workos 9.4.0 → 9.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ccece89bf392d369324892e98d39240f2257017895ab40a1b07d80b433b0d28a
-  data.tar.gz: 43915ec1d843df957f327388dbfa9cc54f93ed1c20b07bde5caf3f8eb78b78a3
+  metadata.gz: d298622f18f3a7fa937e4a37bb7e65ef37553a09ff6299fa32e5899f6ad62dfc
+  data.tar.gz: c8ae0ea79b8d4d9713edc1c22f5f55afc47dc7f5c5374430f7ac3c1eb7c4138a
 SHA512:
-  metadata.gz: 3a429c45d4294e40236c3a0ce87d2df053e2345208615e2f96a8035026cd849fbcd1a03c166ac268196ac5802fd6b412d9f861c3d870f6e218bdf0cb0f0f6b4b
-  data.tar.gz: 78001bbb9b8c29f2e525a76395df27fa6c7d8b8f2f652c439e9a423077732f7cdf8bb1a032fcc91e7c5b0f61e3c99e84e8c3588ca47a305a198680f78afca7f7
+  metadata.gz: e341612af96eb751ee97935c6560b80f647b7032bc37145fa953bf0ed3a72b432d947b8b93a95743ee6bad7bd8bb92336de4140dd202fc23e4ebc7c046dd53b4
+  data.tar.gz: 8df40fc5b71007946287b91b0fedf215b2cb19312f6180c9ec577aecfdfbbfd06482228ba7519aa23eb0be065c5d55088073abcdbbcce65b2b161eb970d089ed

data/.last-synced-sha

@@ -1 +1 @@
-4b4e0618779460dbebc1cf5e0f02197c21796d1f
+23faa38318d596e581656934ed72c4a18476d742

data/.oagen-manifest.json

@@ -1,7 +1,6 @@
 {
   "version": 2,
   "language": "ruby",
-  "generatedAt": "2026-07-02T17:29:49.181Z",
   "files": [
     "lib/workos.rb",
     "lib/workos/admin_portal.rb",
@@ -2057,6 +2056,14 @@
     "PUT /user_management/users/{user_id}/connected_accounts/{slug}": {
       "sdkMethod": "update_user_connected_account",
       "service": "pipes"
+    },
+    "POST /user_management/authenticate#RadarEmailChallengeCodeSessionAuthenticateRequest": {
+      "sdkMethod": "authenticate_with_radar_email_challenge",
+      "service": "user_management"
+    },
+    "POST /user_management/authenticate#RadarSmsChallengeCodeSessionAuthenticateRequest": {
+      "sdkMethod": "authenticate_with_radar_sms_challenge",
+      "service": "user_management"
     }
   }
 }

data/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "9.4.0"
+  ".": "9.5.0"
 }

data/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## [9.5.0](https://github.com/workos/workos-ruby/compare/v9.4.0...v9.5.0) (2026-07-06)
+
+* [#514](https://github.com/workos/workos-ruby/pull/514) fix(generated): regenerate from spec
+
+  **Features**
+  * **[user_management](https://workos.com/docs/reference/authkit/user)**:
+    * Added model `UserRoleAssignmentSource`
+    * Added `source` to `UserRoleAssignment`
+    * Added enum `UserRoleAssignmentSourceType`
+    * Added parameter `UserManagementAuthentication.authorize.max_age`
+    * Added endpoint `GET /user_management/cors_origins`
+    * Added endpoint `GET /user_management/redirect_uris`
+
+  **Fixes**
+  * Restore mistakenly removed CreateMagicAuth logic from previous release
+
 ## [9.4.0](https://github.com/workos/workos-ruby/compare/v9.3.0...v9.4.0) (2026-07-02)
 
 * [#508](https://github.com/workos/workos-ruby/pull/508) fix(generated): regenerate from spec

