workos 7.1.2 → 9.5.0

data/lib/workos/user_management.rb

@@ -20,18 +20,6 @@ module WorkOS
     #   @return [WorkOS::Types::CreateUserPasswordHashType]
     PasswordHashed = Data.define(:password_hash, :password_hash_type)
 
-    # Identifies the role (single variant).
-    #
-    # @!attribute [r] role_slug
-    #   @return [String]
-    RoleSingle = Data.define(:role_slug)
-
-    # Identifies the role (multiple variant).
-    #
-    # @!attribute [r] role_slugs
-    #   @return [Array<String>]
-    RoleMultiple = Data.define(:role_slugs)
-
     def initialize(client)
       @client = client
     end
@@ -57,7 +45,7 @@ module WorkOS
 
     # Authenticate
     # @param client_id [String] The client ID of the application.
-    # @param client_secret [String, nil] The client secret of the application.
+    # @param client_secret [String, nil] The client secret of the application. May be omitted by public clients that authenticate through other means, such as a PKCE `code_verifier`.
     # @param grant_type [String]
     # @param code [String, nil] The authorization code received from the redirect.
     # @param code_verifier [String, nil] The PKCE code verifier used to derive the code challenge passed to the authorization URL.
@@ -65,12 +53,17 @@ module WorkOS
     # @param ip_address [String, nil] The IP address of the user's request.
     # @param device_id [String, nil] A unique identifier for the device.
     # @param user_agent [String, nil] The user agent string from the user's browser.
+    # @param signals_id [String, nil] An optional Radar signals ID to correlate client-side signals with this authentication attempt.
     # @param email [String, nil] The user's email address.
     # @param password [String, nil] The user's password.
+    # @param radar_auth_attempt_id [String, nil] The ID of an existing Radar authentication attempt to associate with this authentication.
     # @param refresh_token [String, nil] The refresh token to exchange for new tokens.
     # @param organization_id [String, nil] The ID of the organization to scope the session to.
     # @param pending_authentication_token [String, nil] The pending authentication token from a previous authentication attempt.
     # @param authentication_challenge_id [String, nil] The ID of the MFA authentication challenge.
+    # @param radar_challenge_id [String, nil] The ID of the Radar email challenge being verified.
+    # @param verification_id [String, nil] The ID of the Radar SMS verification being confirmed.
+    # @param phone_number [String, nil] The phone number the Radar SMS challenge was sent to.
     # @param device_code [String, nil] The device verification code.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
     # @return [WorkOS::AuthenticateResponse]
@@ -84,12 +77,17 @@ module WorkOS
       ip_address: nil,
       device_id: nil,
       user_agent: nil,
+      signals_id: nil,
       email: nil,
       password: nil,
+      radar_auth_attempt_id: nil,
       refresh_token: nil,
       organization_id: nil,
       pending_authentication_token: nil,
       authentication_challenge_id: nil,
+      radar_challenge_id: nil,
+      verification_id: nil,
+      phone_number: nil,
       device_code: nil,
       request_options: {}
     )
@@ -103,12 +101,17 @@ module WorkOS
         "ip_address" => ip_address,
         "device_id" => device_id,
         "user_agent" => user_agent,
+        "signals_id" => signals_id,
         "email" => email,
         "password" => password,
+        "radar_auth_attempt_id" => radar_auth_attempt_id,
         "refresh_token" => refresh_token,
         "organization_id" => organization_id,
         "pending_authentication_token" => pending_authentication_token,
         "authentication_challenge_id" => authentication_challenge_id,
+        "radar_challenge_id" => radar_challenge_id,
+        "verification_id" => verification_id,
+        "phone_number" => phone_number,
         "device_code" => device_code
       }.compact
       response = @client.request(
@@ -130,6 +133,8 @@ module WorkOS
     # @param ip_address [String, nil]
     # @param device_id [String, nil]
     # @param user_agent [String, nil]
+    # @param signals_id [String, nil]
+    # @param radar_auth_attempt_id [String, nil]
