workos 10.4.0 → 10.6.0

data/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "10.4.0"
+  ".": "10.6.0"
 }

data/.ruby-version

@@ -1 +1 @@
-3.4.10
+3.4.11

data/CHANGELOG.md

@@ -1,5 +1,331 @@
 # Changelog
 
+## [10.6.0](https://github.com/workos/workos-ruby/compare/v10.5.0...v10.6.0) (2026-11-04)
+
+### Bug Fixes
+
+* Send Idempotency-Key on the first POST attempt ([#567](https://github.com/workos/workos-ruby/issues/567)) ([fc5fb6c](https://github.com/workos/workos-ruby/commit/fc5fb6cfab255969203a7285d1308053cb72998e))
+
+* [#572](https://github.com/workos/workos-ruby/pull/572) feat(generated)!: regenerate from spec (5 changes)
+
+  **⚠️ Breaking**
+  * **[groups](https://workos.com/docs/reference/groups)**:
+    * Removed model `ReplaceGroupMemberships`
+    * Removed endpoint `PUT /organizations/{organizationId}/groups/{groupId}/organization-memberships`
+  * **[pipes](https://workos.com/docs/reference/pipes)**:
+    * Removed model `ConnectedAccountWriteResponse`
+    * Removed model `ConnectedAccountWriteResponseWarning`
+    * Removed enum `ConnectedAccountWriteResponseConnectionRole`
+    * Removed enum `ConnectedAccountWriteResponseAuthMethod`
+    * Removed enum `ConnectedAccountWriteResponseState`
+    * Removed model `ReauthorizeDataIntegrationsUpsertApiKeyRequest`
+    * Removed model `DataIntegrationsUpsertApiKeyRequest2`
+    * Removed model `AddDataIntegrationsGetDataIntegrationAuthorizeUrlRequest`
+    * Removed model `ReauthorizeDataIntegrationsGetDataIntegrationAuthorizeUrlRequest`
+    * Removed model `ReauthorizeDataIntegrationsUpsertClientCredentialsRequest`
+    * Removed model `DataIntegrationsUpsertClientCredentialsRequest2`
+    * Removed enum `ReauthorizeDataIntegrationsUpsertApiKeyRequestConnectionOwner`
+    * Removed enum `DataIntegrationsUpsertApiKeyRequest2ConnectionOwner`
+    * Removed enum `AddDataIntegrationsGetDataIntegrationAuthorizeUrlRequestConnectionOwner`
+    * Removed enum `ReauthorizeDataIntegrationsGetDataIntegrationAuthorizeUrlRequestConnectionOwner`
+    * Removed enum `ReauthorizeDataIntegrationsUpsertClientCredentialsRequestConnectionOwner`
+    * Removed enum `DataIntegrationsUpsertClientCredentialsRequest2ConnectionOwner`
+
+  **Features**
+  * **[admin_portal](https://workos.com/docs/reference/admin-portal)**:
+    * Added `action_denied` to `ErrorBodyCode`
+    * Added `group_membership_update_overlap` to `ErrorBodyCode`
+  * **[connect](https://workos.com/docs/reference/workos-connect/standalone)**:
+    * Added `cors_origins` to Connect models
+  * **[events](https://workos.com/docs/reference/events)**:
+    * Changed parameter `Events.list.range_start`
+    * Changed parameter `Events.list.range_end`
+  * **[groups](https://workos.com/docs/reference/groups)**:
+    * Added model `PatchGroupMemberships`
+    * Added endpoint `PATCH /organizations/{organizationId}/groups/{groupId}/organization-memberships`
+    * Added model `ReplaceGroupMemberships`
+    * Added endpoint `PUT /organizations/{organizationId}/groups/{groupId}/organization-memberships`
+  * **[organizations](https://workos.com/docs/reference/organization)**:
+    * Changed errors for endpoint `POST /organizations/{organization_id}/it_contacts/{contact_id}/invite`
+  * **[pipes](https://workos.com/docs/reference/pipes)**:
+    * Added model `DataIntegrationFinishConnectionResponse`
+    * Added model `DataIntegrationsFinishConnectionRequest`
+    * Added model `DataIntegrationsFinishConnectionError400`
+    * Added model `DataIntegrationsFinishConnectionError4002`
+    * Added model `DataIntegrationsFinishConnectionError403`
+    * Added model `DataIntegrationsGetDataIntegrationAuthorizeUrlError4002`
+    * Added `completion` to `DataIntegrationAuthorizeUrlResponse`
+    * Added `code_challenge` to `DataIntegrationsGetDataIntegrationAuthorizeUrlRequest`
+    * Added `code_challenge_method` to `DataIntegrationsGetDataIntegrationAuthorizeUrlRequest`
+    * Added `code` to `DataIntegrationsGetDataIntegrationAuthorizeUrlError400`
+    * Added enum `DataIntegrationsFinishConnectionError400Code`
+    * Added enum `DataIntegrationsGetDataIntegrationAuthorizeUrlError400Code`
+    * Added endpoint `POST /data-integrations/finish`
+    * Added model `ConnectedAccountWarning`
+    * Added model `DataIntegrationsListResponseDataConnectedAccountWarning`
+    * Added `warnings` to `ConnectedAccount`
+    * Added `warnings` to `DataIntegrationsListResponseDataConnectedAccount`
