workos 10.3.0 → 10.4.0

data/CHANGELOG.md

@@ -1,5 +1,179 @@
 # Changelog
 
+## [10.4.0](https://github.com/workos/workos-ruby/compare/v10.3.0...v10.4.0) (2026-09-18)
+
+### Features
+
+* Add optional jwt_issuer option for session token validation ([#552](https://github.com/workos/workos-ruby/issues/552)) ([841bf57](https://github.com/workos/workos-ruby/commit/841bf57ed103bf8f1d1a079f7a0d70edb9e7a854))
+
+* [#550](https://github.com/workos/workos-ruby/pull/550) fix(generated): regenerate from spec
+
+  **Features**
+  * **[pipes](https://workos.com/docs/reference/pipes)**:
+    * Added `connected_account_id` to `DataIntegrationsVendCredentialsRequest`
+    * Added `connected_account_id` to `DataIntegrationsGetUserTokenRequest`
+    * Added parameter `UserManagementDataProviders.getUserDataInstallation.connected_account_id`
+    * Changed errors for endpoint `GET /user_management/users/{user_id}/connected_accounts/{slug}`
+    * Added parameter `UserManagementDataProviders.updateUserDataInstallation.connected_account_id`
+    * Changed errors for endpoint `PUT /user_management/users/{user_id}/connected_accounts/{slug}`
+    * Added parameter `UserManagementDataProviders.deleteUserDataInstallation.connected_account_id`
+    * Changed errors for endpoint `DELETE /user_management/users/{user_id}/connected_accounts/{slug}`
+    * Added `connected_accounts` to `DataIntegrationsListResponseData`
+    * Changed errors for endpoint `PUT /data-integrations/{slug}`
+    * Changed errors for endpoint `PUT /data-integrations/{slug}/api-key`
+    * Changed errors for endpoint `PUT /data-integrations/{slug}/client-credentials`
+    * Changed errors for endpoint `POST /data-integrations/{slug}/credentials`
+    * Changed errors for endpoint `POST /data-integrations/{provider}/token`
+
+* [#553](https://github.com/workos/workos-ruby/pull/553) feat(generated): regenerate from spec (4 changes)
+
+  **Features**
+  * **[admin_portal](https://workos.com/docs/reference/admin-portal)**:
+    * Changed the format of `PortalLinkResponse.link`
+  * **[agents](https://workos.com/docs/reference/agents)**:
+    * Added parameter `AgentsSessions.list.organization_id`
+    * Changed the format of `ClaimViewResponse.user_code`
+    * Changed the format of `AgentAdminValidateCredentialRequest.credential`
+  * **[api_keys](https://workos.com/docs/reference/authkit/api-keys)**:
+    * Changed the format of `ValidateApiKey.value`
+    * Changed the format of `OrganizationApiKeyWithValue.value`
+    * Changed the format of `UserApiKeyWithValue.value`
+  * **[multi_factor_auth](https://workos.com/docs/reference/authkit/mfa)**:
+    * Changed the format of `AuthenticationChallenge.code`
+    * Changed the format of `AuthenticationFactorEnrolledTotp.secret`
+    * Changed the format of `AuthenticationFactorEnrolledTotp.qr_code`
+    * Changed the format of `AuthenticationFactorEnrolledTotp.uri`
+    * Changed the format of `AuthenticationChallengesVerifyRequest.code`
+  * **[pipes](https://workos.com/docs/reference/pipes)**:
+    * Added `supports_multiple_connections` to `DataIntegrationsVendCredentialsRequest`
+    * Added `supports_multiple_connections` to `DataIntegrationsGetUserTokenRequest`
+    * Added parameter `UserManagementDataProviders.getUserDataInstallation.supports_multiple_connections`
+    * Added parameter `UserManagementDataProviders.updateUserDataInstallation.supports_multiple_connections`
+    * Added parameter `UserManagementDataProviders.deleteUserDataInstallation.supports_multiple_connections`
+    * Added parameter `UserManagementDataProviders.getUserDataIntegrations.supports_multiple_connections`
+    * Added enum `PipesOwnership`
+    * Added `user` to `CreateDataIntegrationOwnership`
+    * Added `user` to `DataIntegrationOwnership`
+    * Added endpoint `GET /data-integrations/{slug}/organization`
+    * Added endpoint `PUT /data-integrations/{slug}/organization`
