workos 9.5.1 → 10.3.0

data/lib/workos/user_management.rb

@@ -3,6 +3,7 @@
 # This file is auto-generated by oagen. Do not edit.
 
 require "json"
+require "uri"
 
 module WorkOS
   class UserManagement
@@ -18,7 +19,13 @@ module WorkOS
     #   @return [String]
     # @!attribute [r] password_hash_type
     #   @return [WorkOS::Types::CreateUserPasswordHashType]
-    PasswordHashed = Data.define(:password_hash, :password_hash_type)
+    # @!attribute [r] password_salt_position
+    #   @return [WorkOS::Types::CreateUserPasswordSaltPosition, nil]
+    PasswordHashed = Data.define(:password_hash, :password_hash_type, :password_salt_position) do
+      def initialize(password_hash:, password_hash_type:, password_salt_position: nil)
+        super
+      end
+    end
 
     def initialize(client)
       @client = client
@@ -61,9 +68,10 @@ module WorkOS
     # @param organization_id [String, nil] The ID of the organization to scope the session to.
     # @param pending_authentication_token [String, nil] The pending authentication token from a previous authentication attempt.
     # @param authentication_challenge_id [String, nil] The ID of the MFA authentication challenge.
+    # @param email_completion_token [String, nil] The token from the `email_completion_required` response.
     # @param radar_challenge_id [String, nil] The ID of the Radar email challenge being verified.
-    # @param verification_id [String, nil] The ID of the Radar SMS verification being confirmed.
-    # @param phone_number [String, nil] The phone number the Radar SMS challenge was sent to.
+    # @param verification_id [String, nil] The ID of the Radar SMS verification being confirmed. Required for sign-up challenges; omitted for sign-in challenges, where the verification is resolved server-side.
+    # @param phone_number [String, nil] The phone number the Radar SMS challenge was sent to. Required for sign-up challenges; omitted for sign-in challenges, where the phone number on file is resolved server-side.
     # @param device_code [String, nil] The device verification code.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
     # @return [WorkOS::AuthenticateResponse]
@@ -85,6 +93,7 @@ module WorkOS
       organization_id: nil,
       pending_authentication_token: nil,
       authentication_challenge_id: nil,
+      email_completion_token: nil,
       radar_challenge_id: nil,
       verification_id: nil,
       phone_number: nil,
@@ -109,6 +118,7 @@ module WorkOS
         "organization_id" => organization_id,
         "pending_authentication_token" => pending_authentication_token,
         "authentication_challenge_id" => authentication_challenge_id,
+        "email_completion_token" => email_completion_token,
         "radar_challenge_id" => radar_challenge_id,
         "verification_id" => verification_id,
         "phone_number" => phone_number,
@@ -475,8 +485,8 @@ module WorkOS
 
     # Authenticate with radar sms challenge.
     # @param code [String]
-    # @param verification_id [String]
-    # @param phone_number [String]
+    # @param verification_id [String, nil]
+    # @param phone_number [String, nil]
     # @param pending_authentication_token [String]
     # @param ip_address [String, nil]
     # @param device_id [String, nil]
@@ -485,9 +495,9 @@ module WorkOS
     # @return [WorkOS::AuthenticateResponse]
     def authenticate_with_radar_sms_challenge(
       code:,
-      verification_id:,
-      phone_number:,
       pending_authentication_token:,
+      verification_id: nil,
+      phone_number: nil,
       ip_address: nil,
       device_id: nil,
       user_agent: nil,
@@ -515,6 +525,70 @@ module WorkOS
       WorkOS::AuthenticateResponse.new(response.body)
     end
 
