentInstanceType`
+    * Added enum `AgentInstanceSessionStatus`
+    * Added enum `AgentBlueprintsTokenMintTokenRequestType`
+  * **agents_blueprints**:
+    * Added service `AgentsBlueprints`
+  * **agents_blueprints_tokens**:
+    * Added service `AgentsBlueprintsTokens`
+  * **agents_instances**:
+    * Added service `AgentsInstances`
+  * **agents_registrations**:
+    * Added service `AgentsRegistrations`
+  * **agents_sessions**:
+    * Added service `AgentsSessions`
+  * **[organizations](https://workos.com/docs/reference/organization)**:
+    * Added `retention_period` to `UpdateAuditLogsRetention`
+    * Made `UpdateAuditLogsRetention.retention_period_in_days` optional
+    * Added enum `UpdateAuditLogsRetentionRetentionPeriod`
+    * Added model `CreateItContact`
+    * Added model `InviteItContact`
+    * Added model `ItContact`
+    * Added model `ItContactList`
+    * Added model `ItContactListListMetadata`
+    * Added enum `InviteItContactIntents`
+    * Added service `OrganizationsItContacts`
+  * **platform_teams**:
+    * Added model `CreateTeam`
+    * Added model `Team`
+    * Added enum `TeamProductionState`
+    * Added service `PlatformTeams`
+  * **[sso](https://workos.com/docs/reference/sso)**:
+    * Added model `TokenQuery`
+    * Added enum `TokenQueryGrantType`
+    * Added model `CreateConnectionKeyPair`
+    * Added model `CreateConnectionSAMLOptions`
+    * Added model `CreateConnectionOidcOptions`
+    * Added model `CreateConnectionStandardAttributes`
+    * Added model `CreateConnectionAttributeMaps`
+    * Added model `CreateConnection`
+    * Added model `PatchConnectionSAMLOptions`
+    * Added model `PatchConnectionOidcOptions`
+    * Added model `PatchConnectionStandardAttributes`
+    * Added model `PatchConnectionAttributeMaps`
+    * Added model `PatchConnection`
+    * Added model `CreateSAMLIdpSigningCertificate`
+    * Added model `SAMLIdpSigningCertificate`
+    * Added model `SAMLIdpSigningCertificateList`
+    * Added model `SAMLSpEncryptionCertificate`
+    * Added model `SAMLSpEncryptionCertificateList`
+    * Added model `SAMLSpSigningCertificate`
+    * Added enum `CreateConnectionOidcOptionsIdTokenSignatureAlgorithm`
+    * Added enum `PatchConnectionOidcOptionsIdTokenSignatureAlgorithm`
+    * Added endpoint `POST /connections`
+    * Added endpoint `GET /connections/{connectionId}/saml_idp_signing_certs`
+    * Added endpoint `POST /connections/{connectionId}/saml_idp_signing_certs`
+    * Added endpoint `DELETE /connections/{connectionId}/saml_idp_signing_certs/{certificateId}`
+    * Added endpoint `GET /connections/{connectionId}/saml_sp_encryption_certs`
+    * Added endpoint `POST /connections/{connectionId}/saml_sp_encryption_certs`
+    * Added endpoint `DELETE /connections/{connectionId}/saml_sp_encryption_certs/{certificateId}`
+    * Added endpoint `GET /connections/{connectionId}/saml_sp_signing_cert`
+    * Added endpoint `POST /connections/{connectionId}/saml_sp_signing_cert`
+    * Added endpoint `DELETE /connections/{connectionId}/saml_sp_signing_cert/{certificateId}`
+    * Added endpoint `PATCH /connections/{id}`
+    * Added model `TokenBody`
+    * Added enum `TokenBodyGrantType`
+    * Added enum `SSOGrantType`
+    * Changed required status for parameter `SSO.token.code`
+  * **[user_management](https://workos.com/docs/reference/authkit/user)**:
+    * Added enum `CreateConnectionOidcOptionsTokenAuthenticationMethod`
+    * Added enum `PatchConnectionOidcOptionsTokenAuthenticationMethod`
+    * Added model `EmailCompletionSessionAuthenticateRequest`
+    * Added model `CreateWaitlistEntry`
+    * Added model `Waitlist`