     # @param request_options [Hash] Per-request overrides.
     # @return [WorkOS::AuthenticateResponse]
     def authenticate_with_password(
@@ -139,6 +144,8 @@ module WorkOS
       ip_address: nil,
       device_id: nil,
       user_agent: nil,
+      signals_id: nil,
+      radar_auth_attempt_id: nil,
       request_options: {}
     )
       body = {
@@ -150,7 +157,9 @@ module WorkOS
         "invitation_token" => invitation_token,
         "ip_address" => ip_address,
         "device_id" => device_id,
-        "user_agent" => user_agent
+        "user_agent" => user_agent,
+        "signals_id" => signals_id,
+        "radar_auth_attempt_id" => radar_auth_attempt_id
       }.compact
       response = @client.request(
         method: :post,
@@ -169,6 +178,7 @@ module WorkOS
     # @param ip_address [String, nil]
     # @param device_id [String, nil]
     # @param user_agent [String, nil]
+    # @param signals_id [String, nil]
     # @param request_options [Hash] Per-request overrides.
     # @return [WorkOS::AuthenticateResponse]
     def authenticate_with_code(
@@ -178,6 +188,7 @@ module WorkOS
       ip_address: nil,
       device_id: nil,
       user_agent: nil,
+      signals_id: nil,
       request_options: {}
     )
       body = {
@@ -189,7 +200,8 @@ module WorkOS
         "invitation_token" => invitation_token,
         "ip_address" => ip_address,
         "device_id" => device_id,
-        "user_agent" => user_agent
+        "user_agent" => user_agent,
+        "signals_id" => signals_id
       }.compact
       response = @client.request(
         method: :post,
@@ -244,6 +256,7 @@ module WorkOS
     # @param ip_address [String, nil]
     # @param device_id [String, nil]
     # @param user_agent [String, nil]
+    # @param radar_auth_attempt_id [String, nil]
     # @param request_options [Hash] Per-request overrides.
     # @return [WorkOS::AuthenticateResponse]
     def authenticate_with_magic_auth(
@@ -253,6 +266,7 @@ module WorkOS
       ip_address: nil,
       device_id: nil,
       user_agent: nil,
+      radar_auth_attempt_id: nil,
       request_options: {}
     )
       body = {
@@ -264,7 +278,8 @@ module WorkOS
         "invitation_token" => invitation_token,
         "ip_address" => ip_address,
         "device_id" => device_id,
-        "user_agent" => user_agent
+        "user_agent" => user_agent,
+        "radar_auth_attempt_id" => radar_auth_attempt_id
       }.compact
       response = @client.request(
         method: :post,
@@ -419,6 +434,87 @@ module WorkOS
       WorkOS::AuthenticateResponse.new(response.body)
     end
 
+    # Authenticate with radar email challenge.
+    # @param code [String]
+    # @param radar_challenge_id [String]
+    # @param pending_authentication_token [String]
+    # @param ip_address [String, nil]
+    # @param device_id [String, nil]
+    # @param user_agent [String, nil]
+    # @param request_options [Hash] Per-request overrides.
+    # @return [WorkOS::AuthenticateResponse]
+    def authenticate_with_radar_email_challenge(
+      code:,
+      radar_challenge_id:,
+      pending_authentication_token:,
+      ip_address: nil,
+      device_id: nil,
+      user_agent: nil,
+      request_options: {}
+    )
+      body = {
+        "grant_type" => "urn:workos:oauth:grant-type:radar-email-challenge:code",
+        "client_id" => @client.client_id,
+        "client_secret" => @client.api_key,
+        "code" => code,
+        "radar_challenge_id" => radar_challenge_id,
+        "pending_authentication_token" => pending_authentication_token,
+        "ip_address" => ip_address,
+        "device_id" => device_id,
+        "user_agent" => user_agent
+      }.compact
+      response = @client.request(
+        method: :post,
+        path: "/user_management/authenticate",
+        auth: true,
+        body: body,
+        request_options: request_options
+      )
+      WorkOS::AuthenticateResponse.new(response.body)
+    end
+
+    # Authenticate with radar sms challenge.
+    # @param code [String]
+    # @param verification_id [String]
+    # @param phone_number [String]
+    # @param pending_authentication_token [String]
+    # @param ip_address [String, nil]
+    # @param device_id [String, nil]
+    # @param user_agent [String, nil]
+    # @param request_options [Hash] Per-request overrides.
