workos 9.5.0 → 10.1.0

data/lib/workos/types/{data_integration_credentials_type.rb → agent_registration_kind.rb}

@@ -4,6 +4,6 @@
 
 module WorkOS
   module Types
-    DataIntegrationCredentialsType = DataIntegrationCredentialType
+    AgentRegistrationKind = AgentRegistrationCreatedDataKind
   end
 end

data/lib/workos/types/{organization_domain_stand_alone_state.rb → agent_registration_status.rb}

@@ -4,6 +4,6 @@
 
 module WorkOS
   module Types
-    OrganizationDomainStandAloneState = OrganizationCreatedDataDomainState
+    AgentRegistrationStatus = AgentRegistrationCreatedDataStatus
   end
 end

data/lib/workos/types/applications_registration_types.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  module Types
+    class ApplicationsRegistrationTypes
+      DYNAMIC = "dynamic"
+      AUTHENTICATED = "authenticated"
+      ALL = [DYNAMIC, AUTHENTICATED].freeze
+    end
+  end
+end

data/lib/workos/types/{organization_domain_stand_alone_verification_strategy.rb → claim_view_response_status.rb}

@@ -4,6 +4,6 @@
 
 module WorkOS
   module Types
-    OrganizationDomainStandAloneVerificationStrategy = OrganizationCreatedDataDomainVerificationStrategy
+    ClaimViewResponseStatus = AgentRegistrationCreatedDataStatus
   end
 end

data/lib/workos/types/connected_account_auth_method.rb

@@ -7,7 +7,8 @@ module WorkOS
     class ConnectedAccountAuthMethod
       OAUTH = "oauth"
       API_KEY = "api_key"
-      ALL = [OAUTH, API_KEY].freeze
+      CLIENT_CREDENTIALS = "client_credentials"
+      ALL = [OAUTH, API_KEY, CLIENT_CREDENTIALS].freeze
     end
   end
 end

data/lib/workos/types/connected_account_input_state.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  module Types
+    class ConnectedAccountInputState
+      CONNECTED = "connected"
+      NEEDS_REAUTHORIZATION = "needs_reauthorization"
+      ALL = [CONNECTED, NEEDS_REAUTHORIZATION].freeze
+    end
+  end
+end

data/lib/workos/types/connected_account_state.rb

@@ -7,7 +7,8 @@ module WorkOS
     class ConnectedAccountState
       CONNECTED = "connected"
       NEEDS_REAUTHORIZATION = "needs_reauthorization"
-      ALL = [CONNECTED, NEEDS_REAUTHORIZATION].freeze
+      DISCONNECTED = "disconnected"
+      ALL = [CONNECTED, NEEDS_REAUTHORIZATION, DISCONNECTED].freeze
     end
   end
 end

data/lib/workos/types/create_data_integration_auth_methods.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  module Types
+    class CreateDataIntegrationAuthMethods
+      OAUTH = "oauth"
+      API_KEY = "api_key"
+      ALL = [OAUTH, API_KEY].freeze
+    end
+  end
+end

data/lib/workos/types/create_user_password_hash_type.rb

@@ -8,10 +8,11 @@ module WorkOS
       BCRYPT = "bcrypt"
       FIREBASE_SCRYPT = "firebase-scrypt"
       SSHA = "ssha"
+      SSHA_256 = "ssha256"
       SCRYPT = "scrypt"
       PBKDF_2 = "pbkdf2"
       ARGON_2 = "argon2"
-      ALL = [BCRYPT, FIREBASE_SCRYPT, SSHA, SCRYPT, PBKDF_2, ARGON_2].freeze
+      ALL = [BCRYPT, FIREBASE_SCRYPT, SSHA, SSHA_256, SCRYPT, PBKDF_2, ARGON_2].freeze
     end
   end
 end

