workos 7.1.2 → 9.5.0

data/lib/workos/base_client.rb

@@ -134,7 +134,8 @@ module WorkOS
       attempt = 0
 
       loop do
-        log(:debug, "request start", method: request.method, path: request.path, attempt: attempt + 1)
+        loggable_path = redact_path(request.path)
+        log(:debug, "request start", method: request.method, path: loggable_path, attempt: attempt + 1)
         http = connection_for(base, timeout)
         response = http.request(request)
         return response if response.is_a?(Net::HTTPSuccess)
@@ -142,11 +143,11 @@ module WorkOS
         if attempt < retries && retryable?(response)
           attempt += 1
           inject_retry_idempotency_key(request)
-          log(:info, "request retry", method: request.method, path: request.path, attempt: attempt + 1, status: response.code.to_i)
+          log(:info, "request retry", method: request.method, path: loggable_path, attempt: attempt + 1, status: response.code.to_i)
           sleep(retry_delay(response, attempt))
           next
         end
-        log(:warn, "request error", method: request.method, path: request.path, status: response.code.to_i, request_id: response["x-request-id"] || response["X-Request-Id"])
+        log(:warn, "request error", method: request.method, path: loggable_path, status: response.code.to_i, request_id: response["x-request-id"] || response["X-Request-Id"])
         handle_error_response(response)
       rescue Net::OpenTimeout, Net::ReadTimeout,
         Errno::ECONNRESET, Errno::ECONNREFUSED,
@@ -155,17 +156,17 @@ module WorkOS
         if attempt < retries
           attempt += 1
           inject_retry_idempotency_key(request)
-          log(:info, "request retry", method: request.method, path: request.path, attempt: attempt + 1, error: e.class.name)
+          log(:info, "request retry", method: request.method, path: loggable_path, attempt: attempt + 1, error: e.class.name)
           sleep(retry_delay(nil, attempt))
           next
         end
-        log(:warn, "connection error", method: request.method, path: request.path, error: e.class.name, message: e.message)
+        log(:warn, "connection error", method: request.method, path: loggable_path, error: e.class.name, message: e.message)
         raise WorkOS::APIConnectionError.new(message: e.message)
       end
     end
 
     # Close all persistent connections cached by this client on the current
-    # fiber/thread.
+    # thread.
     #
     # Call this before forking (e.g. in a Puma `on_worker_boot` block) to
     # avoid sharing `Net::HTTP` sockets across processes.
@@ -179,6 +180,71 @@ module WorkOS
 
     private
 
+    # Redact path segments that carry bearer-equivalent tokens (e.g.
+    # `/user_management/invitations/by_token/<token>`,
+    # `/user_management/magic_auth/<token>`, password-reset / email-
+    # verification token paths) before the path is written to a logger.
+    # The WorkOS API exposes a small number of "by_token" endpoints whose
+    # path segments are themselves authentication material; redacting them
+    # here means the SDK never emits the token in its own log/retry/error
+    # messages even when the host application configures verbose logging.
+    REDACTED_TOKEN_PREFIXES = %w[
+      /user_management/invitations/by_token
+      /user_management/magic_auth
+      /user_management/password_reset
+      /user_management/email_verification
+    ].freeze
+    private_constant :REDACTED_TOKEN_PREFIXES
+
+    # Query-string keys whose values are bearer-equivalent or otherwise
+    # sensitive and should never appear in SDK log lines. Defense-in-depth
+    # for any path that flows through execute_request with a sensitive
+    # query parameter (most WorkOS-issued tokens are path segments or POST
+    # bodies, but a few flows — e.g. authorize/logout redirects — surface
+    # them in the query string).
+    REDACTED_QUERY_KEYS = %w[
+      token
+      code
+      code_challenge
+      code_verifier
+      session_id
+      refresh_token
+      access_token
+    ].freeze
+    private_constant :REDACTED_QUERY_KEYS
+
+    def redact_path(path)
+      return path if path.nil? || path.empty?
+
+      # Strip query string for the prefix match; reattach (scrubbed) after.
+      path_only, query = path.split("?", 2)
+      REDACTED_TOKEN_PREFIXES.each do |prefix|
+        next unless path_only.start_with?("#{prefix}/")
+
+        # Replace every segment after the matched prefix with "[REDACTED]".
+        remainder = path_only[(prefix.length + 1)..]
+        next if remainder.nil? || remainder.empty?
+
+        redacted = remainder.split("/").map { "[REDACTED]" }.join("/")
+        path_only = "#{prefix}/#{redacted}"
+        break
+      end
+      query ? "#{path_only}?#{redact_query(query)}" : path_only
+    end
+
+    def redact_query(query)
+      return query if query.nil? || query.empty?
+
+      query.split("&").map { |pair|
+        key, value = pair.split("=", 2)
+        if value && !value.empty? && REDACTED_QUERY_KEYS.include?(key)
+          "#{key}=[REDACTED]"
+        else
+          pair
+        end
+      }.join("&")
+    end
+
     def append_query(path, params)
       return path unless params.is_a?(Hash) && !params.empty?
 