+    # @return [WorkOS::AuthenticateResponse]
+    def authenticate_with_radar_sms_challenge(
+      code:,
+      verification_id:,
+      phone_number:,
+      pending_authentication_token:,
+      ip_address: nil,
+      device_id: nil,
+      user_agent: nil,
+      request_options: {}
+    )
+      body = {
+        "grant_type" => "urn:workos:oauth:grant-type:radar-sms-challenge:code",
+        "client_id" => @client.client_id,
+        "client_secret" => @client.api_key,
+        "code" => code,
+        "verification_id" => verification_id,
+        "phone_number" => phone_number,
+        "pending_authentication_token" => pending_authentication_token,
+        "ip_address" => ip_address,
+        "device_id" => device_id,
+        "user_agent" => user_agent
+      }.compact
+      response = @client.request(
+        method: :post,
+        path: "/user_management/authenticate",
+        auth: true,
+        body: body,
+        request_options: request_options
+      )
+      WorkOS::AuthenticateResponse.new(response.body)
+    end
+
     # Get device authorization URL
     # @param client_id [String] The WorkOS client ID for your application.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
@@ -442,20 +538,52 @@ module WorkOS
       result
     end
 
+    # Send a Radar SMS challenge
+    # @param user_id [String] The ID of the user to send the SMS challenge to.
+    # @param pending_authentication_token [String] The pending authentication token from a previous authentication attempt that triggered the Radar challenge.
+    # @param phone_number [String] The phone number to send the SMS verification code to.
+    # @param ip_address [String, nil] The IP address of the user's request.
+    # @param user_agent [String, nil] The user agent string from the user's request.
+    # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
+    # @return [WorkOS::SendRadarSmsChallengeResponse]
+    def create_radar_challenge(
+      user_id:,
+      pending_authentication_token:,
+      phone_number:,
+      ip_address: nil,
+      user_agent: nil,
+      request_options: {}
+    )
+      body = {
+        "user_id" => user_id,
+        "pending_authentication_token" => pending_authentication_token,
+        "phone_number" => phone_number,
+        "ip_address" => ip_address,
+        "user_agent" => user_agent
+      }.compact
+      response = @client.request(
+        method: :post,
+        path: "/user_management/radar_challenges",
+        auth: true,
+        body: body,
+        request_options: request_options
+      )
+      result = WorkOS::SendRadarSmsChallengeResponse.new(response.body)
+      result.last_response = WorkOS::Types::ApiResponse.new(http_status: response.code.to_i, http_headers: response.each_header.to_h, request_id: response["x-request-id"])
+      result
+    end
+
     # Revoke Session
     # @param session_id [String] The ID of the session to revoke. This can be extracted from the `sid` claim of the access token.
-    # @param return_to [String, nil] The URL to redirect the user to after session revocation.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
     # @return [void]
     def revoke_session(
       session_id:,
-      return_to: nil,
       request_options: {}
     )
       body = {
-        "session_id" => session_id,
-        "return_to" => return_to
-      }.compact
+        "session_id" => session_id
+      }
       @client.request(
         method: :post,
         path: "/user_management/sessions/revoke",
@@ -466,6 +594,50 @@ module WorkOS
       nil
     end
 
+    # List CORS origins
+    # @param before [String, nil] An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`.
+    # @param after [String, nil] An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`.
+    # @param limit [Integer, nil] Upper limit on the number of objects to return, between `1` and `100`.
+    # @param order [WorkOS::Types::PaginationOrder, nil] Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records).
+    # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
+    # @return [WorkOS::Types::ListStruct<WorkOS::CORSOriginResponse>]
+    def list_cors_origins(
+      before: nil,
+      after: nil,
+      limit: 10,
+      order: "desc",
+      request_options: {}
+    )
+      params = {
+        "before" => before,
+        "after" => after,
+        "limit" => limit,
+        "order" => order
+      }.compact
+      response = @client.request(
+        method: :get,
+        path: "/user_management/cors_origins",
+        auth: true,
+        params: params,
+        request_options: request_options
+      )
+      fetch_next = ->(cursor) {
+        list_cors_origins(
+          before: before,
+          after: cursor,
+          limit: limit,
+          order: order,
+          request_options: request_options
+        )
+      }
+      WorkOS::Types::ListStruct.from_response(
+        response,
+        model: WorkOS::CORSOriginResponse,
+        filters: {before: before, limit: limit, order: order},
+        fetch_next: fetch_next
+      )
