workos 7.1.2 → 9.5.0

data/test/workos/test_radar_model_round_trip.rb

@@ -0,0 +1,85 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+require "test_helper"
+
+class RadarModelRoundTripTest < Minitest::Test
+  def test_radar_standalone_response_round_trip
+    fixture = {
+      "verdict" => "stub",
+      "reason" => "stub",
+      "attempt_id" => "stub",
+      "control" => "stub",
+      "blocklist_type" => "stub"
+    }
+    model = WorkOS::RadarStandaloneResponse.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["reason"], json[:reason]
+    assert_equal fixture["attempt_id"], json[:attempt_id]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_radar_list_entry_already_present_response_round_trip
+    fixture = {
+      "message" => "stub"
+    }
+    model = WorkOS::RadarListEntryAlreadyPresentResponse.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["message"], json[:message]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_radar_standalone_assess_request_round_trip
+    fixture = {
+      "ip_address" => "stub",
+      "user_agent" => "stub",
+      "email" => "stub",
+      "auth_method" => "stub",
+      "action" => "stub",
+      "signals_id" => "stub"
+    }
+    model = WorkOS::RadarStandaloneAssessRequest.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["ip_address"], json[:ip_address]
+    assert_equal fixture["user_agent"], json[:user_agent]
+    assert_equal fixture["email"], json[:email]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_radar_standalone_update_radar_attempt_request_round_trip
+    fixture = {
+      "challenge_status" => "success",
+      "attempt_status" => "success"
+    }
+    model = WorkOS::RadarStandaloneUpdateRadarAttemptRequest.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_radar_standalone_update_radar_list_request_round_trip
+    fixture = {
+      "entry" => "stub"
+    }
+    model = WorkOS::RadarStandaloneUpdateRadarListRequest.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["entry"], json[:entry]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_radar_standalone_delete_radar_list_entry_request_round_trip
+    fixture = {
+      "entry" => "stub"
+    }
+    model = WorkOS::RadarStandaloneDeleteRadarListEntryRequest.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["entry"], json[:entry]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+end

data/test/workos/test_session.rb

@@ -26,11 +26,27 @@ class SessionTest < Minitest::Test
 
   def test_unseal_with_wrong_key_raises
     sealed = @sm.seal_data({"x" => 1}, PASSWORD)
+    # Wrong key is the same length (>= 32 bytes) so the length guard doesn't
+    # short-circuit; we want to assert the underlying cipher rejection.
     assert_raises(OpenSSL::Cipher::CipherError) do
-      @sm.unseal_data(sealed, "wrong-password")
+      @sm.unseal_data(sealed, "wrong-cookie-password-32-bytes--")
     end
   end
 
+  def test_unseal_with_short_key_raises_argument_error
+    sealed = @sm.seal_data({"x" => 1}, PASSWORD)
+    assert_raises(ArgumentError) { @sm.unseal_data(sealed, "too-short") }
+  end
+
+  def test_seal_with_short_key_raises_argument_error
+    assert_raises(ArgumentError) { @sm.seal_data({"x" => 1}, "too-short") }
+  end
+
+  def test_session_load_requires_min_length_cookie_password
+    short = "x" * 31
+    assert_raises(ArgumentError) { @sm.load(seal_data: "x", cookie_password: short) }
+  end
+
   def test_unseal_rejects_short_payload
     assert_raises(ArgumentError) do
       @sm.unseal_data(Base64.strict_encode64("short"), PASSWORD)
@@ -334,6 +350,19 @@ class SessionTest < Minitest::Test
     assert_equal WorkOS::SessionManager::INVALID_SESSION_COOKIE, result.reason
   end
 
+  def test_refresh_raises_argument_error_for_short_cookie_password_override
+    sealed = @sm.seal_data({"access_token" => "at", "refresh_token" => "rt"}, PASSWORD)
+    session = @sm.load(seal_data: sealed, cookie_password: PASSWORD)
+    err = assert_raises(ArgumentError) { session.refresh(cookie_password: "x" * 31) }
+    assert_match(/at least 32 bytes/, err.message)
+  end
+
+  def test_refresh_raises_argument_error_for_empty_cookie_password_override
+    sealed = @sm.seal_data({"access_token" => "at", "refresh_token" => "rt"}, PASSWORD)
+    session = @sm.load(seal_data: sealed, cookie_password: PASSWORD)
+    assert_raises(ArgumentError) { session.refresh(cookie_password: "") }
+  end
+
   def test_refresh_returns_error_when_no_refresh_token
     sealed = @sm.seal_data({"access_token" => "at_only"}, PASSWORD)
     result = @sm.refresh(seal_data: sealed, cookie_password: PASSWORD)
@@ -361,7 +390,7 @@ class SessionTest < Minitest::Test
     assert_requested(stub)
   end
 
