@workos/mcp-docs-server 0.1.0 → 0.2.0

package/.docs/organized/docs/reference/roles/role/update.mdx

@@ -0,0 +1,78 @@
+---
+descriptions:
+  update_role:
+    name: The new name for the role.
+    description: The new description for the role. Set to `null` to remove the description.
+reference:
+  curl:
+    - key: update_role
+      id: update_role
+      url: /reference/roles/role/update
+      title: '/authorization/roles/:slug'
+      type: PATCH
+      parameters:
+        - key: name
+          type: string
+          optional: true
+          description: (update_role.name)
+        - key: description
+          type: string | null
+          optional: true
+          description: (update_role.description)
+      returns:
+        - (role)
+  js:
+    - key: updateRole
+      id: update_role
+      url: /reference/roles/role/update
+      title: authorization.updateRole()
+      parameters:
+        - key: slug
+          type: string
+          description: The slug of the role to update.
+        - key: options
+          type: object
+          unwrap: true
+          properties:
+            - key: name
+              type: string
+              optional: true
+              description: (update_role.name)
+            - key: description
+              type: string | null
+              optional: true
+              description: (update_role.description)
+      returns:
+        - key: Role
+          description: (role.self)
+  python:
+    - key: update_role
+      id: update_role
+      url: /reference/roles/role/update
+      title: authorization.update_role()
+      parameters:
+        - key: slug
+          type: str
+          description: The slug of the role to update.
+        - key: name
+          type: str
+          optional: true
+          description: (update_role.name)
+        - key: description
+          type: str | None
+          optional: true
+          description: (update_role.description)
+      returns:
+        - key: Role
+          description: (role.self)
+originalPath: .tmp-workos-clone/packages/docs/content/reference/roles/role/update.mdx
+---
+
+## Update an environment role
+
+Update an existing environment role. Only the fields provided in the request body will be updated.
+
+<CodeBlock referenceId="update_role">
+  <CodeBlockTab title="Request" file="update-role-request" />
+  <CodeBlockTab title="Response" file="update-role-response" />
+</CodeBlock>

package/.docs/organized/docs/reference/sso/connection/index.mdx

@@ -114,7 +114,7 @@ descriptions:
         connection is configured, it transitions to the `validating` state until
         its first successful authentication. After it successfully authorizes a
         user for the first time, the connection state changes to `active`.
-    domains: 'List of [Organization Domains](/reference/organization-domain).'
+    domains: 'List of [Organization Domains](/reference/domain-verification).'
     created_at: The timestamp when the Connection was created.
     updated_at: The timestamp when the Connection was last updated.
 reference:
@@ -375,7 +375,7 @@ reference:
 originalPath: .tmp-workos-clone/packages/docs/content/reference/sso/connection/index.mdx
 ---
 
-## Connection
+# Connection
 
 A connection represents the relationship between WorkOS and any collection of application users. This collection of application users may include personal or enterprise identity providers. As a layer of abstraction, a WorkOS connection rests between an application and its users, separating an application from the implementation details required by specific standards like [OAuth 2.0](/glossary/oauth-2-0) and [SAML](/glossary/saml).
 

package/.docs/organized/docs/reference/sso/get-authorization-url/error-codes.mdx

@@ -14,15 +14,17 @@ Possible error codes and the corresponding descriptions are listed below.
 
