workos 7.1.2 → 9.5.0

data/rbi/workos/waitlist_user_created.rbi

@@ -9,6 +9,12 @@ module WorkOS
     sig { params(json: T.any(String, T::Hash[Symbol, T.untyped])).void }
     def initialize(json); end
 
+    sig { returns(String) }
+    def object; end
+
+    sig { params(value: String).returns(String) }
+    def object=(value); end
+
     sig { returns(String) }
     def id; end
 
@@ -39,12 +45,6 @@ module WorkOS
     sig { params(value: T.nilable(WorkOS::EventContext)).returns(T.nilable(WorkOS::EventContext)) }
     def context=(value); end
 
-    sig { returns(String) }
-    def object; end
-
-    sig { params(value: String).returns(String) }
-    def object=(value); end
-
     sig { returns(T::Hash[Symbol, T.untyped]) }
     def to_h; end
 

data/rbi/workos/waitlist_user_denied.rbi

@@ -9,6 +9,12 @@ module WorkOS
     sig { params(json: T.any(String, T::Hash[Symbol, T.untyped])).void }
     def initialize(json); end
 
+    sig { returns(String) }
+    def object; end
+
+    sig { params(value: String).returns(String) }
+    def object=(value); end
+
     sig { returns(String) }
     def id; end
 
@@ -39,12 +45,6 @@ module WorkOS
     sig { params(value: T.nilable(WorkOS::EventContext)).returns(T.nilable(WorkOS::EventContext)) }
     def context=(value); end
 
-    sig { returns(String) }
-    def object; end
-
-    sig { params(value: String).returns(String) }
-    def object=(value); end
-
     sig { returns(T::Hash[Symbol, T.untyped]) }
     def to_h; end
 

data/rbi/workos/webhook_endpoint.rbi

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 # This file is auto-generated by oagen. Do not edit.
 
 # typed: strong

data/rbi/workos/webhooks.rbi

@@ -25,7 +25,7 @@ module WorkOS
         endpoint_url: String,
         events: T::Array[String],
         request_options: T::Hash[Symbol, T.untyped]
-      ).returns(WorkOS::WebhookEndpointJson)
+      ).returns(WorkOS::WebhookEndpoint)
     end
     def create_webhook_endpoint(endpoint_url:, events:, request_options:); end
 
@@ -36,7 +36,7 @@ module WorkOS
         status: T.nilable(String),
         events: T.nilable(T::Array[String]),
         request_options: T::Hash[Symbol, T.untyped]
-      ).returns(WorkOS::WebhookEndpointJson)
+      ).returns(WorkOS::WebhookEndpoint)
     end
     def update_webhook_endpoint(id:, endpoint_url:, status:, events:, request_options:); end
 

data/renovate.json

@@ -1,66 +1,6 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
-    "config:recommended"
-  ],
-  "dependencyDashboard": false,
-  "schedule": [
-    "on the 15th day of the month before 12pm"
-  ],
-  "timezone": "UTC",
-  "rebaseWhen": "conflicted",
-  "packageRules": [
-    {
-      "matchManagers": [
-        "github-actions"
-      ],
-      "pinDigests": true,
-      "extractVersion": "^v(?<version>\\d+\\.\\d+\\.\\d+)$"
-    },
-    {
-      "matchUpdateTypes": [
-        "minor",
-        "patch"
-      ],
-      "automerge": true,
-      "groupName": "minor and patch updates"
-    },
-    {
-      "matchUpdateTypes": [
-        "major"
-      ],
-      "automerge": false
-    },
-    {
-      "matchUpdateTypes": [
-        "digest"
-      ],
-      "automerge": false
-    },
-    {
-      "matchManagers": [
-        "github-actions"
-      ],
-      "matchUpdateTypes": [
-        "minor",
-        "patch",
-        "digest",
-        "pinDigest"
-      ],
-      "groupName": "github actions non-major",
-      "groupSlug": "github-actions-non-major",
-      "automerge": true
-    },
-    {
-      "matchManagers": [
-        "github-actions"
-      ],
-      "matchUpdateTypes": [
-        "major"
-      ],
-      "groupName": "github actions major",
-      "groupSlug": "github-actions-major",
-      "automerge": false
-    }
+    "github>workos/renovate-config:public"
   ]
 }