+    # Get an authorization URL
+    # Builds the URL client-side; no HTTP request is made.
+    # @param code_challenge_method [String, nil] The only valid PKCE code challenge method is `"S256"`. Required when specifying a `code_challenge`.
+    # @param code_challenge [String, nil] Code challenge derived from the code verifier used for the PKCE flow.
+    # @param domain_hint [String, nil] A domain hint for SSO connection lookup.
+    # @param connection_id [String, nil] The ID of an SSO connection to use for authentication.
+    # @param provider_query_params [Hash{String => String}, nil] Key/value pairs of query parameters to pass to the OAuth provider.
+    # @param provider_scopes [Array<String>, nil] Additional OAuth scopes to request from the identity provider.
+    # @param invitation_token [String, nil] A token representing a user invitation to redeem during authentication.
+    # @param max_age [Integer, nil] Maximum allowable elapsed time, in seconds, since the user last actively authenticated. If the last authentication is older than this value, the user is prompted to re-authenticate; a value of `0` forces re-authentication. Only supported when the provider is `authkit`.
+    # @param screen_hint [WorkOS::Types::UserManagementAuthenticationScreenHint, nil] Used to specify which screen to display when the provider is `authkit`.
+    # @param login_hint [String, nil] A hint to the authorization server about the login identifier the user might use.
+    # @param provider [WorkOS::Types::UserManagementAuthenticationProvider, nil] The OAuth provider to authenticate with (e.g., GoogleOAuth, MicrosoftOAuth, GitHubOAuth).
+    # @param prompt [String, nil] Controls the authentication flow behavior for the user.
+    # @param state [String, nil] An opaque value used to maintain state between the request and the callback.
+    # @param organization_id [String, nil] The ID of the organization to authenticate the user against.
+    # @param redirect_uri [String] The callback URI where the authorization code will be sent after authentication.
+    # @param client_id [String, nil] The unique identifier of the WorkOS environment client. Defaults to the client's configured client_id.
+    # @return [String]
+    def get_authorization_url(
+      redirect_uri:,
+      code_challenge_method: nil,
+      code_challenge: nil,
+      domain_hint: nil,
+      connection_id: nil,
+      provider_query_params: nil,
+      provider_scopes: nil,
+      invitation_token: nil,
+      max_age: nil,
+      screen_hint: nil,
+      login_hint: nil,
+      provider: nil,
+      prompt: nil,
+      state: nil,
+      organization_id: nil,
+      client_id: nil
+    )
+      params = {
+        "code_challenge_method" => code_challenge_method,
+        "code_challenge" => code_challenge,
+        "domain_hint" => domain_hint,
+        "connection_id" => connection_id,
+        "provider_query_params" => provider_query_params,
+        "provider_scopes" => provider_scopes,
+        "invitation_token" => invitation_token,
+        "max_age" => max_age,
+        "screen_hint" => screen_hint,
+        "login_hint" => login_hint,
+        "provider" => provider,
+        "prompt" => prompt,
+        "state" => state,
+        "organization_id" => organization_id,
+        "redirect_uri" => redirect_uri,
+        "client_id" => client_id
+      }.compact
+      params["provider_query_params"] = JSON.generate(provider_query_params) unless provider_query_params.nil?
+      params["provider_scopes"] = provider_scopes.join(",") unless provider_scopes.nil?
+      params["response_type"] = "code"
+      params["client_id"] = @client.client_id if !params.key?("client_id") && !@client.client_id.nil?
+      uri = URI.join(@client.base_url, "/user_management/authorize")
+      uri.query = URI.encode_www_form(params) unless params.empty?
+      uri.to_s
+    end
+
     # Get device authorization URL
     # @param client_id [String] The WorkOS client ID for your application.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
@@ -573,6 +647,43 @@ module WorkOS
       result
     end
 