@@ -236,8 +302,25 @@ module WorkOS
       "#{uri.scheme}:#{uri.host}:#{uri.port}:#{timeout}"
     end
 
+    # Per-fiber connection cache (non-inherited).
+    #
+    # Uses Thread.current[] (Ruby fiber-local storage) rather than
+    # Fiber[] (inheritable fiber storage). Fiber[] is inherited *by
+    # reference* by every child fiber and every child thread, so a live
+    # Net::HTTP socket cached in a parent fiber would be shared across
+    # worker threads spawned afterward (e.g. Solid Queue, Puma). Net::HTTP
+    # sockets are not thread-safe; concurrent use corrupts the stream and
+    # surfaces as FrozenError on the SSLContext, Errno::EBADF, "stream
+    # closed in another thread" (IOError), and Net::HTTPBadResponse.
+    # Thread.current[] is not inherited across threads, so each thread
+    # gets its own isolated cache.
+    #
+    # Note: Thread.current[] is fiber-local in Ruby — each Fiber within a
+    # thread has its own slot. In fiber-based servers (Async, Falcon) this
+    # means one connection cache per fiber rather than per OS thread, which
+    # is the desired behavior: each concurrent request gets its own sockets.
     def thread_connections
-      Fiber[:workos_connections] ||= {}
+      Thread.current[:workos_connections] ||= {}
     end
 
     def build_request(klass, path, auth:, request_options:)

data/lib/workos/client.rb

@@ -4,10 +4,6 @@
 
 module WorkOS
   class Client < BaseClient
-    def api_keys
-      @api_keys ||= WorkOS::ApiKeys.new(self)
-    end
-
     def multi_factor_auth
       @multi_factor_auth ||= WorkOS::MultiFactorAuth.new(self)
     end
@@ -20,6 +16,10 @@ module WorkOS
       @authorization ||= WorkOS::Authorization.new(self)
     end
 
+    def client_api
+      @client_api ||= WorkOS::ClientApi.new(self)
+    end
+
     def sso
       @sso ||= WorkOS::SSO.new(self)
     end
@@ -48,6 +48,14 @@ module WorkOS
       @organizations ||= WorkOS::Organizations.new(self)
     end
 
+    def api_keys
+      @api_keys ||= WorkOS::ApiKeys.new(self)
+    end
+
+    def pipes_provider
+      @pipes_provider ||= WorkOS::PipesProvider.new(self)
+    end
+
     def groups
       @groups ||= WorkOS::Groups.new(self)
     end
@@ -64,8 +72,12 @@ module WorkOS
       @user_management ||= WorkOS::UserManagement.new(self)
     end
 
-    def user_management_organization_membership_groups
-      @user_management_organization_membership_groups ||= WorkOS::UserManagementOrganizationMembershipGroups.new(self)
+    def organization_membership
+      @organization_membership ||= WorkOS::OrganizationMembershipService.new(self)
+    end
+
+    def vault
+      @vault ||= WorkOS::Vault.new(self)
     end
 
     def webhooks
@@ -86,10 +98,6 @@ module WorkOS
       @passwordless ||= WorkOS::Passwordless.new(self)
     end
 
