workos 9.5.1 → 10.3.0

data/lib/workos/sso.rb

@@ -3,9 +3,34 @@
 # This file is auto-generated by oagen. Do not edit.
 
 require "json"
+require "uri"
 
 module WorkOS
   class SSO
+    # Identifies the protocol options (saml variant).
+    #
+    # @!attribute [r] saml_options
+    #   @return [WorkOS::CreateConnectionSAMLOptions]
+    CreateProtocolOptionsSAML = Data.define(:saml_options)
+
+    # Identifies the protocol options (oidc variant).
+    #
+    # @!attribute [r] oidc_options
+    #   @return [WorkOS::CreateConnectionOIDCOptions]
+    CreateProtocolOptionsOIDC = Data.define(:oidc_options)
+
+    # Identifies the protocol options (saml variant).
+    #
+    # @!attribute [r] saml_options
+    #   @return [WorkOS::PatchConnectionSAMLOptions]
+    PatchProtocolOptionsSAML = Data.define(:saml_options)
+
+    # Identifies the protocol options (oidc variant).
+    #
+    # @!attribute [r] oidc_options
+    #   @return [WorkOS::PatchConnectionOIDCOptions]
+    PatchProtocolOptionsOIDC = Data.define(:oidc_options)
+
     def initialize(client)
       @client = client
     end
@@ -70,6 +95,228 @@ module WorkOS
       )
     end
 