data/lib/workos/types/create_webhook_endpoint_events.rb

@@ -9,7 +9,10 @@ module WorkOS
       AGENT_REGISTRATION_CLAIM_ATTEMPT_CREATED = "agent.registration.claim.attempt.created"
       AGENT_REGISTRATION_CLAIM_COMPLETED = "agent.registration.claim.completed"
       AGENT_REGISTRATION_CREDENTIAL_ISSUED = "agent.registration.credential.issued"
+      AGENT_REGISTRATION_DELETED = "agent.registration.deleted"
+      AGENT_REGISTRATION_EXPIRED = "agent.registration.expired"
       AGENT_REGISTRATION_ORGANIZATION_SWITCHED = "agent.registration.organization.switched"
+      AGENT_REGISTRATION_REVOKED = "agent.registration.revoked"
       AUTHENTICATION_EMAIL_VERIFICATION_SUCCEEDED = "authentication.email_verification_succeeded"
       AUTHENTICATION_MAGIC_AUTH_FAILED = "authentication.magic_auth_failed"
       AUTHENTICATION_MAGIC_AUTH_SUCCEEDED = "authentication.magic_auth_succeeded"
@@ -24,6 +27,7 @@ module WorkOS
       AUTHENTICATION_SSO_STARTED = "authentication.sso_started"
       AUTHENTICATION_SSO_SUCCEEDED = "authentication.sso_succeeded"
       AUTHENTICATION_SSO_TIMED_OUT = "authentication.sso_timed_out"
+      RADAR_CHALLENGE_CREATED = "radar.challenge_created"
       AUTHENTICATION_RADAR_RISK_DETECTED = "authentication.radar_risk_detected"
       AUTHENTICATION_REAUTHENTICATION_SUCCEEDED = "authentication.reauthentication_succeeded"
       API_KEY_CREATED = "api_key.created"
@@ -93,7 +97,7 @@ module WorkOS
       WAITLIST_USER_APPROVED = "waitlist_user.approved"
       WAITLIST_USER_CREATED = "waitlist_user.created"
       WAITLIST_USER_DENIED = "waitlist_user.denied"
-      ALL = [AGENT_REGISTRATION_CREATED, AGENT_REGISTRATION_CLAIM_ATTEMPT_CREATED, AGENT_REGISTRATION_CLAIM_COMPLETED, AGENT_REGISTRATION_CREDENTIAL_ISSUED, AGENT_REGISTRATION_ORGANIZATION_SWITCHED, AUTHENTICATION_EMAIL_VERIFICATION_SUCCEEDED, AUTHENTICATION_MAGIC_AUTH_FAILED, AUTHENTICATION_MAGIC_AUTH_SUCCEEDED, AUTHENTICATION_MFA_SUCCEEDED, AUTHENTICATION_OAUTH_FAILED, AUTHENTICATION_OAUTH_SUCCEEDED, AUTHENTICATION_PASSWORD_FAILED, AUTHENTICATION_PASSWORD_SUCCEEDED, AUTHENTICATION_PASSKEY_FAILED, AUTHENTICATION_PASSKEY_SUCCEEDED, AUTHENTICATION_SSO_FAILED, AUTHENTICATION_SSO_STARTED, AUTHENTICATION_SSO_SUCCEEDED, AUTHENTICATION_SSO_TIMED_OUT, AUTHENTICATION_RADAR_RISK_DETECTED, AUTHENTICATION_REAUTHENTICATION_SUCCEEDED, API_KEY_CREATED, API_KEY_REVOKED, API_KEY_UPDATED, CONNECTION_ACTIVATED, CONNECTION_DEACTIVATED, CONNECTION_SAML_CERTIFICATE_RENEWAL_REQUIRED, CONNECTION_SAML_CERTIFICATE_RENEWED, CONNECTION_DELETED, DSYNC_ACTIVATED, DSYNC_DELETED, DSYNC_GROUP_CREATED, DSYNC_GROUP_DELETED, DSYNC_GROUP_UPDATED, DSYNC_GROUP_USER_ADDED, DSYNC_GROUP_USER_REMOVED, DSYNC_USER_CREATED, DSYNC_USER_DELETED, DSYNC_USER_UPDATED, EMAIL_VERIFICATION_CREATED, GROUP_CREATED, GROUP_DELETED, GROUP_MEMBER_ADDED, GROUP_MEMBER_REMOVED, GROUP_UPDATED, FLAG_CREATED, FLAG_DELETED, FLAG_UPDATED, FLAG_RULE_UPDATED, INVITATION_ACCEPTED, INVITATION_CREATED, INVITATION_RESENT, INVITATION_REVOKED, MAGIC_AUTH_CREATED, ORGANIZATION_CREATED, ORGANIZATION_DELETED, ORGANIZATION_UPDATED, ORGANIZATION_DOMAIN_CREATED, ORGANIZATION_DOMAIN_DELETED, ORGANIZATION