+    * Added model `WaitlistEntry`
+    * Added enum `WaitlistEntryState`
+    * Added enum `UserManagementWaitlistsState`
+    * Added service `UserManagementWaitlists`
+  * **[webhooks](https://workos.com/docs/reference/webhooks)**:
+    * Added `agent.instance.created` to `CreateWebhookEndpointEvents`
+    * Added `agent.instance.deleted` to `CreateWebhookEndpointEvents`
+    * Added `agent.instance.session.created` to `CreateWebhookEndpointEvents`
+    * Added `agent.instance.session.revoked` to `CreateWebhookEndpointEvents`
+    * Added `agent.instance.created` to `UpdateWebhookEndpointEvents`
+    * Added `agent.instance.deleted` to `UpdateWebhookEndpointEvents`
+    * Added `agent.instance.session.created` to `UpdateWebhookEndpointEvents`
+    * Added `agent.instance.session.revoked` to `UpdateWebhookEndpointEvents`
+    * Added `agent.blueprint.created` to `CreateWebhookEndpointEvents`
+    * Added `agent.blueprint.deleted` to `CreateWebhookEndpointEvents`
+    * Added `agent.blueprint.updated` to `CreateWebhookEndpointEvents`
+    * Added `agent.blueprint.created` to `UpdateWebhookEndpointEvents`
+    * Added `agent.blueprint.deleted` to `UpdateWebhookEndpointEvents`
+    * Added `agent.blueprint.updated` to `UpdateWebhookEndpointEvents`
+
+  **Fixes**
+  * **[sso](https://workos.com/docs/reference/sso)**:
+    * Changed request body of `SSO.token` from `TokenBody` to `TokenQuery`
+    * Removed `DiscordOAuth` from `ConnectionType`
+    * Removed `GrokOAuth` from `ConnectionType`
+    * Removed `XOAuth` from `ConnectionType`
+    * Removed `DiscordOAuth` from `ProfileConnectionType`
+    * Removed `GrokOAuth` from `ProfileConnectionType`
+    * Removed `XOAuth` from `ProfileConnectionType`
+    * Removed `DiscordOAuth` from `ConnectionsConnectionType`
+    * Removed `GrokOAuth` from `ConnectionsConnectionType`
+    * Removed `XOAuth` from `ConnectionsConnectionType`
+    * Changed request body of `SSO.token` from `TokenQuery` to `TokenBody`
+  * **[user_management](https://workos.com/docs/reference/authkit/user)**:
+    * Changed request body for `UserManagementAuthentication.authenticate`
+    * Changed errors for endpoint `POST /user_management/authenticate`
+    * Removed `DiscordOAuth` from `AuthenticateResponseAuthenticationMethod`
+    * Removed `GrokOAuth` from `AuthenticateResponseAuthenticationMethod`
+    * Removed `XOAuth` from `AuthenticateResponseAuthenticationMethod`
+    * Removed `DiscordOAuth` from `UserIdentitiesGetItemProvider`
+    * Removed `GrokOAuth` from `UserIdentitiesGetItemProvider`
+    * Removed `XOAuth` from `UserIdentitiesGetItemProvider`
+    * Changed errors for endpoint `DELETE /user_management/users/{id}`
+
+* [#549](https://github.com/workos/workos-ruby/pull/549) fix(generated): regenerate from spec
+
+  **Features**
+  * **[agents](https://workos.com/docs/reference/agents)**:
+    * Made `AgentBlueprintsCreateRequest.session_settings` optional
+    * Added model `AgentTokenValidation`
+    * Added model `AgentBlueprintsTokenValidateTokenRequest`
+  * **agents_blueprints_tokens**:
+    * Added endpoint `POST /agents/blueprints/{agent_blueprint_id}/tokens/validate`
+
 ## [10.2.1](https://github.com/workos/workos-ruby/compare/v10.2.0...v10.2.1) (2026-08-20)
 
 

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    workos (10.2.1)
+    workos (10.4.0)
       jwt (~> 3.1)
       logger (~> 1.7)
       zeitwerk (~> 2.6)
@@ -17,12 +17,12 @@ GEM
     crack (1.0.1)
       bigdecimal
       rexml
-    csv (3.3.5)
+    csv (3.3.6)
     date (3.5.1)
     drb (2.2.3)
-    erb (6.0.4)
+    erb (6.0.7)
     hashdiff (1.2.1)
-    json (2.19.4)
+    json (2.19.9)
     jwt (3.2.0)
