workos 10.4.0 → 10.6.0

data/lib/workos/pipes.rb

@@ -108,6 +108,35 @@ module WorkOS
       result
     end
 
+    # Finish connection
+    # @param connect_code [String] The `connect_code` WorkOS added to `return_to` when the user finished authorizing. It can be used once and expires 90 seconds after the redirect.
+    # @param code_verifier [String] The code verifier `code_challenge` was derived from: 43 to 128 characters from `A-Z`, `a-z`, `0-9`, `-`, `.`, `_` and `~`. A wrong verifier uses up the `connect_code`, and the user has to connect again.
+    # @param state [String, nil] The `state` WorkOS added to `return_to` alongside `connect_code`. Optional; it is only used to correlate the request in logs.
+    # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
+    # @return [WorkOS::DataIntegrationFinishConnectionResponse]
+    def finish_connection(
+      connect_code:,
+      code_verifier:,
+      state: nil,
+      request_options: {}
+    )
+      body = {
+        "connect_code" => connect_code,
+        "code_verifier" => code_verifier,
+        "state" => state
+      }.compact
+      response = @client.request(
+        method: :post,
+        path: "/data-integrations/finish",
+        auth: true,
+        body: body,
+        request_options: request_options
+      )
+      result = WorkOS::DataIntegrationFinishConnectionResponse.new(response.body)
+      result.last_response = WorkOS::Types::ApiResponse.new(http_status: response.code.to_i, http_headers: response.each_header.to_h, request_id: response["x-request-id"])
+      result
+    end
+
     # Get a data integration
     # @param slug [String] The slug identifier of the data integration.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
@@ -184,31 +213,83 @@ module WorkOS
       nil
     end
 
