workos 10.3.0 → 10.5.0

data/lib/workos/pipes.rb

@@ -15,6 +15,7 @@ module WorkOS
     # @param after [String, nil] An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`.
     # @param limit [Integer, nil] Upper limit on the number of objects to return, between `1` and `100`.
     # @param order [WorkOS::Types::PaginationOrder, nil] Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records).
+    # @param ownership [WorkOS::Types::PipesOwnership, nil] Only return Data Integrations with this ownership: `user` for the integrations users connect their own accounts to, or `organization` for the roots organizations connect to. Omit to return both.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
     # @return [WorkOS::Types::ListStruct<WorkOS::DataIntegration>]
     def list_data_integrations(
@@ -22,13 +23,15 @@ module WorkOS
       after: nil,
       limit: 10,
       order: "desc",
+      ownership: nil,
       request_options: {}
     )
       params = {
         "before" => before,
         "after" => after,
         "limit" => limit,
-        "order" => order
+        "order" => order,
+        "ownership" => ownership
       }.compact
       response = @client.request(
         method: :get,
@@ -43,19 +46,21 @@ module WorkOS
           after: cursor,
           limit: limit,
           order: order,
+          ownership: ownership,
           request_options: request_options
         )
       }
       WorkOS::Types::ListStruct.from_response(
         response,
         model: WorkOS::DataIntegration,
-        filters: {before: before, limit: limit, order: order},
+        filters: {before: before, limit: limit, order: order, ownership: ownership},
         fetch_next: fetch_next
       )
     end
 
     # Create a data integration
     # @param provider [String] The provider to create a Data Integration for. For a built-in provider use its slug (e.g. `github`, `slack`). For a custom provider, this is the new provider slug and `custom_provider` must be supplied. A custom provider slug cannot shadow an existing global provider slug.
+    # @param ownership [WorkOS::Types::CreateDataIntegrationOwnership, nil] Who owns the Data Integration. `user` (the default) creates the integration users connect their own accounts to; `organization` creates the root organizations connect to. Ownership is fixed at creation, and one integration of each ownership may exist per provider. Independent of `credentials.type`.
     # @param description [String, nil] An optional description of the Data Integration.
     # @param enabled [Boolean, nil] Whether the Data Integration is enabled. Defaults to `false`.
     # @param scopes [Array<String>, nil] The OAuth scopes to request for the Data Integration. Defaults to the provider's configured scopes when omitted.
@@ -68,6 +73,7 @@ module WorkOS
     # @return [WorkOS::DataIntegration]
     def create_data_integration(
       provider:,
+      ownership: nil,
       description: WorkOS::OMIT,
       enabled: nil,
       scopes: WorkOS::OMIT,
@@ -80,6 +86,7 @@ module WorkOS
     )
       body = {
         "provider" => provider,
+        "ownership" => ownership,
         "enabled" => enabled,
         "auth_methods" => auth_methods,
         "config" => config,
@@ -177,25 +184,83 @@ module WorkOS
       nil
     end
 
+    # Create another API key connected account
+    # @param slug [String] The identifier of the integration.
+    # @param account_display_name [String, nil] A mutable, non-unique label. Omit to preserve an existing label; null clears it. Labels are never account identifiers.
+    # @param account_identifier [String, nil] A developer-attested provider account identifier, never inferred from a label or credential. Omit to preserve an existing identifier; null clears it.
+    # @param user_id [String] A [User](https://workos.com/docs/reference/authkit/user) identifier.
+    # @param organization_id [String, nil] An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter to scope the connection to a specific organization. Required when `connection_owner` is `organization`.
+    # @param connection_owner [WorkOS::Types::DataIntegrationsCreateApiKeyConnectionRequestConnectionOwner, nil] Whose connection to create or rotate. `user` (the default) addresses the connection owned by `user_id`. `organization` addresses the connection shared by every member of `organization_id`; `user_id` then identifies the member performing the request and must be an active member of the organization.
+    # @param secret [String] The API key secret to store for this integration.
+    # @param connection_intent [String] Must be `add`: this endpoint only creates another connection. The first connection for an owner shape fills the compatibility slot; later connections are standard. Creating an additional connection is not yet available: until it is, `add` succeeds only when the owner has no connection for this integration and otherwise returns 404 `multiple_connections_unavailable`.
+    # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
+    # @return [WorkOS::ConnectedAccountWriteResponse]
+    def create_data_integration_api_key(
+      slug:,
+      user_id:,
+      secret:,
+      connection_intent:,
+      account_display_name: WorkOS::OMIT,
+      account_identifier: WorkOS::OMIT,
+      organization_id: nil,
+      connection_owner: nil,
+      request_options: {}
+    )
+      body = {
+        "user_id" => user_id,
+        "organization_id" => organization_id,
+        "connection_owner" => connection_owner,
+        "secret" => secret,
+        "connection_intent" => connection_intent
+      }.compact
+      body["account_display_name"] = account_display_name unless account_display_name.equal?(WorkOS::OMIT)
+      body["account_identifier"] = account_identifier unless account_identifier.equal?(WorkOS::OMIT)
+      response = @client.request(
+        method: :post,
+        path: "/data-integrations/#{WorkOS::Util.encode_path(slug)}/api-key",
+        auth: true,
+        body: body,
+        request_options: request_options
+      )
+      result = WorkOS::ConnectedAccountWriteResponse.new(response.body)
+      result.last_response = WorkOS::Types::ApiResponse.new(http_status: response.code.to_i, http_headers: response.each_header.to_h, request_id: response["x-request-id"])
+      result
+    end
+
     # Upsert an API key for a connected account
     # @param slug [String] The identifier of the integration.
+    # @param account_display_name [String, nil] A mutable, non-unique label. Omit to preserve an existing label; null clears it. Labels are never account identifiers.