_DOMAIN_UPDATED, ORGANIZATION_DOMAIN_VERIFIED, ORGANIZATION_DOMAIN_VERIFICATION_FAILED, PASSWORD_RESET_CREATED, PASSWORD_RESET_SUCCEEDED, USER_CREATED, USER_UPDATED, USER_DELETED, ORGANIZATION_MEMBERSHIP_CREATED, ORGANIZATION_MEMBERSHIP_DELETED, ORGANIZATION_MEMBERSHIP_UPDATED, ROLE_CREATED, ROLE_DELETED, ROLE_UPDATED, ORGANIZATION_ROLE_CREATED, ORGANIZATION_ROLE_DELETED, ORGANIZATION_ROLE_UPDATED, PERMISSION_CREATED, PERMISSION_DELETED, PERMISSION_UPDATED, PIPES_CONNECTED_ACCOUNT_CONNECTED, PIPES_CONNECTED_ACCOUNT_CONNECTION_FAILED, PIPES_CONNECTED_ACCOUNT_DISCONNECTED, PIPES_CONNECTED_ACCOUNT_REAUTHORIZATION_NEEDED, SESSION_CREATED, SESSION_REVOKED, WAITLIST_USER_APPROVED, WAITLIST_USER_CREATED, WAITLIST_USER_DENIED].freeze
+      ALL = [AGENT_REGISTRATION_CREATED, AGENT_REGISTRATION_CLAIM_ATTEMPT_CREATED, AGENT_REGISTRATION_CLAIM_COMPLETED, AGENT_REGISTRATION_CREDENTIAL_ISSUED, AGENT_REGISTRATION_DELETED, AGENT_REGISTRATION_EXPIRED, AGENT_REGISTRATION_ORGANIZATION_SWITCHED, AGENT_REGISTRATION_REVOKED, AUTHENTICATION_EMAIL_VERIFICATION_SUCCEEDED, AUTHENTICATION_MAGIC_AUTH_FAILED, AUTHENTICATION_MAGIC_AUTH_SUCCEEDED, AUTHENTICATION_MFA_SUCCEEDED, AUTHENTICATION_OAUTH_FAILED, AUTHENTICATION_OAUTH_SUCCEEDED, AUTHENTICATION_PASSWORD_FAILED, AUTHENTICATION_PASSWORD_SUCCEEDED, AUTHENTICATION_PASSKEY_FAILED, AUTHENTICATION_PASSKEY_SUCCEEDED, AUTHENTICATION_SSO_FAILED, AUTHENTICATION_SSO_STARTED, AUTHENTICATION_SSO_SUCCEEDED, AUTHENTICATION_SSO_TIMED_OUT, RADAR_CHALLENGE_CREATED, AUTHENTICATION_RADAR_RISK_DETECTED, AUTHENTICATION_REAUTHENTICATION_SUCCEEDED, API_KEY_CREATED, API_KEY_REVOKED, API_KEY_UPDATED, CONNECTION_ACTIVATED, CONNECTION_DEACTIVATED, CONNECTION_SAML_CERTIFICATE_RENEWAL_REQUIRED, CONNECTION_SAML_CERTIFICATE_RENEWED, CONNECTION_DELETED, DSYNC_ACTIVATED, DSYNC_DELETED, DSYNC_GROUP_CREATED, DSYNC_GROUP_DELETED, DSYNC_GROUP_UPDATED, DSYNC_GROUP_USER_ADDED, DSYNC_GROUP_USER_REMOVED, DSYNC_USER_CREATED, DSYNC_USER_DELETED, DSYNC_USER_UPDATED, EMAIL_VERIFICATION_CREATED, GROUP_CREATED, GROUP_DELETED, GROUP_MEMBER_ADDED, GROUP_MEMBER_REMOVED, GROUP_UPDATED, FLAG_CREATED, FLAG_DELETED, FLAG_UPDATED, FLAG_RULE_UPDATED, INVITATION_ACCEPTED, INVITATION_CREATED, INVITATION_RESENT, INVITATION_REVOKED, MAGIC_AUTH_CREATED, ORGANIZATION_CREATED, ORGANIZATION_DELETED, ORGANIZATION_UPDATED, ORGANIZATION_DOMAIN_CREATED, ORGANIZATION_DOMAIN_DELETED, ORGANIZATION_DOMAIN_UPDATED, ORGANIZATION_DOMAIN_VERIFIED, ORGANIZATION_DOMAIN_VERIFICATION_FAILED, PASSWORD_RESET_CREATED, PASSWORD_RESET_SUCCEEDED, USER_CREATED, USER_UPDATED, USER_DELETED, ORGANIZATION_MEMBERSHIP_CREATED, ORGANIZATION_MEMBERSHIP_DELETED, ORGANIZATION_MEMBERSHIP_UPDATED, ROLE_CREATED, ROLE_DELETED, ROLE_UPDATED, ORGANIZATION_ROLE_CREATED, ORGANIZATION_ROLE_DELETED, ORGANIZATION_ROLE_UPDATED, PERMISSION_CREATED, PERMISSION_DELETED, PERMISSION_UPDATED, PIPES_CONNECTED_ACCOUNT_CONNECTED, PIPES_CONNECTED_ACCOUNT_CONNECTION_FAILED, PIPES_CONNECTED_ACCOUNT_DISCONNECTED, PIPES_CONNECTED_ACCOUNT_REAUTHORIZATION_NEEDED, SESSION_CREATED, SESSION_REVOKED, WAITLIST_USER_APPROVED, WAITLIST_USER_CREATED, WAITLIST_USER_DENIED].freeze
     end
   end
 end

