workos 8.0.0 → 9.0.0

data/.oagen-manifest.json

@@ -1,7 +1,7 @@
 {
   "version": 2,
   "language": "ruby",
-  "generatedAt": "2026-05-06T22:30:35.198Z",
+  "generatedAt": "2026-05-26T15:39:28.792Z",
   "files": [
     "lib/workos.rb",
     "lib/workos/admin_portal.rb",
@@ -27,21 +27,21 @@
     "lib/workos/api_keys/organization_api_key_with_value_owner.rb",
     "lib/workos/api_keys/validate_api_key.rb",
     "lib/workos/audit_logs.rb",
-    "lib/workos/audit_logs/audit_log_action_json.rb",
+    "lib/workos/audit_logs/audit_log_action.rb",
     "lib/workos/audit_logs/audit_log_event.rb",
     "lib/workos/audit_logs/audit_log_event_actor.rb",
     "lib/workos/audit_logs/audit_log_event_context.rb",
     "lib/workos/audit_logs/audit_log_event_create_response.rb",
     "lib/workos/audit_logs/audit_log_event_ingestion.rb",
     "lib/workos/audit_logs/audit_log_event_target.rb",
+    "lib/workos/audit_logs/audit_log_export.rb",
     "lib/workos/audit_logs/audit_log_export_creation.rb",
-    "lib/workos/audit_logs/audit_log_export_json.rb",
     "lib/workos/audit_logs/audit_log_schema.rb",
     "lib/workos/audit_logs/audit_log_schema_actor.rb",
-    "lib/workos/audit_logs/audit_log_schema_json.rb",
-    "lib/workos/audit_logs/audit_log_schema_json_actor.rb",
-    "lib/workos/audit_logs/audit_log_schema_json_target.rb",
+    "lib/workos/audit_logs/audit_log_schema_actor_input.rb",
+    "lib/workos/audit_logs/audit_log_schema_input.rb",
     "lib/workos/audit_logs/audit_log_schema_target.rb",
+    "lib/workos/audit_logs/audit_log_schema_target_input.rb",
     "lib/workos/authorization.rb",
     "lib/workos/authorization/add_role_permission.rb",
     "lib/workos/authorization/assign_role.rb",
@@ -82,6 +82,7 @@
     "lib/workos/connect.rb",
     "lib/workos/connect/application_credentials_list_item.rb",
     "lib/workos/connect/connect_application.rb",
+    "lib/workos/connect/connect_application_redirect_uri.rb",
     "lib/workos/connect/create_application_secret.rb",
     "lib/workos/connect/create_m2m_application.rb",
     "lib/workos/connect/create_oauth_application.rb",
@@ -197,10 +198,15 @@
     "lib/workos/organization_domains/organization_domain_verification_failed_data_organization_domain.rb",
     "lib/workos/organization_domains/organization_domain_verified.rb",
     "lib/workos/organization_domains/organization_domain_verified_data.rb",
+    "lib/workos/organization_membership/create_user_organization_membership.rb",
+    "lib/workos/organization_membership/organization_membership.rb",
+    "lib/workos/organization_membership/update_user_organization_membership.rb",
+    "lib/workos/organization_membership/user_organization_membership.rb",
+    "lib/workos/organization_membership_service.rb",
     "lib/workos/organizations.rb",
     "lib/workos/organizations/audit_log_configuration.rb",
     "lib/workos/organizations/audit_log_configuration_log_stream.rb",
-    "lib/workos/organizations/audit_logs_retention_json.rb",
+    "lib/workos/organizations/audit_logs_retention.rb",
     "lib/workos/organizations/organization.rb",
     "lib/workos/organizations/organization_created.rb",
     "lib/workos/organizations/organization_created_data.rb",
@@ -244,6 +250,10 @@
     "lib/workos/radar/radar_standalone_response.rb",
     "lib/workos/radar/radar_standalone_update_radar_attempt_request.rb",
     "lib/workos/radar/radar_standalone_update_radar_list_request.rb",
+    "lib/workos/shared/connect_application_m2m.rb",
+    "lib/workos/shared/connect_application_oauth.rb",
+    "lib/workos/shared/connect_application_oauth_redirect_uris.rb",
+    "lib/workos/shared/error_response.rb",
     "lib/workos/shared/event_context.rb",
     "lib/workos/shared/event_context_actor.rb",
     "lib/workos/shared/event_context_google_analytics_session.rb",
@@ -254,6 +264,10 @@
     "lib/workos/shared/group_member_removed.rb",
     "lib/workos/shared/group_member_removed_data.rb",
     "lib/workos/shared/group_updated.rb",
+    "lib/workos/shared/pipe_connected_account.rb",
+    "lib/workos/shared/pipes_connected_account_connected.rb",