       base64
     language_server-protocol (3.17.0.5)
@@ -36,7 +36,7 @@ GEM
       ast (~> 2.4.1)
       racc
     prism (1.9.0)
-    psych (5.3.1)
+    psych (5.5.0)
       date
       stringio
     public_suffix (7.0.5)
@@ -90,8 +90,8 @@ GEM
       crack (>= 0.3.2)
       hashdiff (>= 0.4.0, < 2.0.0)
     webrick (1.9.2)
-    yard (0.9.44)
-    yard-markdown (0.7.1)
+    yard (0.9.45)
+    yard-markdown (0.9.1)
       csv
       rdoc
       yard
@@ -118,12 +118,12 @@ CHECKSUMS
   base64 (0.3.0) sha256=27337aeabad6ffae05c265c450490628ef3ebd4b67be58257393227588f5a97b
   bigdecimal (4.1.2) sha256=53d217666027eab4280346fba98e7d5b66baaae1b9c3c1c0ffe89d48188a3fbd
   crack (1.0.1) sha256=ff4a10390cd31d66440b7524eb1841874db86201d5b70032028553130b6d4c7e
-  csv (3.3.5) sha256=6e5134ac3383ef728b7f02725d9872934f523cb40b961479f69cf3afa6c8e73f
+  csv (3.3.6) sha256=aba61e7e507a66f03d45cb1f3c4b6359861c3504038b422962875dce099e4456
   date (3.5.1) sha256=750d06384d7b9c15d562c76291407d89e368dda4d4fff957eb94962d325a0dc0
   drb (2.2.3) sha256=0b00d6fdb50995fe4a45dea13663493c841112e4068656854646f418fda13373
-  erb (6.0.4) sha256=38e3803694be357fe2bfe312487c74beaf9fb4e5beb3e22498952fe1645b95d9
+  erb (6.0.7) sha256=c5ca6dc25b0ef974a44dc8f59fe847577122483b1968a38dec305c60bf91ee92
   hashdiff (1.2.1) sha256=9c079dbc513dfc8833ab59c0c2d8f230fa28499cc5efb4b8dd276cf931457cd1
-  json (2.19.4) sha256=670a7d333fb3b18ca5b29cb255eb7bef099e40d88c02c80bd42a3f30fe5239ac
+  json (2.19.9) sha256=9b9025b7cdddafa38d316eca0b2358488e42d417045c1b90d216a9fefe46b79a
   jwt (3.2.0) sha256=5419b1fe37b1da0982bd07051f573a8b8789ab724c2aa7e785e4784a3ed217d7
   language_server-protocol (3.17.0.5) sha256=fd1e39a51a28bf3eec959379985a72e296e9f9acfce46f6a79d31ca8760803cc
   lint_roller (1.1.0) sha256=2c0c845b632a7d172cb849cc90c1bce937a28c5c8ccccb50dfd46a485003cc87
@@ -132,7 +132,7 @@ CHECKSUMS
   parallel (1.28.0) sha256=33e6de1484baf2524792d178b0913fc8eb94c628d6cfe45599ad4458c638c970
   parser (3.3.11.1) sha256=d17ace7aabe3e72c3cc94043714be27cc6f852f104d81aa284c2281aecc65d54
   prism (1.9.0) sha256=7b530c6a9f92c24300014919c9dcbc055bf4cdf51ec30aed099b06cd6674ef85
-  psych (5.3.1) sha256=eb7a57cef10c9d70173ff74e739d843ac3b2c019a003de48447b2963d81b1974
+  psych (5.5.0) sha256=4b245bbbd0f3238df8ccee766ebc1a6b062b10e4ee1d3284eb588739ba156a0a
   public_suffix (7.0.5) sha256=1a8bb08f1bbea19228d3bed6e5ed908d1cb4f7c2726d18bd9cadf60bc676f623
   racc (1.8.1) sha256=4a7f6929691dbec8b5209a0b373bc2614882b55fc5d2e447a21aaa691303d62f
   rainbow (3.1.1) sha256=039491aa3a89f42efa1d6dec2fc4e62ede96eb6acd95e52f1ad581182b79bc6a
@@ -153,9 +153,9 @@ CHECKSUMS
   unicode-emoji (4.2.0) sha256=519e69150f75652e40bf736106cfbc8f0f73aa3fb6a65afe62fefa7f80b0f80f
   webmock (3.26.2) sha256=774556f2ea6371846cca68c01769b2eac0d134492d21f6d0ab5dd643965a4c90
   webrick (1.9.2) sha256=beb4a15fc474defed24a3bda4ffd88a490d517c9e4e6118c3edce59e45864131
-  workos (10.2.1)
-  yard (0.9.44) sha256=eb087e9b631ccd887b049f303d489963945452d5e2a7eb49a5a74a7cf6887f28
-  yard-markdown (0.7.1) sha256=06c378632dfe7ba053be9ba469eb4701aa0470e36bcf7e5546f353eb90c1bfd1
+  workos (10.4.0)
+  yard (0.9.45) sha256=52e211493f7cb8a3ebf7e104a25a1e73937a3103092545d34cb88fafebb3dc51
+  yard-markdown (0.9.1) sha256=51adf55a814172f70ed81fbd1af4dc42c0e1a698915f7da33eff5a3bb527062d
   zeitwerk (2.7.5) sha256=d8da92128c09ea6ec62c949011b00ed4a20242b255293dd66bf41545398f73dd
 
 BUNDLED WITH

data/README.md

@@ -155,6 +155,29 @@ Anything shorter than 32 bytes (including `nil` or `""`) raises
 `ArgumentError` as soon as you load, seal, or unseal a session — sealing or
 unsealing will not silently proceed with a weakened key.
