workos 10.3.0 → 10.4.0

data/lib/workos/pipes.rb

@@ -15,6 +15,7 @@ module WorkOS
     # @param after [String, nil] An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`.
     # @param limit [Integer, nil] Upper limit on the number of objects to return, between `1` and `100`.
     # @param order [WorkOS::Types::PaginationOrder, nil] Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records).
+    # @param ownership [WorkOS::Types::PipesOwnership, nil] Only return Data Integrations with this ownership: `user` for the integrations users connect their own accounts to, or `organization` for the roots organizations connect to. Omit to return both.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
     # @return [WorkOS::Types::ListStruct<WorkOS::DataIntegration>]
     def list_data_integrations(
@@ -22,13 +23,15 @@ module WorkOS
       after: nil,
       limit: 10,
       order: "desc",
+      ownership: nil,
       request_options: {}
     )
       params = {
         "before" => before,
         "after" => after,
         "limit" => limit,
-        "order" => order
+        "order" => order,
+        "ownership" => ownership
       }.compact
       response = @client.request(
         method: :get,
@@ -43,19 +46,21 @@ module WorkOS
           after: cursor,
           limit: limit,
           order: order,
+          ownership: ownership,
           request_options: request_options
         )
       }
       WorkOS::Types::ListStruct.from_response(
         response,
         model: WorkOS::DataIntegration,
-        filters: {before: before, limit: limit, order: order},
+        filters: {before: before, limit: limit, order: order, ownership: ownership},
         fetch_next: fetch_next
       )
     end
 
     # Create a data integration
     # @param provider [String] The provider to create a Data Integration for. For a built-in provider use its slug (e.g. `github`, `slack`). For a custom provider, this is the new provider slug and `custom_provider` must be supplied. A custom provider slug cannot shadow an existing global provider slug.
+    # @param ownership [WorkOS::Types::CreateDataIntegrationOwnership, nil] Who owns the Data Integration. `user` (the default) creates the integration users connect their own accounts to; `organization` creates the root organizations connect to. Ownership is fixed at creation, and one integration of each ownership may exist per provider. Independent of `credentials.type`.
     # @param description [String, nil] An optional description of the Data Integration.
     # @param enabled [Boolean, nil] Whether the Data Integration is enabled. Defaults to `false`.
     # @param scopes [Array<String>, nil] The OAuth scopes to request for the Data Integration. Defaults to the provider's configured scopes when omitted.
@@ -68,6 +73,7 @@ module WorkOS
     # @return [WorkOS::DataIntegration]
     def create_data_integration(
       provider:,
+      ownership: nil,
       description: WorkOS::OMIT,
       enabled: nil,
       scopes: WorkOS::OMIT,
@@ -80,6 +86,7 @@ module WorkOS
     )
       body = {
         "provider" => provider,
+        "ownership" => ownership,
         "enabled" => enabled,
         "auth_methods" => auth_methods,
         "config" => config,
@@ -180,7 +187,9 @@ module WorkOS
     # Upsert an API key for a connected account
     # @param slug [String] The identifier of the integration.
     # @param user_id [String] A [User](https://workos.com/docs/reference/authkit/user) identifier.
-    # @param organization_id [String, nil] An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter to scope the connection to a specific organization.
+    # @param organization_id [String, nil] An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter to scope the connection to a specific organization. Required when `connection_owner` is `organization`.
+    # @param connected_account_id [String, nil] A [connected account](https://workos.com/docs/reference/pipes/connected-account) identifier. Use this to rotate a specific existing connection.
+    # @param connection_owner [WorkOS::Types::DataIntegrationsUpsertApiKeyRequestConnectionOwner, nil] Whose connection to create or rotate. `user` (the default) addresses the connection owned by `user_id`. `organization` addresses the connection shared by every member of `organization_id`; `user_id` then identifies the member performing the request and must be an active member of the organization.
     # @param secret [String] The API key secret to store for this integration.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
     # @return [WorkOS::ConnectedAccount]
@@ -189,11 +198,15 @@ module WorkOS
       user_id:,
       secret:,
       organization_id: nil,
+      connected_account_id: nil,
+      connection_owner: nil,
       request_options: {}
     )
       body = {
         "user_id" => user_id,
         "organization_id" => organization_id,
+        "connected_account_id" => connected_account_id,
+        "connection_owner" => connection_owner,
         "secret" => secret
       }.compact
       response = @client.request(
@@ -210,8 +223,9 @@ module WorkOS
 