+    "lib/workos/shared/pipes_connected_account_disconnected.rb",
+    "lib/workos/shared/pipes_connected_account_reauthorization_needed.rb",
     "lib/workos/shared/waitlist_user.rb",
     "lib/workos/shared/waitlist_user_approved.rb",
     "lib/workos/shared/waitlist_user_created.rb",
@@ -288,7 +302,7 @@
     "lib/workos/types/audit_log_configuration_log_stream_state.rb",
     "lib/workos/types/audit_log_configuration_log_stream_type.rb",
     "lib/workos/types/audit_log_configuration_state.rb",
-    "lib/workos/types/audit_log_export_json_state.rb",
+    "lib/workos/types/audit_log_export_state.rb",
     "lib/workos/types/authenticate_response_authentication_method.rb",
     "lib/workos/types/authentication_factor_enrolled_type.rb",
     "lib/workos/types/authentication_factor_type.rb",
@@ -367,14 +381,15 @@
     "lib/workos/types/organization_updated_data_domain_state.rb",
     "lib/workos/types/organization_updated_data_domain_verification_strategy.rb",
     "lib/workos/types/pagination_order.rb",
+    "lib/workos/types/pipe_connected_account_state.rb",
     "lib/workos/types/profile_connection_type.rb",
-    "lib/workos/types/radar_action.rb",
+    "lib/workos/types/radar_list_action.rb",
+    "lib/workos/types/radar_list_type.rb",
     "lib/workos/types/radar_standalone_assess_request_action.rb",
     "lib/workos/types/radar_standalone_assess_request_auth_method.rb",
     "lib/workos/types/radar_standalone_response_blocklist_type.rb",
     "lib/workos/types/radar_standalone_response_control.rb",
     "lib/workos/types/radar_standalone_response_verdict.rb",
-    "lib/workos/types/radar_type.rb",
     "lib/workos/types/resend_user_invite_options_locale.rb",
     "lib/workos/types/role_type.rb",
     "lib/workos/types/session_created_data_auth_method.rb",
@@ -404,8 +419,9 @@
     "lib/workos/types/vault_kek_created_data_actor_source.rb",
     "lib/workos/types/vault_metadata_read_data_actor_source.rb",
     "lib/workos/types/vault_names_listed_data_actor_source.rb",
+    "lib/workos/types/vault_order.rb",
     "lib/workos/types/waitlist_user_state.rb",
-    "lib/workos/types/webhook_endpoint_json_status.rb",
+    "lib/workos/types/webhook_endpoint_status.rb",
     "lib/workos/types/widget_session_token_scopes.rb",
     "lib/workos/user_management.rb",
     "lib/workos/user_management/action_authentication_denied.rb",
@@ -473,7 +489,6 @@
     "lib/workos/user_management/create_user.rb",
     "lib/workos/user_management/create_user_api_key.rb",
     "lib/workos/user_management/create_user_invite_options.rb",
-    "lib/workos/user_management/create_user_organization_membership.rb",
     "lib/workos/user_management/device_authorization_response.rb",
     "lib/workos/user_management/device_code_session_authenticate_request.rb",
     "lib/workos/user_management/email_change.rb",
@@ -500,7 +515,6 @@
     "lib/workos/user_management/magic_auth_created.rb",
     "lib/workos/user_management/magic_auth_created_data.rb",
     "lib/workos/user_management/mfa_totp_session_authenticate_request.rb",
-    "lib/workos/user_management/organization_membership.rb",
     "lib/workos/user_management/organization_selection_session_authenticate_request.rb",
     "lib/workos/user_management/password_reset.rb",
     "lib/workos/user_management/password_reset_created.rb",
@@ -524,7 +538,6 @@
     "lib/workos/user_management/sso_device_authorization_request.rb",
     "lib/workos/user_management/update_jwt_template.rb",
     "lib/workos/user_management/update_user.rb",
-    "lib/workos/user_management/update_user_organization_membership.rb",
     "lib/workos/user_management/user.rb",
     "lib/workos/user_management/user_api_key.rb",
     "lib/workos/user_management/user_api_key_created_data_owner.rb",
@@ -536,13 +549,26 @@
     "lib/workos/user_management/user_deleted.rb",
     "lib/workos/user_management/user_identities_get_item.rb",
     "lib/workos/user_management/user_invite.rb",
-    "lib/workos/user_management/user_organization_membership.rb",
     "lib/workos/user_management/user_sessions_impersonator.rb",
     "lib/workos/user_management/user_sessions_list_item.rb",