+    # Create another API key connected account
+    # @param slug [String] The identifier of the integration.
+    # @param account_display_name [String, nil] A mutable, non-unique label. Omit to preserve an existing label; null clears it. Labels are never account identifiers.
+    # @param account_identifier [String, nil] A developer-attested provider account identifier, never inferred from a label or credential. Omit to preserve an existing identifier; null clears it.
+    # @param user_id [String] A [User](https://workos.com/docs/reference/authkit/user) identifier.
+    # @param organization_id [String, nil] An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter to scope the connection to a specific organization. Required when `connection_owner` is `organization`.
+    # @param connection_owner [WorkOS::Types::DataIntegrationsCreateApiKeyConnectionRequestConnectionOwner, nil] Whose connection to create or rotate. `user` (the default) addresses the connection owned by `user_id`. `organization` addresses the connection shared by every member of `organization_id`; `user_id` then identifies the member performing the request and must be an active member of the organization.
+    # @param secret [String] The API key secret to store for this integration.
+    # @param connection_intent [String] Must be `add`: this endpoint only creates another connection. The first connection for an owner shape fills the compatibility slot; later connections are standard.
+    # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
+    # @return [WorkOS::ConnectedAccount]
+    def create_data_integration_api_key(
+      slug:,
+      user_id:,
+      secret:,
+      connection_intent:,
+      account_display_name: WorkOS::OMIT,
+      account_identifier: WorkOS::OMIT,
+      organization_id: nil,
+      connection_owner: nil,
+      request_options: {}
+    )
+      body = {
+        "user_id" => user_id,
+        "organization_id" => organization_id,
+        "connection_owner" => connection_owner,
+        "secret" => secret,
+        "connection_intent" => connection_intent
+      }.compact
+      body["account_display_name"] = account_display_name unless account_display_name.equal?(WorkOS::OMIT)
+      body["account_identifier"] = account_identifier unless account_identifier.equal?(WorkOS::OMIT)
+      response = @client.request(
+        method: :post,
+        path: "/data-integrations/#{WorkOS::Util.encode_path(slug)}/api-key",
+        auth: true,
+        body: body,
+        request_options: request_options
+      )
+      result = WorkOS::ConnectedAccount.new(response.body)
+      result.last_response = WorkOS::Types::ApiResponse.new(http_status: response.code.to_i, http_headers: response.each_header.to_h, request_id: response["x-request-id"])
+      result
+    end
+
     # Upsert an API key for a connected account
     # @param slug [String] The identifier of the integration.
+    # @param account_display_name [String, nil] A mutable, non-unique label. Omit to preserve an existing label; null clears it. Labels are never account identifiers.
+    # @param account_identifier [String, nil] A developer-attested provider account identifier, never inferred from a label or credential. Omit to preserve an existing identifier; null clears it.
     # @param user_id [String] A [User](https://workos.com/docs/reference/authkit/user) identifier.
     # @param organization_id [String, nil] An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter to scope the connection to a specific organization. Required when `connection_owner` is `organization`.
-    # @param connected_account_id [String, nil] A [connected account](https://workos.com/docs/reference/pipes/connected-account) identifier. Use this to rotate a specific existing connection.
     # @param connection_owner [WorkOS::Types::DataIntegrationsUpsertApiKeyRequestConnectionOwner, nil] Whose connection to create or rotate. `user` (the default) addresses the connection owned by `user_id`. `organization` addresses the connection shared by every member of `organization_id`; `user_id` then identifies the member performing the request and must be an active member of the organization.
     # @param secret [String] The API key secret to store for this integration.
+    # @param connection_intent [String, nil] Send `reauthorize` with `connected_account_id` to reauthorize one exact connection. Omit it to use the compatibility connection; creating another connection lives on the POST route.
+    # @param connected_account_id [String, nil] The exact connected account to reauthorize. Required with `connection_intent: reauthorize`; it may also be sent on its own to reauthorize that connection.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
     # @return [WorkOS::ConnectedAccount]
     def update_data_integration_api_key(
       slug:,
       user_id:,
       secret:,
+      account_display_name: WorkOS::OMIT,
+      account_identifier: WorkOS::OMIT,
       organization_id: nil,
-      connected_account_id: nil,
       connection_owner: nil,
+      connection_intent: nil,
+      connected_account_id: nil,
       request_options: {}
     )
       body = {
         "user_id" => user_id,
         "organization_id" => organization_id,
-        "connected_account_id" => connected_account_id,
         "connection_owner" => connection_owner,
-        "secret" => secret
+        "secret" => secret,
+        "connection_intent" => connection_intent,
+        "connected_account_id" => connected_account_id
       }.compact
+      body["account_display_name"] = account_display_name unless account_display_name.equal?(WorkOS::OMIT)
+      body["account_identifier"] = account_identifier unless account_identifier.equal?(WorkOS::OMIT)
       response = @client.request(
         method: :put,
         path: "/data-integrations/#{WorkOS::Util.encode_path(slug)}/api-key",
@@ -223,20 +304,30 @@ module WorkOS
 