+    # Get Radar Challenge details
+    # @param id [String] The unique ID of the Radar Challenge.
+    # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
+    # @return [WorkOS::RadarChallenge]
+    def get_radar_challenge(
+      id:,
+      request_options: {}
+    )
+      response = @client.request(
+        method: :get,
+        path: "/user_management/radar_challenges/#{WorkOS::Util.encode_path(id)}",
+        auth: true,
+        request_options: request_options
+      )
+      result = WorkOS::RadarChallenge.new(response.body)
+      result.last_response = WorkOS::Types::ApiResponse.new(http_status: response.code.to_i, http_headers: response.each_header.to_h, request_id: response["x-request-id"])
+      result
+    end
+
+    # Logout
+    # Builds the URL client-side; no HTTP request is made.
+    # @param session_id [String] The ID of the session. This can be extracted from the `sid` claim of the access token.
+    # @param return_to [String, nil] The URL to redirect the user to after logout.
+    # @return [String]
+    def get_logout_url(
+      session_id:,
+      return_to: nil
+    )
+      params = {
+        "session_id" => session_id,
+        "return_to" => return_to
+      }.compact
+      uri = URI.join(@client.base_url, "/user_management/sessions/logout")
+      uri.query = URI.encode_www_form(params) unless params.empty?
+      uri.to_s
+    end
+
     # Revoke Session
     # @param session_id [String] The ID of the session to revoke. This can be extracted from the `sid` claim of the access token.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
@@ -820,30 +931,30 @@ module WorkOS
     # @return [WorkOS::UserCreateResponse]
     def create_user(
       email:,
-      first_name: nil,
-      last_name: nil,
-      name: nil,
-      email_verified: nil,
-      metadata: nil,
-      external_id: nil,
-      ip_address: nil,
-      user_agent: nil,
+      first_name: WorkOS::OMIT,
+      last_name: WorkOS::OMIT,
+      name: WorkOS::OMIT,
+      email_verified: WorkOS::OMIT,
+      metadata: WorkOS::OMIT,
+      external_id: WorkOS::OMIT,
+      ip_address: WorkOS::OMIT,
+      user_agent: WorkOS::OMIT,
       signals_id: nil,
       password: nil,
       request_options: {}
     )
       body = {
         "email" => email,
-        "first_name" => first_name,
-        "last_name" => last_name,
-        "name" => name,
-        "email_verified" => email_verified,
-        "metadata" => metadata,
-        "external_id" => external_id,
-        "ip_address" => ip_address,
-        "user_agent" => user_agent,
         "signals_id" => signals_id
       }.compact
+      body["first_name"] = first_name unless first_name.equal?(WorkOS::OMIT)
+      body["last_name"] = last_name unless last_name.equal?(WorkOS::OMIT)
+      body["name"] = name unless name.equal?(WorkOS::OMIT)
+      body["email_verified"] = email_verified unless email_verified.equal?(WorkOS::OMIT)
+      body["metadata"] = metadata unless metadata.equal?(WorkOS::OMIT)
+      body["external_id"] = external_id unless external_id.equal?(WorkOS::OMIT)
+      body["ip_address"] = ip_address unless ip_address.equal?(WorkOS::OMIT)
+      body["user_agent"] = user_agent unless user_agent.equal?(WorkOS::OMIT)
       if password
         case password
         when WorkOS::UserManagement::PasswordPlaintext
@@ -851,6 +962,7 @@ module WorkOS
         when WorkOS::UserManagement::PasswordHashed
           body["password_hash"] = password.password_hash
           body["password_hash_type"] = password.password_hash_type
+          body["password_salt_position"] = password.password_salt_position unless password.password_salt_position.nil?
         else
           raise ArgumentError, "expected password to be one of: WorkOS::UserManagement::PasswordPlaintext, WorkOS::UserManagement::PasswordHashed, got #{password.class}"
         end
@@ -925,9 +1037,9 @@ module WorkOS
       last_name: nil,
       name: nil,
       email_verified: nil,
-      metadata: nil,
-      external_id: nil,
-      locale: nil,
+      metadata: WorkOS::OMIT,
+      external_id: WorkOS::OMIT,
+      locale: WorkOS::OMIT,
       password: nil,
       request_options: {}
     )
@@ -936,11 +1048,11 @@ module WorkOS
         "first_name" => first_name,
         "last_name" => last_name,
         "name" => name,
-        "email_verified" => email_verified,
-        "metadata" => metadata,
-        "external_id" => external_id,
-        "locale" => locale
+        "email_verified" => email_verified
       }.compact
+      body["metadata"] = metadata unless metadata.equal?(WorkOS::OMIT)
+      body["external_id"] = external_id unless external_id.equal?(WorkOS::OMIT)
+      body["locale"] = locale unless locale.equal?(WorkOS::OMIT)
       if password
         case password
         when WorkOS::UserManagement::PasswordPlaintext
@@ -948,6 +1060,7 @@ module WorkOS
         when WorkOS::UserManagement::PasswordHashed
           body["password_hash"] = password.password_hash
           body["password_hash_type"] = password.password_hash_type
+          body["password_salt_position"] = password.password_salt_position unless password.password_salt_position.nil?
         else
           raise ArgumentError, "expected password to be one of: WorkOS::UserManagement::PasswordPlaintext, WorkOS::UserManagement::PasswordHashed, got #{password.class}"
         end
@@ -1493,6 +1606,23 @@ module WorkOS
       result
     end
 