+    # @param account_identifier [String, nil] A developer-attested provider account identifier, never inferred from a label or credential. Omit to preserve an existing identifier; null clears it.
     # @param user_id [String] A [User](https://workos.com/docs/reference/authkit/user) identifier.
-    # @param organization_id [String, nil] An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter to scope the connection to a specific organization.
+    # @param organization_id [String, nil] An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter to scope the connection to a specific organization. Required when `connection_owner` is `organization`.
+    # @param connection_owner [WorkOS::Types::DataIntegrationsUpsertApiKeyRequestConnectionOwner, nil] Whose connection to create or rotate. `user` (the default) addresses the connection owned by `user_id`. `organization` addresses the connection shared by every member of `organization_id`; `user_id` then identifies the member performing the request and must be an active member of the organization.
     # @param secret [String] The API key secret to store for this integration.
+    # @param connection_intent [String, nil] Reauthorize exactly the connection named by `connected_account_id`.
+    # @param connected_account_id [String, nil] The exact connected account to reauthorize. Required with `connection_intent: reauthorize`.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
-    # @return [WorkOS::ConnectedAccount]
+    # @return [WorkOS::ConnectedAccountWriteResponse]
     def update_data_integration_api_key(
       slug:,
       user_id:,
       secret:,
+      account_display_name: WorkOS::OMIT,
+      account_identifier: WorkOS::OMIT,
       organization_id: nil,
+      connection_owner: nil,
+      connection_intent: nil,
+      connected_account_id: nil,
       request_options: {}
     )
       body = {
         "user_id" => user_id,
         "organization_id" => organization_id,
-        "secret" => secret
+        "connection_owner" => connection_owner,
+        "secret" => secret,
+        "connection_intent" => connection_intent,
+        "connected_account_id" => connected_account_id
       }.compact
+      body["account_display_name"] = account_display_name unless account_display_name.equal?(WorkOS::OMIT)
+      body["account_identifier"] = account_identifier unless account_identifier.equal?(WorkOS::OMIT)
       response = @client.request(
         method: :put,
         path: "/data-integrations/#{WorkOS::Util.encode_path(slug)}/api-key",
@@ -203,33 +268,45 @@ module WorkOS
         body: body,
         request_options: request_options
       )
-      result = WorkOS::ConnectedAccount.new(response.body)
+      result = WorkOS::ConnectedAccountWriteResponse.new(response.body)
       result.last_response = WorkOS::Types::ApiResponse.new(http_status: response.code.to_i, http_headers: response.each_header.to_h, request_id: response["x-request-id"])
       result
     end
 
     # Get authorization URL
     # @param slug [String] The slug identifier of the provider (e.g., `github`, `slack`, `notion`).
-    # @param user_id [String] The ID of the user to authorize.
-    # @param organization_id [String, nil] An organization ID to scope the authorization to a specific organization.
+    # @param account_display_name [String, nil] A mutable, non-unique label. Omit to preserve an existing label; null clears it. Labels are never account identifiers.
+    # @param user_id [String] The ID of the user to authorize. When `connection_owner` is `organization`, this is the user authorizing on behalf of the organization; they must be an active member of the organization and do not become the owner of the resulting connected account.
+    # @param organization_id [String, nil] An organization ID to scope the authorization to a specific organization. Required when `connection_owner` is `organization`.
+    # @param connection_owner [WorkOS::Types::DataIntegrationsGetDataIntegrationAuthorizeUrlRequestConnectionOwner, nil] Who will own the connected account. `user` (the default) connects the user's own account. `organization` connects the organization's shared account and requires `organization_id`.
     # @param return_to [String, nil] The URL to redirect the user to after authorization.
     # @param config [Hash{String => String}, nil] Connect-time config values for the provider-declared `installation`-scope fields (e.g. a Zendesk `subdomain`), keyed by the config field. Only fields the provider declares may be supplied, and required fields must be provided unless already pinned on the integration.
+    # @param connection_intent [String, nil] Create another connection. The first connection for an owner shape fills the compatibility slot; later connections are standard. Creating an additional connection is not yet available: until it is, `add` succeeds only when the owner has no connection for this integration and otherwise returns 404 `multiple_connections_unavailable`. Omit `connection_intent` to use the compatibility connection, or send `reauthorize` with `connected_account_id` to reauthorize one exact connection.
+    # @param connected_account_id [String, nil] The exact connected account to reauthorize. Required with `connection_intent: reauthorize`.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
     # @return [WorkOS::DataIntegrationAuthorizeUrlResponse]
     def authorize_data_integration(
       slug:,
       user_id:,
+      account_display_name: WorkOS::OMIT,
       organization_id: nil,
+      connection_owner: nil,
       return_to: nil,
       config: nil,
+      connection_intent: nil,
+      connected_account_id: nil,
       request_options: {}
     )
       body = {
         "user_id" => user_id,
         "organization_id" => organization_id,
+        "connection_owner" => connection_owner,
         "return_to" => return_to,
-        "config" => config
+        "config" => config,
+        "connection_intent" => connection_intent,
+        "connected_account_id" => connected_account_id
       }.compact
+      body["account_display_name"] = account_display_name unless account_display_name.equal?(WorkOS::OMIT)
       response = @client.request(
         method: :post,
         path: "/data-integrations/#{WorkOS::Util.encode_path(slug)}/authorize",
@@ -242,31 +319,95 @@ module WorkOS
       result
     end
 
+    # Create another client credentials connected account
+    # @param slug [String] The identifier of the integration.