+    * Added endpoint `DELETE /data-integrations/{slug}/organization`
+    * Added parameter `Pipes.listDataIntegrations.ownership`
+    * Changed errors for endpoint `GET /data-integrations`
+    * Changed errors for endpoint `PUT /user_management/users/{user_id}/connected_accounts/{slug}`
+    * Changed errors for endpoint `DELETE /user_management/users/{user_id}/connected_accounts/{slug}`
+    * Changed the format of `DataIntegrationCredentialsResponseCredential.value`
+    * Added `connection_owner` to `DataIntegrationsUpsertApiKeyRequest`
+    * Added `connection_owner` to `DataIntegrationsUpsertClientCredentialsRequest`
+    * Added enum `DataIntegrationsUpsertApiKeyRequestConnectionOwner`
+    * Added enum `DataIntegrationsUpsertClientCredentialsRequestConnectionOwner`
+    * Added model `AccountSelectionRequiredError`
+    * Added `connected_account_id` to `DataIntegrationsUpsertApiKeyRequest`
+    * Added `connected_account_id` to `DataIntegrationsUpsertClientCredentialsRequest`
+    * Added `ownership` to `CreateDataIntegration`
+    * Added `ownership` to `DataIntegration`
+    * Added `connection_owner` to `DataIntegrationsVendCredentialsRequest`
+    * Added `connection_owner` to `DataIntegrationsGetUserTokenRequest`
+    * Added enum `CreateDataIntegrationOwnership`
+    * Added enum `DataIntegrationOwnership`
+    * Added enum `DataIntegrationsVendCredentialsRequestConnectionOwner`
+    * Added enum `DataIntegrationsGetUserTokenRequestConnectionOwner`
+    * Changed errors for endpoint `POST /data-integrations/{slug}/credentials`
+    * Changed errors for endpoint `POST /data-integrations/{provider}/token`
+  * **[sso](https://workos.com/docs/reference/sso)**:
+    * Changed the format of `CreateConnectionKeyPair.key`
+    * Changed the format of `TokenQuery.code`
+    * Changed the format of `SSOLogoutAuthorizeResponse.logout_url`
+  * **[user_management](https://workos.com/docs/reference/authkit/user)**:
+    * Added model `CreateAuthkitOAuthResource`
+    * Added model `AuthkitOAuthResource`
+    * Added service `UserManagementAuthkitOAuthResources`
+    * Changed the format of `DeviceAuthorizationResponse.verification_uri_complete`
+    * Changed the format of `VerifyEmailAddress.code`
+    * Changed the format of `ConfirmEmailChange.code`
+    * Changed the format of `MagicAuth.code`
+    * Changed the format of `UserInvite.accept_invitation_url`
+    * Changed the format of `EmailVerification.code`
+    * Changed the format of `PasswordReset.password_reset_url`
+    * Changed the format of `AuthenticateResponse.authkit_authorization_code`
+    * Changed the format of `DeviceAuthorizationResponse.device_code`
+    * Changed the format of `DeviceAuthorizationResponse.user_code`
+    * Changed the format of `AuthorizationCodeSessionAuthenticateRequest.code`
+    * Changed the format of `AuthorizationCodeSessionAuthenticateRequest.code_verifier`
+    * Changed the format of `MagicAuthCodeSessionAuthenticateRequest.code`
+    * Changed the format of `EmailVerificationCodeSessionAuthenticateRequest.code`
+    * Changed the format of `MfaTotpSessionAuthenticateRequest.code`
+    * Changed the format of `RadarEmailChallengeCodeSessionAuthenticateRequest.code`
+    * Changed the format of `RadarSmsChallengeCodeSessionAuthenticateRequest.code`
+    * Changed the format of `DeviceCodeSessionAuthenticateRequest.device_code`
+    * Changed the format of `Invitation.accept_invitation_url`
+    * Changed the format of `MagicAuthSendMagicAuthCodeAndReturnResponse.code`
+  * **[radar](https://workos.com/docs/reference/radar)**:
+    * Changed the format of `RadarChallenge.code`
+  * **[vault](https://workos.com/docs/reference/vault)**:
+    * Changed the format of `CreateObjectRequest.value`
+    * Changed the format of `VaultObject.value`
+    * Changed the format of `UpdateObjectRequest.value`