-  def test_refresh_returns_error_on_malformed_access_token_without_mutating_state
+  def test_refresh_persists_seal_data_even_when_access_token_decode_fails
     rsa, pub = signing_key_pair
     old_access = make_jwt({"sid" => "session_old", "exp" => Time.now.to_i - 60}, rsa)
     sealed = @sm.seal_data({"access_token" => old_access, "refresh_token" => "rt_old", "user" => {"id" => "u_1"}}, PASSWORD)
@@ -383,8 +412,18 @@ class SessionTest < Minitest::Test
     assert_kind_of WorkOS::SessionManager::RefreshError, result
     refute result.authenticated
 
-    # Session state should not have been mutated
-    assert_equal sealed, session.seal_data
+    # Session state IS updated to the freshly-sealed cookie before decode runs,
+    # so a transient JWT/JWKS failure leaves a usable seal the caller can
+    # re-#authenticate against rather than half-updated state pinned to the
+    # stale (already-rotated) refresh token.
+    refute_equal sealed, session.seal_data
+    refute_nil session.seal_data
+
+    # The rotated cookie is also reachable through the RefreshError result, so a
+    # caller that doesn't retain the Session object across requests (typical in
+    # a Rails request cycle) can still write the new cookie back to the browser
+    # rather than re-sending the now-revoked refresh token on the next request.
+    assert_equal session.seal_data, result.sealed_session
   end
 
   # --- Session constructor validation ---------------------------------------

data/test/workos/test_shared_model_round_trip.rb

@@ -0,0 +1,92 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+require "test_helper"
+
+class SharedModelRoundTripTest < Minitest::Test
+  def test_connect_application_oauth_round_trip
+    fixture = {
+      "object" => "connect_application",
+      "id" => "stub",
+      "client_id" => "stub",
+      "description" => nil,
+      "name" => "stub",
+      "scopes" => [],
+      "created_at" => "stub",
+      "updated_at" => "stub",
+      "application_type" => "oauth",
+      "redirect_uris" => [],
+      "uses_pkce" => true,
+      "is_first_party" => true,
+      "was_dynamically_registered" => true,
+      "organization_id" => "stub"
+    }
+    model = WorkOS::ConnectApplicationOAuth.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["id"], json[:id]
+    assert_equal fixture["client_id"], json[:client_id]
+    assert_nil json[:description]
+    assert_equal fixture["name"], json[:name]
+    assert_equal fixture["created_at"], json[:created_at]
+    assert_equal fixture["updated_at"], json[:updated_at]
+    assert_equal fixture["uses_pkce"], json[:uses_pkce]
+    assert_equal fixture["is_first_party"], json[:is_first_party]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_connect_application_oauth_redirect_uris_round_trip
+    fixture = {
+      "uri" => "stub",
+      "default" => true
+    }
+    model = WorkOS::ConnectApplicationOAuthRedirectUris.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["uri"], json[:uri]
+    assert_equal fixture["default"], json[:default]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_connect_application_m2m_round_trip
+    fixture = {
+      "object" => "connect_application",
+      "id" => "stub",
+      "client_id" => "stub",
+      "description" => nil,
+      "name" => "stub",
+      "scopes" => [],
+      "created_at" => "stub",
+      "updated_at" => "stub",
+      "application_type" => "m2m",
+      "organization_id" => "stub"
+    }
+    model = WorkOS::ConnectApplicationM2M.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["id"], json[:id]
+    assert_equal fixture["client_id"], json[:client_id]
+    assert_nil json[:description]
+    assert_equal fixture["name"], json[:name]
+    assert_equal fixture["created_at"], json[:created_at]
+    assert_equal fixture["updated_at"], json[:updated_at]
+    assert_equal fixture["organization_id"], json[:organization_id]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_authorized_connect_application_list_data_round_trip
+    fixture = {
+      "object" => "authorized_connect_application",
+      "id" => "stub",
+      "granted_scopes" => [],
+      "oauth_resource" => "stub",
+      "application" => {}
+    }
+    model = WorkOS::AuthorizedConnectApplicationListData.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["id"], json[:id]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+end