-    def vault
-      @vault ||= WorkOS::Vault.new(self)
-    end
-
     def actions
       @actions ||= WorkOS::Actions
     end

data/lib/workos/client_api/client_api_token.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  class ClientApiToken < WorkOS::Types::BaseModel
+    HASH_ATTRS = {
+      organization_id: :organization_id,
+      user_id: :user_id
+    }.freeze
+
+    attr_accessor \
+      :organization_id,
+      :user_id
+
+    def initialize(json)
+      hash = self.class.normalize(json)
+      @organization_id = hash[:organization_id]
+      @user_id = hash[:user_id]
+    end
+  end
+end

data/lib/workos/client_api/client_api_token_response.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  class ClientApiTokenResponse < WorkOS::Types::BaseModel
+    HASH_ATTRS = {
+      token: :token
+    }.freeze
+
+    attr_accessor :token
+
+    def initialize(json)
+      hash = self.class.normalize(json)
+      @token = hash[:token]
+    end
+  end
+end

data/lib/workos/client_api.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+require "json"
+
+module WorkOS
+  class ClientApi
+    def initialize(client)
+      @client = client
+    end
+
+    # Generate a Client API token
+    # @param organization_id [String] The ID of the organization to scope the Client API token to.
+    # @param user_id [String] The ID of the user to issue the Client API token for.
+    # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
+    # @return [WorkOS::ClientApiTokenResponse]
+    def create_token(
+      organization_id:,
+      user_id:,
+      request_options: {}
+    )
+      body = {
+        "organization_id" => organization_id,
+        "user_id" => user_id
+      }
+      response = @client.request(
+        method: :post,
+        path: "/client/token",
+        auth: true,
+        body: body,
+        request_options: request_options
+      )
+      result = WorkOS::ClientApiTokenResponse.new(response.body)
+      result.last_response = WorkOS::Types::ApiResponse.new(http_status: response.code.to_i, http_headers: response.each_header.to_h, request_id: response["x-request-id"])
+      result
+    end
+  end
+end

data/lib/workos/connect/connect_application.rb

@@ -14,6 +14,10 @@ module WorkOS
       created_at: :created_at,
       updated_at: :updated_at,
       application_type: :application_type,
+      redirect_uris: :redirect_uris,
+      uses_pkce: :uses_pkce,
+      is_first_party: :is_first_party,
+      was_dynamically_registered: :was_dynamically_registered,
       organization_id: :organization_id
     }.freeze
 
@@ -27,6 +31,10 @@ module WorkOS
       :created_at,
       :updated_at,
       :application_type,
+      :redirect_uris,
+      :uses_pkce,
+      :is_first_party,
+      :was_dynamically_registered,
       :organization_id
 
     def initialize(json)
@@ -40,6 +48,10 @@ module WorkOS
       @created_at = hash[:created_at]
       @updated_at = hash[:updated_at]
       @application_type = hash[:application_type]
+      @redirect_uris = (hash[:redirect_uris] || []).map { |item| item ? WorkOS::ConnectApplicationRedirectUri.new(item) : nil }
+      @uses_pkce = hash[:uses_pkce]
+      @is_first_party = hash[:is_first_party]
+      @was_dynamically_registered = hash[:was_dynamically_registered]
       @organization_id = hash[:organization_id]
     end
   end

data/lib/workos/connect/connect_application_redirect_uri.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  class ConnectApplicationRedirectUri < WorkOS::Types::BaseModel
+    HASH_ATTRS = {
+      uri: :uri,
+      default: :default
+    }.freeze
+
+    attr_accessor \
+      :uri,
+      :default
+
+    def initialize(json)
+      hash = self.class.normalize(json)
+      @uri = hash[:uri]
+      @default = hash[:default]
+    end
+  end
+end

data/lib/workos/connect/user_object.rb

@@ -9,6 +9,7 @@ module WorkOS
       email: :email,
       first_name: :first_name,
       last_name: :last_name,
+      name: :name,
       metadata: :metadata
     }.freeze
 
@@ -17,6 +18,7 @@ module WorkOS
       :email,
       :first_name,
       :last_name,
+      :name,
       :metadata
 
     def initialize(json)
@@ -25,6 +27,7 @@ module WorkOS
       @email = hash[:email]
       @first_name = hash[:first_name]
       @last_name = hash[:last_name]
+      @name = hash[:name]
       @metadata = hash[:metadata] || {}
     end
   end