     "lib/workos/user_management/user_updated.rb",
     "lib/workos/user_management/verify_email_address.rb",
     "lib/workos/user_management/verify_email_response.rb",
-    "lib/workos/user_management_organization_membership_groups.rb",
+    "lib/workos/vault.rb",
+    "lib/workos/vault/actor.rb",
+    "lib/workos/vault/create_data_key_request.rb",
+    "lib/workos/vault/create_data_key_response.rb",
+    "lib/workos/vault/create_object_request.rb",
+    "lib/workos/vault/decrypt_request.rb",
+    "lib/workos/vault/decrypt_response.rb",
+    "lib/workos/vault/delete_object_response.rb",
+    "lib/workos/vault/object.rb",
+    "lib/workos/vault/object_metadata.rb",
+    "lib/workos/vault/object_summary.rb",
+    "lib/workos/vault/object_version.rb",
+    "lib/workos/vault/object_without_value.rb",
+    "lib/workos/vault/rekey_request.rb",
+    "lib/workos/vault/update_object_request.rb",
     "lib/workos/vault/vault_byok_key_deleted.rb",
     "lib/workos/vault/vault_byok_key_deleted_data.rb",
     "lib/workos/vault/vault_byok_key_verification_completed.rb",
@@ -565,10 +591,11 @@
     "lib/workos/vault/vault_metadata_read_data.rb",
     "lib/workos/vault/vault_names_listed.rb",
     "lib/workos/vault/vault_names_listed_data.rb",
+    "lib/workos/vault/version_list_response.rb",
     "lib/workos/webhooks.rb",
     "lib/workos/webhooks/create_webhook_endpoint.rb",
     "lib/workos/webhooks/update_webhook_endpoint.rb",
-    "lib/workos/webhooks/webhook_endpoint_json.rb",
+    "lib/workos/webhooks/webhook_endpoint.rb",
     "lib/workos/widgets.rb",
     "lib/workos/widgets/widget_session_token.rb",
     "lib/workos/widgets/widget_session_token_response.rb",
@@ -576,6 +603,7 @@
     "rbi/workos/action_authentication_denied_data.rbi",
     "rbi/workos/action_user_registration_denied.rbi",
     "rbi/workos/action_user_registration_denied_data.rbi",
+    "rbi/workos/actor.rbi",
     "rbi/workos/add_role_permission.rbi",
     "rbi/workos/admin_portal.rbi",
     "rbi/workos/api_key.rbi",
@@ -590,7 +618,7 @@
     "rbi/workos/api_keys.rbi",
     "rbi/workos/application_credentials_list_item.rbi",
     "rbi/workos/assign_role.rbi",
-    "rbi/workos/audit_log_action_json.rbi",
+    "rbi/workos/audit_log_action.rbi",
     "rbi/workos/audit_log_configuration.rbi",
     "rbi/workos/audit_log_configuration_log_stream.rbi",
     "rbi/workos/audit_log_event.rbi",
@@ -599,16 +627,16 @@
     "rbi/workos/audit_log_event_create_response.rbi",
     "rbi/workos/audit_log_event_ingestion.rbi",
     "rbi/workos/audit_log_event_target.rbi",
+    "rbi/workos/audit_log_export.rbi",
     "rbi/workos/audit_log_export_creation.rbi",
-    "rbi/workos/audit_log_export_json.rbi",
     "rbi/workos/audit_log_schema.rbi",
     "rbi/workos/audit_log_schema_actor.rbi",
-    "rbi/workos/audit_log_schema_json.rbi",
-    "rbi/workos/audit_log_schema_json_actor.rbi",
-    "rbi/workos/audit_log_schema_json_target.rbi",
+    "rbi/workos/audit_log_schema_actor_input.rbi",
+    "rbi/workos/audit_log_schema_input.rbi",
     "rbi/workos/audit_log_schema_target.rbi",
+    "rbi/workos/audit_log_schema_target_input.rbi",
     "rbi/workos/audit_logs.rbi",
-    "rbi/workos/audit_logs_retention_json.rbi",
+    "rbi/workos/audit_logs_retention.rbi",
     "rbi/workos/authenticate_response.rbi",
     "rbi/workos/authenticate_response_impersonator.rbi",
     "rbi/workos/authenticate_response_oauth_token.rbi",
@@ -680,6 +708,9 @@
     "rbi/workos/confirm_email_change.rbi",
     "rbi/workos/connect.rbi",
     "rbi/workos/connect_application.rbi",
+    "rbi/workos/connect_application_m2m.rbi",
+    "rbi/workos/connect_application_oauth.rbi",
+    "rbi/workos/connect_application_oauth_redirect_uris.rbi",
     "rbi/workos/connected_account.rbi",
     "rbi/workos/connection.rbi",
     "rbi/workos/connection_activated.rbi",
@@ -705,11 +736,14 @@
     "rbi/workos/create_authorization_permission.rbi",
     "rbi/workos/create_authorization_resource.rbi",
     "rbi/workos/create_cors_origin.rbi",
+    "rbi/workos/create_data_key_request.rbi",
+    "rbi/workos/create_data_key_response.rbi",