+    # Create a Connection
+    # @param organization_id [String] Unique identifier for the Organization in which the Connection resides.
+    # @param name [String, nil] A human-readable name for the Connection. This will most commonly be the organization's name.
+    # @param external_id [String, nil] The customer-owned identifier for the Connection.
+    # @param connection_type [String, nil] The type of the Connection. Only SAML and OIDC connection types may be created. When omitted, the type is inferred from the provided options.
+    # @param attribute_maps [WorkOS::CreateConnectionAttributeMaps, nil] How IdP attributes or claims map onto WorkOS profile fields. Provided fields override the defaults for the connection type.
+    # @param protocol_options [WorkOS::SSO::CreateProtocolOptionsSAML, WorkOS::SSO::CreateProtocolOptionsOIDC] Identifies the protocol options.
+    # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
+    # @return [WorkOS::Connection]
+    def create_connection(
+      organization_id:,
+      protocol_options:,
+      name: nil,
+      external_id: nil,
+      connection_type: nil,
+      attribute_maps: nil,
+      request_options: {}
+    )
+      body = {
+        "organization_id" => organization_id,
+        "name" => name,
+        "external_id" => external_id,
+        "connection_type" => connection_type,
+        "attribute_maps" => attribute_maps
+      }.compact
+      case protocol_options
+      when WorkOS::SSO::CreateProtocolOptionsSAML
+        body["saml_options"] = protocol_options.saml_options
+      when WorkOS::SSO::CreateProtocolOptionsOIDC
+        body["oidc_options"] = protocol_options.oidc_options
+      else
+        raise ArgumentError, "expected protocol_options to be one of: WorkOS::SSO::CreateProtocolOptionsSAML, WorkOS::SSO::CreateProtocolOptionsOIDC, got #{protocol_options.class}"
+      end
+      response = @client.request(
+        method: :post,
+        path: "/connections",
+        auth: true,
+        body: body,
+        request_options: request_options
+      )
+      result = WorkOS::Connection.new(response.body)
+      result.last_response = WorkOS::Types::ApiResponse.new(http_status: response.code.to_i, http_headers: response.each_header.to_h, request_id: response["x-request-id"])
+      result
+    end
+
+    # List IdP signing certificates
+    # @param connection_id [String] Unique identifier for the Connection.
+    # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
+    # @return [WorkOS::SAMLIdpSigningCertificateList]
+    def list_connection_saml_idp_signing_certs(
+      connection_id:,
+      request_options: {}
+    )
+      response = @client.request(
+        method: :get,
+        path: "/connections/#{WorkOS::Util.encode_path(connection_id)}/saml_idp_signing_certs",
+        auth: true,
+        request_options: request_options
+      )
+      result = WorkOS::SAMLIdpSigningCertificateList.new(response.body)
+      result.last_response = WorkOS::Types::ApiResponse.new(http_status: response.code.to_i, http_headers: response.each_header.to_h, request_id: response["x-request-id"])
+      result
+    end
+
+    # Create an IdP signing certificate
+    # @param connection_id [String] Unique identifier for the Connection.
+    # @param value [String] The PEM-encoded X.509 certificate.
+    # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
+    # @return [WorkOS::SAMLIdpSigningCertificate]
+    def create_connection_saml_idp_signing_cert(
+      connection_id:,
+      value:,
+      request_options: {}
+    )
+      body = {
+        "value" => value
+      }
+      response = @client.request(
+        method: :post,
+        path: "/connections/#{WorkOS::Util.encode_path(connection_id)}/saml_idp_signing_certs",
+        auth: true,
+        body: body,
+        request_options: request_options
+      )
+      result = WorkOS::SAMLIdpSigningCertificate.new(response.body)
+      result.last_response = WorkOS::Types::ApiResponse.new(http_status: response.code.to_i, http_headers: response.each_header.to_h, request_id: response["x-request-id"])
+      result
+    end
+
+    # Delete an IdP signing certificate
+    # @param connection_id [String] Unique identifier for the Connection.
+    # @param certificate_id [String] Unique identifier for the Identity Provider signing certificate.
+    # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
+    # @return [void]
+    def delete_connection_saml_idp_signing_cert(
+      connection_id:,
+      certificate_id:,
+      request_options: {}
+    )
+      @client.request(
+        method: :delete,
+        path: "/connections/#{WorkOS::Util.encode_path(connection_id)}/saml_idp_signing_certs/#{WorkOS::Util.encode_path(certificate_id)}",
+        auth: true,
+        request_options: request_options
+      )
+      nil
+    end
+
+    # List SP encryption certificates
+    # @param connection_id [String] Unique identifier for the Connection.
+    # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
+    # @return [WorkOS::SAMLSpEncryptionCertificateList]
+    def list_connection_saml_sp_encryption_certs(
+      connection_id:,
+      request_options: {}
+    )
+      response = @client.request(
+        method: :get,
+        path: "/connections/#{WorkOS::Util.encode_path(connection_id)}/saml_sp_encryption_certs",
+        auth: true,
+        request_options: request_options
+      )
+      result = WorkOS::SAMLSpEncryptionCertificateList.new(response.body)
+      result.last_response = WorkOS::Types::ApiResponse.new(http_status: response.code.to_i, http_headers: response.each_header.to_h, request_id: response["x-request-id"])
+      result
+    end
+
+    # Create an SP encryption certificate
+    # @param connection_id [String] Unique identifier for the Connection.
+    # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
+    # @return [WorkOS::SAMLSpEncryptionCertificate]
+    def create_connection_saml_sp_encryption_cert(
+      connection_id:,
+      request_options: {}
+    )
+      response = @client.request(
+        method: :post,
+        path: "/connections/#{WorkOS::Util.encode_path(connection_id)}/saml_sp_encryption_certs",
+        auth: true,
+        request_options: request_options
+      )
+      result = WorkOS::SAMLSpEncryptionCertificate.new(response.body)
+      result.last_response = WorkOS::Types::ApiResponse.new(http_status: response.code.to_i, http_headers: response.each_header.to_h, request_id: response["x-request-id"])
+      result
+    end
+
+    # Delete an SP encryption certificate
+    # @param connection_id [String] Unique identifier for the Connection.
+    # @param certificate_id [String] Unique identifier for the Service Provider encryption key pair. WorkOS holds the corresponding private key, which is never exposed.
+    # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
+    # @return [void]
+    def delete_connection_saml_sp_encryption_cert(
+      connection_id:,
+      certificate_id:,
+      request_options: {}
+    )
+      @client.request(
+        method: :delete,
+        path: "/connections/#{WorkOS::Util.encode_path(connection_id)}/saml_sp_encryption_certs/#{WorkOS::Util.encode_path(certificate_id)}",
+        auth: true,
+        request_options: request_options
+      )
+      nil
+    end
+
+    # Get the SP signing certificate
+    # @param connection_id [String] Unique identifier for the Connection.
+    # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
+    # @return [WorkOS::SAMLSpSigningCertificate]
+    def list_connection_saml_sp_signing_cert(
+      connection_id:,
+      request_options: {}
+    )
+      response = @client.request(
+        method: :get,
+        path: "/connections/#{WorkOS::Util.encode_path(connection_id)}/saml_sp_signing_cert",
+        auth: true,
+        request_options: request_options
+      )
+      result = WorkOS::SAMLSpSigningCertificate.new(response.body)
+      result.last_response = WorkOS::Types::ApiResponse.new(http_status: response.code.to_i, http_headers: response.each_header.to_h, request_id: response["x-request-id"])
+      result
+    end
+
+    # Create an SP signing certificate
+    # @param connection_id [String] Unique identifier for the Connection.
+    # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
+    # @return [WorkOS::SAMLSpSigningCertificate]
+    def create_connection_saml_sp_signing_cert(
+      connection_id:,
+      request_options: {}
+    )
+      response = @client.request(
+        method: :post,
+        path: "/connections/#{WorkOS::Util.encode_path(connection_id)}/saml_sp_signing_cert",
+        auth: true,
+        request_options: request_options
+      )
+      result = WorkOS::SAMLSpSigningCertificate.new(response.body)
+      result.last_response = WorkOS::Types::ApiResponse.new(http_status: response.code.to_i, http_headers: response.each_header.to_h, request_id: response["x-request-id"])
+      result
+    end
+
+    # Delete the SP signing certificate
+    # @param connection_id [String] Unique identifier for the Connection.
+    # @param certificate_id [String] Unique identifier for the Service Provider signing key pair. WorkOS holds the corresponding private key, which is never exposed.
+    # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
+    # @return [void]
+    def delete_connection_saml_sp_signing_cert(
+      connection_id:,
+      certificate_id:,
+      request_options: {}
+    )
+      @client.request(
+        method: :delete,
+        path: "/connections/#{WorkOS::Util.encode_path(connection_id)}/saml_sp_signing_cert/#{WorkOS::Util.encode_path(certificate_id)}",
+        auth: true,
+        request_options: request_options
+      )
+      nil
+    end
+
     # Get a Connection
     # @param id [String] Unique identifier for the Connection.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
@@ -89,6 +336,52 @@ module WorkOS
       result
     end
 