data/script/docs

@@ -0,0 +1,16 @@
+#!/bin/sh
+set -eu
+cd "$(dirname "$0")/.."
+bundle config set --local with 'docs'
+bundle install
+rm -rf docs/_site
+# 1. Generate HTML docs (default YARD format).
+bundle exec yard doc
+# 2. Generate Markdown docs alongside the HTML, using the yard-markdown plugin.
+#    We point output at the same docs/_site directory so .md files land next to .html.
+#    --no-cache forces a re-parse so the markdown formatter sees fresh registry data.
+#    --plugin yard-markdown ensures the plugin is loaded without relying on ~/.yard/config.
+bundle exec yard doc --plugin yard-markdown --format markdown --no-cache --output-dir docs/_site
+# 3. Generate llms.txt (index) from the markdown output, so the published site
+#    is consumable by LLM tooling.
+bundle exec ./script/llms-txt

data/script/docs-serve

@@ -0,0 +1,12 @@
+#!/bin/sh
+set -eu
+cd "$(dirname "$0")/.."
+bundle config set --local with 'docs'
+bundle install --quiet
+if [ "${1:-}" = "--static" ]; then
+  if [ ! -d docs/_site ]; then
+    ./script/docs
+  fi
+  exec bundle exec ruby -run -e httpd -- docs/_site -p 4000
+fi
+exec bundle exec yard server --reload --port 4000

data/script/llms-txt

@@ -0,0 +1,37 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+# Generates llms.txt (curated index) from the Markdown docs produced by
+# `yard --format markdown` in docs/_site. See https://llmstxt.org for the format.
+
+require "pathname"
+
+ROOT = Pathname.new(__dir__).join("..").expand_path
+SITE = ROOT.join("docs/_site")
+require ROOT.join("lib/workos/version").to_s
+
+abort "docs/_site is missing — run script/docs first" unless SITE.directory?
+
+md_files = Pathname.glob(SITE.join("**/*.md")).sort_by { |p| p.relative_path_from(SITE).to_s }
+
+title_for = lambda do |path|
+  first_heading = path.each_line.lazy.map(&:strip).find { |l| l.start_with?("# ") }
+  first_heading ? first_heading.sub(/^#\s+/, "").sub(/\s*<a id=.*?<\/a>\s*$/, "").strip : path.basename(".md").to_s
+end
+
+index_lines = []
+index_lines << "# WorkOS Ruby SDK v#{WorkOS::VERSION}"
+index_lines << ""
+index_lines << "> API client for WorkOS. This file indexes the auto-generated YARD documentation for the `workos` gem so language models can locate per-class references."
+index_lines << ""
+index_lines << "## API Reference"
+index_lines << ""
+md_files.each do |path|
+  rel = path.relative_path_from(SITE).to_s
+  index_lines << "- [#{title_for.call(path)}](#{rel})"
+end
+index_lines << ""
+
+SITE.join("llms.txt").write(index_lines.join("\n"))
+
+puts "Wrote #{SITE.join("llms.txt")} (#{md_files.size} entries)"

data/test/workos/test_actions.rb

@@ -49,6 +49,15 @@ class ActionsTest < Minitest::Test
     end
   end
 
+  def test_verify_header_raises_on_future_timestamp
+    payload = '{"x":1}'
+    future_ts = now_ms + 60_000 # 60s ahead, beyond default 30s tolerance
+    sig = OpenSSL::HMAC.hexdigest("SHA256", SECRET, "#{future_ts}.#{payload}")
+    assert_raises(WorkOS::SignatureVerificationError) do
+      @actions.verify_header(payload: payload, sig_header: "t=#{future_ts}, v1=#{sig}", secret: SECRET)
+    end
+  end
+
   def test_sign_response_authentication_allow
     resp = @actions.sign_response(action_type: "authentication", verdict: "Allow", secret: SECRET)
     assert_equal "authentication_action_response", resp["object"]