data/lib/workos/types/data_integration_auth_methods.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  module Types
+    DataIntegrationAuthMethods = ConnectedAccountAuthMethod
+  end
+end

data/lib/workos/types/data_integration_credentials_input_type.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  module Types
+    DataIntegrationCredentialsInputType = DataIntegrationCredentialType
+  end
+end

data/lib/workos/types/data_integrations_list_response_data_connected_account_state.rb

@@ -4,11 +4,6 @@
 
 module WorkOS
   module Types
-    class DataIntegrationsListResponseDataConnectedAccountState
-      CONNECTED = "connected"
-      NEEDS_REAUTHORIZATION = "needs_reauthorization"
-      DISCONNECTED = "disconnected"
-      ALL = [CONNECTED, NEEDS_REAUTHORIZATION, DISCONNECTED].freeze
-    end
+    DataIntegrationsListResponseDataConnectedAccountState = ConnectedAccountState
   end
 end

data/lib/workos/types/pipe_connected_account_state.rb

@@ -4,10 +4,6 @@
 
 module WorkOS
   module Types
-    class PipeConnectedAccountState
-      CONNECTED = "connected"
-      NEEDS_REAUTHORIZATION = "needs_reauthorization"
-      ALL = [CONNECTED, NEEDS_REAUTHORIZATION].freeze
-    end
+    PipeConnectedAccountState = ConnectedAccountInputState
   end
 end

data/lib/workos/types/vault_kek_deleted_data_actor_source.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  module Types
+    VaultKekDeletedDataActorSource = VaultDataCreatedDataActorSource
+  end
+end