+    end
+
     # Create a CORS origin
     # @param origin [String] The origin URL to allow for CORS requests.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
@@ -580,7 +752,7 @@ module WorkOS
     # @param before [String, nil] An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`.
     # @param after [String, nil] An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`.
     # @param limit [Integer, nil] Upper limit on the number of objects to return, between `1` and `100`.
-    # @param order [WorkOS::Types::UserManagementUsersOrder, nil] Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to descending.
+    # @param order [WorkOS::Types::PaginationOrder, nil] Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records).
     # @param organization [String, nil] (deprecated) Filter users by the organization they are a member of. Deprecated in favor of `organization_id`.
     # @param organization_id [String, nil] Filter users by the organization they are a member of.
     # @param email [String, nil] Filter users by their email address.
@@ -589,7 +761,7 @@ module WorkOS
     def list_users(
       before: nil,
       after: nil,
-      limit: nil,
+      limit: 10,
       order: "desc",
       organization: nil,
       organization_id: nil,
@@ -636,19 +808,27 @@ module WorkOS
     # @param email [String] The email address of the user.
     # @param first_name [String, nil] The first name of the user.
     # @param last_name [String, nil] The last name of the user.
+    # @param name [String, nil] The user's full name.
     # @param email_verified [Boolean, nil] Whether the user's email has been verified.
     # @param metadata [Hash{String => String}, nil] Object containing metadata key/value pairs associated with the user.
     # @param external_id [String, nil] The external ID of the user.
+    # @param ip_address [String, nil] The IP address of the user's request.
+    # @param user_agent [String, nil] The user agent string from the user's request.
+    # @param signals_id [String, nil] An optional Radar signals ID to correlate client-side signals with this request.
     # @param password [WorkOS::UserManagement::PasswordPlaintext, WorkOS::UserManagement::PasswordHashed, nil] Identifies the password.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
-    # @return [WorkOS::User]
+    # @return [WorkOS::UserCreateResponse]
     def create_user(
       email:,
       first_name: nil,
       last_name: nil,
+      name: nil,
       email_verified: nil,
       metadata: nil,
       external_id: nil,
+      ip_address: nil,
+      user_agent: nil,
+      signals_id: nil,
       password: nil,
       request_options: {}
     )
@@ -656,9 +836,13 @@ module WorkOS
         "email" => email,
         "first_name" => first_name,
         "last_name" => last_name,
+        "name" => name,
         "email_verified" => email_verified,
         "metadata" => metadata,
-        "external_id" => external_id
+        "external_id" => external_id,
+        "ip_address" => ip_address,
+        "user_agent" => user_agent,
+        "signals_id" => signals_id
       }.compact
       if password
         case password
@@ -678,7 +862,7 @@ module WorkOS
         body: body,
         request_options: request_options
       )
-      result = WorkOS::User.new(response.body)
+      result = WorkOS::UserCreateResponse.new(response.body)
       result.last_response = WorkOS::Types::ApiResponse.new(http_status: response.code.to_i, http_headers: response.each_header.to_h, request_id: response["x-request-id"])
       result
     end
@@ -726,6 +910,7 @@ module WorkOS
     # @param email [String, nil] The email address of the user.
     # @param first_name [String, nil] The first name of the user.
     # @param last_name [String, nil] The last name of the user.
+    # @param name [String, nil] The user's full name.
     # @param email_verified [Boolean, nil] Whether the user's email has been verified.
     # @param metadata [Hash{String => String}, nil] Object containing metadata key/value pairs associated with the user.
     # @param external_id [String, nil] The external ID of the user.
@@ -738,6 +923,7 @@ module WorkOS
       email: nil,
       first_name: nil,
       last_name: nil,
+      name: nil,
       email_verified: nil,
       metadata: nil,
       external_id: nil,
@@ -749,6 +935,7 @@ module WorkOS
         "email" => email,
         "first_name" => first_name,
         "last_name" => last_name,
+        "name" => name,
         "email_verified" => email_verified,
         "metadata" => metadata,
         "external_id" => external_id,
@@ -911,14 +1098,14 @@ module WorkOS
     # @param before [String, nil] An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`.
     # @param after [String, nil] An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`.
     # @param limit [Integer, nil] Upper limit on the number of objects to return, between `1` and `100`.
-    # @param order [WorkOS::Types::UserManagementUsersOrder, nil] Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to descending.