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    workos (9.4.0)
+    workos (9.5.0)
       jwt (~> 3.1)
       logger (~> 1.7)
       zeitwerk (~> 2.6)
@@ -153,7 +153,7 @@ CHECKSUMS
   unicode-emoji (4.2.0) sha256=519e69150f75652e40bf736106cfbc8f0f73aa3fb6a65afe62fefa7f80b0f80f
   webmock (3.26.2) sha256=774556f2ea6371846cca68c01769b2eac0d134492d21f6d0ab5dd643965a4c90
   webrick (1.9.2) sha256=beb4a15fc474defed24a3bda4ffd88a490d517c9e4e6118c3edce59e45864131
-  workos (9.4.0)
+  workos (9.5.0)
   yard (0.9.44) sha256=eb087e9b631ccd887b049f303d489963945452d5e2a7eb49a5a74a7cf6887f28
   yard-markdown (0.7.1) sha256=06c378632dfe7ba053be9ba469eb4701aa0470e36bcf7e5546f353eb90c1bfd1
   zeitwerk (2.7.5) sha256=d8da92128c09ea6ec62c949011b00ed4a20242b255293dd66bf41545398f73dd

data/lib/workos/user_management/magic_auth_send_magic_auth_code_and_return_response.rb

@@ -5,13 +5,38 @@
 module WorkOS
   class MagicAuthSendMagicAuthCodeAndReturnResponse < WorkOS::Types::BaseModel
     HASH_ATTRS = {
+      object: :object,
+      id: :id,
+      user_id: :user_id,
+      email: :email,
+      expires_at: :expires_at,
+      created_at: :created_at,
+      updated_at: :updated_at,
+      code: :code,
       radar_auth_attempt_id: :radar_auth_attempt_id
     }.freeze
 
-    attr_accessor :radar_auth_attempt_id
+    attr_accessor \
+      :object,
+      :id,
+      :user_id,
+      :email,
+      :expires_at,
+      :created_at,
+      :updated_at,
+      :code,
+      :radar_auth_attempt_id
 
     def initialize(json)
       hash = self.class.normalize(json)
+      @object = hash[:object]
+      @id = hash[:id]
+      @user_id = hash[:user_id]
+      @email = hash[:email]
+      @expires_at = hash[:expires_at]
+      @created_at = hash[:created_at]
+      @updated_at = hash[:updated_at]
+      @code = hash[:code]
       @radar_auth_attempt_id = hash[:radar_auth_attempt_id]
     end
   end

data/lib/workos/user_management/user_create_response.rb

@@ -3,5 +3,59 @@
 # This file is auto-generated by oagen. Do not edit.
 
 module WorkOS
-  UserCreateResponse = MagicAuthSendMagicAuthCodeAndReturnResponse
+  class UserCreateResponse < WorkOS::Types::BaseModel
+    HASH_ATTRS = {
+      object: :object,
+      id: :id,
+      first_name: :first_name,
+      last_name: :last_name,
+      name: :name,
+      profile_picture_url: :profile_picture_url,
+      email: :email,
+      email_verified: :email_verified,
+      external_id: :external_id,
+      metadata: :metadata,
+      last_sign_in_at: :last_sign_in_at,
+      locale: :locale,
+      created_at: :created_at,
+      updated_at: :updated_at,
+      radar_auth_attempt_id: :radar_auth_attempt_id
+    }.freeze
+
+    attr_accessor \
+      :object,
+      :id,
+      :first_name,
+      :last_name,
+      :name,
+      :profile_picture_url,
+      :email,
+      :email_verified,
+      :external_id,
+      :metadata,
+      :last_sign_in_at,
+      :locale,
+      :created_at,
+      :updated_at,
+      :radar_auth_attempt_id
+
+    def initialize(json)
+      hash = self.class.normalize(json)
+      @object = hash[:object]
+      @id = hash[:id]
+      @first_name = hash[:first_name]
+      @last_name = hash[:last_name]
+      @name = hash[:name]
+      @profile_picture_url = hash[:profile_picture_url]
+      @email = hash[:email]
+      @email_verified = hash[:email_verified]
+      @external_id = hash[:external_id]
+      @metadata = hash[:metadata] || {}
+      @last_sign_in_at = hash[:last_sign_in_at]
+      @locale = hash[:locale]
+      @created_at = hash[:created_at]
+      @updated_at = hash[:updated_at]
+      @radar_auth_attempt_id = hash[:radar_auth_attempt_id]
+    end
+  end
 end