+    * Added `connection_intent` to `DataIntegrationsUpsertApiKeyRequest`
+    * Added `connected_account_id` to `DataIntegrationsUpsertApiKeyRequest`
+    * Added `connection_intent` to `DataIntegrationsGetDataIntegrationAuthorizeUrlRequest`
+    * Added `connected_account_id` to `DataIntegrationsGetDataIntegrationAuthorizeUrlRequest`
+    * Added `connection_intent` to `DataIntegrationsUpsertClientCredentialsRequest`
+    * Added `connected_account_id` to `DataIntegrationsUpsertClientCredentialsRequest`
+    * Added enum `DataIntegrationsGetDataIntegrationAuthorizeUrlRequestConnectionIntent`
+  * **[user_management](https://workos.com/docs/reference/authkit/user)**:
+    * Added model `SendVerificationEmail`
+    * Added `locale` to `CreateMagicCodeAndReturn`
+    * Added `locale` to `CreatePasswordResetToken`
+    * Added `locale` to `SendEmailChange`
+    * Added enum `CreateMagicCodeAndReturnLocale`
+    * Added enum `SendVerificationEmailLocale`
+    * Added enum `CreatePasswordResetTokenLocale`
+    * Added enum `SendEmailChangeLocale`
+  * **[widgets](https://workos.com/docs/reference/widgets)**:
+    * Added `widgets:user-api-keys:manage-self` to `WidgetSessionTokenScopes`
+    * Added `widgets:user-api-keys:manage-all` to `WidgetSessionTokenScopes`
+
+  **Fixes**
+  * **[organizations](https://workos.com/docs/reference/organization)**:
+    * Changed errors for endpoint `POST /organizations/{organization_id}/it_contacts/{contact_id}/invite`
+  * **[pipes](https://workos.com/docs/reference/pipes)**:
+    * Changed the type of `DataIntegrationsGetDataIntegrationAuthorizeUrlError400.message`
+    * Changed errors for endpoint `POST /data-integrations/{slug}/authorize`
+    * Changed response of `Pipes.createApiKeyConnection` from `ConnectedAccountWriteResponse` to `ConnectedAccount`
+    * Changed response of `Pipes.upsertApiKey` from `ConnectedAccountWriteResponse` to `ConnectedAccount`
+    * Changed response of `Pipes.createClientCredentialsConnection` from `ConnectedAccountWriteResponse` to `ConnectedAccount`
+    * Changed response of `Pipes.upsertClientCredentials` from `ConnectedAccountWriteResponse` to `ConnectedAccount`
+    * Changed response of `OrganizationsDataProviders.createOrganizationDataInstallation` from `ConnectedAccountWriteResponse` to `ConnectedAccount`
+    * Changed response of `OrganizationsDataProviders.updateOrganizationDataInstallation` from `ConnectedAccountWriteResponse` to `ConnectedAccount`
+    * Changed response of `UserManagementDataProviders.createUserDataInstallation` from `ConnectedAccountWriteResponse` to `ConnectedAccount`
+    * Changed response of `UserManagementDataProviders.updateUserDataInstallation` from `ConnectedAccountWriteResponse` to `ConnectedAccount`
+    * Changed request body for `Pipes.upsertApiKey`
+    * Changed request body for `Pipes.getDataIntegrationAuthorizeUrl`
+    * Changed request body for `Pipes.upsertClientCredentials`
+  * **[sso](https://workos.com/docs/reference/sso)**:
+    * Changed errors for endpoint `POST /sso/logout/authorize`
+  * **[user_management](https://workos.com/docs/reference/authkit/user)**:
+    * Changed errors for endpoint `POST /user_management/authenticate`
+    * Changed request body for `UserManagementUsers.sendVerificationEmail`
+    * Changed errors for endpoint `POST /user_management/users/{id}/email_verification/send`
+    * Changed errors for endpoint `POST /user_management/invitations`
+    * Changed errors for endpoint `POST /user_management/invitations/{id}/resend`
+    * Changed errors for endpoint `POST /user_management/waitlist_entries/{id}/approve`
+
+## [10.5.0](https://github.com/workos/workos-ruby/compare/v10.4.0...v10.5.0) (2026-10-19)
+
+* [#558](https://github.com/workos/workos-ruby/pull/558) feat(generated): regenerate from spec
+
+  **Features**
+  * **[user_management](https://workos.com/docs/reference/authkit/user)**:
+    * Added model `UserRoleAssignmentSourceGroup`
+    * Added `group` to `UserRoleAssignmentSource`
+
+* [#562](https://github.com/workos/workos-ruby/pull/562) feat(generated)!: regenerate from spec (9 changes)
+
+  **⚠️ Breaking**
+  * **[pipes](https://workos.com/docs/reference/pipes)**:
+    * Removed model `AddDataIntegrationsUpsertApiKeyRequest`
+    * Removed model `AddDataIntegrationsUpsertClientCredentialsRequest`
+    * Removed enum `AddDataIntegrationsUpsertApiKeyRequestConnectionOwner`