+    # @param account_display_name [String, nil] A mutable, non-unique label. Omit to preserve an existing label; null clears it. Labels are never account identifiers.
+    # @param account_identifier [String, nil] A developer-attested provider account identifier, never inferred from a label or credential. Omit to preserve an existing identifier; null clears it.
+    # @param user_id [String] A [User](https://workos.com/docs/reference/authkit/user) identifier.
+    # @param organization_id [String, nil] An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter to scope the connection to a specific organization. Required when `connection_owner` is `organization`.
+    # @param connection_owner [WorkOS::Types::DataIntegrationsCreateClientCredentialsConnectionRequestConnectionOwner, nil] Whose connection to create or rotate. `user` (the default) addresses the connection owned by `user_id`. `organization` addresses the connection shared by every member of `organization_id`; `user_id` then identifies the member performing the request and must be an active member of the organization.
+    # @param client_id [String] The OAuth client ID to store for this integration.
+    # @param client_secret [String] The OAuth client secret to store for this integration.
+    # @param config [Hash{String => String}, nil] Provider-specific configuration values collected for this installation, keyed by the provider's config field descriptors.
+    # @param connection_intent [String] Must be `add`: this endpoint only creates another connection. The first connection for an owner shape fills the compatibility slot; later connections are standard. Creating an additional connection is not yet available: until it is, `add` succeeds only when the owner has no connection for this integration and otherwise returns 404 `multiple_connections_unavailable`.
+    # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
+    # @return [WorkOS::ConnectedAccountWriteResponse]
+    def create_data_integration_client_credential(
+      slug:,
+      user_id:,
+      client_id:,
+      client_secret:,
+      connection_intent:,
+      account_display_name: WorkOS::OMIT,
+      account_identifier: WorkOS::OMIT,
+      organization_id: nil,
+      connection_owner: nil,
+      config: nil,
+      request_options: {}
+    )
+      body = {
+        "user_id" => user_id,
+        "organization_id" => organization_id,
+        "connection_owner" => connection_owner,
+        "client_id" => client_id,
+        "client_secret" => client_secret,
+        "config" => config,
+        "connection_intent" => connection_intent
+      }.compact
+      body["account_display_name"] = account_display_name unless account_display_name.equal?(WorkOS::OMIT)
+      body["account_identifier"] = account_identifier unless account_identifier.equal?(WorkOS::OMIT)
+      response = @client.request(
+        method: :post,
+        path: "/data-integrations/#{WorkOS::Util.encode_path(slug)}/client-credentials",
+        auth: true,
+        body: body,
+        request_options: request_options
+      )
+      result = WorkOS::ConnectedAccountWriteResponse.new(response.body)
+      result.last_response = WorkOS::Types::ApiResponse.new(http_status: response.code.to_i, http_headers: response.each_header.to_h, request_id: response["x-request-id"])
+      result
+    end
+
     # Upsert client credentials for a connected account
     # @param slug [String] The identifier of the integration.
+    # @param account_display_name [String, nil] A mutable, non-unique label. Omit to preserve an existing label; null clears it. Labels are never account identifiers.
+    # @param account_identifier [String, nil] A developer-attested provider account identifier, never inferred from a label or credential. Omit to preserve an existing identifier; null clears it.
     # @param user_id [String] A [User](https://workos.com/docs/reference/authkit/user) identifier.
-    # @param organization_id [String, nil] An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter to scope the connection to a specific organization.
+    # @param organization_id [String, nil] An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter to scope the connection to a specific organization. Required when `connection_owner` is `organization`.
+    # @param connection_owner [WorkOS::Types::DataIntegrationsUpsertClientCredentialsRequestConnectionOwner, nil] Whose connection to create or rotate. `user` (the default) addresses the connection owned by `user_id`. `organization` addresses the connection shared by every member of `organization_id`; `user_id` then identifies the member performing the request and must be an active member of the organization.
     # @param client_id [String] The OAuth client ID to store for this integration.
     # @param client_secret [String] The OAuth client secret to store for this integration.
     # @param config [Hash{String => String}, nil] Provider-specific configuration values collected for this installation, keyed by the provider's config field descriptors.
+    # @param connection_intent [String, nil] Reauthorize exactly the connection named by `connected_account_id`.
+    # @param connected_account_id [String, nil] The exact connected account to reauthorize. Required with `connection_intent: reauthorize`.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
-    # @return [WorkOS::ConnectedAccount]
+    # @return [WorkOS::ConnectedAccountWriteResponse]
     def update_data_integration_client_credentials(
       slug:,
       user_id:,
       client_id:,
       client_secret:,
+      account_display_name: WorkOS::OMIT,
+      account_identifier: WorkOS::OMIT,
       organization_id: nil,
+      connection_owner: nil,
       config: nil,
+      connection_intent: nil,
+      connected_account_id: nil,
       request_options: {}
     )
       body = {
         "user_id" => user_id,
         "organization_id" => organization_id,
+        "connection_owner" => connection_owner,
         "client_id" => client_id,
         "client_secret" => client_secret,
-        "config" => config
+        "config" => config,
+        "connection_intent" => connection_intent,
+        "connected_account_id" => connected_account_id
       }.compact
+      body["account_display_name"] = account_display_name unless account_display_name.equal?(WorkOS::OMIT)
+      body["account_identifier"] = account_identifier unless account_identifier.equal?(WorkOS::OMIT)
       response = @client.request(
         method: :put,
         path: "/data-integrations/#{WorkOS::Util.encode_path(slug)}/client-credentials",
@@ -274,26 +415,35 @@ module WorkOS
         body: body,
         request_options: request_options
       )
-      result = WorkOS::ConnectedAccount.new(response.body)
+      result = WorkOS::ConnectedAccountWriteResponse.new(response.body)
       result.last_response = WorkOS::Types::ApiResponse.new(http_status: response.code.to_i, http_headers: response.each_header.to_h, request_id: response["x-request-id"])
       result
     end
 