data/lib/workos/user_management.rb

@@ -133,6 +133,8 @@ module WorkOS
     # @param ip_address [String, nil]
     # @param device_id [String, nil]
     # @param user_agent [String, nil]
+    # @param signals_id [String, nil]
+    # @param radar_auth_attempt_id [String, nil]
     # @param request_options [Hash] Per-request overrides.
     # @return [WorkOS::AuthenticateResponse]
     def authenticate_with_password(
@@ -142,6 +144,8 @@ module WorkOS
       ip_address: nil,
       device_id: nil,
       user_agent: nil,
+      signals_id: nil,
+      radar_auth_attempt_id: nil,
       request_options: {}
     )
       body = {
@@ -153,7 +157,9 @@ module WorkOS
         "invitation_token" => invitation_token,
         "ip_address" => ip_address,
         "device_id" => device_id,
-        "user_agent" => user_agent
+        "user_agent" => user_agent,
+        "signals_id" => signals_id,
+        "radar_auth_attempt_id" => radar_auth_attempt_id
       }.compact
       response = @client.request(
         method: :post,
@@ -172,6 +178,7 @@ module WorkOS
     # @param ip_address [String, nil]
     # @param device_id [String, nil]
     # @param user_agent [String, nil]
+    # @param signals_id [String, nil]
     # @param request_options [Hash] Per-request overrides.
     # @return [WorkOS::AuthenticateResponse]
     def authenticate_with_code(
@@ -181,6 +188,7 @@ module WorkOS
       ip_address: nil,
       device_id: nil,
       user_agent: nil,
+      signals_id: nil,
       request_options: {}
     )
       body = {
@@ -192,7 +200,8 @@ module WorkOS
         "invitation_token" => invitation_token,
         "ip_address" => ip_address,
         "device_id" => device_id,
-        "user_agent" => user_agent
+        "user_agent" => user_agent,
+        "signals_id" => signals_id
       }.compact
       response = @client.request(
         method: :post,
@@ -247,6 +256,7 @@ module WorkOS
     # @param ip_address [String, nil]
     # @param device_id [String, nil]
     # @param user_agent [String, nil]
+    # @param radar_auth_attempt_id [String, nil]
     # @param request_options [Hash] Per-request overrides.
     # @return [WorkOS::AuthenticateResponse]
     def authenticate_with_magic_auth(
@@ -256,6 +266,7 @@ module WorkOS
       ip_address: nil,
       device_id: nil,
       user_agent: nil,
+      radar_auth_attempt_id: nil,
       request_options: {}
     )
       body = {
@@ -267,7 +278,8 @@ module WorkOS
         "invitation_token" => invitation_token,
         "ip_address" => ip_address,
         "device_id" => device_id,
-        "user_agent" => user_agent
+        "user_agent" => user_agent,
+        "radar_auth_attempt_id" => radar_auth_attempt_id
       }.compact
       response = @client.request(
         method: :post,
@@ -422,6 +434,87 @@ module WorkOS
       WorkOS::AuthenticateResponse.new(response.body)
     end
 