 | Error code                                 | Description                                                                                                                                                                                                                                                                                                                        |
 | ------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `access_denied`                            | The user denied an OAuth authorization request at the identity provider.                                                                                                                                                                                                                                                           |
+| `access_denied`                            | The identity provider denied the user's access to the client application, or the user declined the OAuth authorization request at the identity provider.                                                                                                                                                                           |
 | `ambiguous_connection_selector`            | A connection could not be uniquely identified using the provided connection selector (e.g., organization). This can occur when there are multiple SSO connections under the same organization. If you need multiple SSO connections for an organization, use the connection parameter to identify which connection to use for SSO. |
 | `connection_domain_invalid`                | There is no connection for the provided domain.                                                                                                                                                                                                                                                                                    |
 | `connection_invalid`                       | There is no connection for the provided ID.                                                                                                                                                                                                                                                                                        |
 | `connection_strategy_invalid`              | The provider has multiple strategies associated per environment.                                                                                                                                                                                                                                                                   |
 | `connection_unlinked`                      | The connection associated with the request is unlinked.                                                                                                                                                                                                                                                                            |
 | `domain_connection_selector_not_allowed`   | This is a legacy error code that only applies if using the deprecated “domain” query parameter which is no longer valid for this endpoint. Use the “organization” or “connection” query parameters to target a connection instead.                                                                                                 |
+| `idp_initiated_sso_disabled`               | IdP-initiated SSO is disabled for the connection (see [Disable IdP-initiated SSO](/sso/login-flows/idp-initiated-sso/disable-idp-initiated-sso-beta)).                                                                                                                                                                             |
 | `invalid_connection_selector`              | A valid connection selector query parameter must be provided in order to correctly determine the proper connection to return an authorization URL for. Valid connection selectors are either `connection`, `organization`, or `provider`.                                                                                          |
 | `organization_invalid`                     | There is no organization matching the provided ID.                                                                                                                                                                                                                                                                                 |
 | `oauth_failed`                             | An OAuth authorization request failed for a user.                                                                                                                                                                                                                                                                                  |
-| `profile_not_allowed_outside_organization` | A profile was received that has an `email` that is outside the [organization’s domain](/reference/organization-domain) and the organization does not allow this. To resolve this, add the missing domain to the organization's Domains. You can read about other options in the [SSO Domains guide](/sso/domains).                 |
-| `server_error`                             | The SSO authentication failed for the user. More detailed errors and steps to resolve are available in the [Sessions tab](/dashboard/saml-sessions/sessions-tab) on the connection page in the WorkOS Dashboard.                                                                                                                   |
+| `profile_not_allowed_outside_organization` | A profile was received that has an `email` that is outside the [organization’s domain](/reference/domain-verification) and the organization does not allow this. To resolve this, add the missing domain to the organization's Domains. You can read about other options in the [SSO Domains guide](/sso/domains).                 |
+| `server_error`                             | The SSO authentication failed for the user. More detailed errors and steps to resolve are available in the Sessions tab on the connection page in the WorkOS Dashboard.                                                                                                                                                            |
+| `signin_consent_denied`                    | The user rejected the sign-in consent screen. This screen prompts the user to verify the email provided by the identity provider to confirm the legitimacy of the sign-in attempt.                                                                                                                                                 |

package/.docs/organized/docs/reference/sso/get-authorization-url/index.mdx

@@ -49,6 +49,12 @@ descriptions:
     domain_hint: >
       Can be used to pre-fill the domain field when initiating authentication
       with Microsoft OAuth or with a Google SAML connection type.
+    provider_scopes: >
+      Additional OAuth scopes to request from the identity provider. Only
+      applicable when using OAuth connections.
+    provider_query_params: >
+      Key/value pairs of query parameters to pass to the OAuth provider. Only
+      applicable when using OAuth connections.
     url: An OAuth 2.0 authorization URL.
 reference:
   curl:
@@ -91,6 +97,14 @@ reference:
           optional: true
           type: string
           description: (get_authorization_url.domain_hint)
+        - key: provider_scopes
+          optional: true
+          type: string
+          description: (get_authorization_url.provider_scopes)
+        - key: provider_query_params
+          optional: true
+          type: object
+          description: (get_authorization_url.provider_query_params)
       returns:
         - key: url
           type: string
@@ -332,6 +346,14 @@ reference:
               optional: true
               type: string
               description: (get_authorization_url.domain_hint)
+            - key: providerScopes
+              optional: true
+              type: string
+              description: (get_authorization_url.provider_scopes)
+            - key: providerQueryParams
+              optional: true
+              type: object
+              description: (get_authorization_url.provider_query_params)
       returns:
         - key: url
           type: string
@@ -422,9 +444,9 @@ originalPath: >-
   .tmp-workos-clone/packages/docs/content/reference/sso/get-authorization-url/index.mdx
 ---
 
-## Get an authorization URL
+# Get an authorization URL
 
-Generates an OAuth 2.0 authorization URL to authenticate a user with SSO.
+Generates an OAuth 2.0 authorization URL to authenticate a user with SSO.
 
 <CodeBlock referenceId="get_authorization_url">
   <CodeBlockTab title="Request" file="get-authorization-url-request" />

package/.docs/organized/docs/reference/sso/get-authorization-url/redirect-uri.mdx

@@ -18,4 +18,28 @@ Redirect URIs follow stricter requirements in production environments:
 
 - `HTTPS` protocol is required in production environments
 - `HTTP` and `localhost` are allowed in staging environments
-- Wildcard characters are not allowed in production environments
+- The sole exception is the use of `http://127.0.0.1` in production environments to support native clients.
+
+#### Wildcards
+
+WorkOS supports using wildcard characters (`*`) in Redirect URIs to handle dynamic subdomains or variable ports during development.
+
+##### Subdomains
+
+The `*` symbol can be used as a wildcard for subdomains; however, it must be used in accordance with the following rules:
+
+- The protocol of the URL **must not** be `http:` in production environments.
+- The wildcard **must** be located in the subdomain furthest from the root domain (e.g., `https://*.sub.example.com` will work, but `https://sub.*.example.com` will not).
+- The URL **must not** contain more than one wildcard.
+- A wildcard character **may** be prefixed and/or suffixed (e.g., `https://prefix-*-suffix.example.com`).
+- A wildcard **will not** match across multiple subdomain levels (e.g., `https://*.example.com` will not match `https://sub1.sub2.example.com`).
+- Wildcards cannot be used with [public suffix domains](https://publicsuffix.org) (e.g., `https://*.ngrok-free.app` will not work).
+- The wildcard will match letters, digits, hyphens, and underscores.
+- A URL with a wildcard cannot be set as the default redirect URI.
+
+##### Ports
+
+To support [RFC 8252](https://datatracker.ietf.org/doc/html/rfc8252#section-7.3) ("OAuth 2.0 for Native Apps") and local development, a wildcard may be used in place of the port number.
+
+- This is strictly limited to `localhost` and loopback IP addresses (e.g., `127.0.0.1`).
+- Example: `http://localhost:*/auth/callback` is valid.