data/lib/workos/user_management/authentication_reauthentication_succeeded.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  class AuthenticationReauthenticationSucceeded < WorkOS::Types::BaseModel
+    HASH_ATTRS = {
+      object: :object,
+      id: :id,
+      event: :event,
+      data: :data,
+      created_at: :created_at,
+      context: :context
+    }.freeze
+
+    attr_accessor \
+      :object,
+      :id,
+      :event,
+      :data,
+      :created_at,
+      :context
+
+    def initialize(json)
+      hash = self.class.normalize(json)
+      @object = hash[:object]
+      @id = hash[:id]
+      @event = hash[:event]
+      @data = hash[:data] ? WorkOS::AuthenticationReauthenticationSucceededData.new(hash[:data]) : nil
+      @created_at = hash[:created_at]
+      @context = hash[:context] ? WorkOS::EventContext.new(hash[:context]) : nil
+    end
+  end
+end

data/lib/workos/user_management/authentication_reauthentication_succeeded_data.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  class AuthenticationReauthenticationSucceededData < WorkOS::Types::BaseModel
+    HASH_ATTRS = {
+      type: :type,
+      status: :status,
+      ip_address: :ip_address,
+      user_agent: :user_agent,
+      user_id: :user_id,
+      email: :email
+    }.freeze
+
+    attr_accessor \
+      :type,
+      :status,
+      :ip_address,
+      :user_agent,
+      :user_id,
+      :email
+
+    def initialize(json)
+      hash = self.class.normalize(json)
+      @type = hash[:type]
+      @status = hash[:status]
+      @ip_address = hash[:ip_address]
+      @user_agent = hash[:user_agent]
+      @user_id = hash[:user_id]
+      @email = hash[:email]
+    end
+  end
+end

data/lib/workos/user_management/radar_challenge.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  class RadarChallenge < WorkOS::Types::BaseModel
+    HASH_ATTRS = {
+      object: :object,
+      id: :id,
+      type: :type,
+      user_id: :user_id,
+      email: :email,
+      expires_at: :expires_at,
+      created_at: :created_at,
+      updated_at: :updated_at,
+      code: :code
+    }.freeze
+
+    attr_accessor \
+      :object,
+      :id,
+      :type,
+      :user_id,
+      :email,
+      :expires_at,
+      :created_at,
+      :updated_at,
+      :code
+
+    def initialize(json)
+      hash = self.class.normalize(json)
+      @object = hash[:object]
+      @id = hash[:id]
+      @type = hash[:type]
+      @user_id = hash[:user_id]
+      @email = hash[:email]
+      @expires_at = hash[:expires_at]
+      @created_at = hash[:created_at]
+      @updated_at = hash[:updated_at]
+      @code = hash[:code]
+    end
+  end
+end

data/lib/workos/user_management.rb

@@ -3,6 +3,7 @@
 # This file is auto-generated by oagen. Do not edit.
 
 require "json"
+require "uri"
 
 module WorkOS
   class UserManagement
@@ -515,6 +516,70 @@ module WorkOS
       WorkOS::AuthenticateResponse.new(response.body)
     end
 