     # Get authorization URL
     # @param slug [String] The slug identifier of the provider (e.g., `github`, `slack`, `notion`).
+    # @param account_display_name [String, nil] A mutable, non-unique label. Omit to preserve an existing label; null clears it. Labels are never account identifiers.
     # @param user_id [String] The ID of the user to authorize. When `connection_owner` is `organization`, this is the user authorizing on behalf of the organization; they must be an active member of the organization and do not become the owner of the resulting connected account.
     # @param organization_id [String, nil] An organization ID to scope the authorization to a specific organization. Required when `connection_owner` is `organization`.
     # @param connection_owner [WorkOS::Types::DataIntegrationsGetDataIntegrationAuthorizeUrlRequestConnectionOwner, nil] Who will own the connected account. `user` (the default) connects the user's own account. `organization` connects the organization's shared account and requires `organization_id`.
-    # @param return_to [String, nil] The URL to redirect the user to after authorization.
+    # @param return_to [String, nil] The URL to redirect the user to after authorization. Required with `code_challenge`, and must then exactly match a redirect URI registered on one of the environment's applications. Loopback URLs match on any port; wildcard redirect URIs are not honored, and a `return_to` with a query string or fragment never matches.
+    # @param code_challenge [String, nil] A PKCE-style code challenge: the base64url-encoded SHA-256 of a `code_verifier` your app keeps. When set, the connection isn't saved when the user finishes authorizing. Instead, the user is redirected to `return_to` with a `connect_code` and `state`, and your app must call [Finish connection](https://workos.com/docs/reference/pipes/connected-account/finish-connection) with the `connect_code` and `code_verifier` within 90 seconds to save it.
+    # @param code_challenge_method [String, nil] The method used to derive `code_challenge`. Only `S256` is supported, and it is the default. Requires `code_challenge`.
     # @param config [Hash{String => String}, nil] Connect-time config values for the provider-declared `installation`-scope fields (e.g. a Zendesk `subdomain`), keyed by the config field. Only fields the provider declares may be supplied, and required fields must be provided unless already pinned on the integration.
+    # @param connection_intent [WorkOS::Types::DataIntegrationsGetDataIntegrationAuthorizeUrlRequestConnectionIntent, nil] Which connection the request targets. Omit it to use the compatibility connection. Send `add` to create another connection: the first connection for an owner shape fills the compatibility slot, and later connections are standard. Send `reauthorize` with `connected_account_id` to reauthorize one exact connection.
+    # @param connected_account_id [String, nil] The exact connected account to reauthorize. Required with `connection_intent: reauthorize` and not accepted otherwise.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
     # @return [WorkOS::DataIntegrationAuthorizeUrlResponse]
     def authorize_data_integration(
       slug:,
       user_id:,
+      account_display_name: WorkOS::OMIT,
       organization_id: nil,
       connection_owner: nil,
       return_to: nil,
+      code_challenge: nil,
+      code_challenge_method: nil,
       config: nil,
+      connection_intent: nil,
+      connected_account_id: nil,
       request_options: {}
     )
       body = {
@@ -244,8 +335,13 @@ module WorkOS
         "organization_id" => organization_id,
         "connection_owner" => connection_owner,
         "return_to" => return_to,
-        "config" => config
+        "code_challenge" => code_challenge,
+        "code_challenge_method" => code_challenge_method,
+        "config" => config,
+        "connection_intent" => connection_intent,
+        "connected_account_id" => connected_account_id
       }.compact
+      body["account_display_name"] = account_display_name unless account_display_name.equal?(WorkOS::OMIT)
       response = @client.request(
         method: :post,
         path: "/data-integrations/#{WorkOS::Util.encode_path(slug)}/authorize",
@@ -258,15 +354,67 @@ module WorkOS
       result
     end
 