data/lib/workos/connect.rb

@@ -43,14 +43,14 @@ module WorkOS
     # @param before [String, nil] An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`.
     # @param after [String, nil] An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`.
     # @param limit [Integer, nil] Upper limit on the number of objects to return, between `1` and `100`.
-    # @param order [WorkOS::Types::ApplicationsOrder, nil] Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to descending.
+    # @param order [WorkOS::Types::PaginationOrder, nil] Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records).
     # @param organization_id [String, nil] Filter Connect Applications by organization ID.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
     # @return [WorkOS::Types::ListStruct<WorkOS::ConnectApplication>]
     def list_applications(
       before: nil,
       after: nil,
-      limit: nil,
+      limit: 10,
       order: "desc",
       organization_id: nil,
       request_options: {}

data/lib/workos/directory_sync/directory_user.rb

@@ -13,6 +13,7 @@ module WorkOS
       email: :email,
       first_name: :first_name,
       last_name: :last_name,
+      name: :name,
       emails: :emails,
       job_title: :job_title,
       username: :username,
@@ -43,6 +44,7 @@ module WorkOS
       :email,
       :first_name,
       :last_name,
+      :name,
       :state,
       :custom_attributes,
       :role,
@@ -88,6 +90,7 @@ module WorkOS
       @email = hash[:email]
       @first_name = hash[:first_name]
       @last_name = hash[:last_name]
+      @name = hash[:name]
       @emails = (hash[:emails] || []).map { |item| item ? WorkOS::DirectoryUserEmail.new(item) : nil }
       @job_title = hash[:job_title]
       @username = hash[:username]

data/lib/workos/directory_sync/directory_user_with_groups.rb

@@ -13,6 +13,7 @@ module WorkOS
       email: :email,
       first_name: :first_name,
       last_name: :last_name,
+      name: :name,
       emails: :emails,
       job_title: :job_title,
       username: :username,
@@ -35,7 +36,7 @@ module WorkOS
     # @!attribute raw_attributes
     #   @deprecated The raw attributes received from the directory provider.
     # @!attribute groups
-    #   @deprecated The directory groups the user belongs to. Use the List Directory Groups endpoint with a user filter instead.
+    #   @deprecated The directory groups the user belongs to. Deprecated: starting May 1, 2026, this field returns an empty array by default for newly created teams. Existing teams currently depending on this field should migrate to the new access pattern for better throughput performance — the field is unbounded by user, so users with many group memberships produce large, slow response payloads. Use the List Directory Groups endpoint with a `user` filter to fetch a user's group memberships.
 
     attr_accessor \
       :object,
@@ -46,6 +47,7 @@ module WorkOS
       :email,
       :first_name,
       :last_name,
+      :name,
       :state,
       :custom_attributes,
       :role,
@@ -98,6 +100,7 @@ module WorkOS
       @email = hash[:email]
       @first_name = hash[:first_name]
       @last_name = hash[:last_name]
+      @name = hash[:name]
       @emails = (hash[:emails] || []).map { |item| item ? WorkOS::DirectoryUserWithGroupsEmail.new(item) : nil }
       @job_title = hash[:job_title]
       @username = hash[:username]

data/lib/workos/directory_sync/dsync_activated.rb

@@ -5,30 +5,30 @@
 module WorkOS
   class DsyncActivated < WorkOS::Types::BaseModel
     HASH_ATTRS = {
+      object: :object,
       id: :id,
       event: :event,
       data: :data,
       created_at: :created_at,
-      context: :context,
-      object: :object
+      context: :context
     }.freeze
 
     attr_accessor \
+      :object,
       :id,
       :event,
       :data,
       :created_at,
-      :context,
-      :object
+      :context
 
     def initialize(json)
       hash = self.class.normalize(json)
+      @object = hash[:object]
       @id = hash[:id]
       @event = hash[:event]
       @data = hash[:data] ? WorkOS::DsyncActivatedData.new(hash[:data]) : nil
       @created_at = hash[:created_at]
       @context = hash[:context] ? WorkOS::EventContext.new(hash[:context]) : nil
-      @object = hash[:object]
     end
   end
 end

data/lib/workos/directory_sync/dsync_deleted.rb

@@ -5,30 +5,30 @@
 module WorkOS
   class DsyncDeleted < WorkOS::Types::BaseModel
     HASH_ATTRS = {
+      object: :object,
       id: :id,
       event: :event,
       data: :data,
       created_at: :created_at,
-      context: :context,
-      object: :object
+      context: :context
     }.freeze
 
     attr_accessor \
+      :object,
       :id,
       :event,
       :data,
       :created_at,
-      :context,
-      :object
+      :context
 