+    # Update a Connection
+    # @param id [String] Unique identifier for the Connection.
+    # @param name [String, nil] A human-readable name for the Connection.
+    # @param external_id [String, nil] The customer-owned identifier for the Connection. Set to `null` to stop tracking one.
+    # @param connection_type [String, nil] The type of the Connection. Immutable after creation — it may be sent, but only with the Connection current type.
+    # @param attribute_maps [WorkOS::PatchConnectionAttributeMaps, nil] How IdP attributes or claims map onto WorkOS profile fields. Only the provided fields are updated.
+    # @param protocol_options [WorkOS::SSO::PatchProtocolOptionsSAML, WorkOS::SSO::PatchProtocolOptionsOIDC, nil] Identifies the protocol options.
+    # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
+    # @return [WorkOS::Connection]
+    def update_connection(
+      id:,
+      name: nil,
+      external_id: WorkOS::OMIT,
+      connection_type: nil,
+      attribute_maps: nil,
+      protocol_options: nil,
+      request_options: {}
+    )
+      body = {
+        "name" => name,
+        "connection_type" => connection_type,
+        "attribute_maps" => attribute_maps
+      }.compact
+      body["external_id"] = external_id unless external_id.equal?(WorkOS::OMIT)
+      if protocol_options
+        case protocol_options
+        when WorkOS::SSO::PatchProtocolOptionsSAML
+          body["saml_options"] = protocol_options.saml_options
+        when WorkOS::SSO::PatchProtocolOptionsOIDC
+          body["oidc_options"] = protocol_options.oidc_options
+        else
+          raise ArgumentError, "expected protocol_options to be one of: WorkOS::SSO::PatchProtocolOptionsSAML, WorkOS::SSO::PatchProtocolOptionsOIDC, got #{protocol_options.class}"
+        end
+      end
+      response = @client.request(
+        method: :patch,
+        path: "/connections/#{WorkOS::Util.encode_path(id)}",
+        auth: true,
+        body: body,
+        request_options: request_options
+      )
+      result = WorkOS::Connection.new(response.body)
+      result.last_response = WorkOS::Types::ApiResponse.new(http_status: response.code.to_i, http_headers: response.each_header.to_h, request_id: response["x-request-id"])
+      result
+    end
+
     # Delete a Connection
     # @param id [String] Unique identifier for the Connection.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
@@ -106,6 +399,74 @@ module WorkOS
       nil
     end
 