     # Get authorization URL
     # @param slug [String] The slug identifier of the provider (e.g., `github`, `slack`, `notion`).
-    # @param user_id [String] The ID of the user to authorize.
-    # @param organization_id [String, nil] An organization ID to scope the authorization to a specific organization.
+    # @param user_id [String] The ID of the user to authorize. When `connection_owner` is `organization`, this is the user authorizing on behalf of the organization; they must be an active member of the organization and do not become the owner of the resulting connected account.
+    # @param organization_id [String, nil] An organization ID to scope the authorization to a specific organization. Required when `connection_owner` is `organization`.
+    # @param connection_owner [WorkOS::Types::DataIntegrationsGetDataIntegrationAuthorizeUrlRequestConnectionOwner, nil] Who will own the connected account. `user` (the default) connects the user's own account. `organization` connects the organization's shared account and requires `organization_id`.
     # @param return_to [String, nil] The URL to redirect the user to after authorization.
     # @param config [Hash{String => String}, nil] Connect-time config values for the provider-declared `installation`-scope fields (e.g. a Zendesk `subdomain`), keyed by the config field. Only fields the provider declares may be supplied, and required fields must be provided unless already pinned on the integration.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
@@ -220,6 +234,7 @@ module WorkOS
       slug:,
       user_id:,
       organization_id: nil,
+      connection_owner: nil,
       return_to: nil,
       config: nil,
       request_options: {}
@@ -227,6 +242,7 @@ module WorkOS
       body = {
         "user_id" => user_id,
         "organization_id" => organization_id,
+        "connection_owner" => connection_owner,
         "return_to" => return_to,
         "config" => config
       }.compact
@@ -245,7 +261,9 @@ module WorkOS
     # Upsert client credentials for a connected account
     # @param slug [String] The identifier of the integration.
     # @param user_id [String] A [User](https://workos.com/docs/reference/authkit/user) identifier.
-    # @param organization_id [String, nil] An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter to scope the connection to a specific organization.
+    # @param organization_id [String, nil] An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter to scope the connection to a specific organization. Required when `connection_owner` is `organization`.
+    # @param connected_account_id [String, nil] A [connected account](https://workos.com/docs/reference/pipes/connected-account) identifier. Use this to rotate a specific existing connection.
+    # @param connection_owner [WorkOS::Types::DataIntegrationsUpsertClientCredentialsRequestConnectionOwner, nil] Whose connection to create or rotate. `user` (the default) addresses the connection owned by `user_id`. `organization` addresses the connection shared by every member of `organization_id`; `user_id` then identifies the member performing the request and must be an active member of the organization.
     # @param client_id [String] The OAuth client ID to store for this integration.
     # @param client_secret [String] The OAuth client secret to store for this integration.
     # @param config [Hash{String => String}, nil] Provider-specific configuration values collected for this installation, keyed by the provider's config field descriptors.
@@ -257,12 +275,16 @@ module WorkOS
       client_id:,
       client_secret:,
       organization_id: nil,
+      connected_account_id: nil,
+      connection_owner: nil,
       config: nil,
       request_options: {}
     )
       body = {
         "user_id" => user_id,
         "organization_id" => organization_id,
+        "connected_account_id" => connected_account_id,
+        "connection_owner" => connection_owner,
         "client_id" => client_id,
         "client_secret" => client_secret,
         "config" => config
@@ -281,19 +303,28 @@ module WorkOS
 