+    # Authenticate with radar email challenge.
+    # @param code [String]
+    # @param radar_challenge_id [String]
+    # @param pending_authentication_token [String]
+    # @param ip_address [String, nil]
+    # @param device_id [String, nil]
+    # @param user_agent [String, nil]
+    # @param request_options [Hash] Per-request overrides.
+    # @return [WorkOS::AuthenticateResponse]
+    def authenticate_with_radar_email_challenge(
+      code:,
+      radar_challenge_id:,
+      pending_authentication_token:,
+      ip_address: nil,
+      device_id: nil,
+      user_agent: nil,
+      request_options: {}
+    )
+      body = {
+        "grant_type" => "urn:workos:oauth:grant-type:radar-email-challenge:code",
+        "client_id" => @client.client_id,
+        "client_secret" => @client.api_key,
+        "code" => code,
+        "radar_challenge_id" => radar_challenge_id,
+        "pending_authentication_token" => pending_authentication_token,
+        "ip_address" => ip_address,
+        "device_id" => device_id,
+        "user_agent" => user_agent
+      }.compact
+      response = @client.request(
+        method: :post,
+        path: "/user_management/authenticate",
+        auth: true,
+        body: body,
+        request_options: request_options
+      )
+      WorkOS::AuthenticateResponse.new(response.body)
+    end
+
+    # Authenticate with radar sms challenge.
+    # @param code [String]
+    # @param verification_id [String]
+    # @param phone_number [String]
+    # @param pending_authentication_token [String]
+    # @param ip_address [String, nil]
+    # @param device_id [String, nil]
+    # @param user_agent [String, nil]
+    # @param request_options [Hash] Per-request overrides.
+    # @return [WorkOS::AuthenticateResponse]
+    def authenticate_with_radar_sms_challenge(
+      code:,
+      verification_id:,
+      phone_number:,
+      pending_authentication_token:,
+      ip_address: nil,
+      device_id: nil,
+      user_agent: nil,
+      request_options: {}
+    )
+      body = {
+        "grant_type" => "urn:workos:oauth:grant-type:radar-sms-challenge:code",
+        "client_id" => @client.client_id,
+        "client_secret" => @client.api_key,
+        "code" => code,
+        "verification_id" => verification_id,
+        "phone_number" => phone_number,
+        "pending_authentication_token" => pending_authentication_token,
+        "ip_address" => ip_address,
+        "device_id" => device_id,
+        "user_agent" => user_agent
+      }.compact
+      response = @client.request(
+        method: :post,
+        path: "/user_management/authenticate",
+        auth: true,
+        body: body,
+        request_options: request_options
+      )
+      WorkOS::AuthenticateResponse.new(response.body)
+    end
+
     # Get device authorization URL
     # @param client_id [String] The WorkOS client ID for your application.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)

data/lib/workos/version.rb

@@ -2,5 +2,5 @@
 
 # @oagen-ignore-file
 module WorkOS
-  VERSION = "9.4.0"
+  VERSION = "9.5.0"
 end

data/rbi/workos/magic_auth_send_magic_auth_code_and_return_response.rbi

@@ -9,6 +9,54 @@ module WorkOS
     sig { params(json: T.any(String, T::Hash[Symbol, T.untyped])).void }
     def initialize(json); end
 
+    sig { returns(String) }
+    def object; end
+
+    sig { params(value: String).returns(String) }
+    def object=(value); end
+
+    sig { returns(String) }
+    def id; end
+
+    sig { params(value: String).returns(String) }
+    def id=(value); end
+
+    sig { returns(String) }
+    def user_id; end
+
+    sig { params(value: String).returns(String) }
+    def user_id=(value); end
+
+    sig { returns(String) }
+    def email; end
+
+    sig { params(value: String).returns(String) }
+    def email=(value); end
+
+    sig { returns(String) }
+    def expires_at; end
+
+    sig { params(value: String).returns(String) }
+    def expires_at=(value); end
+
+    sig { returns(String) }
+    def created_at; end
+
+    sig { params(value: String).returns(String) }
+    def created_at=(value); end
+
+    sig { returns(String) }
+    def updated_at; end
+
+    sig { params(value: String).returns(String) }
+    def updated_at=(value); end
+
+    sig { returns(String) }
+    def code; end
+
+    sig { params(value: String).returns(String) }
+    def code=(value); end
+
     sig { returns(T.nilable(String)) }
     def radar_auth_attempt_id; end
 

data/rbi/workos/user_create_response.rbi

@@ -9,6 +9,90 @@ module WorkOS
     sig { params(json: T.any(String, T::Hash[Symbol, T.untyped])).void }
     def initialize(json); end
 