+    * Removed enum `AddDataIntegrationsUpsertClientCredentialsRequestConnectionOwner`
+
+  **Features**
+  * **[admin_portal](https://workos.com/docs/reference/admin-portal)**:
+    * Added model `RevokeLink`
+    * Added `external_user_id` to `GenerateLink`
+    * Added endpoint `POST /portal/revoke_link`
+    * Changed errors for endpoint `POST /portal/generate_link`
+  * **[agents](https://workos.com/docs/reference/agents)**:
+    * Added model `AgentBlueprintInvocableAs`
+    * Added model `AgentBlueprintsCreateRequestInvocableAs`
+    * Added model `AgentBlueprintsUpdateRequestInvocableAs`
+    * Added `invocable_as` to `AgentBlueprint`
+    * Added `invocable_as` to `AgentBlueprintsCreateRequest`
+    * Added `invocable_as` to `AgentBlueprintsUpdateRequest`
+    * Added enum `AgentBlueprintInvocableAsInstanceTypes`
+    * Added enum `AgentBlueprintsCreateRequestInvocableAsInstanceTypes`
+    * Added enum `AgentBlueprintsUpdateRequestInvocableAsInstanceTypes`
+  * **[audit_logs](https://workos.com/docs/reference/audit-logs)**:
+    * Changed errors for endpoint `GET /audit_logs/actions`
+    * Changed errors for endpoint `GET /audit_logs/actions/{actionName}/schemas`
+    * Changed errors for endpoint `POST /audit_logs/actions/{actionName}/schemas`
+    * Changed errors for endpoint `POST /audit_logs/events`
+    * Changed errors for endpoint `POST /audit_logs/exports`
+    * Changed errors for endpoint `GET /audit_logs/exports/{auditLogExportId}`
+  * **[authorization](https://workos.com/docs/reference/fga)**:
+    * Changed errors for endpoint `GET /authorization/organization_memberships/{organization_membership_id}/role_assignments`
+    * Changed errors for endpoint `POST /authorization/groups/{group_id}/role_assignments`
+    * Changed errors for endpoint `PUT /authorization/groups/{group_id}/role_assignments`
+    * Changed errors for endpoint `GET /authorization/groups/{group_id}/role_assignments/{role_assignment_id}`
+    * Changed errors for endpoint `POST /authorization/organization_memberships/{organization_membership_id}/check`
+    * Changed errors for endpoint `GET /authorization/organization_memberships/{organization_membership_id}/resources`
+    * Changed errors for endpoint `GET /authorization/organization_memberships/{organization_membership_id}/resources/{resource_id}/permissions`
+    * Changed errors for endpoint `GET /authorization/organization_memberships/{organization_membership_id}/resources/{resource_type_slug}/{external_id}/permissions`
+    * Changed errors for endpoint `POST /authorization/organization_memberships/{organization_membership_id}/role_assignments`
+    * Changed errors for endpoint `GET /authorization/organizations/{organization_id}/resources/{resource_type_slug}/{external_id}`
+    * Changed errors for endpoint `PATCH /authorization/organizations/{organization_id}/resources/{resource_type_slug}/{external_id}`
+    * Changed errors for endpoint `GET /authorization/organizations/{organization_id}/resources/{resource_type_slug}/{external_id}/organization_memberships`
+    * Changed errors for endpoint `GET /authorization/organizations/{organization_id}/resources/{resource_type_slug}/{external_id}/role_assignments`
+    * Changed errors for endpoint `GET /authorization/resources`
+    * Changed errors for endpoint `POST /authorization/resources`
+    * Changed errors for endpoint `GET /authorization/resources/{resource_id}`
+    * Changed errors for endpoint `PATCH /authorization/resources/{resource_id}`
+    * Changed errors for endpoint `GET /authorization/resources/{resource_id}/organization_memberships`
+    * Changed errors for endpoint `GET /authorization/resources/{resource_id}/role_assignments`
+  * **[directory_sync](https://workos.com/docs/reference/directory-sync)**:
+    * Added model `DirectorySyncResponse`
+    * Added model `DirectorySyncRateLimitError`
+    * Added endpoint `POST /directories/{id}/sync`
+  * **[feature_flags](https://workos.com/docs/reference/feature-flags)**:
+    * Changed errors for endpoint `PUT /feature-flags/{slug}/disable`
+    * Changed errors for endpoint `PUT /feature-flags/{slug}/enable`
+  * **[organization_membership](https://workos.com/docs/reference/authkit/organization-membership)**:
+    * Changed errors for endpoint `DELETE /user_management/organization_memberships/{id}`
+  * **[organizations](https://workos.com/docs/reference/organization)**:
+    * Changed errors for endpoint `GET /organizations/{id}/audit_logs_retention`