+    # Delete a redirect URI
+    # @param id [String] The ID of the redirect URI to delete.
+    # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
+    # @return [void]
+    def delete_redirect_uris(
+      id:,
+      request_options: {}
+    )
+      @client.request(
+        method: :delete,
+        path: "/user_management/redirect_uris/#{WorkOS::Util.encode_path(id)}",
+        auth: true,
+        request_options: request_options
+      )
+      nil
+    end
+
     # List authorized applications
     # @param user_id [String] The ID of the user.
     # @param before [String, nil] An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`.
@@ -1559,6 +1689,179 @@ module WorkOS
       nil
     end
 
+    # Delete a waitlist entry
+    # @param id [String] The unique ID of the waitlist entry.
+    # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
+    # @return [void]
+    def delete_waitlist_entry(
+      id:,
+      request_options: {}
+    )
+      @client.request(
+        method: :delete,
+        path: "/user_management/waitlist_entries/#{WorkOS::Util.encode_path(id)}",
+        auth: true,
+        request_options: request_options
+      )
+      nil
+    end
+
+    # Approve a waitlist entry
+    # @param id [String] The unique ID of the waitlist entry.
+    # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
+    # @return [WorkOS::WaitlistEntry]
+    def create_waitlist_entry_approve(
+      id:,
+      request_options: {}
+    )
+      response = @client.request(
+        method: :post,
+        path: "/user_management/waitlist_entries/#{WorkOS::Util.encode_path(id)}/approve",
+        auth: true,
+        request_options: request_options
+      )
+      result = WorkOS::WaitlistEntry.new(response.body)
+      result.last_response = WorkOS::Types::ApiResponse.new(http_status: response.code.to_i, http_headers: response.each_header.to_h, request_id: response["x-request-id"])
+      result
+    end
+
+    # Deny a waitlist entry
+    # @param id [String] The unique ID of the waitlist entry.
+    # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
+    # @return [WorkOS::WaitlistEntry]
+    def create_waitlist_entry_deny(
+      id:,
+      request_options: {}
+    )
+      response = @client.request(
+        method: :post,
+        path: "/user_management/waitlist_entries/#{WorkOS::Util.encode_path(id)}/deny",
+        auth: true,
+        request_options: request_options
+      )
+      result = WorkOS::WaitlistEntry.new(response.body)
+      result.last_response = WorkOS::Types::ApiResponse.new(http_status: response.code.to_i, http_headers: response.each_header.to_h, request_id: response["x-request-id"])
+      result
+    end
+
+    # List waitlists
+    # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
+    # @return [WorkOS::Types::ListStruct<WorkOS::Waitlist>]
+    def list_waitlists(request_options: {})
+      response = @client.request(
+        method: :get,
+        path: "/user_management/waitlists",
+        auth: true,
+        request_options: request_options
+      )
+      WorkOS::Types::ListStruct.from_response(response, model: WorkOS::Waitlist)
+    end
+
+    # Get a waitlist
+    # @param id [String] The unique ID of the waitlist, or the literal `default` for the environment's default waitlist. The default waitlist is created when its first entry is added, so read requests for `default` return a `404` until then.
+    # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
+    # @return [WorkOS::Waitlist]
+    def get_waitlist(
+      id:,
+      request_options: {}
+    )
+      response = @client.request(
+        method: :get,
+        path: "/user_management/waitlists/#{WorkOS::Util.encode_path(id)}",
+        auth: true,
+        request_options: request_options
+      )
+      result = WorkOS::Waitlist.new(response.body)
+      result.last_response = WorkOS::Types::ApiResponse.new(http_status: response.code.to_i, http_headers: response.each_header.to_h, request_id: response["x-request-id"])
+      result
+    end
+
+    # List waitlist entries
+    # @param id [String] The unique ID of the waitlist, or the literal `default` for the environment's default waitlist. The default waitlist is created when its first entry is added, so read requests for `default` return a `404` until then.
+    # @param before [String, nil] An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`.
+    # @param after [String, nil] An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`.
+    # @param limit [Integer, nil] Upper limit on the number of objects to return, between `1` and `100`.
+    # @param order [WorkOS::Types::PaginationOrder, nil] Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records).
+    # @param state [WorkOS::Types::UserManagementWaitlistsState, nil] Filter waitlist entries by their state.
+    # @param email [String, nil] Filter waitlist entries by their exact email address.
+    # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
+    # @return [WorkOS::Types::ListStruct<WorkOS::WaitlistEntry>]
+    def list_waitlist_entries(
+      id:,
+      before: nil,
+      after: nil,
+      limit: 10,
+      order: "desc",
+      state: nil,
+      email: nil,
+      request_options: {}
+    )
+      params = {
+        "before" => before,
+        "after" => after,
+        "limit" => limit,
+        "order" => order,
+        "state" => state,
+        "email" => email
+      }.compact
+      response = @client.request(
+        method: :get,
+        path: "/user_management/waitlists/#{WorkOS::Util.encode_path(id)}/entries",
+        auth: true,
+        params: params,
+        request_options: request_options
+      )
+      fetch_next = ->(cursor) {
+        list_waitlist_entries(
+          id: id,
+          before: before,
+          after: cursor,
+          limit: limit,
+          order: order,
+          state: state,
+          email: email,
+          request_options: request_options
+        )
+      }
+      WorkOS::Types::ListStruct.from_response(
+        response,
+        model: WorkOS::WaitlistEntry,
+        filters: {id: id, before: before, limit: limit, order: order, state: state, email: email},
+        fetch_next: fetch_next
+      )
+    end
+
+    # Create a waitlist entry
+    # @param id [String] The unique ID of the waitlist, or the literal `default` for the environment's default waitlist. Use `default` when adding the first entry — the default waitlist is created automatically.
+    # @param email [String] The email address of the user joining the waitlist.
+    # @param additional_fields [Hash{String => String}, nil] Object containing additional key/value pairs collected with the waitlist entry. Supports up to 50 string pairs, with keys up to 40 characters and values up to 600 characters. Values are user-provided — treat them as untrusted input when rendering or exporting.
+    # @param send_confirmation_email [Boolean, nil] Whether to send the waitlist confirmation email to the user. Defaults to `false`. No email is sent when the waitlist confirmation email is disabled in the environment, even if `send_confirmation_email` is `true`.
+    # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
+    # @return [WorkOS::WaitlistEntry]
+    def create_waitlist_entry(
+      id:,
+      email:,
+      additional_fields: nil,
+      send_confirmation_email: nil,
+      request_options: {}
+    )
+      body = {
+        "email" => email,
+        "additional_fields" => additional_fields,
+        "send_confirmation_email" => send_confirmation_email
+      }.compact
+      response = @client.request(
+        method: :post,
+        path: "/user_management/waitlists/#{WorkOS::Util.encode_path(id)}/entries",
+        auth: true,
+        body: body,
+        request_options: request_options
+      )
+      result = WorkOS::WaitlistEntry.new(response.body)
+      result.last_response = WorkOS::Types::ApiResponse.new(http_status: response.code.to_i, http_headers: response.each_header.to_h, request_id: response["x-request-id"])
+      result
+    end
+
     # List API keys for a user
     # @param user_id [String] Unique identifier of the user.
     # @param before [String, nil] An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.
@@ -1654,32 +1957,10 @@ module WorkOS
       URI.join(base, "/sso/jwks/#{WorkOS::Util.encode_path(cid)}").to_s
     end
 