     # Vend credentials for a connected account
     # @param slug [String] The identifier of the integration.
-    # @param user_id [String] A [User](https://workos.com/docs/reference/authkit/user) identifier.
-    # @param organization_id [String, nil] An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter to scope the connection to a specific organization.
+    # @param user_id [String] A [User](https://workos.com/docs/reference/authkit/user) identifier. When `connection_owner` is `organization`, this is the user the credentials are vended on behalf of; they must be an active member of the organization.
+    # @param organization_id [String, nil] An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter to scope the connection to a specific organization. Required when `connection_owner` is `organization`.
+    # @param connected_account_id [String, nil] A [connected account](https://workos.com/docs/reference/pipes/connected-account) identifier. Use this to select a specific connection when the user has several for this provider.
+    # @param connection_owner [WorkOS::Types::DataIntegrationsVendCredentialsRequestConnectionOwner, nil] Which connection to vend from. `user` (the default) vends the user's own connection and requires `user_id`. `organization` vends the organization's shared connection and requires `organization_id`.
+    # @param supports_multiple_connections [Boolean, nil] Set to `true` to use the plural connection contract. If no `connected_account_id` is supplied and several connections match, the request returns `account_selection_required`. When omitted or `false`, only the compatibility connection is considered.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
     # @return [WorkOS::DataIntegrationCredentialsResponse]
     def create_data_integration_credential(
       slug:,
       user_id:,
       organization_id: nil,
+      connected_account_id: nil,
+      connection_owner: nil,
+      supports_multiple_connections: nil,
       request_options: {}
     )
       body = {
         "user_id" => user_id,
-        "organization_id" => organization_id
+        "organization_id" => organization_id,
+        "connected_account_id" => connected_account_id,
+        "connection_owner" => connection_owner,
+        "supports_multiple_connections" => supports_multiple_connections
       }.compact
       response = @client.request(
         method: :post,
@@ -307,21 +338,106 @@ module WorkOS
       result
     end
 
+    # Get an organization-owned data integration
+    # @param slug [String] The slug identifier of the data integration.
+    # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
+    # @return [WorkOS::DataIntegration]
+    def list_data_integration_organization(
+      slug:,
+      request_options: {}
+    )
+      response = @client.request(
+        method: :get,
+        path: "/data-integrations/#{WorkOS::Util.encode_path(slug)}/organization",
+        auth: true,
+        request_options: request_options
+      )
+      result = WorkOS::DataIntegration.new(response.body)
+      result.last_response = WorkOS::Types::ApiResponse.new(http_status: response.code.to_i, http_headers: response.each_header.to_h, request_id: response["x-request-id"])
+      result
+    end
+
+    # Update an organization-owned data integration
+    # @param slug [String] The slug identifier of the data integration.
+    # @param description [String, nil] An optional description of the Data Integration.
+    # @param enabled [Boolean, nil] Whether the Data Integration is enabled.
+    # @param scopes [Array<String>, nil] The OAuth scopes to request for the Data Integration. Pass `null` to reset to the provider's configured scopes.
+    # @param credentials [WorkOS::DataIntegrationCredentialsInput, nil] New OAuth credentials for the Data Integration. When provided, rotates the stored client secret. Mutually exclusive with `api_key`.
+    # @param api_key [WorkOS::ApiKeyInstallation, nil] An API key to install or rotate for a tenant on an `api_key` integration. Upserts the tenant installation identified by `user_id` (and optional `organization_id`).
+    # @param custom_provider [WorkOS::UpdateCustomProviderDefinition, nil] Updates to a custom provider's OAuth definition. Only valid for custom-provider integrations.
+    # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
+    # @return [WorkOS::DataIntegration]
+    def update_data_integration_organization(
+      slug:,
+      description: WorkOS::OMIT,
+      enabled: nil,
+      scopes: WorkOS::OMIT,
+      credentials: nil,
+      api_key: nil,
+      custom_provider: nil,
+      request_options: {}
+    )
+      body = {
+        "enabled" => enabled,
+        "credentials" => credentials,
+        "api_key" => api_key,
+        "custom_provider" => custom_provider
+      }.compact
+      body["description"] = description unless description.equal?(WorkOS::OMIT)
+      body["scopes"] = scopes unless scopes.equal?(WorkOS::OMIT)
+      response = @client.request(
+        method: :put,
+        path: "/data-integrations/#{WorkOS::Util.encode_path(slug)}/organization",
+        auth: true,
+        body: body,
+        request_options: request_options
+      )
+      result = WorkOS::DataIntegration.new(response.body)
+      result.last_response = WorkOS::Types::ApiResponse.new(http_status: response.code.to_i, http_headers: response.each_header.to_h, request_id: response["x-request-id"])
+      result
+    end
+
+    # Delete an organization-owned data integration
+    # @param slug [String] The slug identifier of the data integration.
+    # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
+    # @return [void]
+    def delete_data_integration_organization(
+      slug:,
+      request_options: {}
+    )
+      @client.request(
+        method: :delete,
+        path: "/data-integrations/#{WorkOS::Util.encode_path(slug)}/organization",
+        auth: true,
+        request_options: request_options
+      )
+      nil
+    end
+
     # Get an access token for a connected account
     # @param provider [String] The identifier of the integration.
-    # @param user_id [String] A [User](https://workos.com/docs/reference/authkit/user) identifier.
-    # @param organization_id [String, nil] An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter to scope the connection to a specific organization.
+    # @param user_id [String] A [User](https://workos.com/docs/reference/authkit/user) identifier. When `connection_owner` is `organization`, this is the user the credentials are vended on behalf of; they must be an active member of the organization.
+    # @param organization_id [String, nil] An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter to scope the connection to a specific organization. Required when `connection_owner` is `organization`.
+    # @param connected_account_id [String, nil] A [connected account](https://workos.com/docs/reference/pipes/connected-account) identifier. Use this to select a specific connection when the user has several for this provider.
+    # @param connection_owner [WorkOS::Types::DataIntegrationsGetUserTokenRequestConnectionOwner, nil] Which connection to vend from. `user` (the default) vends the user's own connection and requires `user_id`. `organization` vends the organization's shared connection and requires `organization_id`.
+    # @param supports_multiple_connections [Boolean, nil] Set to `true` to use the plural connection contract. If no `connected_account_id` is supplied and several connections match, the request returns `account_selection_required`. When omitted or `false`, only the compatibility connection is considered.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
     # @return [WorkOS::DataIntegrationAccessTokenResponse]
     def get_access_token(
       provider:,
       user_id:,
       organization_id: WorkOS::OMIT,
+      connected_account_id: nil,
+      connection_owner: nil,
+      supports_multiple_connections: nil,
       request_options: {}
     )
       body = {
-        "user_id" => user_id
-      }
+        "user_id" => user_id,
+        "connected_account_id" => connected_account_id,
+        "connection_owner" => connection_owner,
+        "supports_multiple_connections" => supports_multiple_connections
+      }.compact
       body["organization_id"] = organization_id unless organization_id.equal?(WorkOS::OMIT)
       response = @client.request(
         method: :post,
@@ -335,20 +451,196 @@ module WorkOS
       result
     end
 