data/test/workos/test_admin_portal_model_round_trip.rb

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+require "test_helper"
+
+class AdminPortalModelRoundTripTest < Minitest::Test
+  def test_generate_link_round_trip
+    fixture = {
+      "return_url" => "stub",
+      "success_url" => "stub",
+      "organization" => "stub",
+      "intent" => "stub",
+      "it_contact_emails" => []
+    }
+    model = WorkOS::GenerateLink.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["organization"], json[:organization]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_portal_link_response_round_trip
+    fixture = {
+      "link" => "stub"
+    }
+    model = WorkOS::PortalLinkResponse.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["link"], json[:link]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+end

data/test/workos/test_api_keys.rb

@@ -11,6 +11,20 @@ class ApiKeysTest < Minitest::Test
     @client = WorkOS::Client.new(api_key: "sk_test_123")
   end
 
+  def test_list_organization_api_keys_returns_expected_result
+    stub_request(:get, %r{\Ahttps://api\.workos\.com/organizations/stub/api_keys(\?|\z)})
+      .to_return(body: '{"data": [], "list_metadata": {}}', status: 200)
+    result = @client.api_keys.list_organization_api_keys(organization_id: "stub")
+    assert_kind_of WorkOS::Types::ListStruct, result
+  end
+
+  def test_create_organization_api_key_returns_expected_result
+    stub_request(:post, %r{\Ahttps://api\.workos\.com/organizations/stub/api_keys(\?|\z)})
+      .to_return(body: "{}", status: 200)
+    result = @client.api_keys.create_organization_api_key(organization_id: "stub", name: "stub")
+    refute_nil result
+  end
+
   def test_create_validation_returns_expected_result
     stub_request(:post, %r{\Ahttps://api\.workos\.com/api_keys/validations(\?|\z)})
       .to_return(body: "{}", status: 200)
@@ -25,26 +39,20 @@ class ApiKeysTest < Minitest::Test
     assert_nil result
   end
 
-  def test_list_organization_api_keys_returns_expected_result
-    stub_request(:get, %r{\Ahttps://api\.workos\.com/organizations/stub/api_keys(\?|\z)})
-      .to_return(body: '{"data": [], "list_metadata": {}}', status: 200)
-    result = @client.api_keys.list_organization_api_keys(organization_id: "stub")
-    assert_kind_of WorkOS::Types::ListStruct, result
-  end
-
-  def test_create_organization_api_key_returns_expected_result
-    stub_request(:post, %r{\Ahttps://api\.workos\.com/organizations/stub/api_keys(\?|\z)})
+  def test_create_api_key_expire_returns_expected_result
+    stub_request(:post, %r{\Ahttps://api\.workos\.com/api_keys/stub/expire(\?|\z)})
       .to_return(body: "{}", status: 200)
-    result = @client.api_keys.create_organization_api_key(organization_id: "stub", name: "stub")
+    result = @client.api_keys.create_api_key_expire(id: "stub")
     refute_nil result
   end
 
   # Parameterized authentication error tests (one per endpoint).
   [
+    {name: :list_organization_api_keys, verb: :get, url: %r{\Ahttps://api\.workos\.com/organizations/stub/api_keys(\?|\z)}, args: {organization_id: "stub"}},
+    {name: :create_organization_api_key, verb: :post, url: %r{\Ahttps://api\.workos\.com/organizations/stub/api_keys(\?|\z)}, args: {organization_id: "stub", name: "stub"}},
     {name: :create_validation, verb: :post, url: %r{\Ahttps://api\.workos\.com/api_keys/validations(\?|\z)}, args: {value: "stub"}},
     {name: :delete_api_key, verb: :delete, url: %r{\Ahttps://api\.workos\.com/api_keys/stub(\?|\z)}, args: {id: "stub"}},
-    {name: :list_organization_api_keys, verb: :get, url: %r{\Ahttps://api\.workos\.com/organizations/stub/api_keys(\?|\z)}, args: {organization_id: "stub"}},
-    {name: :create_organization_api_key, verb: :post, url: %r{\Ahttps://api\.workos\.com/organizations/stub/api_keys(\?|\z)}, args: {organization_id: "stub", name: "stub"}}
+    {name: :create_api_key_expire, verb: :post, url: %r{\Ahttps://api\.workos\.com/api_keys/stub/expire(\?|\z)}, args: {id: "stub"}}
   ].each do |spec|
     define_method("test_#{spec[:name]}_raises_authentication_error_on_401") do
       stub_request(spec[:verb], spec[:url])