+    # Create another client credentials connected account
+    # @param slug [String] The identifier of the integration.
+    # @param account_display_name [String, nil] A mutable, non-unique label. Omit to preserve an existing label; null clears it. Labels are never account identifiers.
+    # @param account_identifier [String, nil] A developer-attested provider account identifier, never inferred from a label or credential. Omit to preserve an existing identifier; null clears it.
+    # @param user_id [String] A [User](https://workos.com/docs/reference/authkit/user) identifier.
+    # @param organization_id [String, nil] An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter to scope the connection to a specific organization. Required when `connection_owner` is `organization`.
+    # @param connection_owner [WorkOS::Types::DataIntegrationsCreateClientCredentialsConnectionRequestConnectionOwner, nil] Whose connection to create or rotate. `user` (the default) addresses the connection owned by `user_id`. `organization` addresses the connection shared by every member of `organization_id`; `user_id` then identifies the member performing the request and must be an active member of the organization.
+    # @param client_id [String] The OAuth client ID to store for this integration.
+    # @param client_secret [String] The OAuth client secret to store for this integration.
+    # @param config [Hash{String => String}, nil] Provider-specific configuration values collected for this installation, keyed by the provider's config field descriptors.
+    # @param connection_intent [String] Must be `add`: this endpoint only creates another connection. The first connection for an owner shape fills the compatibility slot; later connections are standard.
+    # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
+    # @return [WorkOS::ConnectedAccount]
+    def create_data_integration_client_credential(
+      slug:,
+      user_id:,
+      client_id:,
+      client_secret:,
+      connection_intent:,
+      account_display_name: WorkOS::OMIT,
+      account_identifier: WorkOS::OMIT,
+      organization_id: nil,
+      connection_owner: nil,
+      config: nil,
+      request_options: {}
+    )
+      body = {
+        "user_id" => user_id,
+        "organization_id" => organization_id,
+        "connection_owner" => connection_owner,
+        "client_id" => client_id,
+        "client_secret" => client_secret,
+        "config" => config,
+        "connection_intent" => connection_intent
+      }.compact
+      body["account_display_name"] = account_display_name unless account_display_name.equal?(WorkOS::OMIT)
+      body["account_identifier"] = account_identifier unless account_identifier.equal?(WorkOS::OMIT)
+      response = @client.request(
+        method: :post,
+        path: "/data-integrations/#{WorkOS::Util.encode_path(slug)}/client-credentials",
+        auth: true,
+        body: body,
+        request_options: request_options
+      )
+      result = WorkOS::ConnectedAccount.new(response.body)
+      result.last_response = WorkOS::Types::ApiResponse.new(http_status: response.code.to_i, http_headers: response.each_header.to_h, request_id: response["x-request-id"])
+      result
+    end
+
     # Upsert client credentials for a connected account
     # @param slug [String] The identifier of the integration.
+    # @param account_display_name [String, nil] A mutable, non-unique label. Omit to preserve an existing label; null clears it. Labels are never account identifiers.
+    # @param account_identifier [String, nil] A developer-attested provider account identifier, never inferred from a label or credential. Omit to preserve an existing identifier; null clears it.
     # @param user_id [String] A [User](https://workos.com/docs/reference/authkit/user) identifier.
     # @param organization_id [String, nil] An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter to scope the connection to a specific organization. Required when `connection_owner` is `organization`.
-    # @param connected_account_id [String, nil] A [connected account](https://workos.com/docs/reference/pipes/connected-account) identifier. Use this to rotate a specific existing connection.
     # @param connection_owner [WorkOS::Types::DataIntegrationsUpsertClientCredentialsRequestConnectionOwner, nil] Whose connection to create or rotate. `user` (the default) addresses the connection owned by `user_id`. `organization` addresses the connection shared by every member of `organization_id`; `user_id` then identifies the member performing the request and must be an active member of the organization.
     # @param client_id [String] The OAuth client ID to store for this integration.
     # @param client_secret [String] The OAuth client secret to store for this integration.
     # @param config [Hash{String => String}, nil] Provider-specific configuration values collected for this installation, keyed by the provider's config field descriptors.
+    # @param connection_intent [String, nil] Send `reauthorize` with `connected_account_id` to reauthorize one exact connection. Omit it to use the compatibility connection; creating another connection lives on the POST route.
+    # @param connected_account_id [String, nil] The exact connected account to reauthorize. Required with `connection_intent: reauthorize`; it may also be sent on its own to reauthorize that connection.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
     # @return [WorkOS::ConnectedAccount]
     def update_data_integration_client_credentials(
@@ -274,21 +422,27 @@ module WorkOS
       user_id:,
       client_id:,
       client_secret:,
+      account_display_name: WorkOS::OMIT,
+      account_identifier: WorkOS::OMIT,
       organization_id: nil,
-      connected_account_id: nil,
       connection_owner: nil,
       config: nil,
+      connection_intent: nil,
+      connected_account_id: nil,
       request_options: {}
     )
       body = {
         "user_id" => user_id,
         "organization_id" => organization_id,
-        "connected_account_id" => connected_account_id,
         "connection_owner" => connection_owner,
         "client_id" => client_id,
         "client_secret" => client_secret,
-        "config" => config
+        "config" => config,
+        "connection_intent" => connection_intent,
+        "connected_account_id" => connected_account_id
       }.compact
+      body["account_display_name"] = account_display_name unless account_display_name.equal?(WorkOS::OMIT)
+      body["account_identifier"] = account_identifier unless account_identifier.equal?(WorkOS::OMIT)
       response = @client.request(