+    sig { returns(String) }
+    def object; end
+
+    sig { params(value: String).returns(String) }
+    def object=(value); end
+
+    sig { returns(String) }
+    def id; end
+
+    sig { params(value: String).returns(String) }
+    def id=(value); end
+
+    sig { returns(T.nilable(String)) }
+    def first_name; end
+
+    sig { params(value: T.nilable(String)).returns(T.nilable(String)) }
+    def first_name=(value); end
+
+    sig { returns(T.nilable(String)) }
+    def last_name; end
+
+    sig { params(value: T.nilable(String)).returns(T.nilable(String)) }
+    def last_name=(value); end
+
+    sig { returns(T.nilable(String)) }
+    def name; end
+
+    sig { params(value: T.nilable(String)).returns(T.nilable(String)) }
+    def name=(value); end
+
+    sig { returns(T.nilable(String)) }
+    def profile_picture_url; end
+
+    sig { params(value: T.nilable(String)).returns(T.nilable(String)) }
+    def profile_picture_url=(value); end
+
+    sig { returns(String) }
+    def email; end
+
+    sig { params(value: String).returns(String) }
+    def email=(value); end
+
+    sig { returns(T::Boolean) }
+    def email_verified; end
+
+    sig { params(value: T::Boolean).returns(T::Boolean) }
+    def email_verified=(value); end
+
+    sig { returns(T.nilable(String)) }
+    def external_id; end
+
+    sig { params(value: T.nilable(String)).returns(T.nilable(String)) }
+    def external_id=(value); end
+
+    sig { returns(T.nilable(T::Hash[String, String])) }
+    def metadata; end
+
+    sig { params(value: T.nilable(T::Hash[String, String])).returns(T.nilable(T::Hash[String, String])) }
+    def metadata=(value); end
+
+    sig { returns(T.nilable(String)) }
+    def last_sign_in_at; end
+
+    sig { params(value: T.nilable(String)).returns(T.nilable(String)) }
+    def last_sign_in_at=(value); end
+
+    sig { returns(T.nilable(String)) }
+    def locale; end
+
+    sig { params(value: T.nilable(String)).returns(T.nilable(String)) }
+    def locale=(value); end
+
+    sig { returns(String) }
+    def created_at; end
+
+    sig { params(value: String).returns(String) }
+    def created_at=(value); end
+
+    sig { returns(String) }
+    def updated_at; end
+
+    sig { params(value: String).returns(String) }
+    def updated_at=(value); end
+
     sig { returns(T.nilable(String)) }
     def radar_auth_attempt_id; end
 