data/test/workos/test_audit_logs_model_round_trip.rb

@@ -0,0 +1,218 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+require "test_helper"
+
+class AuditLogsModelRoundTripTest < Minitest::Test
+  def test_audit_log_event_actor_round_trip
+    fixture = {
+      "id" => "stub",
+      "type" => "stub",
+      "name" => "stub",
+      "metadata" => {}
+    }
+    model = WorkOS::AuditLogEventActor.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["id"], json[:id]
+    assert_equal fixture["type"], json[:type]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_audit_log_event_target_round_trip
+    fixture = {
+      "id" => "stub",
+      "type" => "stub",
+      "name" => "stub",
+      "metadata" => {}
+    }
+    model = WorkOS::AuditLogEventTarget.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["id"], json[:id]
+    assert_equal fixture["type"], json[:type]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_audit_log_event_context_round_trip
+    fixture = {
+      "location" => "stub",
+      "user_agent" => "stub"
+    }
+    model = WorkOS::AuditLogEventContext.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["location"], json[:location]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_audit_log_event_round_trip
+    fixture = {
+      "action" => "stub",
+      "occurred_at" => "stub",
+      "actor" => {},
+      "targets" => [],
+      "context" => {},
+      "metadata" => {},
+      "version" => 1
+    }
+    model = WorkOS::AuditLogEvent.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["action"], json[:action]
+    assert_equal fixture["occurred_at"], json[:occurred_at]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_audit_log_event_ingestion_round_trip
+    fixture = {
+      "organization_id" => "stub",
+      "event" => {}
+    }
+    model = WorkOS::AuditLogEventIngestion.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["organization_id"], json[:organization_id]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_audit_log_export_creation_round_trip
+    fixture = {
+      "organization_id" => "stub",
+      "range_start" => "stub",
+      "range_end" => "stub",
+      "actions" => [],
+      "actors" => [],
+      "actor_names" => [],
+      "actor_ids" => [],
+      "targets" => []
+    }
+    model = WorkOS::AuditLogExportCreation.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["organization_id"], json[:organization_id]
+    assert_equal fixture["range_start"], json[:range_start]
+    assert_equal fixture["range_end"], json[:range_end]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_audit_log_schema_actor_input_round_trip
+    fixture = {
+      "metadata" => {}
+    }
+    model = WorkOS::AuditLogSchemaActorInput.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_audit_log_schema_target_input_round_trip
+    fixture = {
+      "type" => "stub",
+      "metadata" => {}
+    }
+    model = WorkOS::AuditLogSchemaTargetInput.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["type"], json[:type]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_audit_log_schema_input_round_trip
+    fixture = {
+      "actor" => {},
+      "targets" => [],
+      "metadata" => {}
+    }
+    model = WorkOS::AuditLogSchemaInput.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_audit_log_event_create_response_round_trip
+    fixture = {
+      "success" => true
+    }
+    model = WorkOS::AuditLogEventCreateResponse.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["success"], json[:success]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_audit_log_export_round_trip
+    fixture = {
+      "object" => "audit_log_export",
+      "id" => "stub",
+      "state" => "stub",
+      "url" => nil,
+      "created_at" => "stub",
+      "updated_at" => "stub"
+    }
+    model = WorkOS::AuditLogExport.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["id"], json[:id]
+    assert_equal fixture["created_at"], json[:created_at]
+    assert_equal fixture["updated_at"], json[:updated_at]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_audit_log_schema_round_trip
+    fixture = {
+      "object" => "audit_log_schema",
+      "version" => 1,
+      "actor" => {},
+      "targets" => [],
+      "metadata" => {},
+      "created_at" => "stub"
+    }
+    model = WorkOS::AuditLogSchema.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["version"], json[:version]
+    assert_equal fixture["created_at"], json[:created_at]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_audit_log_action_round_trip
+    fixture = {
+      "object" => "audit_log_action",
+      "name" => "stub",
+      "schema" => {},
+      "created_at" => "stub",
+      "updated_at" => "stub"
+    }
+    model = WorkOS::AuditLogAction.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["name"], json[:name]
+    assert_equal fixture["created_at"], json[:created_at]
+    assert_equal fixture["updated_at"], json[:updated_at]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_audit_log_schema_actor_round_trip
+    fixture = {
+      "metadata" => {}
+    }
+    model = WorkOS::AuditLogSchemaActor.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_audit_log_schema_target_round_trip
+    fixture = {
+      "type" => "stub",
+      "metadata" => {}
+    }
+    model = WorkOS::AuditLogSchemaTarget.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["type"], json[:type]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+end