+    * Changed errors for endpoint `PUT /organizations/{id}/audit_logs_retention`
+    * Changed errors for endpoint `POST /organizations/{organization_id}/it_contacts/{contact_id}/invite`
+  * **[pipes](https://workos.com/docs/reference/pipes)**:
+    * Added `established_by_user_id` to `ConnectedAccountWriteResponse`
+    * Added `state_reason` to `ConnectedAccountWriteResponse`
+    * Added `established_by_user_id` to `ConnectedAccount`
+    * Added `state_reason` to `ConnectedAccount`
+    * Added `established_by_user_id` to `DataIntegrationsListResponseDataConnectedAccount`
+    * Added `state_reason` to `DataIntegrationsListResponseDataConnectedAccount`
+    * Changed idempotency-key contract for endpoint `POST /data-integrations/{slug}/api-key`
+    * Changed idempotency-key contract for endpoint `POST /data-integrations/{slug}/client-credentials`
+    * Changed idempotency-key contract for endpoint `POST /organizations/{organization_id}/connected_accounts/{slug}`
+    * Changed idempotency-key contract for endpoint `POST /user_management/users/{user_id}/connected_accounts/{slug}`
+    * Added model `ConnectedAccountWriteResponse`
+    * Added model `ConnectedAccountWriteResponseWarning`
+    * Added `account_display_name` to `CreateOrganizationConnectedAccount`
+    * Added `account_identifier` to `CreateOrganizationConnectedAccount`
+    * Added `account_display_name` to `OrganizationConnectedAccount`
+    * Added `account_identifier` to `OrganizationConnectedAccount`
+    * Added `account_display_name` to `CreateConnectedAccount`
+    * Added `account_identifier` to `CreateConnectedAccount`
+    * Added `account_display_name` to `ConnectedAccountInput`
+    * Added `account_identifier` to `ConnectedAccountInput`
+    * Added `account_display_name` to `DataIntegrationsCreateApiKeyConnectionRequest`
+    * Added `account_identifier` to `DataIntegrationsCreateApiKeyConnectionRequest`
+    * Added `account_display_name` to `DataIntegrationsUpsertApiKeyRequest`
+    * Added `account_identifier` to `DataIntegrationsUpsertApiKeyRequest`
+    * Added `account_display_name` to `ReauthorizeDataIntegrationsUpsertApiKeyRequest`
+    * Added `account_identifier` to `ReauthorizeDataIntegrationsUpsertApiKeyRequest`
+    * Added `account_display_name` to `DataIntegrationsUpsertApiKeyRequest2`
+    * Added `account_identifier` to `DataIntegrationsUpsertApiKeyRequest2`
+    * Added `account_display_name` to `DataIntegrationsGetDataIntegrationAuthorizeUrlRequest`
+    * Added `account_display_name` to `AddDataIntegrationsGetDataIntegrationAuthorizeUrlRequest`
+    * Added `account_display_name` to `ReauthorizeDataIntegrationsGetDataIntegrationAuthorizeUrlRequest`
+    * Added `account_display_name` to `DataIntegrationsCreateClientCredentialsConnectionRequest`
+    * Added `account_identifier` to `DataIntegrationsCreateClientCredentialsConnectionRequest`
+    * Added `account_display_name` to `DataIntegrationsUpsertClientCredentialsRequest`
+    * Added `account_identifier` to `DataIntegrationsUpsertClientCredentialsRequest`
+    * Added `account_display_name` to `ReauthorizeDataIntegrationsUpsertClientCredentialsRequest`
+    * Added `account_identifier` to `ReauthorizeDataIntegrationsUpsertClientCredentialsRequest`
+    * Added `account_display_name` to `DataIntegrationsUpsertClientCredentialsRequest2`
+    * Added `account_identifier` to `DataIntegrationsUpsertClientCredentialsRequest2`
+    * Added enum `ConnectedAccountWriteResponseConnectionRole`
+    * Added enum `ConnectedAccountWriteResponseAuthMethod`
+    * Added enum `ConnectedAccountWriteResponseState`
+    * Changed errors for endpoint `POST /data-integrations/{slug}/api-key`
+    * Changed errors for endpoint `POST /data-integrations/{slug}/authorize`
+    * Changed errors for endpoint `POST /data-integrations/{slug}/client-credentials`
+    * Added model `AddDataIntegrationsGetDataIntegrationAuthorizeUrlRequest`
+    * Added model `ReauthorizeDataIntegrationsGetDataIntegrationAuthorizeUrlRequest`
+    * Added enum `AddDataIntegrationsGetDataIntegrationAuthorizeUrlRequestConnectionOwner`
+    * Added enum `ReauthorizeDataIntegrationsGetDataIntegrationAuthorizeUrlRequestConnectionOwner`
+    * Added model `DataIntegrationsCreateApiKeyConnectionRequest`
+    * Added model `DataIntegrationsCreateClientCredentialsConnectionRequest`
+    * Added enum `DataIntegrationsCreateApiKeyConnectionRequestConnectionOwner`