+    # @param order [WorkOS::Types::PaginationOrder, nil] Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records).
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
     # @return [WorkOS::Types::ListStruct<WorkOS::UserSessionsListItem>]
     def list_sessions(
       id:,
       before: nil,
       after: nil,
-      limit: nil,
+      limit: 10,
       order: "desc",
       request_options: {}
     )
@@ -957,7 +1144,7 @@ module WorkOS
     # @param before [String, nil] An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`.
     # @param after [String, nil] An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`.
     # @param limit [Integer, nil] Upper limit on the number of objects to return, between `1` and `100`.
-    # @param order [WorkOS::Types::UserManagementInvitationsOrder, nil] Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to descending.
+    # @param order [WorkOS::Types::PaginationOrder, nil] Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records).
     # @param organization_id [String, nil] The ID of the [organization](https://workos.com/docs/reference/organization) that the recipient will join.
     # @param email [String, nil] The email address of the recipient.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
@@ -965,7 +1152,7 @@ module WorkOS
     def list_invitations(
       before: nil,
       after: nil,
-      limit: nil,
+      limit: 10,
       order: "desc",
       organization_id: nil,
       email: nil,
@@ -1144,6 +1331,21 @@ module WorkOS
       result
     end
 
+    # Get JWT template
+    # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
+    # @return [WorkOS::JWTTemplateResponse]
+    def list_jwt_template(request_options: {})
+      response = @client.request(
+        method: :get,
+        path: "/user_management/jwt_template",
+        auth: true,
+        request_options: request_options
+      )
+      result = WorkOS::JWTTemplateResponse.new(response.body)
+      result.last_response = WorkOS::Types::ApiResponse.new(http_status: response.code.to_i, http_headers: response.each_header.to_h, request_id: response["x-request-id"])
+      result
+    end
+
     # Update JWT template
     # @param content [String] The JWT template content as a Liquid template string.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
@@ -1170,16 +1372,28 @@ module WorkOS
     # Create a Magic Auth code
     # @param email [String] The email address to send the magic code to.
     # @param invitation_token [String, nil] The invitation token to associate with this magic code.
+    # @param ip_address [String, nil] The IP address of the user's request.
+    # @param user_agent [String, nil] The user agent string from the user's request.
+    # @param radar_auth_attempt_id [String, nil] The ID of an existing Radar authentication attempt to associate with this request.
+    # @param signals_id [String, nil] An optional Radar signals ID to correlate client-side signals with this request.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
-    # @return [WorkOS::MagicAuth]
+    # @return [WorkOS::MagicAuthSendMagicAuthCodeAndReturnResponse]
     def create_magic_auth(
       email:,
       invitation_token: nil,
+      ip_address: nil,
+      user_agent: nil,
+      radar_auth_attempt_id: nil,
+      signals_id: nil,
       request_options: {}
     )
       body = {
         "email" => email,
-        "invitation_token" => invitation_token
+        "invitation_token" => invitation_token,
+        "ip_address" => ip_address,
+        "user_agent" => user_agent,
+        "radar_auth_attempt_id" => radar_auth_attempt_id,
+        "signals_id" => signals_id
       }.compact
       response = @client.request(
         method: :post,
@@ -1188,7 +1402,7 @@ module WorkOS
         body: body,
         request_options: request_options
       )
-      result = WorkOS::MagicAuth.new(response.body)
+      result = WorkOS::MagicAuthSendMagicAuthCodeAndReturnResponse.new(response.body)
       result.last_response = WorkOS::Types::ApiResponse.new(http_status: response.code.to_i, http_headers: response.each_header.to_h, request_id: response["x-request-id"])
       result
     end
@@ -1212,207 +1426,50 @@ module WorkOS
       result
     end
 
-    # List organization memberships
+    # List redirect URIs
     # @param before [String, nil] An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`.
     # @param after [String, nil] An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`.
     # @param limit [Integer, nil] Upper limit on the number of objects to return, between `1` and `100`.
-    # @param order [WorkOS::Types::UserManagementOrganizationMembershipOrder, nil] Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to descending.