     # Vend credentials for a connected account
     # @param slug [String] The identifier of the integration.
-    # @param user_id [String] A [User](https://workos.com/docs/reference/authkit/user) identifier.
-    # @param organization_id [String, nil] An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter to scope the connection to a specific organization.
+    # @param user_id [String] A [User](https://workos.com/docs/reference/authkit/user) identifier. When `connection_owner` is `organization`, this is the user the credentials are vended on behalf of; they must be an active member of the organization.
+    # @param organization_id [String, nil] An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter to scope the connection to a specific organization. Required when `connection_owner` is `organization`.
+    # @param connected_account_id [String, nil] A [connected account](https://workos.com/docs/reference/pipes/connected-account) identifier. Use this to select a specific connection when the user has several for this provider.
+    # @param connection_owner [WorkOS::Types::DataIntegrationsVendCredentialsRequestConnectionOwner, nil] Which connection to vend from. `user` (the default) vends the user's own connection and requires `user_id`. `organization` vends the organization's shared connection and requires `organization_id`.
+    # @param supports_multiple_connections [Boolean, nil] Set to `true` to use the plural connection contract. If no `connected_account_id` is supplied and several connections match, the request returns `account_selection_required`. When omitted or `false`, only the compatibility connection is considered.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
     # @return [WorkOS::DataIntegrationCredentialsResponse]
     def create_data_integration_credential(
       slug:,
       user_id:,
       organization_id: nil,
+      connected_account_id: nil,
+      connection_owner: nil,
+      supports_multiple_connections: nil,
       request_options: {}
     )
       body = {
         "user_id" => user_id,
-        "organization_id" => organization_id
+        "organization_id" => organization_id,
+        "connected_account_id" => connected_account_id,
+        "connection_owner" => connection_owner,
+        "supports_multiple_connections" => supports_multiple_connections
       }.compact
       response = @client.request(
         method: :post,
@@ -307,21 +457,106 @@ module WorkOS
       result
     end
 
+    # Get an organization-owned data integration
+    # @param slug [String] The slug identifier of the data integration.
+    # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
+    # @return [WorkOS::DataIntegration]
+    def list_data_integration_organization(
+      slug:,
+      request_options: {}
+    )
+      response = @client.request(
+        method: :get,
+        path: "/data-integrations/#{WorkOS::Util.encode_path(slug)}/organization",
+        auth: true,
+        request_options: request_options
+      )
+      result = WorkOS::DataIntegration.new(response.body)
+      result.last_response = WorkOS::Types::ApiResponse.new(http_status: response.code.to_i, http_headers: response.each_header.to_h, request_id: response["x-request-id"])
+      result
+    end
+
+    # Update an organization-owned data integration
+    # @param slug [String] The slug identifier of the data integration.
+    # @param description [String, nil] An optional description of the Data Integration.
+    # @param enabled [Boolean, nil] Whether the Data Integration is enabled.
+    # @param scopes [Array<String>, nil] The OAuth scopes to request for the Data Integration. Pass `null` to reset to the provider's configured scopes.
+    # @param credentials [WorkOS::DataIntegrationCredentialsInput, nil] New OAuth credentials for the Data Integration. When provided, rotates the stored client secret. Mutually exclusive with `api_key`.
+    # @param api_key [WorkOS::ApiKeyInstallation, nil] An API key to install or rotate for a tenant on an `api_key` integration. Upserts the tenant installation identified by `user_id` (and optional `organization_id`).
+    # @param custom_provider [WorkOS::UpdateCustomProviderDefinition, nil] Updates to a custom provider's OAuth definition. Only valid for custom-provider integrations.
+    # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
+    # @return [WorkOS::DataIntegration]
+    def update_data_integration_organization(
+      slug:,
+      description: WorkOS::OMIT,
+      enabled: nil,
+      scopes: WorkOS::OMIT,
+      credentials: nil,
+      api_key: nil,
+      custom_provider: nil,
+      request_options: {}
+    )
+      body = {
+        "enabled" => enabled,
+        "credentials" => credentials,
+        "api_key" => api_key,
+        "custom_provider" => custom_provider
+      }.compact
+      body["description"] = description unless description.equal?(WorkOS::OMIT)
+      body["scopes"] = scopes unless scopes.equal?(WorkOS::OMIT)
+      response = @client.request(
+        method: :put,
+        path: "/data-integrations/#{WorkOS::Util.encode_path(slug)}/organization",
+        auth: true,
+        body: body,
+        request_options: request_options
+      )
+      result = WorkOS::DataIntegration.new(response.body)
+      result.last_response = WorkOS::Types::ApiResponse.new(http_status: response.code.to_i, http_headers: response.each_header.to_h, request_id: response["x-request-id"])
+      result
+    end
+
+    # Delete an organization-owned data integration
+    # @param slug [String] The slug identifier of the data integration.