+    * Added enum `DataIntegrationsCreateClientCredentialsConnectionRequestConnectionOwner`
+    * Added endpoint `POST /data-integrations/{slug}/api-key`
+    * Added endpoint `POST /data-integrations/{slug}/client-credentials`
+    * Added `config` to `DataIntegrationVendedCredential`
+    * Added model `DataIntegrationVendedCredential`
+    * Added model `CreateOrganizationConnectedAccount`
+    * Added model `CreateConnectedAccount`
+    * Added model `AddDataIntegrationsUpsertApiKeyRequest`
+    * Added model `ReauthorizeDataIntegrationsUpsertApiKeyRequest`
+    * Added model `DataIntegrationsUpsertApiKeyRequest2`
+    * Added model `AddDataIntegrationsUpsertClientCredentialsRequest`
+    * Added model `ReauthorizeDataIntegrationsUpsertClientCredentialsRequest`
+    * Added model `DataIntegrationsUpsertClientCredentialsRequest2`
+    * Added enum `CreateOrganizationConnectedAccountState`
+    * Added enum `CreateConnectedAccountState`
+    * Added enum `AddDataIntegrationsUpsertApiKeyRequestConnectionOwner`
+    * Added enum `ReauthorizeDataIntegrationsUpsertApiKeyRequestConnectionOwner`
+    * Added enum `DataIntegrationsUpsertApiKeyRequest2ConnectionOwner`
+    * Added enum `AddDataIntegrationsUpsertClientCredentialsRequestConnectionOwner`
+    * Added enum `ReauthorizeDataIntegrationsUpsertClientCredentialsRequestConnectionOwner`
+    * Added enum `DataIntegrationsUpsertClientCredentialsRequest2ConnectionOwner`
+    * Added parameter `OrganizationsDataProviders.updateOrganizationDataInstallation.connection_intent`
+    * Added parameter `UserManagementDataProviders.updateUserDataInstallation.connection_intent`
+    * Added model `OrganizationConnectedAccount`
+    * Added enum `OrganizationConnectedAccountState`
+  * **[radar](https://workos.com/docs/reference/radar)**:
+    * Changed errors for endpoint `POST /radar/attempts`
+    * Changed errors for endpoint `PUT /radar/attempts/{id}`
+    * Changed errors for endpoint `POST /radar/lists/{type}/{action}`
+  * **[sso](https://workos.com/docs/reference/sso)**:
+    * Added `code_verifier` to `TokenQuery`
+  * **[user_management](https://workos.com/docs/reference/authkit/user)**:
+    * Changed errors for endpoint `POST /user_management/invitations`
+    * Changed errors for endpoint `POST /user_management/invitations/{id}/resend`
+    * Changed errors for endpoint `POST /user_management/waitlist_entries/{id}/approve`
+    * Changed errors for endpoint `PUT /user_management/users/{id}`
+
+  **Fixes**
+  * **[agents](https://workos.com/docs/reference/agents)**:
+    * Changed errors for endpoint `POST /agents/blueprints/{agent_blueprint_id}/tokens`
+  * **[pipes](https://workos.com/docs/reference/pipes)**:
+    * Changed response of `Pipes.createApiKeyConnection` from `ConnectedAccount` to `ConnectedAccountWriteResponse`
+    * Changed response of `Pipes.upsertApiKey` from `ConnectedAccount` to `ConnectedAccountWriteResponse`
+    * Changed response of `Pipes.createClientCredentialsConnection` from `ConnectedAccount` to `ConnectedAccountWriteResponse`
+    * Changed response of `Pipes.upsertClientCredentials` from `ConnectedAccount` to `ConnectedAccountWriteResponse`
+    * Changed response of `OrganizationsDataProviders.createOrganizationDataInstallation` from `ConnectedAccount` to `ConnectedAccountWriteResponse`
+    * Changed response of `OrganizationsDataProviders.updateOrganizationDataInstallation` from `ConnectedAccount` to `ConnectedAccountWriteResponse`
+    * Changed response of `UserManagementDataProviders.createUserDataInstallation` from `ConnectedAccount` to `ConnectedAccountWriteResponse`
+    * Changed response of `UserManagementDataProviders.updateUserDataInstallation` from `ConnectedAccount` to `ConnectedAccountWriteResponse`
+    * Changed errors for endpoint `POST /organizations/{organization_id}/connected_accounts/{slug}`
+    * Changed errors for endpoint `POST /user_management/users/{user_id}/connected_accounts/{slug}`
+    * Changed errors for endpoint `PUT /data-integrations/{slug}/api-key`
+    * Changed request body for `Pipes.getDataIntegrationAuthorizeUrl`
+    * Changed errors for endpoint `POST /data-integrations/{slug}/authorize`
+    * Changed errors for endpoint `PUT /data-integrations/{slug}/client-credentials`
+    * Changed request body for `Pipes.upsertApiKey`
+    * Changed request body for `Pipes.upsertClientCredentials`
+    * Changed the type of `DataIntegrationCredentialsResponse.credential`