         method: :put,
         path: "/data-integrations/#{WorkOS::Util.encode_path(slug)}/client-credentials",
@@ -484,21 +638,29 @@ module WorkOS
     # Import an organization connected account
     # @param organization_id [String] An [Organization](https://workos.com/docs/reference/organization) identifier.
     # @param slug [String] The slug identifier of the provider (e.g., `github`, `slack`, `notion`).
+    # @param account_display_name [String, nil] A mutable, non-unique connection label; null clears it. Not an account identifier.
+    # @param account_identifier [String, nil] A developer-attested account identifier; null clears it.
     # @param access_token [String, nil] The OAuth access token for the connected account.
     # @param refresh_token [String, nil] The OAuth refresh token for the connected account.
     # @param expires_at [String, nil] The ISO-8601 timestamp when the access token expires. Required when `access_token` is provided for tokens that expire.
     # @param scopes [Array<String>, nil] The OAuth scopes granted for this connection.
-    # @param state [WorkOS::Types::ConnectedAccountInputState, nil] Explicitly set the state of the connected account. When omitted, the state is derived from the token combination provided.
+    # @param state [WorkOS::Types::CreateOrganizationConnectedAccountState, nil] Explicitly set the state of the connected account. When omitted, the state is derived from the token combination provided.
+    # @param user_id [String] The [User](https://workos.com/docs/reference/authkit/user) identifier of the organization member on whose behalf the connected account is being imported or updated. The user must be an active member of the organization.
+    # @param connection_intent [String, nil] Set to `add` to create another connected account. Omit this field for permanent compatibility behavior.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
     # @return [WorkOS::ConnectedAccount]
     def create_organization_connected_account(
       organization_id:,
       slug:,
+      user_id:,
+      account_display_name: WorkOS::OMIT,
+      account_identifier: WorkOS::OMIT,
       access_token: nil,
       refresh_token: nil,
       expires_at: nil,
       scopes: nil,
       state: nil,
+      connection_intent: nil,
       request_options: {}
     )
       body = {
@@ -506,8 +668,12 @@ module WorkOS
         "refresh_token" => refresh_token,
         "expires_at" => expires_at,
         "scopes" => scopes,
-        "state" => state
+        "state" => state,
+        "user_id" => user_id,
+        "connection_intent" => connection_intent
       }.compact
+      body["account_display_name"] = account_display_name unless account_display_name.equal?(WorkOS::OMIT)
+      body["account_identifier"] = account_identifier unless account_identifier.equal?(WorkOS::OMIT)
       response = @client.request(
         method: :post,
         path: "/organizations/#{WorkOS::Util.encode_path(organization_id)}/connected_accounts/#{WorkOS::Util.encode_path(slug)}",
@@ -523,18 +689,25 @@ module WorkOS
     # Update an organization connected account
     # @param organization_id [String] An [Organization](https://workos.com/docs/reference/organization) identifier.
     # @param slug [String] The slug identifier of the provider (e.g., `github`, `slack`, `notion`).
+    # @param account_display_name [String, nil] A mutable, non-unique connection label; null clears it. Not an account identifier.
+    # @param account_identifier [String, nil] A developer-attested account identifier; null clears it.
     # @param access_token [String, nil] The OAuth access token for the connected account.
     # @param refresh_token [String, nil] The OAuth refresh token for the connected account.
     # @param expires_at [String, nil] The ISO-8601 timestamp when the access token expires. Required when `access_token` is provided for tokens that expire.
     # @param scopes [Array<String>, nil] The OAuth scopes granted for this connection.
-    # @param state [WorkOS::Types::ConnectedAccountInputState, nil] Explicitly set the state of the connected account. When omitted, the state is derived from the token combination provided.
-    # @param supports_multiple_connections [Boolean, nil] Set to `true` to use the plural connection contract. When omitted or `false`, only the compatibility connection is considered.
+    # @param state [WorkOS::Types::OrganizationConnectedAccountState, nil] Explicitly set the state of the connected account. When omitted, the state is derived from the token combination provided.
+    # @param user_id [String] The [User](https://workos.com/docs/reference/authkit/user) identifier of the organization member on whose behalf the connected account is being imported or updated. The user must be an active member of the organization.
+    # @param supports_multiple_connections [Boolean, nil] Accepted for compatibility; does not change update targeting. Omit intent and selector to update the compatibility connection, or supply `connected_account_id` to update an exact connection.
     # @param connected_account_id [String, nil] A [connected account](https://workos.com/docs/reference/pipes/connected-account) identifier. Use this to select the connection to update.
+    # @param connection_intent [String, nil] Set to `reauthorize` with `connected_account_id` to update one exact connection. The intent may be omitted when supplying an ID. Omit both for permanent compatibility behavior.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
     # @return [WorkOS::ConnectedAccount]
     def update_organization_connected_account(
       organization_id:,
       slug:,
+      user_id:,
+      account_display_name: WorkOS::OMIT,
+      account_identifier: WorkOS::OMIT,
       access_token: nil,
       refresh_token: nil,
       expires_at: nil,
@@ -542,19 +715,24 @@ module WorkOS
       state: nil,
       supports_multiple_connections: nil,
       connected_account_id: nil,
+      connection_intent: nil,
       request_options: {}
     )
       params = {
         "supports_multiple_connections" => supports_multiple_connections,
-        "connected_account_id" => connected_account_id
+        "connected_account_id" => connected_account_id,
+        "connection_intent" => connection_intent
       }.compact
       body = {
         "access_token" => access_token,
         "refresh_token" => refresh_token,
         "expires_at" => expires_at,
         "scopes" => scopes,
-        "state" => state
+        "state" => state,
+        "user_id" => user_id
       }.compact