+    # Initiate SSO
+    # Builds the URL client-side; no HTTP request is made.
+    # @param provider_scopes [Array<String>, nil] Additional scopes to request from the identity provider. Applicable when using OAuth or OpenID Connect connections.
+    # @param provider_query_params [Hash{String => String}, nil] Key/value pairs of query parameters to pass to the OAuth provider. Only applicable when using OAuth connections.
+    # @param client_id [String, nil] The unique identifier of the WorkOS environment client. Defaults to the client's configured client_id.
+    # @param domain [String, nil] Deprecated. Use `connection` or `organization` instead. Used to initiate SSO for a connection by domain. The domain must be associated with a connection in your WorkOS environment.
+    # @param provider [WorkOS::Types::SSOProvider, nil] Used to initiate OAuth authentication with various providers.
+    # @param redirect_uri [String] Where to redirect the user after they complete the authentication process. You must use one of the redirect URIs configured via the [Redirects](https://dashboard.workos.com/redirects) page on the dashboard.
+    # @param state [String, nil] An optional parameter that can be used to encode arbitrary information to help restore application state between redirects. If included, the redirect URI received from WorkOS will contain the exact `state` that was passed.
+    # @param connection [String, nil] Used to initiate SSO for a connection. The value should be a WorkOS connection ID. You can persist the WorkOS connection ID with application user or team identifiers. WorkOS will use the connection indicated by the connection parameter to direct the user to the corresponding IdP for authentication.
+    # @param organization [String, nil] Used to initiate SSO for an organization. The value should be a WorkOS organization ID. You can persist the WorkOS organization ID with application user or team identifiers. WorkOS will use the organization ID to determine the appropriate connection and the IdP to direct the user to for authentication.
+    # @param domain_hint [String, nil] Can be used to pre-fill the domain field when initiating authentication with Microsoft OAuth or with a Google SAML connection type.
+    # @param login_hint [String, nil] Can be used to pre-fill the username/email address field of the IdP sign-in page for the user, if you know their username ahead of time. Currently supported for OAuth, OpenID Connect, Okta, Entra ID, and custom SAML connections.
+    # @param nonce [String, nil] A random string generated by the client that is used to mitigate replay attacks.
+    # @param prompt [String, nil] If set to `login`, forces re-authentication at the identity provider. For supported SAML providers this sets `ForceAuthn="true"` in the SAML request; providers that don't support it are unaffected.
+    # @return [String]
+    def get_authorization_url(
+      redirect_uri:,
+      provider_scopes: nil,
+      provider_query_params: nil,
+      client_id: nil,
+      domain: nil,
+      provider: nil,
+      state: nil,
+      connection: nil,
+      organization: nil,
+      domain_hint: nil,
+      login_hint: nil,
+      nonce: nil,
+      prompt: nil
+    )
+      params = {
+        "provider_scopes" => provider_scopes,
+        "provider_query_params" => provider_query_params,
+        "client_id" => client_id,
+        "domain" => domain,
+        "provider" => provider,
+        "redirect_uri" => redirect_uri,
+        "state" => state,
+        "connection" => connection,
+        "organization" => organization,
+        "domain_hint" => domain_hint,
+        "login_hint" => login_hint,
+        "nonce" => nonce,
+        "prompt" => prompt
+      }.compact
+      params["provider_scopes"] = provider_scopes.join(",") unless provider_scopes.nil?
+      params["provider_query_params"] = JSON.generate(provider_query_params) unless provider_query_params.nil?
+      params["response_type"] = "code"
+      params["client_id"] = @client.client_id if !params.key?("client_id") && !@client.client_id.nil?
+      uri = URI.join(@client.base_url, "/sso/authorize")
+      uri.query = URI.encode_www_form(params) unless params.empty?
+      uri.to_s
+    end
+
+    # Logout Redirect
+    # Builds the URL client-side; no HTTP request is made.
+    # @param token [String] The logout token returned from the [Logout Authorize](https://workos.com/docs/reference/sso/logout/authorize) endpoint.
+    # @return [String]
+    def get_logout_url(token:)
+      params = {
+        "token" => token
+      }
+      uri = URI.join(@client.base_url, "/sso/logout")
+      uri.query = URI.encode_www_form(params) unless params.empty?
+      uri.to_s
+    end
+
     # Logout Authorize
     # @param profile_id [String] The unique ID of the profile to log out.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
@@ -145,19 +506,28 @@ module WorkOS
     end
 