+
+  **Fixes**
+  * **[pipes](https://workos.com/docs/reference/pipes)**:
+    * Removed `userland_user` from `CreateDataIntegrationOwnership`
+    * Removed `userland_user` from `DataIntegrationOwnership`
+    * Changed errors for endpoint `POST /user_management/users/{user_id}/connected_accounts/{slug}`
+    * Changed errors for endpoint `PUT /data-integrations/{slug}/api-key`
+    * Changed errors for endpoint `PUT /data-integrations/{slug}/client-credentials`
+    * Changed errors for endpoint `POST /data-integrations/{slug}/credentials`
+    * Changed errors for endpoint `POST /data-integrations/{provider}/token`
+    * Changed errors for endpoint `GET /user_management/users/{user_id}/connected_accounts/{slug}`
+    * Changed errors for endpoint `PUT /user_management/users/{user_id}/connected_accounts/{slug}`
+    * Changed errors for endpoint `DELETE /user_management/users/{user_id}/connected_accounts/{slug}`
+    * Changed the type of `DataIntegrationInstallation.user_id`
+
+* [#556](https://github.com/workos/workos-ruby/pull/556) fix(generated): regenerate from spec (1 change)
+
+  **Features**
+  * **[multi_factor_auth](https://workos.com/docs/reference/authkit/mfa)**:
+    * Changed errors for endpoint `POST /auth/factors/{id}/challenge`
+  * **[pipes](https://workos.com/docs/reference/pipes)**:
+    * Added `connection_owner` to `DataIntegrationsListResponseData`
+    * Added enum `DataIntegrationsListResponseDataConnectionOwner`
+    * Added `connection_role` to `DataIntegrationsListResponseDataConnectedAccount`
+    * Added `account_identifier` to `DataIntegrationsListResponseDataConnectedAccount`
+    * Added `account_display_name` to `DataIntegrationsListResponseDataConnectedAccount`
+    * Added enum `DataIntegrationsListResponseDataConnectedAccountConnectionRole`
+    * Added `connection_role` to `DataIntegrationInstallation`
+    * Added `account_identifier` to `DataIntegrationInstallation`
+    * Added `account_display_name` to `DataIntegrationInstallation`
+    * Added enum `DataIntegrationInstallationConnectionRole`
+    * Added `connection_owner` to `DataIntegrationsGetDataIntegrationAuthorizeUrlRequest`
+    * Added enum `DataIntegrationsGetDataIntegrationAuthorizeUrlRequestConnectionOwner`
+    * Added the organization connected-account operations on `Pipes`: `client.pipes.get_organization_connected_account`, `create_organization_connected_account`, `update_organization_connected_account`, `delete_organization_connected_account`, `list_organization_data_providers`
+  * **[connect](https://workos.com/docs/reference/workos-connect/standalone)**:
+    * Added `connection_role` to `ConnectedAccount`
+    * Added `account_identifier` to `ConnectedAccount`
+    * Added `account_display_name` to `ConnectedAccount`
+    * Added enum `ConnectedAccountConnectionRole`
+  * **[webhooks](https://workos.com/docs/reference/webhooks)**:
+    * Added `pipes.account_connection.add_failed` to `CreateWebhookEndpointEvents`
+    * Added `pipes.account_connection.connected` to `CreateWebhookEndpointEvents`
+    * Added `pipes.account_connection.connection_failed` to `CreateWebhookEndpointEvents`
+    * Added `pipes.account_connection.disconnected` to `CreateWebhookEndpointEvents`
+    * Added `pipes.account_connection.reauthorization_needed` to `CreateWebhookEndpointEvents`
+    * Added `pipes.account_connection.add_failed` to `UpdateWebhookEndpointEvents`
+    * Added `pipes.account_connection.connected` to `UpdateWebhookEndpointEvents`
+    * Added `pipes.account_connection.connection_failed` to `UpdateWebhookEndpointEvents`
+    * Added `pipes.account_connection.disconnected` to `UpdateWebhookEndpointEvents`
+    * Added `pipes.account_connection.reauthorization_needed` to `UpdateWebhookEndpointEvents`
+
+  **Fixes**
+  * **[multi_factor_auth](https://workos.com/docs/reference/authkit/mfa)**:
+    * Changed errors for endpoint `POST /auth/factors/{id}/challenge`
+
+* [#557](https://github.com/workos/workos-ruby/pull/557) fix(generated): regenerate from spec (1 change)
+
+  **Fixes**
+  * **[multi_factor_auth](https://workos.com/docs/reference/authkit/mfa)**:
+    * Changed errors for endpoint `POST /auth/factors/{id}/challenge`
+
 ## [10.3.0](https://github.com/workos/workos-ruby/compare/v10.2.1...v10.3.0) (2026-09-01)
 
 * [#546](https://github.com/workos/workos-ruby/pull/546) feat(generated)!: regenerate from spec (5 changes)

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    workos (10.3.0)
+    workos (10.4.0)
       jwt (~> 3.1)
       logger (~> 1.7)
       zeitwerk (~> 2.6)
@@ -17,12 +17,12 @@ GEM
     crack (1.0.1)
       bigdecimal
       rexml
-    csv (3.3.5)
+    csv (3.3.6)
     date (3.5.1)
     drb (2.2.3)
-    erb (6.0.4)
+    erb (6.0.7)
     hashdiff (1.2.1)
-    json (2.19.4)
+    json (2.19.9)
     jwt (3.2.0)
       base64
     language_server-protocol (3.17.0.5)
@@ -36,7 +36,7 @@ GEM
       ast (~> 2.4.1)
       racc
     prism (1.9.0)
-    psych (5.3.1)
+    psych (5.5.0)
       date
       stringio
     public_suffix (7.0.5)
@@ -90,8 +90,8 @@ GEM
       crack (>= 0.3.2)
       hashdiff (>= 0.4.0, < 2.0.0)
     webrick (1.9.2)
-    yard (0.9.44)
-    yard-markdown (0.7.1)
+    yard (0.9.45)
+    yard-markdown (0.9.1)
       csv
       rdoc
       yard
@@ -118,12 +118,12 @@ CHECKSUMS
   base64 (0.3.0) sha256=27337aeabad6ffae05c265c450490628ef3ebd4b67be58257393227588f5a97b
   bigdecimal (4.1.2) sha256=53d217666027eab4280346fba98e7d5b66baaae1b9c3c1c0ffe89d48188a3fbd
   crack (1.0.1) sha256=ff4a10390cd31d66440b7524eb1841874db86201d5b70032028553130b6d4c7e
-  csv (3.3.5) sha256=6e5134ac3383ef728b7f02725d9872934f523cb40b961479f69cf3afa6c8e73f
+  csv (3.3.6) sha256=aba61e7e507a66f03d45cb1f3c4b6359861c3504038b422962875dce099e4456
   date (3.5.1) sha256=750d06384d7b9c15d562c76291407d89e368dda4d4fff957eb94962d325a0dc0
   drb (2.2.3) sha256=0b00d6fdb50995fe4a45dea13663493c841112e4068656854646f418fda13373
-  erb (6.0.4) sha256=38e3803694be357fe2bfe312487c74beaf9fb4e5beb3e22498952fe1645b95d9
+  erb (6.0.7) sha256=c5ca6dc25b0ef974a44dc8f59fe847577122483b1968a38dec305c60bf91ee92
   hashdiff (1.2.1) sha256=9c079dbc513dfc8833ab59c0c2d8f230fa28499cc5efb4b8dd276cf931457cd1
-  json (2.19.4) sha256=670a7d333fb3b18ca5b29cb255eb7bef099e40d88c02c80bd42a3f30fe5239ac
+  json (2.19.9) sha256=9b9025b7cdddafa38d316eca0b2358488e42d417045c1b90d216a9fefe46b79a
   jwt (3.2.0) sha256=5419b1fe37b1da0982bd07051f573a8b8789ab724c2aa7e785e4784a3ed217d7
   language_server-protocol (3.17.0.5) sha256=fd1e39a51a28bf3eec959379985a72e296e9f9acfce46f6a79d31ca8760803cc
   lint_roller (1.1.0) sha256=2c0c845b632a7d172cb849cc90c1bce937a28c5c8ccccb50dfd46a485003cc87
@@ -132,7 +132,7 @@ CHECKSUMS
   parallel (1.28.0) sha256=33e6de1484baf2524792d178b0913fc8eb94c628d6cfe45599ad4458c638c970
   parser (3.3.11.1) sha256=d17ace7aabe3e72c3cc94043714be27cc6f852f104d81aa284c2281aecc65d54
   prism (1.9.0) sha256=7b530c6a9f92c24300014919c9dcbc055bf4cdf51ec30aed099b06cd6674ef85
-  psych (5.3.1) sha256=eb7a57cef10c9d70173ff74e739d843ac3b2c019a003de48447b2963d81b1974
+  psych (5.5.0) sha256=4b245bbbd0f3238df8ccee766ebc1a6b062b10e4ee1d3284eb588739ba156a0a
   public_suffix (7.0.5) sha256=1a8bb08f1bbea19228d3bed6e5ed908d1cb4f7c2726d18bd9cadf60bc676f623
   racc (1.8.1) sha256=4a7f6929691dbec8b5209a0b373bc2614882b55fc5d2e447a21aaa691303d62f
   rainbow (3.1.1) sha256=039491aa3a89f42efa1d6dec2fc4e62ede96eb6acd95e52f1ad581182b79bc6a
@@ -153,9 +153,9 @@ CHECKSUMS
   unicode-emoji (4.2.0) sha256=519e69150f75652e40bf736106cfbc8f0f73aa3fb6a65afe62fefa7f80b0f80f
   webmock (3.26.2) sha256=774556f2ea6371846cca68c01769b2eac0d134492d21f6d0ab5dd643965a4c90
   webrick (1.9.2) sha256=beb4a15fc474defed24a3bda4ffd88a490d517c9e4e6118c3edce59e45864131
-  workos (10.3.0)