+    # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
+    # @return [void]
+    def delete_data_integration_organization(
+      slug:,
+      request_options: {}
+    )
+      @client.request(
+        method: :delete,
+        path: "/data-integrations/#{WorkOS::Util.encode_path(slug)}/organization",
+        auth: true,
+        request_options: request_options
+      )
+      nil
+    end
+
     # Get an access token for a connected account
     # @param provider [String] The identifier of the integration.
-    # @param user_id [String] A [User](https://workos.com/docs/reference/authkit/user) identifier.
-    # @param organization_id [String, nil] An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter to scope the connection to a specific organization.
+    # @param user_id [String] A [User](https://workos.com/docs/reference/authkit/user) identifier. When `connection_owner` is `organization`, this is the user the credentials are vended on behalf of; they must be an active member of the organization.
+    # @param organization_id [String, nil] An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter to scope the connection to a specific organization. Required when `connection_owner` is `organization`.
+    # @param connected_account_id [String, nil] A [connected account](https://workos.com/docs/reference/pipes/connected-account) identifier. Use this to select a specific connection when the user has several for this provider.
+    # @param connection_owner [WorkOS::Types::DataIntegrationsGetUserTokenRequestConnectionOwner, nil] Which connection to vend from. `user` (the default) vends the user's own connection and requires `user_id`. `organization` vends the organization's shared connection and requires `organization_id`.
+    # @param supports_multiple_connections [Boolean, nil] Set to `true` to use the plural connection contract. If no `connected_account_id` is supplied and several connections match, the request returns `account_selection_required`. When omitted or `false`, only the compatibility connection is considered.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
     # @return [WorkOS::DataIntegrationAccessTokenResponse]
     def get_access_token(
       provider:,
       user_id:,
       organization_id: WorkOS::OMIT,
+      connected_account_id: nil,
+      connection_owner: nil,
+      supports_multiple_connections: nil,
       request_options: {}
     )
       body = {
-        "user_id" => user_id
-      }
+        "user_id" => user_id,
+        "connected_account_id" => connected_account_id,
+        "connection_owner" => connection_owner,
+        "supports_multiple_connections" => supports_multiple_connections
+      }.compact
       body["organization_id"] = organization_id unless organization_id.equal?(WorkOS::OMIT)
       response = @client.request(
         method: :post,
@@ -335,20 +570,220 @@ module WorkOS
       result
     end
 
+    # Get an organization connected account
+    # @param organization_id [String] An [Organization](https://workos.com/docs/reference/organization) identifier.
+    # @param slug [String] The slug identifier of the provider (e.g., `github`, `slack`, `notion`).
+    # @param supports_multiple_connections [Boolean, nil] Set to `true` to use the plural connection contract. When omitted or `false`, only the compatibility connection is considered.
+    # @param connected_account_id [String, nil] A [connected account](https://workos.com/docs/reference/pipes/connected-account) identifier. Use this to select a specific connection when the organization has several for this provider.
+    # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
+    # @return [WorkOS::ConnectedAccount]
+    def get_organization_connected_account(
+      organization_id:,
+      slug:,
+      supports_multiple_connections: nil,
+      connected_account_id: nil,
+      request_options: {}
+    )
+      params = {
+        "supports_multiple_connections" => supports_multiple_connections,
+        "connected_account_id" => connected_account_id
+      }.compact
+      response = @client.request(
+        method: :get,
+        path: "/organizations/#{WorkOS::Util.encode_path(organization_id)}/connected_accounts/#{WorkOS::Util.encode_path(slug)}",
+        auth: true,
+        params: params,
+        request_options: request_options
+      )
+      result = WorkOS::ConnectedAccount.new(response.body)
+      result.last_response = WorkOS::Types::ApiResponse.new(http_status: response.code.to_i, http_headers: response.each_header.to_h, request_id: response["x-request-id"])
+      result
+    end
+
+    # Import an organization connected account
+    # @param organization_id [String] An [Organization](https://workos.com/docs/reference/organization) identifier.
+    # @param slug [String] The slug identifier of the provider (e.g., `github`, `slack`, `notion`).
+    # @param account_display_name [String, nil] A mutable, non-unique connection label; null clears it. Not an account identifier.
+    # @param account_identifier [String, nil] A developer-attested account identifier; null clears it.
+    # @param access_token [String, nil] The OAuth access token for the connected account.
+    # @param refresh_token [String, nil] The OAuth refresh token for the connected account.
+    # @param expires_at [String, nil] The ISO-8601 timestamp when the access token expires. Required when `access_token` is provided for tokens that expire.
+    # @param scopes [Array<String>, nil] The OAuth scopes granted for this connection.
+    # @param state [WorkOS::Types::CreateOrganizationConnectedAccountState, nil] Explicitly set the state of the connected account. When omitted, the state is derived from the token combination provided.
+    # @param user_id [String] The [User](https://workos.com/docs/reference/authkit/user) identifier of the organization member on whose behalf the connected account is being imported or updated. The user must be an active member of the organization.
+    # @param connection_intent [String, nil] Set to `add` to create another connected account. Omit this field for permanent compatibility behavior. Creating an additional connection is not yet available: until it is, `add` succeeds only when the owner has no connection for this integration, which creates the compatibility connection, and otherwise returns 404 `multiple_connections_unavailable`.