+    # Get an organization connected account
+    # @param organization_id [String] An [Organization](https://workos.com/docs/reference/organization) identifier.
+    # @param slug [String] The slug identifier of the provider (e.g., `github`, `slack`, `notion`).
+    # @param supports_multiple_connections [Boolean, nil] Set to `true` to use the plural connection contract. When omitted or `false`, only the compatibility connection is considered.
+    # @param connected_account_id [String, nil] A [connected account](https://workos.com/docs/reference/pipes/connected-account) identifier. Use this to select a specific connection when the organization has several for this provider.
+    # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
+    # @return [WorkOS::ConnectedAccount]
+    def get_organization_connected_account(
+      organization_id:,
+      slug:,
+      supports_multiple_connections: nil,
+      connected_account_id: nil,
+      request_options: {}
+    )
+      params = {
+        "supports_multiple_connections" => supports_multiple_connections,
+        "connected_account_id" => connected_account_id
+      }.compact
+      response = @client.request(
+        method: :get,
+        path: "/organizations/#{WorkOS::Util.encode_path(organization_id)}/connected_accounts/#{WorkOS::Util.encode_path(slug)}",
+        auth: true,
+        params: params,
+        request_options: request_options
+      )
+      result = WorkOS::ConnectedAccount.new(response.body)
+      result.last_response = WorkOS::Types::ApiResponse.new(http_status: response.code.to_i, http_headers: response.each_header.to_h, request_id: response["x-request-id"])
+      result
+    end
+
+    # Import an organization connected account
+    # @param organization_id [String] An [Organization](https://workos.com/docs/reference/organization) identifier.
+    # @param slug [String] The slug identifier of the provider (e.g., `github`, `slack`, `notion`).
+    # @param access_token [String, nil] The OAuth access token for the connected account.
+    # @param refresh_token [String, nil] The OAuth refresh token for the connected account.
+    # @param expires_at [String, nil] The ISO-8601 timestamp when the access token expires. Required when `access_token` is provided for tokens that expire.
+    # @param scopes [Array<String>, nil] The OAuth scopes granted for this connection.
+    # @param state [WorkOS::Types::ConnectedAccountInputState, nil] Explicitly set the state of the connected account. When omitted, the state is derived from the token combination provided.
+    # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
+    # @return [WorkOS::ConnectedAccount]
+    def create_organization_connected_account(
+      organization_id:,
+      slug:,
+      access_token: nil,
+      refresh_token: nil,
+      expires_at: nil,
+      scopes: nil,
+      state: nil,
+      request_options: {}
+    )
+      body = {
+        "access_token" => access_token,
+        "refresh_token" => refresh_token,
+        "expires_at" => expires_at,
+        "scopes" => scopes,
+        "state" => state
+      }.compact
+      response = @client.request(
+        method: :post,
+        path: "/organizations/#{WorkOS::Util.encode_path(organization_id)}/connected_accounts/#{WorkOS::Util.encode_path(slug)}",
+        auth: true,
+        body: body,
+        request_options: request_options
+      )
+      result = WorkOS::ConnectedAccount.new(response.body)
+      result.last_response = WorkOS::Types::ApiResponse.new(http_status: response.code.to_i, http_headers: response.each_header.to_h, request_id: response["x-request-id"])
+      result
+    end
+
+    # Update an organization connected account
+    # @param organization_id [String] An [Organization](https://workos.com/docs/reference/organization) identifier.
+    # @param slug [String] The slug identifier of the provider (e.g., `github`, `slack`, `notion`).
+    # @param access_token [String, nil] The OAuth access token for the connected account.
+    # @param refresh_token [String, nil] The OAuth refresh token for the connected account.
+    # @param expires_at [String, nil] The ISO-8601 timestamp when the access token expires. Required when `access_token` is provided for tokens that expire.
+    # @param scopes [Array<String>, nil] The OAuth scopes granted for this connection.
+    # @param state [WorkOS::Types::ConnectedAccountInputState, nil] Explicitly set the state of the connected account. When omitted, the state is derived from the token combination provided.
+    # @param supports_multiple_connections [Boolean, nil] Set to `true` to use the plural connection contract. When omitted or `false`, only the compatibility connection is considered.