-  yard (0.9.44) sha256=eb087e9b631ccd887b049f303d489963945452d5e2a7eb49a5a74a7cf6887f28
-  yard-markdown (0.7.1) sha256=06c378632dfe7ba053be9ba469eb4701aa0470e36bcf7e5546f353eb90c1bfd1
+  workos (10.4.0)
+  yard (0.9.45) sha256=52e211493f7cb8a3ebf7e104a25a1e73937a3103092545d34cb88fafebb3dc51
+  yard-markdown (0.9.1) sha256=51adf55a814172f70ed81fbd1af4dc42c0e1a698915f7da33eff5a3bb527062d
   zeitwerk (2.7.5) sha256=d8da92128c09ea6ec62c949011b00ed4a20242b255293dd66bf41545398f73dd
 
 BUNDLED WITH

data/README.md

@@ -155,6 +155,29 @@ Anything shorter than 32 bytes (including `nil` or `""`) raises
 `ArgumentError` as soon as you load, seal, or unseal a session — sealing or
 unsealing will not silently proceed with a weakened key.
 
+### Validating the access token issuer
+
+By default the SDK verifies the signature and expiry of session access tokens
+but does not check the `iss` claim. To also require a specific issuer (or one
+of several), set `jwt_issuer` on the client — either a single string or an
+array of accepted issuers:
+
+```ruby
+WorkOS.configure do |config|
+  config.jwt_issuer = "https://api.workos.com/user_management/#{ENV["WORKOS_CLIENT_ID"]}"
+end
+
+# or per client
+client = WorkOS::Client.new(
+  api_key: ENV.fetch("WORKOS_API_KEY"),
+  client_id: ENV["WORKOS_CLIENT_ID"],
+  jwt_issuer: ["https://api.workos.com", "https://auth.example.com"]
+)
+```
+
+Tokens whose `iss` is not in the configured set fail authentication with
+reason `WorkOS::SessionManager::INVALID_JWT`.
+
 ### Verify a webhook
 
 ```ruby

data/lib/workos/admin_portal.rb

@@ -11,8 +11,8 @@ module WorkOS
     end
 
     # Generate a Portal Link
-    # @param return_url [String, nil] The URL to go to when an admin clicks on your logo in the Admin Portal. If not specified, the return URL configured on the [Redirects](https://dashboard.workos.com/redirects) page will be used.
-    # @param success_url [String, nil] The URL to redirect the admin to when they finish setup. If not specified, the success URL configured on the [Redirects](https://dashboard.workos.com/redirects) page will be used.
+    # @param return_url [String, nil] The URL to go to when an admin clicks on your logo in the Admin Portal. If not specified, the return URL configured on the [Admin Portal](https://dashboard.workos.com/admin-portal) page will be used.
+    # @param success_url [String, nil] The URL to redirect the admin to when they finish setup. If not specified, the success URL configured on the [Admin Portal](https://dashboard.workos.com/admin-portal) page will be used.
     # @param organization [String] An [Organization](https://workos.com/docs/reference/organization) identifier.
     # @param intent [WorkOS::Types::GenerateLinkIntent, nil] The intent of the Admin Portal. - `sso` - Launch Admin Portal for creating SSO connections - `dsync` - Launch Admin Portal for creating Directory Sync connections - `audit_logs` - Launch Admin Portal for viewing Audit Logs - `log_streams` - Launch Admin Portal for creating Log Streams - `domain_verification` - Launch Admin Portal for Domain Verification - `certificate_renewal` - Launch Admin Portal for renewing SAML Certificates - `bring_your_own_key` - Launch Admin Portal for configuring Bring Your Own Key
     # @param it_contact_emails [Array<String>, nil] The email addresses of the IT contacts to grant access to the Admin Portal for the given organization. Accepts up to 20 emails.

data/lib/workos/agents.rb

@@ -400,6 +400,7 @@ module WorkOS
     # @param after [String, nil] An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`.
     # @param limit [Integer, nil] Upper limit on the number of objects to return, between `1` and `100`.
     # @param order [WorkOS::Types::PaginationOrder, nil] Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records).
+    # @param organization_id [String, nil] Only return sessions of instances acting within this organization.