+    # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
+    # @return [WorkOS::ConnectedAccountWriteResponse]
+    def create_organization_connected_account(
+      organization_id:,
+      slug:,
+      user_id:,
+      account_display_name: WorkOS::OMIT,
+      account_identifier: WorkOS::OMIT,
+      access_token: nil,
+      refresh_token: nil,
+      expires_at: nil,
+      scopes: nil,
+      state: nil,
+      connection_intent: nil,
+      request_options: {}
+    )
+      body = {
+        "access_token" => access_token,
+        "refresh_token" => refresh_token,
+        "expires_at" => expires_at,
+        "scopes" => scopes,
+        "state" => state,
+        "user_id" => user_id,
+        "connection_intent" => connection_intent
+      }.compact
+      body["account_display_name"] = account_display_name unless account_display_name.equal?(WorkOS::OMIT)
+      body["account_identifier"] = account_identifier unless account_identifier.equal?(WorkOS::OMIT)
+      response = @client.request(
+        method: :post,
+        path: "/organizations/#{WorkOS::Util.encode_path(organization_id)}/connected_accounts/#{WorkOS::Util.encode_path(slug)}",
+        auth: true,
+        body: body,
+        request_options: request_options
+      )
+      result = WorkOS::ConnectedAccountWriteResponse.new(response.body)
+      result.last_response = WorkOS::Types::ApiResponse.new(http_status: response.code.to_i, http_headers: response.each_header.to_h, request_id: response["x-request-id"])
+      result
+    end
+
+    # Update an organization connected account
+    # @param organization_id [String] An [Organization](https://workos.com/docs/reference/organization) identifier.
+    # @param slug [String] The slug identifier of the provider (e.g., `github`, `slack`, `notion`).
+    # @param account_display_name [String, nil] A mutable, non-unique connection label; null clears it. Not an account identifier.
+    # @param account_identifier [String, nil] A developer-attested account identifier; null clears it.
+    # @param access_token [String, nil] The OAuth access token for the connected account.
+    # @param refresh_token [String, nil] The OAuth refresh token for the connected account.
+    # @param expires_at [String, nil] The ISO-8601 timestamp when the access token expires. Required when `access_token` is provided for tokens that expire.
+    # @param scopes [Array<String>, nil] The OAuth scopes granted for this connection.
+    # @param state [WorkOS::Types::OrganizationConnectedAccountState, nil] Explicitly set the state of the connected account. When omitted, the state is derived from the token combination provided.
+    # @param user_id [String] The [User](https://workos.com/docs/reference/authkit/user) identifier of the organization member on whose behalf the connected account is being imported or updated. The user must be an active member of the organization.
+    # @param supports_multiple_connections [Boolean, nil] Accepted for compatibility; does not change update targeting. Omit intent and selector to update the compatibility connection, or supply `connected_account_id` to update an exact connection.
+    # @param connected_account_id [String, nil] A [connected account](https://workos.com/docs/reference/pipes/connected-account) identifier. Use this to select the connection to update.
+    # @param connection_intent [String, nil] Set to `reauthorize` with `connected_account_id` to update one exact connection. The intent may be omitted when supplying an ID. Omit both for permanent compatibility behavior.
+    # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
+    # @return [WorkOS::ConnectedAccountWriteResponse]
+    def update_organization_connected_account(
+      organization_id:,
+      slug:,
+      user_id:,
+      account_display_name: WorkOS::OMIT,
+      account_identifier: WorkOS::OMIT,
+      access_token: nil,
+      refresh_token: nil,
+      expires_at: nil,
+      scopes: nil,
+      state: nil,
+      supports_multiple_connections: nil,
+      connected_account_id: nil,
+      connection_intent: nil,
+      request_options: {}
+    )
+      params = {
+        "supports_multiple_connections" => supports_multiple_connections,
+        "connected_account_id" => connected_account_id,
+        "connection_intent" => connection_intent
+      }.compact
+      body = {
+        "access_token" => access_token,
+        "refresh_token" => refresh_token,
+        "expires_at" => expires_at,
+        "scopes" => scopes,
+        "state" => state,
+        "user_id" => user_id
+      }.compact
+      body["account_display_name"] = account_display_name unless account_display_name.equal?(WorkOS::OMIT)
+      body["account_identifier"] = account_identifier unless account_identifier.equal?(WorkOS::OMIT)
+      response = @client.request(
+        method: :put,
+        path: "/organizations/#{WorkOS::Util.encode_path(organization_id)}/connected_accounts/#{WorkOS::Util.encode_path(slug)}",
+        auth: true,
+        params: params,
+        body: body,
+        request_options: request_options
+      )
+      result = WorkOS::ConnectedAccountWriteResponse.new(response.body)
+      result.last_response = WorkOS::Types::ApiResponse.new(http_status: response.code.to_i, http_headers: response.each_header.to_h, request_id: response["x-request-id"])
+      result
+    end
+
+    # Delete an organization connected account
+    # @param organization_id [String] An [Organization](https://workos.com/docs/reference/organization) identifier.
+    # @param slug [String] The slug identifier of the provider (e.g., `github`, `slack`, `notion`).
+    # @param supports_multiple_connections [Boolean, nil] Set to `true` to use the plural connection contract. When omitted or `false`, only the compatibility connection is considered.
+    # @param connected_account_id [String, nil] A [connected account](https://workos.com/docs/reference/pipes/connected-account) identifier. Use this to select the connection to delete.