     "rbi/workos/create_group.rbi",
     "rbi/workos/create_group_membership.rbi",
     "rbi/workos/create_m2m_application.rbi",
     "rbi/workos/create_magic_code_and_return.rbi",
     "rbi/workos/create_oauth_application.rbi",
+    "rbi/workos/create_object_request.rbi",
     "rbi/workos/create_organization_api_key.rbi",
     "rbi/workos/create_organization_domain.rbi",
     "rbi/workos/create_organization_role.rbi",
@@ -730,6 +764,9 @@
     "rbi/workos/data_integrations_list_response.rbi",
     "rbi/workos/data_integrations_list_response_data.rbi",
     "rbi/workos/data_integrations_list_response_data_connected_account.rbi",
+    "rbi/workos/decrypt_request.rbi",
+    "rbi/workos/decrypt_response.rbi",
+    "rbi/workos/delete_object_response.rbi",
     "rbi/workos/device_authorization_response.rbi",
     "rbi/workos/device_code_session_authenticate_request.rbi",
     "rbi/workos/directory.rbi",
@@ -771,6 +808,7 @@
     "rbi/workos/email_verification_created.rbi",
     "rbi/workos/email_verification_created_data.rbi",
     "rbi/workos/enroll_user_authentication_factor.rbi",
+    "rbi/workos/error_response.rbi",
     "rbi/workos/event_context.rbi",
     "rbi/workos/event_context_actor.rbi",
     "rbi/workos/event_context_google_analytics_session.rbi",
@@ -844,6 +882,11 @@
     "rbi/workos/mfa_totp_session_authenticate_request.rbi",
     "rbi/workos/multi_factor_auth.rbi",
     "rbi/workos/new_connect_application_secret.rbi",
+    "rbi/workos/object.rbi",
+    "rbi/workos/object_metadata.rbi",
+    "rbi/workos/object_summary.rbi",
+    "rbi/workos/object_version.rbi",
+    "rbi/workos/object_without_value.rbi",
     "rbi/workos/organization.rbi",
     "rbi/workos/organization_api_key.rbi",
     "rbi/workos/organization_api_key_owner.rbi",
@@ -876,6 +919,7 @@
     "rbi/workos/organization_membership_created_data.rbi",
     "rbi/workos/organization_membership_deleted.rbi",
     "rbi/workos/organization_membership_deleted_data.rbi",
+    "rbi/workos/organization_membership_service.rbi",
     "rbi/workos/organization_membership_updated.rbi",
     "rbi/workos/organization_membership_updated_data.rbi",
     "rbi/workos/organization_role_created.rbi",
@@ -902,7 +946,11 @@
     "rbi/workos/permission_deleted_data.rbi",
     "rbi/workos/permission_updated.rbi",
     "rbi/workos/permission_updated_data.rbi",
+    "rbi/workos/pipe_connected_account.rbi",
     "rbi/workos/pipes.rbi",
+    "rbi/workos/pipes_connected_account_connected.rbi",
+    "rbi/workos/pipes_connected_account_disconnected.rbi",
+    "rbi/workos/pipes_connected_account_reauthorization_needed.rbi",
     "rbi/workos/portal_link_response.rbi",
     "rbi/workos/profile.rbi",
     "rbi/workos/radar.rbi",
@@ -915,6 +963,7 @@
     "rbi/workos/redirect_uri.rbi",
     "rbi/workos/redirect_uri_input.rbi",
     "rbi/workos/refresh_token_session_authenticate_request.rbi",
+    "rbi/workos/rekey_request.rbi",
     "rbi/workos/remove_role.rbi",
     "rbi/workos/resend_user_invite_options.rbi",
     "rbi/workos/reset_password_response.rbi",
@@ -952,6 +1001,7 @@
     "rbi/workos/update_group.rbi",
     "rbi/workos/update_jwt_template.rbi",
     "rbi/workos/update_oauth_application.rbi",
+    "rbi/workos/update_object_request.rbi",
     "rbi/workos/update_organization.rbi",
     "rbi/workos/update_organization_role.rbi",
     "rbi/workos/update_role.rbi",
@@ -974,7 +1024,6 @@
     "rbi/workos/user_invite.rbi",
     "rbi/workos/user_management.rbi",
     "rbi/workos/user_management_login_request.rbi",
-    "rbi/workos/user_management_organization_membership_groups.rbi",
     "rbi/workos/user_object.rbi",
     "rbi/workos/user_organization_membership.rbi",
     "rbi/workos/user_organization_membership_base_list_data.rbi",
@@ -984,6 +1033,7 @@
     "rbi/workos/user_sessions_list_item.rbi",
     "rbi/workos/user_updated.rbi",
     "rbi/workos/validate_api_key.rbi",
+    "rbi/workos/vault.rbi",
     "rbi/workos/vault_byok_key_deleted.rbi",
     "rbi/workos/vault_byok_key_deleted_data.rbi",
     "rbi/workos/vault_byok_key_verification_completed.rbi",
@@ -1012,7 +1062,7 @@
     "rbi/workos/waitlist_user_approved.rbi",