     # @param agent_blueprint_id [String, nil] Only return sessions of instances minted from this blueprint.
     # @param agent_instance_id [String, nil] Only return sessions belonging to this agent instance.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
@@ -409,6 +410,7 @@ module WorkOS
       after: nil,
       limit: 10,
       order: "desc",
+      organization_id: nil,
       agent_blueprint_id: nil,
       agent_instance_id: nil,
       request_options: {}
@@ -418,6 +420,7 @@ module WorkOS
         "after" => after,
         "limit" => limit,
         "order" => order,
+        "organization_id" => organization_id,
         "agent_blueprint_id" => agent_blueprint_id,
         "agent_instance_id" => agent_instance_id
       }.compact
@@ -434,6 +437,7 @@ module WorkOS
           after: cursor,
           limit: limit,
           order: order,
+          organization_id: organization_id,
           agent_blueprint_id: agent_blueprint_id,
           agent_instance_id: agent_instance_id,
           request_options: request_options
@@ -442,7 +446,7 @@ module WorkOS
       WorkOS::Types::ListStruct.from_response(
         response,
         model: WorkOS::AgentInstanceSession,
-        filters: {before: before, limit: limit, order: order, agent_blueprint_id: agent_blueprint_id, agent_instance_id: agent_instance_id},
+        filters: {before: before, limit: limit, order: order, organization_id: organization_id, agent_blueprint_id: agent_blueprint_id, agent_instance_id: agent_instance_id},
         fetch_next: fetch_next
       )
     end

data/lib/workos/api_keys/validate_api_key.rb

@@ -3,5 +3,16 @@
 # This file is auto-generated by oagen. Do not edit.
 
 module WorkOS
-  ValidateApiKey = CreateSAMLIdpSigningCertificate
+  class ValidateApiKey < WorkOS::Types::BaseModel
+    HASH_ATTRS = {
+      value: :value
+    }.freeze
+
+    attr_accessor :value
+
+    def initialize(json)
+      hash = self.class.normalize(json)
+      @value = hash[:value]
+    end
+  end
 end

data/lib/workos/base_client.rb

@@ -41,11 +41,14 @@ module WorkOS
       "v#{WorkOS::VERSION}"
     ].join("; ").freeze
 
-    attr_reader :api_key, :base_url, :client_id, :timeout, :max_retries, :logger, :log_level
+    attr_reader :api_key, :base_url, :client_id, :timeout, :max_retries, :logger, :log_level, :jwt_issuer
 
+    # @param jwt_issuer [String, Array<String>, nil] Expected `iss` claim of
+    #   session access tokens (one issuer or a list of accepted issuers).
+    #   When nil, the issuer is not validated.
     def initialize(api_key: nil, base_url: DEFAULT_BASE_URL, client_id: nil,
       timeout: DEFAULT_TIMEOUT, max_retries: DEFAULT_MAX_RETRIES,
-      logger: nil, log_level: nil, random: Random.new)
+      logger: nil, log_level: nil, jwt_issuer: nil, random: Random.new)
       @api_key = api_key
       @base_url = base_url
       @client_id = client_id
@@ -53,6 +56,7 @@ module WorkOS
       @max_retries = max_retries
       @logger = logger
       @log_level = log_level
+      @jwt_issuer = jwt_issuer
       @random = random
     end
 

data/lib/workos/configuration.rb

@@ -12,7 +12,7 @@ module WorkOS
   #     config.log_level = :info
   #   end
   class Configuration
-    attr_accessor :api_key, :base_url, :client_id, :timeout, :max_retries, :logger, :log_level
+    attr_accessor :api_key, :base_url, :client_id, :timeout, :max_retries, :logger, :log_level, :jwt_issuer
 
     def initialize
       @base_url = WorkOS::BaseClient::DEFAULT_BASE_URL
@@ -47,7 +47,8 @@ module WorkOS
         timeout: configuration.timeout,
         max_retries: configuration.max_retries,
         logger: configuration.logger,
-        log_level: configuration.log_level
+        log_level: configuration.log_level,
+        jwt_issuer: configuration.jwt_issuer
       )
     end
 

data/lib/workos/inflections.rb

@@ -31,6 +31,7 @@ WORKOS_INFLECTIONS = {
   "authentication_sso_timed_out_data" => "AuthenticationSSOTimedOutData",
   "authentication_sso_timed_out_data_error" => "AuthenticationSSOTimedOutDataError",
   "authentication_sso_timed_out_data_sso" => "AuthenticationSSOTimedOutDataSSO",
+  "authkit_oauth_resource" => "AuthkitOAuthResource",
   "connect_application_m2m" => "ConnectApplicationM2M",
   "connect_application_oauth" => "ConnectApplicationOAuth",
   "connect_application_oauth_redirect_uris" => "ConnectApplicationOAuthRedirectUris",
@@ -45,6 +46,7 @@ WORKOS_INFLECTIONS = {
   "connection_saml_certificate_renewed_data_certificate_certificate_type" => "ConnectionSAMLCertificateRenewedDataCertificateCertificateType",
   "connection_saml_certificate_renewed_data_connection" => "ConnectionSAMLCertificateRenewedDataConnection",
   "cors_origin_response" => "CORSOriginResponse",
+  "create_authkit_oauth_resource" => "CreateAuthkitOAuthResource",
   "create_connection_oidc_options" => "CreateConnectionOIDCOptions",
   "create_connection_oidc_options_id_token_signature_algorithm" => "CreateConnectionOIDCOptionsIdTokenSignatureAlgorithm",
   "create_connection_oidc_options_token_authentication_method" => "CreateConnectionOIDCOptionsTokenAuthenticationMethod",

data/lib/workos/multi_factor_auth.rb

@@ -108,7 +108,7 @@ module WorkOS
 