 
+### Validating the access token issuer
+
+By default the SDK verifies the signature and expiry of session access tokens
+but does not check the `iss` claim. To also require a specific issuer (or one
+of several), set `jwt_issuer` on the client — either a single string or an
+array of accepted issuers:
+
+```ruby
+WorkOS.configure do |config|
+  config.jwt_issuer = "https://api.workos.com/user_management/#{ENV["WORKOS_CLIENT_ID"]}"
+end
+
+# or per client
+client = WorkOS::Client.new(
+  api_key: ENV.fetch("WORKOS_API_KEY"),
+  client_id: ENV["WORKOS_CLIENT_ID"],
+  jwt_issuer: ["https://api.workos.com", "https://auth.example.com"]
+)
+```
+
+Tokens whose `iss` is not in the configured set fail authentication with
+reason `WorkOS::SessionManager::INVALID_JWT`.
+
 ### Verify a webhook
 
 ```ruby

data/lib/workos/admin_portal.rb

@@ -11,8 +11,8 @@ module WorkOS
     end
 
     # Generate a Portal Link
-    # @param return_url [String, nil] The URL to go to when an admin clicks on your logo in the Admin Portal. If not specified, the return URL configured on the [Redirects](https://dashboard.workos.com/redirects) page will be used.
-    # @param success_url [String, nil] The URL to redirect the admin to when they finish setup. If not specified, the success URL configured on the [Redirects](https://dashboard.workos.com/redirects) page will be used.
+    # @param return_url [String, nil] The URL to go to when an admin clicks on your logo in the Admin Portal. If not specified, the return URL configured on the [Admin Portal](https://dashboard.workos.com/admin-portal) page will be used.
+    # @param success_url [String, nil] The URL to redirect the admin to when they finish setup. If not specified, the success URL configured on the [Admin Portal](https://dashboard.workos.com/admin-portal) page will be used.
     # @param organization [String] An [Organization](https://workos.com/docs/reference/organization) identifier.
     # @param intent [WorkOS::Types::GenerateLinkIntent, nil] The intent of the Admin Portal. - `sso` - Launch Admin Portal for creating SSO connections - `dsync` - Launch Admin Portal for creating Directory Sync connections - `audit_logs` - Launch Admin Portal for viewing Audit Logs - `log_streams` - Launch Admin Portal for creating Log Streams - `domain_verification` - Launch Admin Portal for Domain Verification - `certificate_renewal` - Launch Admin Portal for renewing SAML Certificates - `bring_your_own_key` - Launch Admin Portal for configuring Bring Your Own Key
     # @param it_contact_emails [Array<String>, nil] The email addresses of the IT contacts to grant access to the Admin Portal for the given organization. Accepts up to 20 emails.