+      body["account_display_name"] = account_display_name unless account_display_name.equal?(WorkOS::OMIT)
+      body["account_identifier"] = account_identifier unless account_identifier.equal?(WorkOS::OMIT)
       response = @client.request(
         method: :put,
         path: "/organizations/#{WorkOS::Util.encode_path(organization_id)}/connected_accounts/#{WorkOS::Util.encode_path(slug)}",
@@ -657,22 +835,28 @@ module WorkOS
     # Import a connected account
     # @param user_id [String] A [User](https://workos.com/docs/reference/authkit/user) identifier.
     # @param slug [String] The slug identifier of the provider (e.g., `github`, `slack`, `notion`).
+    # @param account_display_name [String, nil] A mutable, non-unique connection label; null clears it. Not an account identifier.
+    # @param account_identifier [String, nil] A developer-attested account identifier; null clears it.
     # @param access_token [String, nil] The OAuth access token for the connected account.
     # @param refresh_token [String, nil] The OAuth refresh token for the connected account.
     # @param expires_at [String, nil] The ISO-8601 timestamp when the access token expires. Required when `access_token` is provided for tokens that expire.
     # @param scopes [Array<String>, nil] The OAuth scopes granted for this connection.
-    # @param state [WorkOS::Types::ConnectedAccountInputState, nil] Explicitly set the state of the connected account. When omitted, the state is derived from the token combination provided.
+    # @param state [WorkOS::Types::CreateConnectedAccountState, nil] Explicitly set the state of the connected account. When omitted, the state is derived from the token combination provided.
+    # @param connection_intent [String, nil] Set to `add` to create another connected account. Omit this field for permanent compatibility behavior.
     # @param organization_id [String, nil] An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter if the connection is scoped to an organization.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
     # @return [WorkOS::ConnectedAccount]
     def create_user_connected_account(
       user_id:,
       slug:,
+      account_display_name: WorkOS::OMIT,
+      account_identifier: WorkOS::OMIT,
       access_token: nil,
       refresh_token: nil,
       expires_at: nil,
       scopes: nil,
       state: nil,
+      connection_intent: nil,
       organization_id: nil,
       request_options: {}
     )
@@ -684,8 +868,11 @@ module WorkOS
         "refresh_token" => refresh_token,
         "expires_at" => expires_at,
         "scopes" => scopes,
-        "state" => state
+        "state" => state,
+        "connection_intent" => connection_intent
       }.compact
+      body["account_display_name"] = account_display_name unless account_display_name.equal?(WorkOS::OMIT)
+      body["account_identifier"] = account_identifier unless account_identifier.equal?(WorkOS::OMIT)
       response = @client.request(
         method: :post,
         path: "/user_management/users/#{WorkOS::Util.encode_path(user_id)}/connected_accounts/#{WorkOS::Util.encode_path(slug)}",
@@ -702,19 +889,24 @@ module WorkOS
     # Update a connected account
     # @param user_id [String] A [User](https://workos.com/docs/reference/authkit/user) identifier.
     # @param slug [String] The slug identifier of the provider (e.g., `github`, `slack`, `notion`).
+    # @param account_display_name [String, nil] A mutable, non-unique connection label; null clears it. Not an account identifier.
+    # @param account_identifier [String, nil] A developer-attested account identifier; null clears it.
     # @param access_token [String, nil] The OAuth access token for the connected account.
     # @param refresh_token [String, nil] The OAuth refresh token for the connected account.
     # @param expires_at [String, nil] The ISO-8601 timestamp when the access token expires. Required when `access_token` is provided for tokens that expire.
     # @param scopes [Array<String>, nil] The OAuth scopes granted for this connection.
     # @param state [WorkOS::Types::ConnectedAccountInputState, nil] Explicitly set the state of the connected account. When omitted, the state is derived from the token combination provided.
     # @param organization_id [String, nil] An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter if the connection is scoped to an organization.
-    # @param supports_multiple_connections [Boolean, nil] Set to `true` to use the plural connection contract. When omitted or `false`, only the compatibility connection is considered.
+    # @param supports_multiple_connections [Boolean, nil] Accepted for compatibility; does not change update targeting. Omit intent and selector to update the compatibility connection, or supply `connected_account_id` to update an exact connection.
     # @param connected_account_id [String, nil] A [connected account](https://workos.com/docs/reference/pipes/connected-account) identifier. Use this to select the connection to update.
+    # @param connection_intent [String, nil] Set to `reauthorize` with `connected_account_id` to update one exact connection. The intent may be omitted when supplying an ID. Omit both for permanent compatibility behavior.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
     # @return [WorkOS::ConnectedAccount]
     def update_user_connected_account(
       user_id:,
       slug:,
+      account_display_name: WorkOS::OMIT,
+      account_identifier: WorkOS::OMIT,
       access_token: nil,
       refresh_token: nil,
       expires_at: nil,
@@ -723,12 +915,14 @@ module WorkOS
       organization_id: nil,
       supports_multiple_connections: nil,
       connected_account_id: nil,
+      connection_intent: nil,
       request_options: {}
     )
       params = {
         "organization_id" => organization_id,
         "supports_multiple_connections" => supports_multiple_connections,
-        "connected_account_id" => connected_account_id
+        "connected_account_id" => connected_account_id,
+        "connection_intent" => connection_intent
       }.compact
       body = {
         "access_token" => access_token,
@@ -737,6 +931,8 @@ module WorkOS
         "scopes" => scopes,
         "state" => state
       }.compact
+      body["account_display_name"] = account_display_name unless account_display_name.equal?(WorkOS::OMIT)
+      body["account_identifier"] = account_identifier unless account_identifier.equal?(WorkOS::OMIT)
       response = @client.request(
         method: :put,
         path: "/user_management/users/#{WorkOS::Util.encode_path(user_id)}/connected_accounts/#{WorkOS::Util.encode_path(slug)}",