     # Challenge Factor
     # @param id [String] The unique ID of the Authentication Factor to be challenged.
-    # @param sms_template [String, nil] A custom template for the SMS message. Use the {{code}} placeholder to include the verification code.
+    # @param sms_template [String, nil] A custom template for the SMS message. Use the {{code}} placeholder to include the verification code. Must not contain URLs or domain names.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
     # @return [WorkOS::AuthenticationChallenge]
     def challenge_factor(

data/lib/workos/pipes/connected_account.rb

@@ -7,6 +7,9 @@ module WorkOS
     HASH_ATTRS = {
       object: :object,
       id: :id,
+      connection_role: :connection_role,
+      account_identifier: :account_identifier,
+      account_display_name: :account_display_name,
       user_id: :user_id,
       organization_id: :organization_id,
       scopes: :scopes,
@@ -23,6 +26,9 @@ module WorkOS
     attr_accessor \
       :object,
       :id,
+      :connection_role,
+      :account_identifier,
+      :account_display_name,
       :user_id,
       :organization_id,
       :scopes,
@@ -39,6 +45,9 @@ module WorkOS
       hash = self.class.normalize(json)
       @object = hash[:object]
       @id = hash[:id]
+      @connection_role = hash[:connection_role]
+      @account_identifier = hash[:account_identifier]
+      @account_display_name = hash[:account_display_name]
       @user_id = hash[:user_id]
       @organization_id = hash[:organization_id]
       @scopes = hash[:scopes] || []

data/lib/workos/pipes/create_data_integration.rb

@@ -6,6 +6,7 @@ module WorkOS
   class CreateDataIntegration < WorkOS::Types::BaseModel
     HASH_ATTRS = {
       provider: :provider,
+      ownership: :ownership,
       description: :description,
       enabled: :enabled,
       scopes: :scopes,
@@ -18,6 +19,7 @@ module WorkOS
 
     attr_accessor \
       :provider,
+      :ownership,
       :description,
       :enabled,
       :scopes,
@@ -30,6 +32,7 @@ module WorkOS
     def initialize(json)
       hash = self.class.normalize(json)
       @provider = hash[:provider]
+      @ownership = hash[:ownership]
       @description = hash[:description]
       @enabled = hash[:enabled]
       @scopes = hash[:scopes] || []

data/lib/workos/pipes/data_integration.rb

@@ -9,6 +9,7 @@ module WorkOS
       id: :id,
       slug: :slug,
       integration_type: :integration_type,
+      ownership: :ownership,
       description: :description,
       enabled: :enabled,
       state: :state,
@@ -28,6 +29,7 @@ module WorkOS
       :id,
       :slug,
       :integration_type,
+      :ownership,
       :description,
       :enabled,
       :state,
@@ -47,6 +49,7 @@ module WorkOS
       @id = hash[:id]
       @slug = hash[:slug]
       @integration_type = hash[:integration_type]
+      @ownership = hash[:ownership]
       @description = hash[:description]
       @enabled = hash[:enabled]
       @state = hash[:state]

data/lib/workos/pipes/data_integration_installation.rb

@@ -6,6 +6,9 @@ module WorkOS
   class DataIntegrationInstallation < WorkOS::Types::BaseModel
     HASH_ATTRS = {
       id: :id,
+      connection_role: :connection_role,
+      account_identifier: :account_identifier,
+      account_display_name: :account_display_name,
       user_id: :user_id,
       organization_id: :organization_id,
       api_key_last_4: :api_key_last_4
@@ -13,6 +16,9 @@ module WorkOS
 
     attr_accessor \
       :id,
+      :connection_role,
+      :account_identifier,
+      :account_display_name,
       :user_id,
       :organization_id,
       :api_key_last_4
@@ -20,6 +26,9 @@ module WorkOS
     def initialize(json)
       hash = self.class.normalize(json)
       @id = hash[:id]
+      @connection_role = hash[:connection_role]
+      @account_identifier = hash[:account_identifier]
+      @account_display_name = hash[:account_display_name]