-    # @param organization_id [String, nil] The ID of the [organization](https://workos.com/docs/reference/organization) which the user belongs to.
-    # @param statuses [Array<WorkOS::Types::UserManagementOrganizationMembershipStatuses>, nil] Filter by the status of the organization membership. Array including any of `active`, `inactive`, or `pending`.
-    # @param user_id [String, nil] The ID of the [user](https://workos.com/docs/reference/authkit/user).
+    # @param order [WorkOS::Types::PaginationOrder, nil] Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records).
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
-    # @return [WorkOS::Types::ListStruct<WorkOS::UserOrganizationMembership>]
-    def list_organization_memberships(
+    # @return [WorkOS::Types::ListStruct<WorkOS::RedirectUri>]
+    def list_redirect_uris(
       before: nil,
       after: nil,
-      limit: nil,
+      limit: 10,
       order: "desc",
-      organization_id: nil,
-      statuses: nil,
-      user_id: nil,
       request_options: {}
     )
       params = {
         "before" => before,
         "after" => after,
         "limit" => limit,
-        "order" => order,
-        "organization_id" => organization_id,
-        "statuses" => statuses,
-        "user_id" => user_id
+        "order" => order
       }.compact
       response = @client.request(
         method: :get,
-        path: "/user_management/organization_memberships",
+        path: "/user_management/redirect_uris",
         auth: true,
         params: params,
         request_options: request_options
       )
       fetch_next = ->(cursor) {
-        list_organization_memberships(
+        list_redirect_uris(
           before: before,
           after: cursor,
           limit: limit,
           order: order,
-          organization_id: organization_id,
-          statuses: statuses,
-          user_id: user_id,
           request_options: request_options
         )
       }
       WorkOS::Types::ListStruct.from_response(
         response,
-        model: WorkOS::UserOrganizationMembership,
-        filters: {before: before, limit: limit, order: order, organization_id: organization_id, statuses: statuses, user_id: user_id},
+        model: WorkOS::RedirectUri,
+        filters: {before: before, limit: limit, order: order},
         fetch_next: fetch_next
       )
     end
 
-    # Create an organization membership
-    # @param user_id [String] The ID of the [user](https://workos.com/docs/reference/authkit/user).
-    # @param organization_id [String] The ID of the [organization](https://workos.com/docs/reference/organization) which the user belongs to.
-    # @param role [WorkOS::UserManagement::RoleSingle, WorkOS::UserManagement::RoleMultiple, nil] Identifies the role.
-    # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
-    # @return [WorkOS::OrganizationMembership]
-    def create_organization_membership(
-      user_id:,
-      organization_id:,
-      role: nil,
-      request_options: {}
-    )
-      body = {
-        "user_id" => user_id,
-        "organization_id" => organization_id
-      }
-      if role
-        case role
-        when WorkOS::UserManagement::RoleSingle
-          body["role_slug"] = role.role_slug
-        when WorkOS::UserManagement::RoleMultiple
-          body["role_slugs"] = role.role_slugs
-        else
-          raise ArgumentError, "expected role to be one of: WorkOS::UserManagement::RoleSingle, WorkOS::UserManagement::RoleMultiple, got #{role.class}"
-        end
-      end
-      response = @client.request(
-        method: :post,
-        path: "/user_management/organization_memberships",
-        auth: true,
-        body: body,
-        request_options: request_options
-      )
-      result = WorkOS::OrganizationMembership.new(response.body)
-      result.last_response = WorkOS::Types::ApiResponse.new(http_status: response.code.to_i, http_headers: response.each_header.to_h, request_id: response["x-request-id"])
-      result
-    end
-
-    # Get an organization membership
-    # @param id [String] The unique ID of the organization membership.