+    # Get an authorization URL
+    # Builds the URL client-side; no HTTP request is made.
+    # @param code_challenge_method [String, nil] The only valid PKCE code challenge method is `"S256"`. Required when specifying a `code_challenge`.
+    # @param code_challenge [String, nil] Code challenge derived from the code verifier used for the PKCE flow.
+    # @param domain_hint [String, nil] A domain hint for SSO connection lookup.
+    # @param connection_id [String, nil] The ID of an SSO connection to use for authentication.
+    # @param provider_query_params [Hash{String => String}, nil] Key/value pairs of query parameters to pass to the OAuth provider.
+    # @param provider_scopes [Array<String>, nil] Additional OAuth scopes to request from the identity provider.
+    # @param invitation_token [String, nil] A token representing a user invitation to redeem during authentication.
+    # @param max_age [Integer, nil] Maximum allowable elapsed time, in seconds, since the user last actively authenticated. If the last authentication is older than this value, the user is prompted to re-authenticate; a value of `0` forces re-authentication. Only supported when the provider is `authkit`.
+    # @param screen_hint [WorkOS::Types::UserManagementAuthenticationScreenHint, nil] Used to specify which screen to display when the provider is `authkit`.
+    # @param login_hint [String, nil] A hint to the authorization server about the login identifier the user might use.
+    # @param provider [WorkOS::Types::UserManagementAuthenticationProvider, nil] The OAuth provider to authenticate with (e.g., GoogleOAuth, MicrosoftOAuth, GitHubOAuth).
+    # @param prompt [String, nil] Controls the authentication flow behavior for the user.
+    # @param state [String, nil] An opaque value used to maintain state between the request and the callback.
+    # @param organization_id [String, nil] The ID of the organization to authenticate the user against.
+    # @param redirect_uri [String] The callback URI where the authorization code will be sent after authentication.
+    # @param client_id [String, nil] The unique identifier of the WorkOS environment client. Defaults to the client's configured client_id.
+    # @return [String]
+    def get_authorization_url(
+      redirect_uri:,
+      code_challenge_method: nil,
+      code_challenge: nil,
+      domain_hint: nil,
+      connection_id: nil,
+      provider_query_params: nil,
+      provider_scopes: nil,
+      invitation_token: nil,
+      max_age: nil,
+      screen_hint: nil,
+      login_hint: nil,
+      provider: nil,
+      prompt: nil,
+      state: nil,
+      organization_id: nil,
+      client_id: nil
+    )
+      params = {
+        "code_challenge_method" => code_challenge_method,
+        "code_challenge" => code_challenge,
+        "domain_hint" => domain_hint,
+        "connection_id" => connection_id,
+        "provider_query_params" => provider_query_params,
+        "provider_scopes" => provider_scopes,
+        "invitation_token" => invitation_token,
+        "max_age" => max_age,
+        "screen_hint" => screen_hint,
+        "login_hint" => login_hint,
+        "provider" => provider,
+        "prompt" => prompt,
+        "state" => state,
+        "organization_id" => organization_id,
+        "redirect_uri" => redirect_uri,
+        "client_id" => client_id
+      }.compact
+      params["provider_query_params"] = JSON.generate(provider_query_params) unless provider_query_params.nil?
+      params["provider_scopes"] = provider_scopes.join(",") unless provider_scopes.nil?
+      params["response_type"] = "code"
+      params["client_id"] = @client.client_id if !params.key?("client_id") && !@client.client_id.nil?
+      uri = URI.join(@client.base_url, "/user_management/authorize")
+      uri.query = URI.encode_www_form(params) unless params.empty?
+      uri.to_s
+    end
+
     # Get device authorization URL
     # @param client_id [String] The WorkOS client ID for your application.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
@@ -573,6 +638,43 @@ module WorkOS
       result
     end
 