-    # H09 — Build an AuthKit authorization URL (client-side, no HTTP call).
-    # Overrides the generated get_authorization_url which hits the API.
-    def get_authorization_url(redirect_uri:, client_id: nil, provider: nil, connection_id: nil,
-      organization_id: nil, domain_hint: nil, login_hint: nil,
-      state: nil, screen_hint: nil, code_challenge: nil,
-      code_challenge_method: nil, prompt: nil, **)
-      cid = client_id || @client.client_id
-      raise ArgumentError, "client_id is required (set on Client or pass explicitly)" if cid.nil? || cid.empty?
-      raise ArgumentError, "provider, connection_id, or organization_id required" if provider.nil? && connection_id.nil? && organization_id.nil?
-      params = {
-        "client_id" => cid,
-        "redirect_uri" => redirect_uri,
-        "response_type" => "code",
-        "provider" => provider,
-        "connection_id" => connection_id,
-        "organization_id" => organization_id,
-        "domain_hint" => domain_hint,
-        "login_hint" => login_hint,
-        "state" => state,
-        "screen_hint" => screen_hint,
-        "code_challenge" => code_challenge,
-        "code_challenge_method" => code_challenge_method,
-        "prompt" => prompt
-      }.compact
-      build_url("/user_management/authorize", params)
-    end
+    # H09 (authkit_authorization_url) is provided by the generated
+    # `get_authorization_url` url-builder method, which accepts an optional
+    # per-call `client_id` override falling back to the client's configured
+    # value; no hand-maintained override is needed here.
 