-    # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
-    # @return [WorkOS::UserOrganizationMembership]
-    def get_organization_membership(
-      id:,
-      request_options: {}
-    )
-      response = @client.request(
-        method: :get,
-        path: "/user_management/organization_memberships/#{WorkOS::Util.encode_path(id)}",
-        auth: true,
-        request_options: request_options
-      )
-      result = WorkOS::UserOrganizationMembership.new(response.body)
-      result.last_response = WorkOS::Types::ApiResponse.new(http_status: response.code.to_i, http_headers: response.each_header.to_h, request_id: response["x-request-id"])
-      result
-    end
-
-    # Update an organization membership
-    # @param id [String] The unique ID of the organization membership.
-    # @param role [WorkOS::UserManagement::RoleSingle, WorkOS::UserManagement::RoleMultiple, nil] Identifies the role.
-    # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
-    # @return [WorkOS::UserOrganizationMembership]
-    def update_organization_membership(
-      id:,
-      role: nil,
-      request_options: {}
-    )
-      body = {}
-      if role
-        case role
-        when WorkOS::UserManagement::RoleSingle
-          body["role_slug"] = role.role_slug
-        when WorkOS::UserManagement::RoleMultiple
-          body["role_slugs"] = role.role_slugs
-        else
-          raise ArgumentError, "expected role to be one of: WorkOS::UserManagement::RoleSingle, WorkOS::UserManagement::RoleMultiple, got #{role.class}"
-        end
-      end
-      response = @client.request(
-        method: :put,
-        path: "/user_management/organization_memberships/#{WorkOS::Util.encode_path(id)}",
-        auth: true,
-        body: body,
-        request_options: request_options
-      )
-      result = WorkOS::UserOrganizationMembership.new(response.body)
-      result.last_response = WorkOS::Types::ApiResponse.new(http_status: response.code.to_i, http_headers: response.each_header.to_h, request_id: response["x-request-id"])
-      result
-    end
-
-    # Delete an organization membership
-    # @param id [String] The unique ID of the organization membership.
-    # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
-    # @return [void]
-    def delete_organization_membership(
-      id:,
-      request_options: {}
-    )
-      @client.request(
-        method: :delete,
-        path: "/user_management/organization_memberships/#{WorkOS::Util.encode_path(id)}",
-        auth: true,
-        request_options: request_options
-      )
-      nil
-    end
-
-    # Deactivate an organization membership
-    # @param id [String] The unique ID of the organization membership.
-    # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
-    # @return [WorkOS::OrganizationMembership]
-    def deactivate_organization_membership(
-      id:,
-      request_options: {}
-    )
-      response = @client.request(
-        method: :put,
-        path: "/user_management/organization_memberships/#{WorkOS::Util.encode_path(id)}/deactivate",
-        auth: true,
-        request_options: request_options
-      )
-      result = WorkOS::OrganizationMembership.new(response.body)
-      result.last_response = WorkOS::Types::ApiResponse.new(http_status: response.code.to_i, http_headers: response.each_header.to_h, request_id: response["x-request-id"])
-      result
-    end
-
-    # Reactivate an organization membership
-    # @param id [String] The unique ID of the organization membership.
-    # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
-    # @return [WorkOS::UserOrganizationMembership]
-    def reactivate_organization_membership(
-      id:,
-      request_options: {}
-    )
-      response = @client.request(
-        method: :put,
-        path: "/user_management/organization_memberships/#{WorkOS::Util.encode_path(id)}/reactivate",
-        auth: true,
-        request_options: request_options
-      )
-      result = WorkOS::UserOrganizationMembership.new(response.body)
-      result.last_response = WorkOS::Types::ApiResponse.new(http_status: response.code.to_i, http_headers: response.each_header.to_h, request_id: response["x-request-id"])
-      result
-    end
-
     # Create a redirect URI
     # @param uri [String] The redirect URI to create.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
@@ -1441,14 +1498,14 @@ module WorkOS
     # @param before [String, nil] An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`.
     # @param after [String, nil] An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`.
     # @param limit [Integer, nil] Upper limit on the number of objects to return, between `1` and `100`.
-    # @param order [WorkOS::Types::UserManagementUsersAuthorizedApplicationsOrder, nil] Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to descending.
+    # @param order [WorkOS::Types::PaginationOrder, nil] Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records).