data/lib/workos/shared/access_denied_oauth_error_body.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  class AccessDeniedOAuthErrorBody < WorkOS::Types::BaseModel
+    HASH_ATTRS = {
+      error: :error,
+      error_description: :error_description
+    }.freeze
+
+    attr_accessor \
+      :error,
+      :error_description
+
+    def initialize(json)
+      hash = self.class.normalize(json)
+      @error = hash[:error]
+      @error_description = hash[:error_description]
+    end
+  end
+end

data/lib/workos/shared/account_selection_required_error_body.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  AccountSelectionRequiredErrorBody = AccountSelectionRequiredError
+end

data/lib/workos/shared/agent_blueprint_created_data.rb

@@ -11,6 +11,7 @@ module WorkOS
       description: :description,
       permissions: :permissions,
       invocable_by: :invocable_by,
+      invocable_as: :invocable_as,
       session_settings: :session_settings,
       created_at: :created_at,
       updated_at: :updated_at
@@ -23,6 +24,7 @@ module WorkOS
       :description,
       :permissions,
       :invocable_by,
+      :invocable_as,
       :session_settings,
       :created_at,
       :updated_at
@@ -35,6 +37,7 @@ module WorkOS
       @description = hash[:description]
       @permissions = hash[:permissions] || []
       @invocable_by = hash[:invocable_by] ? WorkOS::AgentBlueprintCreatedDataInvocableBy.new(hash[:invocable_by]) : nil
+      @invocable_as = hash[:invocable_as] ? WorkOS::AgentBlueprintCreatedDataInvocableAs.new(hash[:invocable_as]) : nil
       @session_settings = hash[:session_settings] ? WorkOS::AgentBlueprintCreatedDataSessionSetting.new(hash[:session_settings]) : nil
       @created_at = hash[:created_at]
       @updated_at = hash[:updated_at]