     "rbi/workos/waitlist_user_created.rbi",
     "rbi/workos/waitlist_user_denied.rbi",
-    "rbi/workos/webhook_endpoint_json.rbi",
+    "rbi/workos/webhook_endpoint.rbi",
     "rbi/workos/webhooks.rbi",
     "rbi/workos/widget_session_token.rbi",
     "rbi/workos/widget_session_token_response.rbi",
@@ -1029,12 +1079,13 @@
     "test/workos/test_model_round_trip.rb",
     "test/workos/test_multi_factor_auth.rb",
     "test/workos/test_organization_domains.rb",
+    "test/workos/test_organization_membership_service.rb",
     "test/workos/test_organizations.rb",
     "test/workos/test_pipes.rb",
     "test/workos/test_radar.rb",
     "test/workos/test_sso.rb",
     "test/workos/test_user_management.rb",
-    "test/workos/test_user_management_organization_membership_groups.rb",
+    "test/workos/test_vault.rb",
     "test/workos/test_webhooks.rb",
     "test/workos/test_widgets.rb"
   ],
@@ -1641,35 +1692,35 @@
     },
     "GET /user_management/organization_memberships": {
       "sdkMethod": "list_organization_memberships",
-      "service": "user_management"
+      "service": "organization_membership"
     },
     "POST /user_management/organization_memberships": {
       "sdkMethod": "create_organization_membership",
-      "service": "user_management"
+      "service": "organization_membership"
     },
     "GET /user_management/organization_memberships/{id}": {
       "sdkMethod": "get_organization_membership",
-      "service": "user_management"
+      "service": "organization_membership"
     },
     "PUT /user_management/organization_memberships/{id}": {
       "sdkMethod": "update_organization_membership",
-      "service": "user_management"
+      "service": "organization_membership"
     },
     "DELETE /user_management/organization_memberships/{id}": {
       "sdkMethod": "delete_organization_membership",
-      "service": "user_management"
+      "service": "organization_membership"
     },
     "PUT /user_management/organization_memberships/{id}/deactivate": {
       "sdkMethod": "deactivate_organization_membership",
-      "service": "user_management"
+      "service": "organization_membership"
     },
     "PUT /user_management/organization_memberships/{id}/reactivate": {
       "sdkMethod": "reactivate_organization_membership",
-      "service": "user_management"
+      "service": "organization_membership"
     },
     "GET /user_management/organization_memberships/{omId}/groups": {
       "sdkMethod": "list_organization_membership_groups",
-      "service": "user_management_organization_membership_groups"
+      "service": "organization_membership"
     },
     "POST /user_management/redirect_uris": {
       "sdkMethod": "create_redirect_uri",
@@ -1707,6 +1758,50 @@
       "sdkMethod": "create_user_auth_factor",
       "service": "multi_factor_auth"
     },
+    "POST /vault/v1/keys/data-key": {
+      "sdkMethod": "create_data_key",
+      "service": "vault"
+    },
+    "POST /vault/v1/keys/decrypt": {
+      "sdkMethod": "create_decrypt",
+      "service": "vault"
+    },
+    "POST /vault/v1/keys/rekey": {
+      "sdkMethod": "create_rekey",
+      "service": "vault"
+    },
+    "GET /vault/v1/kv": {
+      "sdkMethod": "list_kv",
+      "service": "vault"
+    },
+    "POST /vault/v1/kv": {
+      "sdkMethod": "create_kv",
+      "service": "vault"
+    },
+    "GET /vault/v1/kv/name/{name}": {
+      "sdkMethod": "get_name",
+      "service": "vault"
+    },
+    "GET /vault/v1/kv/{id}": {
+      "sdkMethod": "get_kv",
+      "service": "vault"
+    },
+    "PUT /vault/v1/kv/{id}": {
+      "sdkMethod": "update_kv",
+      "service": "vault"
+    },
+    "DELETE /vault/v1/kv/{id}": {
+      "sdkMethod": "delete_kv",
+      "service": "vault"
+    },
+    "GET /vault/v1/kv/{id}/metadata": {
+      "sdkMethod": "list_kv_metadata",
+      "service": "vault"
+    },
+    "GET /vault/v1/kv/{id}/versions": {
+      "sdkMethod": "list_kv_versions",
+      "service": "vault"
+    },
     "GET /webhook_endpoints": {
       "sdkMethod": "list_webhook_endpoints",
       "service": "webhooks"