+    # Get Radar Challenge details
+    # @param id [String] The unique ID of the Radar Challenge.
+    # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
+    # @return [WorkOS::RadarChallenge]
+    def get_radar_challenge(
+      id:,
+      request_options: {}
+    )
+      response = @client.request(
+        method: :get,
+        path: "/user_management/radar_challenges/#{WorkOS::Util.encode_path(id)}",
+        auth: true,
+        request_options: request_options
+      )
+      result = WorkOS::RadarChallenge.new(response.body)
+      result.last_response = WorkOS::Types::ApiResponse.new(http_status: response.code.to_i, http_headers: response.each_header.to_h, request_id: response["x-request-id"])
+      result
+    end
+
+    # Logout
+    # Builds the URL client-side; no HTTP request is made.
+    # @param session_id [String] The ID of the session. This can be extracted from the `sid` claim of the access token.
+    # @param return_to [String, nil] The URL to redirect the user to after logout.
+    # @return [String]
+    def get_logout_url(
+      session_id:,
+      return_to: nil
+    )
+      params = {
+        "session_id" => session_id,
+        "return_to" => return_to
+      }.compact
+      uri = URI.join(@client.base_url, "/user_management/sessions/logout")
+      uri.query = URI.encode_www_form(params) unless params.empty?
+      uri.to_s
+    end
+
     # Revoke Session
     # @param session_id [String] The ID of the session to revoke. This can be extracted from the `sid` claim of the access token.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
@@ -820,30 +922,30 @@ module WorkOS
     # @return [WorkOS::UserCreateResponse]
     def create_user(
       email:,
-      first_name: nil,
-      last_name: nil,
-      name: nil,
-      email_verified: nil,
-      metadata: nil,
-      external_id: nil,
-      ip_address: nil,
-      user_agent: nil,
+      first_name: WorkOS::OMIT,
+      last_name: WorkOS::OMIT,
+      name: WorkOS::OMIT,
+      email_verified: WorkOS::OMIT,
+      metadata: WorkOS::OMIT,
+      external_id: WorkOS::OMIT,
+      ip_address: WorkOS::OMIT,
+      user_agent: WorkOS::OMIT,
       signals_id: nil,
       password: nil,
       request_options: {}
     )
       body = {
         "email" => email,
-        "first_name" => first_name,
-        "last_name" => last_name,
-        "name" => name,
-        "email_verified" => email_verified,
-        "metadata" => metadata,
-        "external_id" => external_id,
-        "ip_address" => ip_address,
-        "user_agent" => user_agent,
         "signals_id" => signals_id
       }.compact
+      body["first_name"] = first_name unless first_name.equal?(WorkOS::OMIT)
+      body["last_name"] = last_name unless last_name.equal?(WorkOS::OMIT)
+      body["name"] = name unless name.equal?(WorkOS::OMIT)
+      body["email_verified"] = email_verified unless email_verified.equal?(WorkOS::OMIT)
+      body["metadata"] = metadata unless metadata.equal?(WorkOS::OMIT)
+      body["external_id"] = external_id unless external_id.equal?(WorkOS::OMIT)
+      body["ip_address"] = ip_address unless ip_address.equal?(WorkOS::OMIT)
+      body["user_agent"] = user_agent unless user_agent.equal?(WorkOS::OMIT)
       if password
         case password
         when WorkOS::UserManagement::PasswordPlaintext
@@ -925,9 +1027,9 @@ module WorkOS
       last_name: nil,
       name: nil,
       email_verified: nil,
-      metadata: nil,
-      external_id: nil,
-      locale: nil,
+      metadata: WorkOS::OMIT,
+      external_id: WorkOS::OMIT,
+      locale: WorkOS::OMIT,
       password: nil,
       request_options: {}
     )
@@ -936,11 +1038,11 @@ module WorkOS
         "first_name" => first_name,
         "last_name" => last_name,
         "name" => name,
-        "email_verified" => email_verified,
-        "metadata" => metadata,
-        "external_id" => external_id,
-        "locale" => locale
+        "email_verified" => email_verified
       }.compact
+      body["metadata"] = metadata unless metadata.equal?(WorkOS::OMIT)
+      body["external_id"] = external_id unless external_id.equal?(WorkOS::OMIT)
+      body["locale"] = locale unless locale.equal?(WorkOS::OMIT)
       if password
         case password
         when WorkOS::UserManagement::PasswordPlaintext
@@ -1493,6 +1595,23 @@ module WorkOS
       result
     end
 
+    # Delete a redirect URI
+    # @param id [String] The ID of the redirect URI to delete.
+    # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
+    # @return [void]
+    def delete_redirect_uris(
+      id:,
+      request_options: {}
+    )
+      @client.request(
+        method: :delete,
+        path: "/user_management/redirect_uris/#{WorkOS::Util.encode_path(id)}",
+        auth: true,
+        request_options: request_options
+      )
+      nil
+    end
+
     # List authorized applications
     # @param user_id [String] The ID of the user.
     # @param before [String, nil] An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`.
@@ -1654,32 +1773,10 @@ module WorkOS
       URI.join(base, "/sso/jwks/#{WorkOS::Util.encode_path(cid)}").to_s
     end
 