     # H10 — AuthKit authorization URL with auto-generated PKCE + state.
     # Returns [url, code_verifier, state].
@@ -1737,24 +2018,9 @@ module WorkOS
     # `authenticate_with_device_code` method (wraps /user_management/authenticate);
     # no hand-maintained override is needed here.
 
-    # Build the AuthKit logout redirect URL (client-side, no HTTP call).
-    # @param session_id [String] The session ID (from the `sid` claim of the access token).
-    # @param return_to [String, nil] URL to redirect the user to after session revocation.
-    # @return [String]
-    def get_logout_url(session_id:, return_to: nil)
-      params = {"session_id" => session_id}
-      params["return_to"] = return_to if return_to
-      build_url("/user_management/sessions/logout", params)
-    end
-
-    private
-
-    def build_url(path, params)
-      base = @client.base_url
-      uri = URI.join(base, path)
-      uri.query = URI.encode_www_form(params)
-      uri.to_s
-    end
+    # The AuthKit logout redirect URL is provided by the generated
+    # `get_logout_url` url-builder method; no hand-maintained override is
+    # needed here.
     # @oagen-ignore-end
   end
 end

data/lib/workos/vault/vault_kek_deleted.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  class VaultKekDeleted < WorkOS::Types::BaseModel
+    HASH_ATTRS = {
+      object: :object,
+      id: :id,
+      event: :event,
+      data: :data,
+      created_at: :created_at,
+      context: :context
+    }.freeze
+
+    attr_accessor \
+      :object,
+      :id,
+      :event,
+      :data,
+      :created_at,
+      :context
+
+    def initialize(json)
+      hash = self.class.normalize(json)
+      @object = hash[:object]
+      @id = hash[:id]
+      @event = hash[:event]
+      @data = hash[:data] ? WorkOS::VaultKekDeletedData.new(hash[:data]) : nil
+      @created_at = hash[:created_at]
+      @context = hash[:context] ? WorkOS::EventContext.new(hash[:context]) : nil
+    end
+  end
+end

data/lib/workos/vault/vault_kek_deleted_data.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  class VaultKekDeletedData < WorkOS::Types::BaseModel
+    HASH_ATTRS = {
+      actor_id: :actor_id,
+      actor_source: :actor_source,
+      actor_name: :actor_name,
+      key_name: :key_name,
+      key_id: :key_id
+    }.freeze
+
+    attr_accessor \
+      :actor_id,
+      :actor_source,
+      :actor_name,
+      :key_name,
+      :key_id
+
+    def initialize(json)
+      hash = self.class.normalize(json)
+      @actor_id = hash[:actor_id]
+      @actor_source = hash[:actor_source]
+      @actor_name = hash[:actor_name]
+      @key_name = hash[:key_name]
+      @key_id = hash[:key_id]
+    end
+  end
+end

data/lib/workos/vault.rb

@@ -213,13 +213,13 @@ module WorkOS
     def update_kv(
       id:,
       value:,
-      version_check: nil,
+      version_check: WorkOS::OMIT,
       request_options: {}
     )
       body = {
-        "value" => value,
-        "version_check" => version_check
-      }.compact
+        "value" => value
+      }
+      body["version_check"] = version_check unless version_check.equal?(WorkOS::OMIT)
       response = @client.request(
         method: :put,
         path: "/vault/v1/kv/#{WorkOS::Util.encode_path(id)}",

data/lib/workos/version.rb

@@ -2,5 +2,5 @@
 
 # @oagen-ignore-file
 module WorkOS
-  VERSION = "9.5.1"
+  VERSION = "10.3.0"
 end

data/lib/workos/widgets.rb

@@ -11,13 +11,13 @@ module WorkOS
     end
 
     # Generate a widget token
-    # @param organization_id [String] The ID of the organization to scope the widget session to.
+    # @param organization_id [String, nil] The ID of the organization to scope the widget session to. Required when scopes are provided. Optional when issuing a token for user-only widgets (e.g. `UserProfile`, `UserSecurity`) that do not require organization context.
     # @param user_id [String, nil] The ID of the user to issue the widget session token for.
     # @param scopes [Array<WorkOS::Types::WidgetSessionTokenScopes>, nil] The scopes to grant the widget session.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
     # @return [WorkOS::WidgetSessionTokenResponse]
     def create_token(
-      organization_id:,
+      organization_id: nil,
       user_id: nil,
       scopes: nil,
       request_options: {}