data/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "8.0.0"
+  ".": "9.0.0"
 }

data/CHANGELOG.md

@@ -1,5 +1,71 @@
 # Changelog
 
+## [9.0.0](https://github.com/workos/workos-ruby/compare/v8.0.1...v9.0.0) (2026-05-26)
+
+### Bug Fixes
+
+* **ci:** extract version from PR title in changelog inline step ([93768a1](https://github.com/workos/workos-ruby/commit/93768a1c00aab7f82c869f38bea5925f6e8cd933))
+
+* [#491](https://github.com/workos/workos-ruby/pull/491) feat(generated)!: regenerate from spec (9 changes)
+
+  **⚠️ Breaking**
+  * **organization_membership:** Migrate organization membership to dedicated service
+    * Moved organization membership methods from `UserManagement` to new `OrganizationMembershipService` class
+    * Methods `create_organization_membership`, `get_organization_membership`, `update_organization_membership`, `delete_organization_membership`, `deactivate_organization_membership`, `reactivate_organization_membership`, `list_organization_memberships`, and `list_organization_membership_groups` now accessed via `client.organization_membership` instead of `client.user_management`
+    * Removed `UserManagement::RoleSingle` and `UserManagement::RoleMultiple` data classes (moved to `OrganizationMembershipService`)
+  * **api_keys:** Add expires_at field to API key models
+    * Added `expires_at` optional field to `ApiKey`, `OrganizationApiKey`, `OrganizationApiKeyWithValue`, `UserApiKey`, and `UserApiKeyWithValue` models
+    * Added `expires_at` field to `CreateOrganizationApiKey` and `CreateUserApiKey` request models
+    * Updated `create_organization_api_key` and `create_user_api_key` methods to accept `expires_at` parameter
+  * **radar:** Remove device_fingerprint and bot_score fields from Radar
+    * Removed `device_fingerprint` and `bot_score` parameters from `Radar.create_attempt` method
+    * Removed `device_fingerprint` and `bot_score` fields from `RadarStandaloneAssessRequest` model
+    * Updated enum values in `RadarStandaloneAssessRequestAction`: removed `LOGIN`, `SIGNUP`, `SIGN_UP_2`, `SIGN_IN_2`, `SIGN_IN_3`, `SIGN_UP_3`; standardized to `SIGN_UP` and `SIGN_IN`
+    * Removed `CREDENTIAL_STUFFING` and `IP_SIGN_UP_RATE_LIMIT` from `RadarStandaloneResponseControl` enum
+  * **audit_logs:** Refactor audit logs models and type names
+    * Merged `AuditLogSchemaJson` fields into `AuditLogSchema`; removed `AuditLogSchemaJson` class
+    * Added new `AuditLogSchemaInput` class (write-side schema without read-only fields)
+    * Renamed `AuditLogSchemaJsonActor` to `AuditLogSchemaActorInput`
+    * Renamed `AuditLogSchemaJsonTarget` to `AuditLogSchemaTargetInput`
+    * Removed `AuditLogActionJson`; `AuditLogAction` now extends `BaseModel`
+    * Renamed `AuditLogExportJson` to `AuditLogExport` (now extends `BaseModel`)
+    * Renamed `AuditLogsRetentionJson` to `AuditLogsRetention` (now extends `BaseModel`)
+    * Removed `AuditLogExportJsonState` type; replaced with `AuditLogExportState`
+    * Updated `list_actions` method return type from `AuditLogActionJson` to `AuditLogAction`
+    * Updated `create_export` and `get_export` method return types from `AuditLogExportJson` to `AuditLogExport`
+  * **webhooks:** Rename WebhookEndpointJson to WebhookEndpoint
+    * Renamed `WebhookEndpointJson` to `WebhookEndpoint`
+    * Updated `list_webhook_endpoints`, `create_webhook_endpoint`, and `update_webhook_endpoint` method return types
+    * `WebhookEndpointStatus` is now an alias for `UpdateWebhookEndpointStatus` (no longer a standalone class); removed `WebhookEndpointJsonStatus` alias
+    * Updated `WebhookEndpoint` to extend `BaseModel` for consistency
+  * **authorization:** Add filtering parameters to authorization list methods
+    * Added `resource_id`, `resource_external_id`, `resource_type_slug` filter parameters to `list_role_assignments` method
+    * Added `role_slug` filter parameter to `list_role_assignments_for_resource_by_external_id` and `list_role_assignments_for_resource` methods
+    * Removed `search` parameter from `list_resources` method
+
+  **Features**
+  * **vault:** Add new Vault service with key-value operations
+    * Added new `Vault` service class with methods: `create_data_key`, `create_decrypt`, `create_rekey`, `list_kv`, `create_kv`, `get_name`, `get_kv`, `update_kv`, `delete_kv`, `list_kv_metadata`, `list_kv_versions`
+    * Added vault model classes: `Actor`, `CreateDataKeyRequest`, `CreateDataKeyResponse`, `CreateObjectRequest`, `DecryptRequest`, `DecryptResponse`, `DeleteObjectResponse`, `ObjectModel`, `ObjectMetadata`, `ObjectSummary`, `ObjectVersion`, `ObjectWithoutValue`, `RekeyRequest`, `UpdateObjectRequest`
+    * Added `VaultOrder` enum for sorting operations
+    * Added `client.vault` accessor to access the new service
+  * **pipes:** Add Pipes connected account event models
+    * Added `PipeConnectedAccount` model for representing connected accounts
+    * Added three new event models: `PipesConnectedAccountConnected`, `PipesConnectedAccountDisconnected`, `PipesConnectedAccountReauthorizationNeeded`
+    * Added `PipeConnectedAccountState` enum with `CONNECTED` and `NEEDS_REAUTHORIZATION` values
+    * Added new webhook event types to `CreateWebhookEndpointEvents` and `UpdateWebhookEndpointEvents`
+  * **generated:** Add Error and Actor shared models
+    * Added `Error` model in shared module for error responses
+    * Added `Actor` model in vault module representing user/actor information
+    * Updated inflections to map 'object' to 'ObjectModel' to avoid conflicts
+
+## [8.0.1](https://github.com/workos/workos-ruby/compare/v8.0.0...v8.0.1) (2026-05-12)
+
+
+### Bug Fixes
+
+* harden session sealing, log redaction, and webhook tolerance checks ([#482](https://github.com/workos/workos-ruby/issues/482)) ([347fe1e](https://github.com/workos/workos-ruby/commit/347fe1edf296778d7ea331e666a7957870074b9f))
+
 ## [8.0.0](https://github.com/workos/workos-ruby/compare/v7.1.2...v8.0.0) (2026-05-06)
 