data/test/workos/test_user_management.rb

@@ -145,6 +145,36 @@ class UserManagementTest < Minitest::Test
     end
   end
 
+  def test_authenticate_with_radar_email_challenge_returns_expected_result
+    stub_request(:post, %r{\Ahttps://api\.workos\.com/user_management/authenticate(\?|\z)})
+      .to_return(body: "{}", status: 200)
+    result = @client.user_management.authenticate_with_radar_email_challenge(code: "stub", radar_challenge_id: "stub", pending_authentication_token: "stub")
+    refute_nil result
+  end
+
+  def test_authenticate_with_radar_email_challenge_raises_authentication_error_on_401
+    stub_request(:post, %r{\Ahttps://api\.workos\.com/user_management/authenticate(\?|\z)})
+      .to_return(body: '{"message": "Unauthorized"}', status: 401)
+    assert_raises(WorkOS::AuthenticationError) do
+      @client.user_management.authenticate_with_radar_email_challenge(code: "stub", radar_challenge_id: "stub", pending_authentication_token: "stub")
+    end
+  end
+
+  def test_authenticate_with_radar_sms_challenge_returns_expected_result
+    stub_request(:post, %r{\Ahttps://api\.workos\.com/user_management/authenticate(\?|\z)})
+      .to_return(body: "{}", status: 200)
+    result = @client.user_management.authenticate_with_radar_sms_challenge(code: "stub", verification_id: "stub", phone_number: "stub", pending_authentication_token: "stub")
+    refute_nil result
+  end
+
+  def test_authenticate_with_radar_sms_challenge_raises_authentication_error_on_401
+    stub_request(:post, %r{\Ahttps://api\.workos\.com/user_management/authenticate(\?|\z)})
+      .to_return(body: '{"message": "Unauthorized"}', status: 401)
+    assert_raises(WorkOS::AuthenticationError) do
+      @client.user_management.authenticate_with_radar_sms_challenge(code: "stub", verification_id: "stub", phone_number: "stub", pending_authentication_token: "stub")
+    end
+  end
+
   def test_create_device_returns_expected_result
     stub_request(:post, %r{\Ahttps://api\.workos\.com/user_management/authorize/device(\?|\z)})
       .to_return(body: "{}", status: 200)

data/test/workos/test_user_management_model_round_trip.rb

@@ -928,21 +928,60 @@ class UserManagementModelRoundTripTest < Minitest::Test
 
   def test_magic_auth_send_magic_auth_code_and_return_response_round_trip
     fixture = {
+      "object" => "magic_auth",
+      "id" => "stub",
+      "user_id" => "stub",
+      "email" => "stub",
+      "expires_at" => "stub",
+      "created_at" => "stub",
+      "updated_at" => "stub",
+      "code" => "stub",
       "radar_auth_attempt_id" => "stub"
     }
     model = WorkOS::MagicAuthSendMagicAuthCodeAndReturnResponse.new(fixture.to_json)
     json = model.to_h
     assert_kind_of Hash, json
+    assert_equal fixture["id"], json[:id]
+    assert_equal fixture["user_id"], json[:user_id]
+    assert_equal fixture["email"], json[:email]
+    assert_equal fixture["expires_at"], json[:expires_at]
+    assert_equal fixture["created_at"], json[:created_at]
+    assert_equal fixture["updated_at"], json[:updated_at]
+    assert_equal fixture["code"], json[:code]
     fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
   end
 
   def test_user_create_response_round_trip
     fixture = {
+      "object" => "user",
+      "id" => "stub",
+      "first_name" => nil,
+      "last_name" => nil,
+      "name" => nil,
+      "profile_picture_url" => nil,
+      "email" => "stub",
+      "email_verified" => true,
+      "external_id" => nil,
+      "metadata" => {},
+      "last_sign_in_at" => nil,
+      "locale" => nil,
+      "created_at" => "stub",
+      "updated_at" => "stub",
       "radar_auth_attempt_id" => "stub"
     }
     model = WorkOS::UserCreateResponse.new(fixture.to_json)
     json = model.to_h
     assert_kind_of Hash, json
+    assert_equal fixture["id"], json[:id]
+    assert_nil json[:first_name]
+    assert_nil json[:last_name]
+    assert_nil json[:profile_picture_url]
+    assert_equal fixture["email"], json[:email]
+    assert_equal fixture["email_verified"], json[:email_verified]
+    assert_nil json[:external_id]
+    assert_nil json[:last_sign_in_at]
+    assert_equal fixture["created_at"], json[:created_at]
+    assert_equal fixture["updated_at"], json[:updated_at]
     fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
   end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: workos
 version: !ruby/object:Gem::Version
-  version: 9.4.0
+  version: 9.5.0
 platform: ruby
 authors:
 - WorkOS