data/test/workos/test_user_management.rb

@@ -21,7 +21,7 @@ class UserManagementTest < Minitest::Test
   def test_create_authenticate_returns_expected_result
     stub_request(:post, %r{\Ahttps://api\.workos\.com/user_management/authenticate(\?|\z)})
       .to_return(body: "{}", status: 200)
-    result = @client.user_management.create_authenticate(client_id: "stub", client_secret: "stub", grant_type: "authorization_code", code: "stub")
+    result = @client.user_management.create_authenticate(client_id: "stub", grant_type: "authorization_code", code: "stub")
     refute_nil result
   end
 
@@ -145,6 +145,36 @@ class UserManagementTest < Minitest::Test
     end
   end
 
+  def test_authenticate_with_radar_email_challenge_returns_expected_result
+    stub_request(:post, %r{\Ahttps://api\.workos\.com/user_management/authenticate(\?|\z)})
+      .to_return(body: "{}", status: 200)
+    result = @client.user_management.authenticate_with_radar_email_challenge(code: "stub", radar_challenge_id: "stub", pending_authentication_token: "stub")
+    refute_nil result
+  end
+
+  def test_authenticate_with_radar_email_challenge_raises_authentication_error_on_401
+    stub_request(:post, %r{\Ahttps://api\.workos\.com/user_management/authenticate(\?|\z)})
+      .to_return(body: '{"message": "Unauthorized"}', status: 401)
+    assert_raises(WorkOS::AuthenticationError) do
+      @client.user_management.authenticate_with_radar_email_challenge(code: "stub", radar_challenge_id: "stub", pending_authentication_token: "stub")
+    end
+  end
+
+  def test_authenticate_with_radar_sms_challenge_returns_expected_result
+    stub_request(:post, %r{\Ahttps://api\.workos\.com/user_management/authenticate(\?|\z)})
+      .to_return(body: "{}", status: 200)
+    result = @client.user_management.authenticate_with_radar_sms_challenge(code: "stub", verification_id: "stub", phone_number: "stub", pending_authentication_token: "stub")
+    refute_nil result
+  end
+
+  def test_authenticate_with_radar_sms_challenge_raises_authentication_error_on_401
+    stub_request(:post, %r{\Ahttps://api\.workos\.com/user_management/authenticate(\?|\z)})
+      .to_return(body: '{"message": "Unauthorized"}', status: 401)
+    assert_raises(WorkOS::AuthenticationError) do
+      @client.user_management.authenticate_with_radar_sms_challenge(code: "stub", verification_id: "stub", phone_number: "stub", pending_authentication_token: "stub")
+    end
+  end
+
   def test_create_device_returns_expected_result
     stub_request(:post, %r{\Ahttps://api\.workos\.com/user_management/authorize/device(\?|\z)})
       .to_return(body: "{}", status: 200)
@@ -152,6 +182,13 @@ class UserManagementTest < Minitest::Test
     refute_nil result
   end
 
+  def test_create_radar_challenge_returns_expected_result
+    stub_request(:post, %r{\Ahttps://api\.workos\.com/user_management/radar_challenges(\?|\z)})
+      .to_return(body: "{}", status: 200)
+    result = @client.user_management.create_radar_challenge(user_id: "stub", pending_authentication_token: "stub", phone_number: "stub")
+    refute_nil result
+  end
+
   def test_revoke_session_returns_expected_result
     stub_request(:post, %r{\Ahttps://api\.workos\.com/user_management/sessions/revoke(\?|\z)})
       .to_return(body: "{}", status: 200)
@@ -159,6 +196,13 @@ class UserManagementTest < Minitest::Test
     assert_nil result
   end
 