 

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    workos (8.0.0)
+    workos (9.0.0)
       jwt (~> 3.1)
       logger (~> 1.7)
       zeitwerk (~> 2.6)
@@ -23,7 +23,7 @@ GEM
     erb (6.0.4)
     hashdiff (1.2.1)
     json (2.19.4)
-    jwt (3.1.2)
+    jwt (3.2.0)
       base64
     language_server-protocol (3.17.0.5)
     lint_roller (1.1.0)
@@ -124,7 +124,7 @@ CHECKSUMS
   erb (6.0.4) sha256=38e3803694be357fe2bfe312487c74beaf9fb4e5beb3e22498952fe1645b95d9
   hashdiff (1.2.1) sha256=9c079dbc513dfc8833ab59c0c2d8f230fa28499cc5efb4b8dd276cf931457cd1
   json (2.19.4) sha256=670a7d333fb3b18ca5b29cb255eb7bef099e40d88c02c80bd42a3f30fe5239ac
-  jwt (3.1.2) sha256=af6991f19a6bb4060d618d9add7a66f0eeb005ac0bc017cd01f63b42e122d535
+  jwt (3.2.0) sha256=5419b1fe37b1da0982bd07051f573a8b8789ab724c2aa7e785e4784a3ed217d7
   language_server-protocol (3.17.0.5) sha256=fd1e39a51a28bf3eec959379985a72e296e9f9acfce46f6a79d31ca8760803cc
   lint_roller (1.1.0) sha256=2c0c845b632a7d172cb849cc90c1bce937a28c5c8ccccb50dfd46a485003cc87
   logger (1.7.0) sha256=196edec7cc44b66cfb40f9755ce11b392f21f7967696af15d274dde7edff0203
@@ -153,7 +153,7 @@ CHECKSUMS
   unicode-emoji (4.2.0) sha256=519e69150f75652e40bf736106cfbc8f0f73aa3fb6a65afe62fefa7f80b0f80f
   webmock (3.26.2) sha256=774556f2ea6371846cca68c01769b2eac0d134492d21f6d0ab5dd643965a4c90
   webrick (1.9.2) sha256=beb4a15fc474defed24a3bda4ffd88a490d517c9e4e6118c3edce59e45864131
-  workos (8.0.0)
+  workos (9.0.0)
   yard (0.9.43) sha256=cf8733a8f0485df2a162927e9b5f182215a61f6d22de096b8f402c726a1c5821
   yard-markdown (0.7.1) sha256=06c378632dfe7ba053be9ba469eb4701aa0470e36bcf7e5546f353eb90c1bfd1
   zeitwerk (2.7.5) sha256=d8da92128c09ea6ec62c949011b00ed4a20242b255293dd66bf41545398f73dd