     # Get a Profile and Token
-    # @param code [String] The authorization code received from the authorization callback.
+    # @param code [String, nil] The authorization code received from the authorization callback. Required when `grant_type` is `authorization_code`.
+    # @param subject_token [String, nil] The OIDC ID token to exchange. Required when `grant_type` is `urn:ietf:params:oauth:grant-type:token-exchange`. Must be sent in the request body.
+    # @param subject_token_type [String, nil] The type of the subject token. Required when `grant_type` is `urn:ietf:params:oauth:grant-type:token-exchange`. Must be sent in the request body.
+    # @param organization_id [String, nil] The ID of the organization whose connection the subject token is validated against. Required when `grant_type` is `urn:ietf:params:oauth:grant-type:token-exchange`. Must be sent in the request body.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
     # @return [WorkOS::SSOTokenResponse]
     def get_profile_and_token(
-      code:,
+      code: nil,
+      subject_token: nil,
+      subject_token_type: nil,
+      organization_id: nil,
       request_options: {}
     )
       body = {
         "grant_type" => "authorization_code",
         "client_id" => request_options[:client_id] || @client.client_id,
         "client_secret" => request_options[:api_key] || @client.api_key,
-        "code" => code
-      }
+        "code" => code,
+        "subject_token" => subject_token,
+        "subject_token_type" => subject_token_type,
+        "organization_id" => organization_id
+      }.compact
       response = @client.request(
         method: :post,
         path: "/sso/token",
@@ -171,32 +541,10 @@ module WorkOS
     end
 
     # @oagen-ignore-start — non-spec helpers (hand-maintained)
-    # H14 — Build an SSO authorization URL (client-side, no HTTP call).
-    # Overrides the generated method which incorrectly hits the API.
-    def get_authorization_url(redirect_uri:, client_id: nil, state: nil, connection: nil,
-      organization: nil, provider: nil, domain_hint: nil,
-      login_hint: nil, nonce: nil, provider_scopes: nil,
-      provider_query_params: nil, **)
-      cid = client_id || @client.client_id
-      raise ArgumentError, "client_id is required (set on Client or pass explicitly)" if cid.nil? || cid.empty?
-      params = {
-        "client_id" => cid,
-        "redirect_uri" => redirect_uri,
-        "response_type" => "code",
-        "state" => state,
-        "connection" => connection,
-        "organization" => organization,
-        "provider" => provider,
-        "domain_hint" => domain_hint,
-        "login_hint" => login_hint,
-        "nonce" => nonce
-      }.compact
-      params["provider_scopes"] = Array(provider_scopes).join(",") if provider_scopes
-      if provider_query_params.is_a?(Hash) && !provider_query_params.empty?
-        params["provider_query_params"] = JSON.generate(provider_query_params)
-      end
-      build_url("/sso/authorize", params)
-    end
+    # H14 (sso_authorization_url) is provided by the generated
+    # `get_authorization_url` url-builder method, which accepts an optional
+    # per-call `client_id` override falling back to the client's configured
+    # value; no hand-maintained override is needed here.
 