+    # @param connected_account_id [String, nil] A [connected account](https://workos.com/docs/reference/pipes/connected-account) identifier. Use this to select the connection to update.
+    # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
+    # @return [WorkOS::ConnectedAccount]
+    def update_organization_connected_account(
+      organization_id:,
+      slug:,
+      access_token: nil,
+      refresh_token: nil,
+      expires_at: nil,
+      scopes: nil,
+      state: nil,
+      supports_multiple_connections: nil,
+      connected_account_id: nil,
+      request_options: {}
+    )
+      params = {
+        "supports_multiple_connections" => supports_multiple_connections,
+        "connected_account_id" => connected_account_id
+      }.compact
+      body = {
+        "access_token" => access_token,
+        "refresh_token" => refresh_token,
+        "expires_at" => expires_at,
+        "scopes" => scopes,
+        "state" => state
+      }.compact
+      response = @client.request(
+        method: :put,
+        path: "/organizations/#{WorkOS::Util.encode_path(organization_id)}/connected_accounts/#{WorkOS::Util.encode_path(slug)}",
+        auth: true,
+        params: params,
+        body: body,
+        request_options: request_options
+      )
+      result = WorkOS::ConnectedAccount.new(response.body)
+      result.last_response = WorkOS::Types::ApiResponse.new(http_status: response.code.to_i, http_headers: response.each_header.to_h, request_id: response["x-request-id"])
+      result
+    end
+
+    # Delete an organization connected account
+    # @param organization_id [String] An [Organization](https://workos.com/docs/reference/organization) identifier.
+    # @param slug [String] The slug identifier of the provider (e.g., `github`, `slack`, `notion`).
+    # @param supports_multiple_connections [Boolean, nil] Set to `true` to use the plural connection contract. When omitted or `false`, only the compatibility connection is considered.
+    # @param connected_account_id [String, nil] A [connected account](https://workos.com/docs/reference/pipes/connected-account) identifier. Use this to select the connection to delete.
+    # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
+    # @return [void]
+    def delete_organization_connected_account(
+      organization_id:,
+      slug:,
+      supports_multiple_connections: nil,
+      connected_account_id: nil,
+      request_options: {}
+    )
+      params = {
+        "supports_multiple_connections" => supports_multiple_connections,
+        "connected_account_id" => connected_account_id
+      }.compact
+      @client.request(
+        method: :delete,
+        path: "/organizations/#{WorkOS::Util.encode_path(organization_id)}/connected_accounts/#{WorkOS::Util.encode_path(slug)}",
+        auth: true,
+        params: params,
+        request_options: request_options
+      )
+      nil
+    end
+
+    # List providers for an organization
+    # @param organization_id [String] An [Organization](https://workos.com/docs/reference/organization) identifier to list providers and connected accounts for.
+    # @param supports_multiple_connections [Boolean, nil] Set to `true` to use the plural connection contract. When omitted or `false`, only the compatibility connection is considered.
+    # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
+    # @return [WorkOS::DataIntegrationsListResponse]
+    def list_organization_data_providers(
+      organization_id:,
+      supports_multiple_connections: nil,
+      request_options: {}
+    )
+      params = {
+        "supports_multiple_connections" => supports_multiple_connections
+      }.compact
+      response = @client.request(
+        method: :get,
+        path: "/organizations/#{WorkOS::Util.encode_path(organization_id)}/data_providers",
+        auth: true,
+        params: params,
+        request_options: request_options
+      )
+      result = WorkOS::DataIntegrationsListResponse.new(response.body)
+      result.last_response = WorkOS::Types::ApiResponse.new(http_status: response.code.to_i, http_headers: response.each_header.to_h, request_id: response["x-request-id"])
+      result
+    end
+
     # Get a connected account
     # @param user_id [String] A [User](https://workos.com/docs/reference/authkit/user) identifier.
     # @param slug [String] The slug identifier of the provider (e.g., `github`, `slack`, `notion`).
     # @param organization_id [String, nil] An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter if the connection is scoped to an organization.
+    # @param supports_multiple_connections [Boolean, nil] Set to `true` to use the plural connection contract. When omitted or `false`, only the compatibility connection is considered.