-    # H09 — Build an AuthKit authorization URL (client-side, no HTTP call).
-    # Overrides the generated get_authorization_url which hits the API.
-    def get_authorization_url(redirect_uri:, client_id: nil, provider: nil, connection_id: nil,
-      organization_id: nil, domain_hint: nil, login_hint: nil,
-      state: nil, screen_hint: nil, code_challenge: nil,
-      code_challenge_method: nil, prompt: nil, **)
-      cid = client_id || @client.client_id
-      raise ArgumentError, "client_id is required (set on Client or pass explicitly)" if cid.nil? || cid.empty?
-      raise ArgumentError, "provider, connection_id, or organization_id required" if provider.nil? && connection_id.nil? && organization_id.nil?
-      params = {
-        "client_id" => cid,
-        "redirect_uri" => redirect_uri,
-        "response_type" => "code",
-        "provider" => provider,
-        "connection_id" => connection_id,
-        "organization_id" => organization_id,
-        "domain_hint" => domain_hint,
-        "login_hint" => login_hint,
-        "state" => state,
-        "screen_hint" => screen_hint,
-        "code_challenge" => code_challenge,
-        "code_challenge_method" => code_challenge_method,
-        "prompt" => prompt
-      }.compact
-      build_url("/user_management/authorize", params)
-    end
+    # H09 (authkit_authorization_url) is provided by the generated
+    # `get_authorization_url` url-builder method, which accepts an optional
+    # per-call `client_id` override falling back to the client's configured
+    # value; no hand-maintained override is needed here.
 
     # H10 — AuthKit authorization URL with auto-generated PKCE + state.
     # Returns [url, code_verifier, state].
@@ -1737,24 +1834,9 @@ module WorkOS
     # `authenticate_with_device_code` method (wraps /user_management/authenticate);
     # no hand-maintained override is needed here.
 
-    # Build the AuthKit logout redirect URL (client-side, no HTTP call).
-    # @param session_id [String] The session ID (from the `sid` claim of the access token).
-    # @param return_to [String, nil] URL to redirect the user to after session revocation.
-    # @return [String]
-    def get_logout_url(session_id:, return_to: nil)
-      params = {"session_id" => session_id}
-      params["return_to"] = return_to if return_to
-      build_url("/user_management/sessions/logout", params)
-    end
-
-    private
-
-    def build_url(path, params)
-      base = @client.base_url
-      uri = URI.join(base, path)
-      uri.query = URI.encode_www_form(params)
-      uri.to_s
-    end
+    # The AuthKit logout redirect URL is provided by the generated
+    # `get_logout_url` url-builder method; no hand-maintained override is
+    # needed here.
     # @oagen-ignore-end
   end
 end

data/lib/workos/vault/vault_kek_deleted.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  class VaultKekDeleted < WorkOS::Types::BaseModel
+    HASH_ATTRS = {
+      object: :object,
+      id: :id,
+      event: :event,
+      data: :data,
+      created_at: :created_at,
+      context: :context
+    }.freeze
+
+    attr_accessor \
+      :object,
+      :id,
+      :event,
+      :data,
+      :created_at,
+      :context
+
+    def initialize(json)
+      hash = self.class.normalize(json)
+      @object = hash[:object]
+      @id = hash[:id]
+      @event = hash[:event]
+      @data = hash[:data] ? WorkOS::VaultKekDeletedData.new(hash[:data]) : nil
+      @created_at = hash[:created_at]
+      @context = hash[:context] ? WorkOS::EventContext.new(hash[:context]) : nil
+    end
+  end
+end

data/lib/workos/vault/vault_kek_deleted_data.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  class VaultKekDeletedData < WorkOS::Types::BaseModel
+    HASH_ATTRS = {
+      actor_id: :actor_id,
+      actor_source: :actor_source,
+      actor_name: :actor_name,
+      key_name: :key_name,
+      key_id: :key_id
+    }.freeze
+
+    attr_accessor \
+      :actor_id,
+      :actor_source,
+      :actor_name,
+      :key_name,
+      :key_id
+
+    def initialize(json)
+      hash = self.class.normalize(json)
+      @actor_id = hash[:actor_id]
+      @actor_source = hash[:actor_source]
+      @actor_name = hash[:actor_name]
+      @key_name = hash[:key_name]
+      @key_id = hash[:key_id]
+    end
+  end
+end