data/lib/workos/agents/agent_blueprint.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  class AgentBlueprint < WorkOS::Types::BaseModel
+    HASH_ATTRS = {
+      object: :object,
+      id: :id,
+      name: :name,
+      description: :description,
+      permissions: :permissions,
+      invocable_by: :invocable_by,
+      session_settings: :session_settings,
+      created_at: :created_at,
+      updated_at: :updated_at
+    }.freeze
+
+    attr_accessor \
+      :object,
+      :id,
+      :name,
+      :description,
+      :permissions,
+      :invocable_by,
+      :session_settings,
+      :created_at,
+      :updated_at
+
+    def initialize(json)
+      hash = self.class.normalize(json)
+      @object = hash[:object]
+      @id = hash[:id]
+      @name = hash[:name]
+      @description = hash[:description]
+      @permissions = hash[:permissions] || []
+      @invocable_by = hash[:invocable_by] ? WorkOS::AgentBlueprintInvocableBy.new(hash[:invocable_by]) : nil
+      @session_settings = hash[:session_settings] ? WorkOS::AgentBlueprintSessionSetting.new(hash[:session_settings]) : nil
+      @created_at = hash[:created_at]
+      @updated_at = hash[:updated_at]
+    end
+  end
+end

data/lib/workos/agents/agent_blueprint_invocable_by.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  AgentBlueprintInvocableBy = AgentBlueprintCreatedDataInvocableBy
+end

data/lib/workos/agents/agent_blueprint_session_setting.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  class AgentBlueprintSessionSetting < WorkOS::Types::BaseModel
+    HASH_ATTRS = {
+      max_age_seconds: :max_age_seconds,
+      access_token_ttl_seconds: :access_token_ttl_seconds,
+      refresh_token_ttl_seconds: :refresh_token_ttl_seconds
+    }.freeze
+
+    attr_accessor \
+      :max_age_seconds,
+      :access_token_ttl_seconds,
+      :refresh_token_ttl_seconds
+
+    def initialize(json)
+      hash = self.class.normalize(json)
+      @max_age_seconds = hash[:max_age_seconds]
+      @access_token_ttl_seconds = hash[:access_token_ttl_seconds]
+      @refresh_token_ttl_seconds = hash[:refresh_token_ttl_seconds]
+    end
+  end
+end

data/lib/workos/agents/agent_blueprints_create_request.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  class AgentBlueprintsCreateRequest < WorkOS::Types::BaseModel
+    HASH_ATTRS = {
+      name: :name,
+      description: :description,
+      permissions: :permissions,
+      invocable_by: :invocable_by,
+      session_settings: :session_settings
+    }.freeze
+
+    attr_accessor \
+      :name,
+      :description,
+      :permissions,
+      :invocable_by,
+      :session_settings
+
+    def initialize(json)
+      hash = self.class.normalize(json)
+      @name = hash[:name]
+      @description = hash[:description]
+      @permissions = hash[:permissions] || []
+      @invocable_by = hash[:invocable_by] ? WorkOS::AgentBlueprintsCreateRequestInvocableBy.new(hash[:invocable_by]) : nil
+      @session_settings = hash[:session_settings] ? WorkOS::AgentBlueprintsCreateRequestSessionSetting.new(hash[:session_settings]) : nil
+    end
+  end
+end

data/lib/workos/agents/agent_blueprints_create_request_invocable_by.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  class AgentBlueprintsCreateRequestInvocableBy < WorkOS::Types::BaseModel
+    HASH_ATTRS = {
+      role_slugs: :role_slugs,
+      organization_ids: :organization_ids
+    }.freeze
+
+    attr_accessor \
+      :role_slugs,
+      :organization_ids
+
+    def initialize(json)
+      hash = self.class.normalize(json)
+      @role_slugs = hash[:role_slugs] || []
+      @organization_ids = hash[:organization_ids] || []
+    end
+  end
+end

data/lib/workos/agents/agent_blueprints_create_request_session_setting.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  AgentBlueprintsCreateRequestSessionSetting = AgentBlueprintSessionSetting
+end

data/lib/workos/agents/agent_blueprints_token_mint_token_request.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  class AgentBlueprintsTokenMintTokenRequest < WorkOS::Types::BaseModel
+    HASH_ATTRS = {
+      type: :type,
+      user_access_token: :user_access_token,
+      intent: :intent,
+      organization_id: :organization_id,
+      agent_access_token: :agent_access_token,
+      refresh_token: :refresh_token
+    }.freeze
+
+    attr_accessor \
+      :type,
+      :user_access_token,
+      :intent,
+      :organization_id,
+      :agent_access_token,
+      :refresh_token
+
+    def initialize(json)
+      hash = self.class.normalize(json)
+      @type = hash[:type]
+      @user_access_token = hash[:user_access_token]
+      @intent = hash[:intent]
+      @organization_id = hash[:organization_id]
+      @agent_access_token = hash[:agent_access_token]
+      @refresh_token = hash[:refresh_token]
+    end
+  end
+end