+  def test_list_cors_origins_returns_expected_result
+    stub_request(:get, %r{\Ahttps://api\.workos\.com/user_management/cors_origins(\?|\z)})
+      .to_return(body: '{"data": [], "list_metadata": {}}', status: 200)
+    result = @client.user_management.list_cors_origins
+    assert_kind_of WorkOS::Types::ListStruct, result
+  end
+
   def test_create_cors_origin_returns_expected_result
     stub_request(:post, %r{\Ahttps://api\.workos\.com/user_management/cors_origins(\?|\z)})
       .to_return(body: "{}", status: 200)
@@ -345,6 +389,13 @@ class UserManagementTest < Minitest::Test
     refute_nil result
   end
 
+  def test_list_jwt_template_returns_expected_result
+    stub_request(:get, %r{\Ahttps://api\.workos\.com/user_management/jwt_template(\?|\z)})
+      .to_return(body: "{}", status: 200)
+    result = @client.user_management.list_jwt_template
+    refute_nil result
+  end
+
   def test_update_jwt_template_returns_expected_result
     stub_request(:put, %r{\Ahttps://api\.workos\.com/user_management/jwt_template(\?|\z)})
       .to_return(body: "{}", status: 200)
@@ -366,73 +417,13 @@ class UserManagementTest < Minitest::Test
     refute_nil result
   end
 
-  def test_list_organization_memberships_returns_expected_result
-    stub_request(:get, %r{\Ahttps://api\.workos\.com/user_management/organization_memberships(\?|\z)})
+  def test_list_redirect_uris_returns_expected_result
+    stub_request(:get, %r{\Ahttps://api\.workos\.com/user_management/redirect_uris(\?|\z)})
       .to_return(body: '{"data": [], "list_metadata": {}}', status: 200)
-    result = @client.user_management.list_organization_memberships
+    result = @client.user_management.list_redirect_uris
     assert_kind_of WorkOS::Types::ListStruct, result
   end
 
-  def test_create_organization_membership_returns_expected_result
-    stub_request(:post, %r{\Ahttps://api\.workos\.com/user_management/organization_memberships(\?|\z)})
-      .with(body: hash_including("user_id" => "stub", "organization_id" => "stub", "role_slug" => "stub"))
-      .to_return(body: "{}", status: 200)
-    result = @client.user_management.create_organization_membership(user_id: "stub", organization_id: "stub", role: WorkOS::UserManagement::RoleSingle.new(role_slug: "stub"))
-    refute_nil result
-  end
-
-  def test_create_organization_membership_with_role_multiple_returns_expected_result
-    stub_request(:post, %r{\Ahttps://api\.workos\.com/user_management/organization_memberships(\?|\z)})
-      .with(body: hash_including("user_id" => "stub", "organization_id" => "stub", "role_slugs" => ["stub"]))
-      .to_return(body: "{}", status: 200)
-    result = @client.user_management.create_organization_membership(user_id: "stub", organization_id: "stub", role: WorkOS::UserManagement::RoleMultiple.new(role_slugs: ["stub"]))
-    refute_nil result
-  end
-
-  def test_get_organization_membership_returns_expected_result
-    stub_request(:get, %r{\Ahttps://api\.workos\.com/user_management/organization_memberships/stub(\?|\z)})
-      .to_return(body: "{}", status: 200)
-    result = @client.user_management.get_organization_membership(id: "stub")
-    refute_nil result
-  end
-
-  def test_update_organization_membership_returns_expected_result
-    stub_request(:put, %r{\Ahttps://api\.workos\.com/user_management/organization_memberships/stub(\?|\z)})
-      .with(body: hash_including("role_slug" => "stub"))
-      .to_return(body: "{}", status: 200)
-    result = @client.user_management.update_organization_membership(id: "stub", role: WorkOS::UserManagement::RoleSingle.new(role_slug: "stub"))
-    refute_nil result
-  end
-
-  def test_update_organization_membership_with_role_multiple_returns_expected_result
-    stub_request(:put, %r{\Ahttps://api\.workos\.com/user_management/organization_memberships/stub(\?|\z)})
-      .with(body: hash_including("role_slugs" => ["stub"]))
-      .to_return(body: "{}", status: 200)
-    result = @client.user_management.update_organization_membership(id: "stub", role: WorkOS::UserManagement::RoleMultiple.new(role_slugs: ["stub"]))
-    refute_nil result
-  end
-
-  def test_delete_organization_membership_returns_expected_result
-    stub_request(:delete, %r{\Ahttps://api\.workos\.com/user_management/organization_memberships/stub(\?|\z)})
-      .to_return(body: "{}", status: 200)
-    result = @client.user_management.delete_organization_membership(id: "stub")
-    assert_nil result
-  end
-
-  def test_deactivate_organization_membership_returns_expected_result
-    stub_request(:put, %r{\Ahttps://api\.workos\.com/user_management/organization_memberships/stub/deactivate(\?|\z)})
-      .to_return(body: "{}", status: 200)
-    result = @client.user_management.deactivate_organization_membership(id: "stub")
-    refute_nil result
-  end
-
-  def test_reactivate_organization_membership_returns_expected_result
-    stub_request(:put, %r{\Ahttps://api\.workos\.com/user_management/organization_memberships/stub/reactivate(\?|\z)})
-      .to_return(body: "{}", status: 200)
-    result = @client.user_management.reactivate_organization_membership(id: "stub")
-    refute_nil result
-  end
-
   def test_create_redirect_uri_returns_expected_result
     stub_request(:post, %r{\Ahttps://api\.workos\.com/user_management/redirect_uris(\?|\z)})
       .to_return(body: "{}", status: 200)
@@ -454,12 +445,28 @@ class UserManagementTest < Minitest::Test
     assert_nil result
   end
 