     # H15 — SSO authorization URL with auto-generated PKCE pair + state.
     # Returns [url, code_verifier, state].

data/lib/workos/types/agent_admin_validate_credential_request_type.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  module Types
+    class AgentAdminValidateCredentialRequestType
+      API_KEY = "api_key"
+      ACCESS_TOKEN = "access_token"
+      ALL = [API_KEY, ACCESS_TOKEN].freeze
+    end
+  end
+end

data/lib/workos/types/agent_blueprints_token_mint_token_request_type.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  module Types
+    class AgentBlueprintsTokenMintTokenRequestType
+      USER_DELEGATED = "user_delegated"
+      AUTONOMOUS = "autonomous"
+      AGENT_DELEGATED = "agent_delegated"
+      REFRESH = "refresh"
+      ALL = [USER_DELEGATED, AUTONOMOUS, AGENT_DELEGATED, REFRESH].freeze
+    end
+  end
+end

data/lib/workos/types/agent_instance_created_data_type.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  module Types
+    class AgentInstanceCreatedDataType
+      DELEGATED = "delegated"
+      AUTONOMOUS = "autonomous"
+      ALL = [DELEGATED, AUTONOMOUS].freeze
+    end
+  end
+end

data/lib/workos/types/{data_integration_credentials_type.rb → agent_instance_deleted_data_type.rb}

@@ -4,6 +4,6 @@
 
 module WorkOS
   module Types
-    DataIntegrationCredentialsType = DataIntegrationCredentialType
+    AgentInstanceDeletedDataType = AgentInstanceCreatedDataType
   end
 end

data/lib/workos/types/agent_instance_session_status.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  module Types
+    class AgentInstanceSessionStatus
+      ACTIVE = "active"
+      REVOKED = "revoked"
+      EXPIRED = "expired"
+      ALL = [ACTIVE, REVOKED, EXPIRED].freeze
+    end
+  end
+end

data/lib/workos/types/{organization_domain_stand_alone_state.rb → agent_instance_type.rb}

@@ -4,6 +4,6 @@
 
 module WorkOS
   module Types
-    OrganizationDomainStandAloneState = OrganizationCreatedDataDomainState
+    AgentInstanceType = AgentInstanceCreatedDataType
   end
 end

data/lib/workos/types/agent_registration_created_data_kind.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  module Types
+    class AgentRegistrationCreatedDataKind
+      ANONYMOUS = "anonymous"
+      SERVICE_AUTH = "service_auth"
+      IDENTITY_ASSERTION = "identity_assertion"
+      ALL = [ANONYMOUS, SERVICE_AUTH, IDENTITY_ASSERTION].freeze
+    end
+  end
+end

data/lib/workos/types/agent_registration_created_data_method.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  module Types
+    class AgentRegistrationCreatedDataMethod
+      ANONYMOUS = "anonymous"
+      SERVICE_AUTH = "service_auth"
+      ID_JAG = "id_jag"
+      ALL = [ANONYMOUS, SERVICE_AUTH, ID_JAG].freeze
+    end
+  end
+end

data/lib/workos/types/agent_registration_created_data_status.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  module Types
+    class AgentRegistrationCreatedDataStatus
+      UNVERIFIED = "unverified"
+      VERIFIED = "verified"
+      EXPIRED = "expired"
+      REVOKED = "revoked"
+      ALL = [UNVERIFIED, VERIFIED, EXPIRED, REVOKED].freeze
+    end
+  end
+end

data/lib/workos/types/{organization_domain_stand_alone_verification_strategy.rb → agent_registration_kind.rb}