data/test/workos/test_authorization.rb

@@ -11,6 +11,48 @@ class AuthorizationTest < Minitest::Test
     @client = WorkOS::Client.new(api_key: "sk_test_123")
   end
 
+  def test_list_group_role_assignments_returns_expected_result
+    stub_request(:get, %r{\Ahttps://api\.workos\.com/authorization/groups/stub/role_assignments(\?|\z)})
+      .to_return(body: '{"data": [], "list_metadata": {}}', status: 200)
+    result = @client.authorization.list_group_role_assignments(group_id: "stub")
+    assert_kind_of WorkOS::Types::ListStruct, result
+  end
+
+  def test_create_group_role_assignment_returns_expected_result
+    stub_request(:post, %r{\Ahttps://api\.workos\.com/authorization/groups/stub/role_assignments(\?|\z)})
+      .to_return(body: "{}", status: 200)
+    result = @client.authorization.create_group_role_assignment(group_id: "stub", role_slug: "stub")
+    refute_nil result
+  end
+
+  def test_update_group_role_assignments_returns_expected_result
+    stub_request(:put, %r{\Ahttps://api\.workos\.com/authorization/groups/stub/role_assignments(\?|\z)})
+      .to_return(body: '{"data": [], "list_metadata": {}}', status: 200)
+    result = @client.authorization.update_group_role_assignments(group_id: "stub", role_assignments: [{}])
+    assert_kind_of WorkOS::Types::ListStruct, result
+  end
+
+  def test_delete_group_role_assignments_returns_expected_result
+    stub_request(:delete, %r{\Ahttps://api\.workos\.com/authorization/groups/stub/role_assignments(\?|\z)})
+      .to_return(body: "{}", status: 200)
+    result = @client.authorization.delete_group_role_assignments(group_id: "stub", role_slug: "stub")
+    assert_nil result
+  end
+
+  def test_get_group_role_assignment_returns_expected_result
+    stub_request(:get, %r{\Ahttps://api\.workos\.com/authorization/groups/stub/role_assignments/stub(\?|\z)})
+      .to_return(body: "{}", status: 200)
+    result = @client.authorization.get_group_role_assignment(group_id: "stub", role_assignment_id: "stub")
+    refute_nil result
+  end
+
+  def test_delete_group_role_assignment_returns_expected_result
+    stub_request(:delete, %r{\Ahttps://api\.workos\.com/authorization/groups/stub/role_assignments/stub(\?|\z)})
+      .to_return(body: "{}", status: 200)
+    result = @client.authorization.delete_group_role_assignment(group_id: "stub", role_assignment_id: "stub")
+    assert_nil result
+  end
+
   def test_check_returns_expected_result
     stub_request(:post, %r{\Ahttps://api\.workos\.com/authorization/organization_memberships/stub/check(\?|\z)})
       .with(body: hash_including("permission_slug" => "stub", "resource_id" => "stub"))
@@ -192,6 +234,13 @@ class AuthorizationTest < Minitest::Test
     assert_kind_of WorkOS::Types::ListStruct, result
   end
 