data/lib/workos/shared/agent_blueprint_created_data_invocable_as.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  class AgentBlueprintCreatedDataInvocableAs < WorkOS::Types::BaseModel
+    HASH_ATTRS = {
+      instance_types: :instance_types
+    }.freeze
+
+    attr_accessor :instance_types
+
+    def initialize(json)
+      hash = self.class.normalize(json)
+      @instance_types = hash[:instance_types] || []
+    end
+  end
+end

data/lib/workos/shared/agent_blueprint_updated_data.rb

@@ -3,5 +3,44 @@
 # This file is auto-generated by oagen. Do not edit.
 
 module WorkOS
-  AgentBlueprintUpdatedData = AgentBlueprintCreatedData
+  class AgentBlueprintUpdatedData < WorkOS::Types::BaseModel
+    HASH_ATTRS = {
+      object: :object,
+      id: :id,
+      name: :name,
+      description: :description,
+      permissions: :permissions,
+      invocable_by: :invocable_by,
+      invocable_as: :invocable_as,
+      session_settings: :session_settings,
+      created_at: :created_at,
+      updated_at: :updated_at
+    }.freeze
+
+    attr_accessor \
+      :object,
+      :id,
+      :name,
+      :description,
+      :permissions,
+      :invocable_by,
+      :invocable_as,
+      :session_settings,
+      :created_at,
+      :updated_at
+
+    def initialize(json)
+      hash = self.class.normalize(json)
+      @object = hash[:object]
+      @id = hash[:id]
+      @name = hash[:name]
+      @description = hash[:description]
+      @permissions = hash[:permissions] || []
+      @invocable_by = hash[:invocable_by] ? WorkOS::AgentBlueprintUpdatedDataInvocableBy.new(hash[:invocable_by]) : nil
+      @invocable_as = hash[:invocable_as] ? WorkOS::AgentBlueprintUpdatedDataInvocableAs.new(hash[:invocable_as]) : nil
+      @session_settings = hash[:session_settings] ? WorkOS::AgentBlueprintUpdatedDataSessionSetting.new(hash[:session_settings]) : nil
+      @created_at = hash[:created_at]
+      @updated_at = hash[:updated_at]
+    end
+  end
 end

data/lib/workos/shared/agent_blueprint_updated_data_invocable_as.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  class AgentBlueprintUpdatedDataInvocableAs < WorkOS::Types::BaseModel
+    HASH_ATTRS = {
+      instance_types: :instance_types
+    }.freeze
+
+    attr_accessor :instance_types
+
+    def initialize(json)
+      hash = self.class.normalize(json)
+      @instance_types = hash[:instance_types] || []
+    end
+  end
+end

data/lib/workos/shared/already_claimed_error_body.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  class AlreadyClaimedErrorBody < WorkOS::Types::BaseModel
+    HASH_ATTRS = {
+      code: :code,
+      message: :message
+    }.freeze
+
+    attr_accessor \
+      :code,
+      :message
+
+    def initialize(json)
+      hash = self.class.normalize(json)
+      @code = hash[:code]
+      @message = hash[:message]
+    end
+  end
+end

data/lib/workos/shared/application_consent_required_error_body.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  class ApplicationConsentRequiredErrorBody < WorkOS::Types::BaseModel
+    HASH_ATTRS = {
+      code: :code,
+      message: :message
+    }.freeze
+
+    attr_accessor \
+      :code,
+      :message
+
+    def initialize(json)
+      hash = self.class.normalize(json)
+      @code = hash[:code]
+      @message = hash[:message]
+    end
+  end
+end