+    # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
+    # @return [void]
+    def delete_organization_connected_account(
+      organization_id:,
+      slug:,
+      supports_multiple_connections: nil,
+      connected_account_id: nil,
+      request_options: {}
+    )
+      params = {
+        "supports_multiple_connections" => supports_multiple_connections,
+        "connected_account_id" => connected_account_id
+      }.compact
+      @client.request(
+        method: :delete,
+        path: "/organizations/#{WorkOS::Util.encode_path(organization_id)}/connected_accounts/#{WorkOS::Util.encode_path(slug)}",
+        auth: true,
+        params: params,
+        request_options: request_options
+      )
+      nil
+    end
+
+    # List providers for an organization
+    # @param organization_id [String] An [Organization](https://workos.com/docs/reference/organization) identifier to list providers and connected accounts for.
+    # @param supports_multiple_connections [Boolean, nil] Set to `true` to use the plural connection contract. When omitted or `false`, only the compatibility connection is considered.
+    # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
+    # @return [WorkOS::DataIntegrationsListResponse]
+    def list_organization_data_providers(
+      organization_id:,
+      supports_multiple_connections: nil,
+      request_options: {}
+    )
+      params = {
+        "supports_multiple_connections" => supports_multiple_connections
+      }.compact
+      response = @client.request(
+        method: :get,
+        path: "/organizations/#{WorkOS::Util.encode_path(organization_id)}/data_providers",
+        auth: true,
+        params: params,
+        request_options: request_options
+      )
+      result = WorkOS::DataIntegrationsListResponse.new(response.body)
+      result.last_response = WorkOS::Types::ApiResponse.new(http_status: response.code.to_i, http_headers: response.each_header.to_h, request_id: response["x-request-id"])
+      result
+    end
+
     # Get a connected account
     # @param user_id [String] A [User](https://workos.com/docs/reference/authkit/user) identifier.
     # @param slug [String] The slug identifier of the provider (e.g., `github`, `slack`, `notion`).
     # @param organization_id [String, nil] An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter if the connection is scoped to an organization.
+    # @param supports_multiple_connections [Boolean, nil] Set to `true` to use the plural connection contract. When omitted or `false`, only the compatibility connection is considered.
+    # @param connected_account_id [String, nil] A [connected account](https://workos.com/docs/reference/pipes/connected-account) identifier. Use this to select a specific connection when the user has several for this provider.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
     # @return [WorkOS::ConnectedAccount]
     def get_user_connected_account(
       user_id:,
       slug:,
       organization_id: nil,
+      supports_multiple_connections: nil,
+      connected_account_id: nil,
       request_options: {}
     )
       params = {
-        "organization_id" => organization_id
+        "organization_id" => organization_id,
+        "supports_multiple_connections" => supports_multiple_connections,
+        "connected_account_id" => connected_account_id
       }.compact
       response = @client.request(
         method: :get,
@@ -365,22 +800,28 @@ module WorkOS
     # Import a connected account
     # @param user_id [String] A [User](https://workos.com/docs/reference/authkit/user) identifier.
     # @param slug [String] The slug identifier of the provider (e.g., `github`, `slack`, `notion`).
+    # @param account_display_name [String, nil] A mutable, non-unique connection label; null clears it. Not an account identifier.
+    # @param account_identifier [String, nil] A developer-attested account identifier; null clears it.
     # @param access_token [String, nil] The OAuth access token for the connected account.
     # @param refresh_token [String, nil] The OAuth refresh token for the connected account.
     # @param expires_at [String, nil] The ISO-8601 timestamp when the access token expires. Required when `access_token` is provided for tokens that expire.
     # @param scopes [Array<String>, nil] The OAuth scopes granted for this connection.
-    # @param state [WorkOS::Types::ConnectedAccountInputState, nil] Explicitly set the state of the connected account. When omitted, the state is derived from the token combination provided.
+    # @param state [WorkOS::Types::CreateConnectedAccountState, nil] Explicitly set the state of the connected account. When omitted, the state is derived from the token combination provided.
+    # @param connection_intent [String, nil] Set to `add` to create another connected account. Omit this field for permanent compatibility behavior. Creating an additional connection is not yet available: until it is, `add` succeeds only when the owner has no connection for this integration, which creates the compatibility connection, and otherwise returns 404 `multiple_connections_unavailable`.
     # @param organization_id [String, nil] An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter if the connection is scoped to an organization.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
-    # @return [WorkOS::ConnectedAccount]
+    # @return [WorkOS::ConnectedAccountWriteResponse]
     def create_user_connected_account(
       user_id:,
       slug:,
+      account_display_name: WorkOS::OMIT,
+      account_identifier: WorkOS::OMIT,
       access_token: nil,
       refresh_token: nil,
       expires_at: nil,
       scopes: nil,
       state: nil,
+      connection_intent: nil,
       organization_id: nil,
       request_options: {}
     )
@@ -392,8 +833,11 @@ module WorkOS
         "refresh_token" => refresh_token,
         "expires_at" => expires_at,
         "scopes" => scopes,
-        "state" => state
+        "state" => state,
+        "connection_intent" => connection_intent
       }.compact
+      body["account_display_name"] = account_display_name unless account_display_name.equal?(WorkOS::OMIT)
+      body["account_identifier"] = account_identifier unless account_identifier.equal?(WorkOS::OMIT)
       response = @client.request(
         method: :post,
         path: "/user_management/users/#{WorkOS::Util.encode_path(user_id)}/connected_accounts/#{WorkOS::Util.encode_path(slug)}",
@@ -402,7 +846,7 @@ module WorkOS
         body: body,
         request_options: request_options
       )
-      result = WorkOS::ConnectedAccount.new(response.body)
+      result = WorkOS::ConnectedAccountWriteResponse.new(response.body)
       result.last_response = WorkOS::Types::ApiResponse.new(http_status: response.code.to_i, http_headers: response.each_header.to_h, request_id: response["x-request-id"])
       result
     end
@@ -410,27 +854,40 @@ module WorkOS
     # Update a connected account
     # @param user_id [String] A [User](https://workos.com/docs/reference/authkit/user) identifier.
     # @param slug [String] The slug identifier of the provider (e.g., `github`, `slack`, `notion`).
+    # @param account_display_name [String, nil] A mutable, non-unique connection label; null clears it. Not an account identifier.