       @user_id = hash[:user_id]
       @organization_id = hash[:organization_id]
       @api_key_last_4 = hash[:api_key_last_4]

data/lib/workos/pipes/data_integrations_get_data_integration_authorize_url_request.rb

@@ -7,6 +7,7 @@ module WorkOS
     HASH_ATTRS = {
       user_id: :user_id,
       organization_id: :organization_id,
+      connection_owner: :connection_owner,
       return_to: :return_to,
       config: :config
     }.freeze
@@ -14,6 +15,7 @@ module WorkOS
     attr_accessor \
       :user_id,
       :organization_id,
+      :connection_owner,
       :return_to,
       :config
 
@@ -21,6 +23,7 @@ module WorkOS
       hash = self.class.normalize(json)
       @user_id = hash[:user_id]
       @organization_id = hash[:organization_id]
+      @connection_owner = hash[:connection_owner]
       @return_to = hash[:return_to]
       @config = hash[:config] || {}
     end

data/lib/workos/pipes/data_integrations_get_user_token_request.rb

@@ -6,17 +6,26 @@ module WorkOS
   class DataIntegrationsGetUserTokenRequest < WorkOS::Types::BaseModel
     HASH_ATTRS = {
       user_id: :user_id,
-      organization_id: :organization_id
+      organization_id: :organization_id,
+      connected_account_id: :connected_account_id,
+      connection_owner: :connection_owner,
+      supports_multiple_connections: :supports_multiple_connections
     }.freeze
 
     attr_accessor \
       :user_id,
-      :organization_id
+      :organization_id,
+      :connected_account_id,
+      :connection_owner,
+      :supports_multiple_connections
 
     def initialize(json)
       hash = self.class.normalize(json)
       @user_id = hash[:user_id]
       @organization_id = hash[:organization_id]
+      @connected_account_id = hash[:connected_account_id]
+      @connection_owner = hash[:connection_owner]
+      @supports_multiple_connections = hash[:supports_multiple_connections]
     end
   end
 end

data/lib/workos/pipes/data_integrations_list_response_data.rb

@@ -14,12 +14,17 @@ module WorkOS
       credentials_type: :credentials_type,
       scopes: :scopes,
       auth_methods: :auth_methods,
+      connection_owner: :connection_owner,
       ownership: :ownership,
       created_at: :created_at,
       updated_at: :updated_at,
-      connected_account: :connected_account
+      connected_account: :connected_account,
+      connected_accounts: :connected_accounts
     }.freeze
 
+    # @!attribute ownership
+    #   @deprecated Use `connection_owner` instead. Legacy spelling of the same value: `userland_user` corresponds to `connection_owner: "user"` and `organization` to `connection_owner: "organization"`.
+
     attr_accessor \
       :object,
       :id,
@@ -30,10 +35,18 @@ module WorkOS
       :credentials_type,
       :scopes,
       :auth_methods,
-      :ownership,
+      :connection_owner,
       :created_at,
       :updated_at,
-      :connected_account
+      :connected_account,
+      :connected_accounts
+
+    def ownership
+      warn "[DEPRECATION] `ownership` is deprecated and will be removed in a future version.", uplevel: 1
+      @ownership
+    end
+
+    attr_writer :ownership
 
     def initialize(json)
       hash = self.class.normalize(json)
@@ -46,10 +59,12 @@ module WorkOS
       @credentials_type = hash[:credentials_type]
       @scopes = hash[:scopes] || []
       @auth_methods = hash[:auth_methods] || []
+      @connection_owner = hash[:connection_owner]
       @ownership = hash[:ownership]
       @created_at = hash[:created_at]
       @updated_at = hash[:updated_at]
       @connected_account = hash[:connected_account] ? WorkOS::DataIntegrationsListResponseDataConnectedAccount.new(hash[:connected_account]) : nil
+      @connected_accounts = (hash[:connected_accounts] || []).map { |item| item ? WorkOS::DataIntegrationsListResponseDataConnectedAccount.new(item) : nil }
     end
   end
 end