+  def test_list_user_api_keys_returns_expected_result
+    stub_request(:get, %r{\Ahttps://api\.workos\.com/user_management/users/stub/api_keys(\?|\z)})
+      .to_return(body: '{"data": [], "list_metadata": {}}', status: 200)
+    result = @client.user_management.list_user_api_keys(user_id: "stub")
+    assert_kind_of WorkOS::Types::ListStruct, result
+  end
+
+  def test_create_user_api_key_returns_expected_result
+    stub_request(:post, %r{\Ahttps://api\.workos\.com/user_management/users/stub/api_keys(\?|\z)})
+      .to_return(body: "{}", status: 200)
+    result = @client.user_management.create_user_api_key(user_id: "stub", name: "stub", organization_id: "stub")
+    refute_nil result
+  end
+
   # Parameterized authentication error tests (one per endpoint).
   [
     {name: :get_jwks, verb: :get, url: %r{\Ahttps://api\.workos\.com/sso/jwks/stub(\?|\z)}, args: {client_id: "stub"}},
-    {name: :create_authenticate, verb: :post, url: %r{\Ahttps://api\.workos\.com/user_management/authenticate(\?|\z)}, args: {client_id: "stub", client_secret: "stub", grant_type: "authorization_code", code: "stub"}},
+    {name: :create_authenticate, verb: :post, url: %r{\Ahttps://api\.workos\.com/user_management/authenticate(\?|\z)}, args: {client_id: "stub", grant_type: "authorization_code", code: "stub"}},
     {name: :create_device, verb: :post, url: %r{\Ahttps://api\.workos\.com/user_management/authorize/device(\?|\z)}, args: {client_id: "stub"}},
+    {name: :create_radar_challenge, verb: :post, url: %r{\Ahttps://api\.workos\.com/user_management/radar_challenges(\?|\z)}, args: {user_id: "stub", pending_authentication_token: "stub", phone_number: "stub"}},
     {name: :revoke_session, verb: :post, url: %r{\Ahttps://api\.workos\.com/user_management/sessions/revoke(\?|\z)}, args: {session_id: "stub"}},
+    {name: :list_cors_origins, verb: :get, url: %r{\Ahttps://api\.workos\.com/user_management/cors_origins(\?|\z)}},
     {name: :create_cors_origin, verb: :post, url: %r{\Ahttps://api\.workos\.com/user_management/cors_origins(\?|\z)}, args: {origin: "stub"}},
     {name: :get_email_verification, verb: :get, url: %r{\Ahttps://api\.workos\.com/user_management/email_verification/stub(\?|\z)}, args: {id: "stub"}},
     {name: :reset_password, verb: :post, url: %r{\Ahttps://api\.workos\.com/user_management/password_reset(\?|\z)}, args: {email: "stub"}},
@@ -484,19 +491,16 @@ class UserManagementTest < Minitest::Test
     {name: :accept_invitation, verb: :post, url: %r{\Ahttps://api\.workos\.com/user_management/invitations/stub/accept(\?|\z)}, args: {id: "stub"}},
     {name: :resend_invitation, verb: :post, url: %r{\Ahttps://api\.workos\.com/user_management/invitations/stub/resend(\?|\z)}, args: {id: "stub"}},
     {name: :revoke_invitation, verb: :post, url: %r{\Ahttps://api\.workos\.com/user_management/invitations/stub/revoke(\?|\z)}, args: {id: "stub"}},
+    {name: :list_jwt_template, verb: :get, url: %r{\Ahttps://api\.workos\.com/user_management/jwt_template(\?|\z)}},