+  def test_list_role_assignments_for_resource_by_external_id_returns_expected_result
+    stub_request(:get, %r{\Ahttps://api\.workos\.com/authorization/organizations/stub/resources/stub/stub/role_assignments(\?|\z)})
+      .to_return(body: '{"data": [], "list_metadata": {}}', status: 200)
+    result = @client.authorization.list_role_assignments_for_resource_by_external_id(organization_id: "stub", resource_type_slug: "stub", external_id: "stub")
+    assert_kind_of WorkOS::Types::ListStruct, result
+  end
+
   def test_list_resources_returns_expected_result
     stub_request(:get, %r{\Ahttps://api\.workos\.com/authorization/resources(\?|\z)})
       .to_return(body: '{"data": [], "list_metadata": {}}', status: 200)
@@ -259,6 +308,13 @@ class AuthorizationTest < Minitest::Test
     assert_kind_of WorkOS::Types::ListStruct, result
   end
 
+  def test_list_role_assignments_for_resource_returns_expected_result
+    stub_request(:get, %r{\Ahttps://api\.workos\.com/authorization/resources/stub/role_assignments(\?|\z)})
+      .to_return(body: '{"data": [], "list_metadata": {}}', status: 200)
+    result = @client.authorization.list_role_assignments_for_resource(resource_id: "stub")
+    assert_kind_of WorkOS::Types::ListStruct, result
+  end
+
   def test_list_environment_roles_returns_expected_result
     stub_request(:get, %r{\Ahttps://api\.workos\.com/authorization/roles(\?|\z)})
       .to_return(body: "{}", status: 200)
@@ -338,6 +394,12 @@ class AuthorizationTest < Minitest::Test
 