+    # @param account_identifier [String, nil] A developer-attested account identifier; null clears it.
     # @param access_token [String, nil] The OAuth access token for the connected account.
     # @param refresh_token [String, nil] The OAuth refresh token for the connected account.
     # @param expires_at [String, nil] The ISO-8601 timestamp when the access token expires. Required when `access_token` is provided for tokens that expire.
     # @param scopes [Array<String>, nil] The OAuth scopes granted for this connection.
     # @param state [WorkOS::Types::ConnectedAccountInputState, nil] Explicitly set the state of the connected account. When omitted, the state is derived from the token combination provided.
     # @param organization_id [String, nil] An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter if the connection is scoped to an organization.
+    # @param supports_multiple_connections [Boolean, nil] Accepted for compatibility; does not change update targeting. Omit intent and selector to update the compatibility connection, or supply `connected_account_id` to update an exact connection.
+    # @param connected_account_id [String, nil] A [connected account](https://workos.com/docs/reference/pipes/connected-account) identifier. Use this to select the connection to update.
+    # @param connection_intent [String, nil] Set to `reauthorize` with `connected_account_id` to update one exact connection. The intent may be omitted when supplying an ID. Omit both for permanent compatibility behavior.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
-    # @return [WorkOS::ConnectedAccount]
+    # @return [WorkOS::ConnectedAccountWriteResponse]
     def update_user_connected_account(
       user_id:,
       slug:,
+      account_display_name: WorkOS::OMIT,
+      account_identifier: WorkOS::OMIT,
       access_token: nil,
       refresh_token: nil,
       expires_at: nil,
       scopes: nil,
       state: nil,
       organization_id: nil,
+      supports_multiple_connections: nil,
+      connected_account_id: nil,
+      connection_intent: nil,
       request_options: {}
     )
       params = {
-        "organization_id" => organization_id
+        "organization_id" => organization_id,
+        "supports_multiple_connections" => supports_multiple_connections,
+        "connected_account_id" => connected_account_id,
+        "connection_intent" => connection_intent
       }.compact
       body = {
         "access_token" => access_token,
@@ -439,6 +896,8 @@ module WorkOS
         "scopes" => scopes,
         "state" => state
       }.compact
+      body["account_display_name"] = account_display_name unless account_display_name.equal?(WorkOS::OMIT)
+      body["account_identifier"] = account_identifier unless account_identifier.equal?(WorkOS::OMIT)
       response = @client.request(
         method: :put,
         path: "/user_management/users/#{WorkOS::Util.encode_path(user_id)}/connected_accounts/#{WorkOS::Util.encode_path(slug)}",
@@ -447,7 +906,7 @@ module WorkOS
         body: body,
         request_options: request_options
       )
-      result = WorkOS::ConnectedAccount.new(response.body)
+      result = WorkOS::ConnectedAccountWriteResponse.new(response.body)
       result.last_response = WorkOS::Types::ApiResponse.new(http_status: response.code.to_i, http_headers: response.each_header.to_h, request_id: response["x-request-id"])
       result
     end
@@ -456,16 +915,22 @@ module WorkOS
     # @param user_id [String] A [User](https://workos.com/docs/reference/authkit/user) identifier.
     # @param slug [String] The slug identifier of the provider (e.g., `github`, `slack`, `notion`).
     # @param organization_id [String, nil] An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter if the connection is scoped to an organization.
+    # @param supports_multiple_connections [Boolean, nil] Set to `true` to use the plural connection contract. When omitted or `false`, only the compatibility connection is considered.
+    # @param connected_account_id [String, nil] A [connected account](https://workos.com/docs/reference/pipes/connected-account) identifier. Use this to select the connection to delete.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
     # @return [void]
     def delete_user_connected_account(
       user_id:,
       slug:,
       organization_id: nil,
+      supports_multiple_connections: nil,
+      connected_account_id: nil,
       request_options: {}
     )
       params = {
-        "organization_id" => organization_id
+        "organization_id" => organization_id,
+        "supports_multiple_connections" => supports_multiple_connections,
+        "connected_account_id" => connected_account_id
       }.compact
       @client.request(
         method: :delete,
@@ -480,15 +945,18 @@ module WorkOS
     # List providers for a user
     # @param user_id [String] A [User](https://workos.com/docs/reference/authkit/user) identifier to list providers and connected accounts for.
     # @param organization_id [String, nil] An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter to filter connections for a specific organization.
+    # @param supports_multiple_connections [Boolean, nil] Set to `true` to use the plural connection contract. When omitted or `false`, only the compatibility connection is considered.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
     # @return [WorkOS::DataIntegrationsListResponse]
     def list_user_data_providers(
       user_id:,
       organization_id: nil,
+      supports_multiple_connections: nil,
       request_options: {}
     )
       params = {
-        "organization_id" => organization_id
+        "organization_id" => organization_id,
+        "supports_multiple_connections" => supports_multiple_connections
       }.compact
       response = @client.request(
         method: :get,