data/README.md

@@ -139,6 +139,25 @@ user = WorkOS.client.user_management.create_user(
 puts user.id
 ```
 
+### Sealed sessions (cookie_password requirements)
+
+When you use `client.session_manager` to seal session cookies, the
+`cookie_password` you supply must be **at least 32 bytes** of high-entropy
+secret material (typically 32 random bytes encoded as base64 or a 64-char
+hex string). The SDK derives the AES-256-GCM key from this password via
+SHA-256, and a passphrase shorter than 32 bytes makes the resulting key
+materially easier to brute-force offline.
+
+Generate a suitable secret once and store it as an environment variable:
+
+```sh
+ruby -rsecurerandom -e 'puts SecureRandom.base64(32)'
+```
+
+Anything shorter than 32 bytes (including `nil` or `""`) raises
+`ArgumentError` at SDK init time — sealing or unsealing will not silently
+proceed with a weakened key.
+
 ### Verify a webhook
 
 ```ruby

data/docs/V7_MIGRATION_GUIDE.md

@@ -501,6 +501,27 @@ Session management was one of the largest refactors in v7. The old `WorkOS::Sess
 
 If your application seals session cookies, refreshes access tokens, or decodes the access-token JWT, every one of these call sites needs to be updated.
 
+#### `cookie_password` minimum length (32 bytes)
+
+v7 enforces a **minimum 32-byte length** on every `cookie_password` you supply
+to the session manager (`load`, `seal_data`, `unseal_data`,
+`seal_session_from_auth_response`, and the underlying `Encryptors::AesGcm`).
+
+Anything shorter — including `nil` or `""` — now raises `ArgumentError` at the
+moment the SDK is asked to seal or unseal. Older deployments that used a
+short passphrase (e.g. a 16-character secret) will start erroring at app
+boot or the next sealed-session request.
+
+Pick a 32+ byte secret once and store it as an environment variable:
+
+```sh
+ruby -rsecurerandom -e 'puts SecureRandom.base64(32)'
+```
+
+The KDF itself (single-pass SHA-256) is unchanged in this release, so
+existing sealed cookies continue to round-trip as long as the same
+(now-length-validated) password is in use.
+
 #### Sealing a cookie from an authentication response
 
 In v6, you asked `authenticate_with_*` to seal the cookie for you:

data/lib/workos/actions.rb

@@ -35,7 +35,7 @@ module WorkOS
     def verify_header(payload:, sig_header:, secret:, tolerance: DEFAULT_TOLERANCE_SECONDS)
       timestamp_ms, signature_hash = parse_signature_header(sig_header)
       issued_at = timestamp_ms.to_i / 1000.0
-      if (Time.now.to_f - issued_at) > tolerance
+      if (Time.now.to_f - issued_at).abs > tolerance
         raise WorkOS::SignatureVerificationError.new(
           message: "Timestamp outside the tolerance zone",
           http_status: nil

data/lib/workos/api_keys/api_key.rb

@@ -11,6 +11,7 @@ module WorkOS
       name: :name,
       obfuscated_value: :obfuscated_value,
       last_used_at: :last_used_at,
+      expires_at: :expires_at,
       permissions: :permissions,
       created_at: :created_at,
       updated_at: :updated_at
@@ -23,6 +24,7 @@ module WorkOS
       :name,
       :obfuscated_value,
       :last_used_at,
+      :expires_at,
       :permissions,
       :created_at,
       :updated_at
@@ -35,6 +37,7 @@ module WorkOS
       @name = hash[:name]
       @obfuscated_value = hash[:obfuscated_value]
       @last_used_at = hash[:last_used_at]
+      @expires_at = hash[:expires_at]
       @permissions = hash[:permissions] || []
       @created_at = hash[:created_at]
       @updated_at = hash[:updated_at]