+    # @param connected_account_id [String, nil] A [connected account](https://workos.com/docs/reference/pipes/connected-account) identifier. Use this to select a specific connection when the user has several for this provider.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
     # @return [WorkOS::ConnectedAccount]
     def get_user_connected_account(
       user_id:,
       slug:,
       organization_id: nil,
+      supports_multiple_connections: nil,
+      connected_account_id: nil,
       request_options: {}
     )
       params = {
-        "organization_id" => organization_id
+        "organization_id" => organization_id,
+        "supports_multiple_connections" => supports_multiple_connections,
+        "connected_account_id" => connected_account_id
       }.compact
       response = @client.request(
         method: :get,
@@ -416,6 +708,8 @@ module WorkOS
     # @param scopes [Array<String>, nil] The OAuth scopes granted for this connection.
     # @param state [WorkOS::Types::ConnectedAccountInputState, nil] Explicitly set the state of the connected account. When omitted, the state is derived from the token combination provided.
     # @param organization_id [String, nil] An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter if the connection is scoped to an organization.
+    # @param supports_multiple_connections [Boolean, nil] Set to `true` to use the plural connection contract. When omitted or `false`, only the compatibility connection is considered.
+    # @param connected_account_id [String, nil] A [connected account](https://workos.com/docs/reference/pipes/connected-account) identifier. Use this to select the connection to update.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
     # @return [WorkOS::ConnectedAccount]
     def update_user_connected_account(
@@ -427,10 +721,14 @@ module WorkOS
       scopes: nil,
       state: nil,
       organization_id: nil,
+      supports_multiple_connections: nil,
+      connected_account_id: nil,
       request_options: {}
     )
       params = {
-        "organization_id" => organization_id
+        "organization_id" => organization_id,
+        "supports_multiple_connections" => supports_multiple_connections,
+        "connected_account_id" => connected_account_id
       }.compact
       body = {
         "access_token" => access_token,
@@ -456,16 +754,22 @@ module WorkOS
     # @param user_id [String] A [User](https://workos.com/docs/reference/authkit/user) identifier.
     # @param slug [String] The slug identifier of the provider (e.g., `github`, `slack`, `notion`).
     # @param organization_id [String, nil] An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter if the connection is scoped to an organization.
+    # @param supports_multiple_connections [Boolean, nil] Set to `true` to use the plural connection contract. When omitted or `false`, only the compatibility connection is considered.
+    # @param connected_account_id [String, nil] A [connected account](https://workos.com/docs/reference/pipes/connected-account) identifier. Use this to select the connection to delete.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
     # @return [void]
     def delete_user_connected_account(
       user_id:,
       slug:,
       organization_id: nil,
+      supports_multiple_connections: nil,
+      connected_account_id: nil,
       request_options: {}
     )
       params = {
-        "organization_id" => organization_id
+        "organization_id" => organization_id,
+        "supports_multiple_connections" => supports_multiple_connections,
+        "connected_account_id" => connected_account_id
       }.compact
       @client.request(
         method: :delete,
@@ -480,15 +784,18 @@ module WorkOS
     # List providers for a user
     # @param user_id [String] A [User](https://workos.com/docs/reference/authkit/user) identifier to list providers and connected accounts for.
     # @param organization_id [String, nil] An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter to filter connections for a specific organization.
+    # @param supports_multiple_connections [Boolean, nil] Set to `true` to use the plural connection contract. When omitted or `false`, only the compatibility connection is considered.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
     # @return [WorkOS::DataIntegrationsListResponse]
     def list_user_data_providers(
       user_id:,
       organization_id: nil,
+      supports_multiple_connections: nil,
       request_options: {}
     )
       params = {
-        "organization_id" => organization_id
+        "organization_id" => organization_id,
+        "supports_multiple_connections" => supports_multiple_connections
       }.compact
       response = @client.request(
         method: :get,