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
     # @return [WorkOS::Types::ListStruct<WorkOS::AuthorizedConnectApplicationListData>]
     def list_user_authorized_applications(
       user_id:,
       before: nil,
       after: nil,
-      limit: nil,
+      limit: 10,
       order: "desc",
       request_options: {}
     )
@@ -1502,6 +1559,91 @@ module WorkOS
       nil
     end
 
+    # List API keys for a user
+    # @param user_id [String] Unique identifier of the user.
+    # @param before [String, nil] An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.
+    # @param after [String, nil] An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.
+    # @param limit [Integer, nil] Upper limit on the number of objects to return, between `1` and `100`.
+    # @param order [WorkOS::Types::PaginationOrder, nil] Order the results by the creation time.
+    # @param organization_id [String, nil] The ID of the organization to filter user API keys by. When provided, only API keys created against that organization membership are returned.
+    # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
+    # @return [WorkOS::Types::ListStruct<WorkOS::UserApiKey>]
+    def list_user_api_keys(
+      user_id:,
+      before: nil,
+      after: nil,
+      limit: 10,
+      order: "desc",
+      organization_id: nil,
+      request_options: {}
+    )
+      params = {
+        "before" => before,
+        "after" => after,
+        "limit" => limit,
+        "order" => order,
+        "organization_id" => organization_id
+      }.compact
+      response = @client.request(
+        method: :get,
+        path: "/user_management/users/#{WorkOS::Util.encode_path(user_id)}/api_keys",
+        auth: true,
+        params: params,
+        request_options: request_options
+      )
+      fetch_next = ->(cursor) {
+        list_user_api_keys(
+          user_id: user_id,
+          before: before,
+          after: cursor,
+          limit: limit,
+          order: order,
+          organization_id: organization_id,
+          request_options: request_options
+        )
+      }
+      WorkOS::Types::ListStruct.from_response(
+        response,
+        model: WorkOS::UserApiKey,
+        filters: {user_id: user_id, before: before, limit: limit, order: order, organization_id: organization_id},
+        fetch_next: fetch_next
+      )
+    end
+
+    # Create an API key for a user
+    # @param user_id [String] Unique identifier of the user.
+    # @param name [String] A descriptive name for the API key.
+    # @param organization_id [String] The ID of the organization the user API key is associated with. The user must have an active membership in this organization.
+    # @param permissions [Array<String>, nil] The permission slugs to assign to the API key. Each permission must be enabled for user API keys.
+    # @param expires_at [String, nil] The timestamp when the API key should expire. Must be a future timestamp. If omitted, the key does not expire.
+    # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
+    # @return [WorkOS::UserApiKeyWithValue]
+    def create_user_api_key(
+      user_id:,
+      name:,
+      organization_id:,
+      permissions: nil,
+      expires_at: nil,
+      request_options: {}
+    )
+      body = {
+        "name" => name,
+        "organization_id" => organization_id,
+        "permissions" => permissions,
+        "expires_at" => expires_at
+      }.compact
+      response = @client.request(
+        method: :post,
+        path: "/user_management/users/#{WorkOS::Util.encode_path(user_id)}/api_keys",
+        auth: true,
+        body: body,
+        request_options: request_options
+      )
+      result = WorkOS::UserApiKeyWithValue.new(response.body)
+      result.last_response = WorkOS::Types::ApiResponse.new(http_status: response.code.to_i, http_headers: response.each_header.to_h, request_id: response["x-request-id"])
+      result
+    end
+
     # @oagen-ignore-start — non-spec helpers (hand-maintained)
     # H13 — Build the JWKS URL for a given client_id (no HTTP call).
     # Pair with #get_jwks (generated) to fetch the keyset.
@@ -1544,6 +1686,13 @@ module WorkOS
     def get_authorization_url_with_pkce(redirect_uri:, client_id: nil, **opts)
       pair = WorkOS::PKCE.generate_pair
       state = opts.delete(:state) || WorkOS::PKCE.generate_code_verifier
+      # Strip caller-supplied PKCE params: this helper exists specifically
+      # to generate them, so a caller-provided value would either silently
+      # override our freshly-generated challenge (defeating the helper) or
+      # collide with the keyword args below and raise. Mirror the existing
+      # opts.delete(:state) pattern.
+      opts.delete(:code_challenge)
+      opts.delete(:code_challenge_method)
       url = get_authorization_url(
         redirect_uri: redirect_uri,
         client_id: client_id,