     def initialize(json)
       hash = self.class.normalize(json)
+      @object = hash[:object]
       @id = hash[:id]
       @event = hash[:event]
       @data = hash[:data] ? WorkOS::DsyncDeletedData.new(hash[:data]) : nil
       @created_at = hash[:created_at]
       @context = hash[:context] ? WorkOS::EventContext.new(hash[:context]) : nil
-      @object = hash[:object]
     end
   end
 end

data/lib/workos/directory_sync/dsync_group_created.rb

@@ -5,30 +5,30 @@
 module WorkOS
   class DsyncGroupCreated < WorkOS::Types::BaseModel
     HASH_ATTRS = {
+      object: :object,
       id: :id,
       event: :event,
       data: :data,
       created_at: :created_at,
-      context: :context,
-      object: :object
+      context: :context
     }.freeze
 
     attr_accessor \
+      :object,
       :id,
       :event,
       :data,
       :created_at,
-      :context,
-      :object
+      :context
 
     def initialize(json)
       hash = self.class.normalize(json)
+      @object = hash[:object]
       @id = hash[:id]
       @event = hash[:event]
       @data = hash[:data] ? WorkOS::DirectoryGroup.new(hash[:data]) : nil
       @created_at = hash[:created_at]
       @context = hash[:context] ? WorkOS::EventContext.new(hash[:context]) : nil
-      @object = hash[:object]
     end
   end
 end

data/lib/workos/directory_sync/dsync_group_deleted.rb

@@ -5,30 +5,30 @@
 module WorkOS
   class DsyncGroupDeleted < WorkOS::Types::BaseModel
     HASH_ATTRS = {
+      object: :object,
       id: :id,
       event: :event,
       data: :data,
       created_at: :created_at,
-      context: :context,
-      object: :object
+      context: :context
     }.freeze
 
     attr_accessor \
+      :object,
       :id,
       :event,
       :data,
       :created_at,
-      :context,
-      :object
+      :context
 
     def initialize(json)
       hash = self.class.normalize(json)
+      @object = hash[:object]
       @id = hash[:id]
       @event = hash[:event]
       @data = hash[:data] ? WorkOS::DirectoryGroup.new(hash[:data]) : nil
       @created_at = hash[:created_at]
       @context = hash[:context] ? WorkOS::EventContext.new(hash[:context]) : nil
-      @object = hash[:object]
     end
   end
 end

data/lib/workos/directory_sync/dsync_group_updated.rb

@@ -5,30 +5,30 @@
 module WorkOS
   class DsyncGroupUpdated < WorkOS::Types::BaseModel
     HASH_ATTRS = {
+      object: :object,
       id: :id,
       event: :event,
       data: :data,
       created_at: :created_at,
-      context: :context,
-      object: :object
+      context: :context
     }.freeze
 
     attr_accessor \
+      :object,
       :id,
       :event,
       :data,
       :created_at,
-      :context,
-      :object
+      :context
 
     def initialize(json)
       hash = self.class.normalize(json)
+      @object = hash[:object]
       @id = hash[:id]
       @event = hash[:event]
       @data = hash[:data] ? WorkOS::DsyncGroupUpdatedData.new(hash[:data]) : nil
       @created_at = hash[:created_at]
       @context = hash[:context] ? WorkOS::EventContext.new(hash[:context]) : nil
-      @object = hash[:object]
     end
   end
 end

data/lib/workos/directory_sync/dsync_group_user_added.rb

@@ -5,30 +5,30 @@
 module WorkOS
   class DsyncGroupUserAdded < WorkOS::Types::BaseModel
     HASH_ATTRS = {
+      object: :object,
       id: :id,
       event: :event,
       data: :data,
       created_at: :created_at,
-      context: :context,
-      object: :object
+      context: :context
     }.freeze
 
     attr_accessor \
+      :object,
       :id,
       :event,
       :data,
       :created_at,
-      :context,
-      :object
+      :context
 
     def initialize(json)
       hash = self.class.normalize(json)
+      @object = hash[:object]
       @id = hash[:id]
       @event = hash[:event]
       @data = hash[:data] ? WorkOS::DsyncGroupUserAddedData.new(hash[:data]) : nil
       @created_at = hash[:created_at]
       @context = hash[:context] ? WorkOS::EventContext.new(hash[:context]) : nil
-      @object = hash[:object]
     end
   end
 end