@@ -4,6 +4,6 @@
 
 module WorkOS
   module Types
-    OrganizationDomainStandAloneVerificationStrategy = OrganizationCreatedDataDomainVerificationStrategy
+    AgentRegistrationKind = AgentRegistrationCreatedDataKind
   end
 end

data/lib/workos/types/agent_registration_status.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  module Types
+    AgentRegistrationStatus = AgentRegistrationCreatedDataStatus
+  end
+end

data/lib/workos/types/applications_registration_types.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  module Types
+    class ApplicationsRegistrationTypes
+      DYNAMIC = "dynamic"
+      AUTHENTICATED = "authenticated"
+      ALL = [DYNAMIC, AUTHENTICATED].freeze
+    end
+  end
+end

data/lib/workos/types/authenticate_response_authentication_method.rb

@@ -11,7 +11,6 @@ module WorkOS
       APPLE_OAUTH = "AppleOAuth"
       BITBUCKET_OAUTH = "BitbucketOAuth"
       CROSS_APP_AUTH = "CrossAppAuth"
-      DISCORD_OAUTH = "DiscordOAuth"
       EXTERNAL_AUTH = "ExternalAuth"
       GIT_HUB_OAUTH = "GitHubOAuth"
       GIT_LAB_OAUTH = "GitLabOAuth"
@@ -27,7 +26,7 @@ module WorkOS
       MAGIC_AUTH = "MagicAuth"
       IMPERSONATION = "Impersonation"
       MIGRATED_SESSION = "MigratedSession"
-      ALL = [SSO, PASSWORD, PASSKEY, APPLE_OAUTH, BITBUCKET_OAUTH, CROSS_APP_AUTH, DISCORD_OAUTH, EXTERNAL_AUTH, GIT_HUB_OAUTH, GIT_LAB_OAUTH, GOOGLE_OAUTH, INTUIT_OAUTH, LINKED_IN_OAUTH, MICROSOFT_OAUTH, SALESFORCE_OAUTH, SLACK_OAUTH, VERCEL_MARKETPLACE_OAUTH, VERCEL_OAUTH, XERO_OAUTH, MAGIC_AUTH, IMPERSONATION, MIGRATED_SESSION].freeze
+      ALL = [SSO, PASSWORD, PASSKEY, APPLE_OAUTH, BITBUCKET_OAUTH, CROSS_APP_AUTH, EXTERNAL_AUTH, GIT_HUB_OAUTH, GIT_LAB_OAUTH, GOOGLE_OAUTH, INTUIT_OAUTH, LINKED_IN_OAUTH, MICROSOFT_OAUTH, SALESFORCE_OAUTH, SLACK_OAUTH, VERCEL_MARKETPLACE_OAUTH, VERCEL_OAUTH, XERO_OAUTH, MAGIC_AUTH, IMPERSONATION, MIGRATED_SESSION].freeze
     end
   end
 end

data/lib/workos/types/claim_view_response_status.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  module Types
+    ClaimViewResponseStatus = AgentRegistrationCreatedDataStatus
+  end
+end

data/lib/workos/types/connected_account_auth_method.rb

@@ -7,7 +7,8 @@ module WorkOS
     class ConnectedAccountAuthMethod
       OAUTH = "oauth"
       API_KEY = "api_key"
-      ALL = [OAUTH, API_KEY].freeze
+      CLIENT_CREDENTIALS = "client_credentials"
+      ALL = [OAUTH, API_KEY, CLIENT_CREDENTIALS].freeze
     end
   end
 end

data/lib/workos/types/connected_account_input_state.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  module Types
+    class ConnectedAccountInputState
+      CONNECTED = "connected"
+      NEEDS_REAUTHORIZATION = "needs_reauthorization"
+      ALL = [CONNECTED, NEEDS_REAUTHORIZATION].freeze
+    end
+  end
+end