+    * Removed `connected_account_id` from `DataIntegrationsUpsertApiKeyRequest`
+    * Removed `connected_account_id` from `DataIntegrationsUpsertClientCredentialsRequest`
+    * Changed request body of `OrganizationsDataProviders.createOrganizationDataInstallation` from `OrganizationConnectedAccount` to `CreateOrganizationConnectedAccount`
+    * Changed request body of `UserManagementDataProviders.createUserDataInstallation` from `ConnectedAccountInput` to `CreateConnectedAccount`
+    * Changed request body of `OrganizationsDataProviders.createOrganizationDataInstallation` from `ConnectedAccountInput` to `OrganizationConnectedAccount`
+    * Changed request body of `OrganizationsDataProviders.updateOrganizationDataInstallation` from `ConnectedAccountInput` to `OrganizationConnectedAccount`
+    * Changed errors for endpoint `PUT /organizations/{organization_id}/connected_accounts/{slug}`
+  * **[sso](https://workos.com/docs/reference/sso)**:
+    * Changed errors for endpoint `POST /connections`
+    * Changed errors for endpoint `POST /connections/{connectionId}/saml_sp_signing_cert`
+
+* [#565](https://github.com/workos/workos-ruby/pull/565) feat(generated)!: regenerate from spec (3 changes)
+
+  **Features**
+  * **[user_management](https://workos.com/docs/reference/authkit/user)**:
+    * Changed errors for endpoint `POST /user_management/users`
+    * Changed errors for endpoint `POST /user_management/magic_auth`
+
+  **Fixes**
+  * **[user_management](https://workos.com/docs/reference/authkit/user)**:
+    * Changed errors for endpoint `POST /user_management/authenticate`
+
+* [#566](https://github.com/workos/workos-ruby/pull/566) fix(generated): regenerate from spec
+
+  **Features**
+  * **[agents](https://workos.com/docs/reference/agents)**:
+    * Added `revoked_at` to `AgentRegistration`
+    * Added endpoint `POST /agents/registrations/{id}/revoke`
+
 ## [10.4.0](https://github.com/workos/workos-ruby/compare/v10.3.0...v10.4.0) (2026-09-18)
 
 ### Features

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    workos (10.4.0)
+    workos (10.6.0)
       jwt (~> 3.1)
       logger (~> 1.7)
       zeitwerk (~> 2.6)
@@ -153,7 +153,7 @@ CHECKSUMS
   unicode-emoji (4.2.0) sha256=519e69150f75652e40bf736106cfbc8f0f73aa3fb6a65afe62fefa7f80b0f80f
   webmock (3.26.2) sha256=774556f2ea6371846cca68c01769b2eac0d134492d21f6d0ab5dd643965a4c90
   webrick (1.9.2) sha256=beb4a15fc474defed24a3bda4ffd88a490d517c9e4e6118c3edce59e45864131
-  workos (10.4.0)
+  workos (10.6.0)
   yard (0.9.45) sha256=52e211493f7cb8a3ebf7e104a25a1e73937a3103092545d34cb88fafebb3dc51
   yard-markdown (0.9.1) sha256=51adf55a814172f70ed81fbd1af4dc42c0e1a698915f7da33eff5a3bb527062d
   zeitwerk (2.7.5) sha256=d8da92128c09ea6ec62c949011b00ed4a20242b255293dd66bf41545398f73dd

data/README.md

@@ -100,10 +100,10 @@ organization = WorkOS.client.organizations.get_organization(
 )
 ```
 
-`Idempotency-Key` is only sent on `POST`, `PUT`, and `PATCH` requests — either when you provide `request_options[:idempotency_key]`, or auto-generated when the SDK retries one of those requests after a transient failure. It is never attached to `GET` or `DELETE` requests.
+`Idempotency-Key` is only sent on `POST`, `PUT`, and `PATCH` requests, and never on `GET` or `DELETE`. Every `POST` carries one: the key you provide in `request_options[:idempotency_key]`, or one the SDK generates before the first attempt and reuses on every retry. `PUT` and `PATCH` requests carry one when you provide it, or when the SDK retries them after a transient failure.
 
 > [!NOTE]
-> The WorkOS API currently honors `Idempotency-Key` only on the [Create Audit Log Event](https://workos.com/docs/reference/audit-logs/event) endpoint (`audit_logs.create_event`). Other endpoints accept the header but do not deduplicate requests, so a retried mutation elsewhere can still create a duplicate.
+> The WorkOS API currently honors `Idempotency-Key` only on the [Create Audit Log Event](https://workos.com/docs/reference/audit-logs/event) endpoint (`audit_logs.create_event`) and on Pipes explicit adds (`pipes.create_data_integration_api_key`, `pipes.create_data_integration_client_credential`, and `pipes.create_user_connected_account` / `pipes.create_organization_connected_account` with `connection_intent: "add"`). Other endpoints accept the header but do not deduplicate requests, so a retried mutation elsewhere can still create a duplicate.