   # Parameterized authentication error tests (one per endpoint).
   [
+    {name: :list_group_role_assignments, verb: :get, url: %r{\Ahttps://api\.workos\.com/authorization/groups/stub/role_assignments(\?|\z)}, args: {group_id: "stub"}},
+    {name: :create_group_role_assignment, verb: :post, url: %r{\Ahttps://api\.workos\.com/authorization/groups/stub/role_assignments(\?|\z)}, args: {group_id: "stub", role_slug: "stub"}},
+    {name: :update_group_role_assignments, verb: :put, url: %r{\Ahttps://api\.workos\.com/authorization/groups/stub/role_assignments(\?|\z)}, args: {group_id: "stub", role_assignments: [{}]}},
+    {name: :delete_group_role_assignments, verb: :delete, url: %r{\Ahttps://api\.workos\.com/authorization/groups/stub/role_assignments(\?|\z)}, args: {group_id: "stub", role_slug: "stub"}},
+    {name: :get_group_role_assignment, verb: :get, url: %r{\Ahttps://api\.workos\.com/authorization/groups/stub/role_assignments/stub(\?|\z)}, args: {group_id: "stub", role_assignment_id: "stub"}},
+    {name: :delete_group_role_assignment, verb: :delete, url: %r{\Ahttps://api\.workos\.com/authorization/groups/stub/role_assignments/stub(\?|\z)}, args: {group_id: "stub", role_assignment_id: "stub"}},
     {name: :check, verb: :post, url: %r{\Ahttps://api\.workos\.com/authorization/organization_memberships/stub/check(\?|\z)}, args: {organization_membership_id: "stub", permission_slug: "stub", resource_target: WorkOS::Authorization::ResourceTargetById.new(resource_id: "stub")}},
     {name: :list_resources_for_membership, verb: :get, url: %r{\Ahttps://api\.workos\.com/authorization/organization_memberships/stub/resources(\?|\z)}, args: {organization_membership_id: "stub", permission_slug: "stub", parent_resource: WorkOS::Authorization::ParentResourceById.new(parent_resource_id: "stub")}},
     {name: :list_effective_permissions, verb: :get, url: %r{\Ahttps://api\.workos\.com/authorization/organization_memberships/stub/resources/stub/permissions(\?|\z)}, args: {organization_membership_id: "stub", resource_id: "stub"}},
@@ -358,12 +420,14 @@ class AuthorizationTest < Minitest::Test
     {name: :update_resource_by_external_id, verb: :patch, url: %r{\Ahttps://api\.workos\.com/authorization/organizations/stub/resources/stub/stub(\?|\z)}, args: {organization_id: "stub", resource_type_slug: "stub", external_id: "stub", parent_resource: WorkOS::Authorization::ParentResourceById.new(parent_resource_id: "stub")}},
     {name: :delete_resource_by_external_id, verb: :delete, url: %r{\Ahttps://api\.workos\.com/authorization/organizations/stub/resources/stub/stub(\?|\z)}, args: {organization_id: "stub", resource_type_slug: "stub", external_id: "stub"}},
     {name: :list_memberships_for_resource_by_external_id, verb: :get, url: %r{\Ahttps://api\.workos\.com/authorization/organizations/stub/resources/stub/stub/organization_memberships(\?|\z)}, args: {organization_id: "stub", resource_type_slug: "stub", external_id: "stub", permission_slug: "stub"}},
+    {name: :list_role_assignments_for_resource_by_external_id, verb: :get, url: %r{\Ahttps://api\.workos\.com/authorization/organizations/stub/resources/stub/stub/role_assignments(\?|\z)}, args: {organization_id: "stub", resource_type_slug: "stub", external_id: "stub"}},
     {name: :list_resources, verb: :get, url: %r{\Ahttps://api\.workos\.com/authorization/resources(\?|\z)}, args: {parent: WorkOS::Authorization::ParentById.new(parent_resource_id: "stub")}},
     {name: :create_resource, verb: :post, url: %r{\Ahttps://api\.workos\.com/authorization/resources(\?|\z)}, args: {external_id: "stub", name: "stub", resource_type_slug: "stub", organization_id: "stub", parent_resource: WorkOS::Authorization::ParentResourceById.new(parent_resource_id: "stub")}},
     {name: :get_resource, verb: :get, url: %r{\Ahttps://api\.workos\.com/authorization/resources/stub(\?|\z)}, args: {resource_id: "stub"}},
     {name: :update_resource, verb: :patch, url: %r{\Ahttps://api\.workos\.com/authorization/resources/stub(\?|\z)}, args: {resource_id: "stub", parent_resource: WorkOS::Authorization::ParentResourceById.new(parent_resource_id: "stub")}},
     {name: :delete_resource, verb: :delete, url: %r{\Ahttps://api\.workos\.com/authorization/resources/stub(\?|\z)}, args: {resource_id: "stub"}},
     {name: :list_memberships_for_resource, verb: :get, url: %r{\Ahttps://api\.workos\.com/authorization/resources/stub/organization_memberships(\?|\z)}, args: {resource_id: "stub", permission_slug: "stub"}},
+    {name: :list_role_assignments_for_resource, verb: :get, url: %r{\Ahttps://api\.workos\.com/authorization/resources/stub/role_assignments(\?|\z)}, args: {resource_id: "stub"}},
     {name: :list_environment_roles, verb: :get, url: %r{\Ahttps://api\.workos\.com/authorization/roles(\?|\z)}},
     {name: :create_environment_role, verb: :post, url: %r{\Ahttps://api\.workos\.com/authorization/roles(\?|\z)}, args: {slug: "stub", name: "stub"}},
     {name: :get_environment_role, verb: :get, url: %r{\Ahttps://api\.workos\.com/authorization/roles/stub(\?|\z)}, args: {slug: "stub"}},