data/lib/workos/session_manager.rb

@@ -174,7 +174,10 @@ module WorkOS
     # Verify an access-token JWT against the WorkOS JWKS for this client.
     # Used by Session#authenticate; exposed publicly for advanced cases.
     #
-    # NOTE on iss/aud/required_claims: this method intentionally does not
+    # The `iss` claim is only checked when the client was built with
+    # `jwt_issuer:` (a String or an Array of accepted issuers).
+    #
+    # NOTE on iss/aud/required_claims: by default this method does not
     # enforce iss, aud, or required_claims. workos-node's `jose` call and
     # workos-php's `isset($exp) && $exp < time()` accept exp-less tokens, and
     # cross-SDK parity is required for the planned coordinated hardening of
@@ -182,15 +185,17 @@ module WorkOS
     # required_claims: ['exp'] tightening that was considered here.
     def decode_jwt(access_token, verify_expiration: true)
       jwks = fetch_jwks
-      JWT.decode(
-        access_token,
-        nil,
-        true,
+      options = {
         algorithms: JWK_ALGORITHMS,
         jwks: jwks,
         verify_aud: false,
         verify_expiration: verify_expiration
-      ).first
+      }
+      unless client.jwt_issuer.nil?
+        options[:iss] = client.jwt_issuer
+        options[:verify_iss] = true
+      end
+      JWT.decode(access_token, nil, true, options).first
     end
 
     private

data/lib/workos/shared/account_selection_required_error.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  class AccountSelectionRequiredError < WorkOS::Types::BaseModel
+    HASH_ATTRS = {
+      code: :code,
+      message: :message
+    }.freeze
+
+    attr_accessor \
+      :code,
+      :message
+
+    def initialize(json)
+      hash = self.class.normalize(json)
+      @code = hash[:code]
+      @message = hash[:message]
+    end
+  end
+end

data/lib/workos/shared/pipe_connected_account.rb

@@ -7,11 +7,16 @@ module WorkOS
     HASH_ATTRS = {
       object: :object,
       id: :id,
+      connection_role: :connection_role,
+      account_identifier: :account_identifier,
+      account_display_name: :account_display_name,
       data_integration_id: :data_integration_id,
       provider_slug: :provider_slug,
       user_id: :user_id,
       organization_id: :organization_id,
       scopes: :scopes,
+      auth_method: :auth_method,
+      api_key_last_4: :api_key_last_4,
       state: :state,
       created_at: :created_at,
       updated_at: :updated_at
@@ -20,11 +25,16 @@ module WorkOS
     attr_accessor \
       :object,
       :id,
+      :connection_role,
+      :account_identifier,
+      :account_display_name,
       :data_integration_id,
       :provider_slug,
       :user_id,
       :organization_id,
       :scopes,
+      :auth_method,
+      :api_key_last_4,
       :state,
       :created_at,
       :updated_at
@@ -33,11 +43,16 @@ module WorkOS
       hash = self.class.normalize(json)
       @object = hash[:object]
       @id = hash[:id]
+      @connection_role = hash[:connection_role]
+      @account_identifier = hash[:account_identifier]
+      @account_display_name = hash[:account_display_name]
       @data_integration_id = hash[:data_integration_id]
       @provider_slug = hash[:provider_slug]
       @user_id = hash[:user_id]
       @organization_id = hash[:organization_id]
       @scopes = hash[:scopes] || []
+      @auth_method = hash[:auth_method]
+      @api_key_last_4 = hash[:api_key_last_4]
       @state = hash[:state]
       @created_at = hash[:created_at]
       @updated_at = hash[:updated_at]