 
 ## Usage Examples
 

data/lib/workos/admin_portal/generate_link.rb

@@ -8,6 +8,7 @@ module WorkOS
       return_url: :return_url,
       success_url: :success_url,
       organization: :organization,
+      external_user_id: :external_user_id,
       intent: :intent,
       it_contact_emails: :it_contact_emails
     }.freeze
@@ -16,6 +17,7 @@ module WorkOS
       :return_url,
       :success_url,
       :organization,
+      :external_user_id,
       :intent,
       :it_contact_emails
 
@@ -24,6 +26,7 @@ module WorkOS
       @return_url = hash[:return_url]
       @success_url = hash[:success_url]
       @organization = hash[:organization]
+      @external_user_id = hash[:external_user_id]
       @intent = hash[:intent]
       @it_contact_emails = hash[:it_contact_emails] || []
     end

data/lib/workos/admin_portal/revoke_link.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  class RevokeLink < WorkOS::Types::BaseModel
+    HASH_ATTRS = {
+      organization: :organization,
+      external_user_id: :external_user_id
+    }.freeze
+
+    attr_accessor \
+      :organization,
+      :external_user_id
+
+    def initialize(json)
+      hash = self.class.normalize(json)
+      @organization = hash[:organization]
+      @external_user_id = hash[:external_user_id]
+    end
+  end
+end

data/lib/workos/admin_portal.rb

@@ -14,6 +14,7 @@ module WorkOS
     # @param return_url [String, nil] The URL to go to when an admin clicks on your logo in the Admin Portal. If not specified, the return URL configured on the [Admin Portal](https://dashboard.workos.com/admin-portal) page will be used.
     # @param success_url [String, nil] The URL to redirect the admin to when they finish setup. If not specified, the success URL configured on the [Admin Portal](https://dashboard.workos.com/admin-portal) page will be used.
     # @param organization [String] An [Organization](https://workos.com/docs/reference/organization) identifier.
+    # @param external_user_id [String, nil] The ID of the user in your application the link is generated for. The link and any Admin Portal sessions started from it can later be revoked by this ID, for example when that user is deprovisioned from your application.
     # @param intent [WorkOS::Types::GenerateLinkIntent, nil] The intent of the Admin Portal. - `sso` - Launch Admin Portal for creating SSO connections - `dsync` - Launch Admin Portal for creating Directory Sync connections - `audit_logs` - Launch Admin Portal for viewing Audit Logs - `log_streams` - Launch Admin Portal for creating Log Streams - `domain_verification` - Launch Admin Portal for Domain Verification - `certificate_renewal` - Launch Admin Portal for renewing SAML Certificates - `bring_your_own_key` - Launch Admin Portal for configuring Bring Your Own Key
     # @param it_contact_emails [Array<String>, nil] The email addresses of the IT contacts to grant access to the Admin Portal for the given organization. Accepts up to 20 emails.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
@@ -22,6 +23,7 @@ module WorkOS
       organization:,
       return_url: nil,
       success_url: nil,
+      external_user_id: nil,
       intent: nil,
       it_contact_emails: nil,
       request_options: {}
@@ -30,6 +32,7 @@ module WorkOS
         "return_url" => return_url,
         "success_url" => success_url,
         "organization" => organization,
+        "external_user_id" => external_user_id,
         "intent" => intent,
         "it_contact_emails" => it_contact_emails
       }.compact
@@ -44,5 +47,29 @@ module WorkOS
       result.last_response = WorkOS::Types::ApiResponse.new(http_status: response.code.to_i, http_headers: response.each_header.to_h, request_id: response["x-request-id"])
       result
     end
+
+    # Revoke a Portal Link
+    # @param organization [String] An [Organization](https://workos.com/docs/reference/organization) identifier.
+    # @param external_user_id [String] The `external_user_id` the Portal Links were generated with for this organization. Every matching link is revoked, along with any Admin Portal sessions started from those links.