     {name: :update_jwt_template, verb: :put, url: %r{\Ahttps://api\.workos\.com/user_management/jwt_template(\?|\z)}, args: {content: "stub"}},
     {name: :create_magic_auth, verb: :post, url: %r{\Ahttps://api\.workos\.com/user_management/magic_auth(\?|\z)}, args: {email: "stub"}},
     {name: :get_magic_auth, verb: :get, url: %r{\Ahttps://api\.workos\.com/user_management/magic_auth/stub(\?|\z)}, args: {id: "stub"}},
-    {name: :list_organization_memberships, verb: :get, url: %r{\Ahttps://api\.workos\.com/user_management/organization_memberships(\?|\z)}},
-    {name: :create_organization_membership, verb: :post, url: %r{\Ahttps://api\.workos\.com/user_management/organization_memberships(\?|\z)}, args: {user_id: "stub", organization_id: "stub", role: WorkOS::UserManagement::RoleSingle.new(role_slug: "stub")}},
-    {name: :get_organization_membership, verb: :get, url: %r{\Ahttps://api\.workos\.com/user_management/organization_memberships/stub(\?|\z)}, args: {id: "stub"}},
-    {name: :update_organization_membership, verb: :put, url: %r{\Ahttps://api\.workos\.com/user_management/organization_memberships/stub(\?|\z)}, args: {id: "stub", role: WorkOS::UserManagement::RoleSingle.new(role_slug: "stub")}},
-    {name: :delete_organization_membership, verb: :delete, url: %r{\Ahttps://api\.workos\.com/user_management/organization_memberships/stub(\?|\z)}, args: {id: "stub"}},
-    {name: :deactivate_organization_membership, verb: :put, url: %r{\Ahttps://api\.workos\.com/user_management/organization_memberships/stub/deactivate(\?|\z)}, args: {id: "stub"}},
-    {name: :reactivate_organization_membership, verb: :put, url: %r{\Ahttps://api\.workos\.com/user_management/organization_memberships/stub/reactivate(\?|\z)}, args: {id: "stub"}},
+    {name: :list_redirect_uris, verb: :get, url: %r{\Ahttps://api\.workos\.com/user_management/redirect_uris(\?|\z)}},
     {name: :create_redirect_uri, verb: :post, url: %r{\Ahttps://api\.workos\.com/user_management/redirect_uris(\?|\z)}, args: {uri: "stub"}},
     {name: :list_user_authorized_applications, verb: :get, url: %r{\Ahttps://api\.workos\.com/user_management/users/stub/authorized_applications(\?|\z)}, args: {user_id: "stub"}},
-    {name: :delete_user_authorized_application, verb: :delete, url: %r{\Ahttps://api\.workos\.com/user_management/users/stub/authorized_applications/stub(\?|\z)}, args: {application_id: "stub", user_id: "stub"}}
+    {name: :delete_user_authorized_application, verb: :delete, url: %r{\Ahttps://api\.workos\.com/user_management/users/stub/authorized_applications/stub(\?|\z)}, args: {application_id: "stub", user_id: "stub"}},
+    {name: :list_user_api_keys, verb: :get, url: %r{\Ahttps://api\.workos\.com/user_management/users/stub/api_keys(\?|\z)}, args: {user_id: "stub"}},
+    {name: :create_user_api_key, verb: :post, url: %r{\Ahttps://api\.workos\.com/user_management/users/stub/api_keys(\?|\z)}, args: {user_id: "stub", name: "stub", organization_id: "stub"}}
   ].each do |spec|
     define_method("test_#{spec[:name]}_raises_authentication_error_on_401") do
       stub_request(spec[:verb], spec[:url])