+    # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
+    # @return [void]
+    def revoke_link(
+      organization:,
+      external_user_id:,
+      request_options: {}
+    )
+      body = {
+        "organization" => organization,
+        "external_user_id" => external_user_id
+      }
+      @client.request(
+        method: :post,
+        path: "/portal/revoke_link",
+        auth: true,
+        body: body,
+        request_options: request_options
+      )
+      nil
+    end
   end
 end

data/lib/workos/agents/agent_blueprint.rb

@@ -11,6 +11,7 @@ module WorkOS
       description: :description,
       permissions: :permissions,
       invocable_by: :invocable_by,
+      invocable_as: :invocable_as,
       session_settings: :session_settings,
       created_at: :created_at,
       updated_at: :updated_at
@@ -23,6 +24,7 @@ module WorkOS
       :description,
       :permissions,
       :invocable_by,
+      :invocable_as,
       :session_settings,
       :created_at,
       :updated_at
@@ -35,6 +37,7 @@ module WorkOS
       @description = hash[:description]
       @permissions = hash[:permissions] || []
       @invocable_by = hash[:invocable_by] ? WorkOS::AgentBlueprintInvocableBy.new(hash[:invocable_by]) : nil
+      @invocable_as = hash[:invocable_as] ? WorkOS::AgentBlueprintInvocableAs.new(hash[:invocable_as]) : nil
       @session_settings = hash[:session_settings] ? WorkOS::AgentBlueprintSessionSetting.new(hash[:session_settings]) : nil
       @created_at = hash[:created_at]
       @updated_at = hash[:updated_at]

data/lib/workos/agents/agent_blueprint_invocable_as.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  class AgentBlueprintInvocableAs < WorkOS::Types::BaseModel
+    HASH_ATTRS = {
+      instance_types: :instance_types
+    }.freeze
+
+    attr_accessor :instance_types
+
+    def initialize(json)
+      hash = self.class.normalize(json)
+      @instance_types = hash[:instance_types] || []
+    end
+  end
+end

data/lib/workos/agents/agent_blueprints_create_request.rb

@@ -9,6 +9,7 @@ module WorkOS
       description: :description,
       permissions: :permissions,
       invocable_by: :invocable_by,
+      invocable_as: :invocable_as,
       session_settings: :session_settings
     }.freeze
 
@@ -17,6 +18,7 @@ module WorkOS
       :description,
       :permissions,
       :invocable_by,
+      :invocable_as,
       :session_settings
 
     def initialize(json)
@@ -25,6 +27,7 @@ module WorkOS
       @description = hash[:description]
       @permissions = hash[:permissions] || []
       @invocable_by = hash[:invocable_by] ? WorkOS::AgentBlueprintsCreateRequestInvocableBy.new(hash[:invocable_by]) : nil
+      @invocable_as = hash[:invocable_as] ? WorkOS::AgentBlueprintsCreateRequestInvocableAs.new(hash[:invocable_as]) : nil
       @session_settings = hash[:session_settings] ? WorkOS::AgentBlueprintsCreateRequestSessionSetting.new(hash[:session_settings]) : nil
     end
   end

data/lib/workos/agents/agent_blueprints_create_request_invocable_as.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  class AgentBlueprintsCreateRequestInvocableAs < WorkOS::Types::BaseModel
+    HASH_ATTRS = {
+      instance_types: :instance_types
+    }.freeze
+
+    attr_accessor :instance_types
+
+    def initialize(json)
+      hash = self.class.normalize(json)
+      @instance_types = hash[:instance_types] || []
+    end
+  end
+end

data/lib/workos/agents/agent_blueprints_update_request.rb

@@ -9,6 +9,7 @@ module WorkOS
       description: :description,
       permissions: :permissions,
       invocable_by: :invocable_by,
+      invocable_as: :invocable_as,
       session_settings: :session_settings
     }.freeze
 
@@ -17,6 +18,7 @@ module WorkOS
       :description,
       :permissions,
       :invocable_by,
+      :invocable_as,
       :session_settings
 
     def initialize(json)
@@ -25,6 +27,7 @@ module WorkOS
       @description = hash[:description]
       @permissions = hash[:permissions] || []
       @invocable_by = hash[:invocable_by] ? WorkOS::AgentBlueprintsUpdateRequestInvocableBy.new(hash[:invocable_by]) : nil
+      @invocable_as = hash[:invocable_as] ? WorkOS::AgentBlueprintsUpdateRequestInvocableAs.new(hash[:invocable_as]) : nil
       @session_settings = hash[:session_settings] ? WorkOS::AgentBlueprintsUpdateRequestSessionSetting.new(hash[:session_settings]) : nil
     end
   end

data/lib/workos/agents/agent_blueprints_update_request_invocable_as.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  class AgentBlueprintsUpdateRequestInvocableAs < WorkOS::Types::BaseModel
+    HASH_ATTRS = {
+      instance_types: :instance_types
+    }.freeze
+
+    attr_accessor :instance_types
+
+    def initialize(json)
+      hash = self.class.normalize(json)
+      @instance_types = hash[:instance_types] || []
+    end
+  end
+end

data/lib/workos/agents/agent_registration.rb

@@ -9,6 +9,7 @@ module WorkOS
       agent_identity: :agent_identity,
       organization_id: :organization_id,
       status: :status,
+      revoked_at: :revoked_at,
       kind: :kind,
       claim: :claim,
       created_at: :created_at,
@@ -20,6 +21,7 @@ module WorkOS
       :agent_identity,
       :organization_id,
       :status,
+      :revoked_at,
       :kind,
       :claim,
       :created_at,
@@ -31,6 +33,7 @@ module WorkOS
       @agent_identity = hash[:agent_identity] ? WorkOS::AgentRegistrationAgentIdentity.new(hash[:agent_identity]) : nil
       @organization_id = hash[:organization_id]
       @status = hash[:status]
+      @revoked_at = hash[:revoked_at]
       @kind = hash[:kind]
       @claim = hash[:claim] ? WorkOS::AgentRegistrationClaim.new(hash[:claim]) : nil
       @created_at = hash[:created_at]