package/.docs/organized/docs/reference/sso/index.mdx

@@ -5,4 +5,4 @@ originalPath: .tmp-workos-clone/packages/docs/content/reference/sso/index.mdx
 
 The Single Sign-On API has been modeled to meet the [OAuth 2.0](/glossary/oauth-2-0) framework specification. As a result, authentication flows constructed using the Single Sign-On API replicate the OAuth 2.0 protocol flow.
 
-To automatically respond to changes in your SSO connections, use the [Connection events](/events/connection).
+To automatically respond to changes in your SSO connections, use the [Connection events](/events/connection).

package/.docs/organized/docs/reference/sso/logout/authorize.mdx

@@ -1,5 +1,4 @@
 ---
-featureFlag: single-logout-docs
 descriptions:
   logout_authorize:
     profile_id: |

package/.docs/organized/docs/reference/sso/logout/index.mdx

@@ -1,9 +1,8 @@
 ---
-featureFlag: single-logout-docs
 originalPath: .tmp-workos-clone/packages/docs/content/reference/sso/logout/index.mdx
 ---
 
-## Logout
+# Logout
 
 The Logout endpoints enable the RP-initiated logout functionality for users in your application.
 Refer to [Single Logout](/sso/single-logout/idp-initiated-logout) section for more details on how to handle

package/.docs/organized/docs/reference/sso/logout/redirect.mdx

@@ -1,5 +1,4 @@
 ---
-featureFlag: single-logout-docs
 descriptions:
   logout:
     token: >

package/.docs/organized/docs/reference/sso/profile/get-profile-and-token.mdx

@@ -10,7 +10,11 @@ descriptions:
       URI](/reference/sso/get-authorization-url/redirect-uri).
     access_token: >-
       An access token that can be exchanged for a user profile. Access tokens
-      expire 5 minutes after they’re created.
+      expire 5 minutes after they're created.
+    oauth_tokens: >
+      OAuth tokens from the identity provider when using OAuth connections.
+      Contains the provider name, access token, refresh token, expiration time,
+      and scopes.
 reference:
   curl:
     - key: get_profile_and_token
@@ -42,6 +46,10 @@ reference:
             - key: profile
               type: string
               description: (profile.self)
+            - key: oauth_tokens
+              type: object
+              optional: true
+              description: (get_profile_and_token.oauth_tokens)
   dotnet:
     - key: GetProfileAndToken
       url: /reference/sso/profile/get-profile-and-token
@@ -166,6 +174,10 @@ reference:
             - key: profile
               type: Profile
               description: (profile.self)
+            - key: oauthTokens
+              type: object
+              optional: true
+              description: (get_profile_and_token.oauth_tokens)
   go:
     - key: GetProfileAndToken
       url: /reference/sso/profile/get-profile-and-token

package/.docs/organized/docs/reference/sso/profile/index.mdx

@@ -24,14 +24,15 @@ descriptions:
       slug: >-
         Unique identifier for the role, assigned [based on group
         memberships](/sso/identity-provider-role-assignment) at sign-in.
-    raw_attributes: >
-      This field is deprecated. Object of key-value pairs containing relevant
-      user data from the Identity Provider.
+    custom_attributes: >
+      Object containing custom attributes that have been mapped from the
+      Identity Provider. These attributes are configured in the [WorkOS
+      Dashboard](https://dashboard.workos.com/) and can include both predefined
+      and custom attributes.
 
 
-      Raw attributes are an extended set of information one can expect for each
-      user Profile. These raw attributes will vary by Identity Provider and
-      Identity Provider configuration.
+      For more information about configuring custom attributes, see the [Profile
+      Attributes](/sso/attributes) guide.
     self: 'The user [Profile](/reference/sso/profile) object.'
 reference:
   curl:
@@ -75,9 +76,9 @@ reference:
             - key: slug
               type: string
               description: (profile.role.slug)
-        - key: 'raw_attributes [Deprecated]'
+        - key: custom_attributes
           type: object
-          description: (profile.raw_attributes)
+          description: (profile.custom_attributes)
   dotnet:
     - url: /reference/sso/profile
       key: Profile
@@ -112,9 +113,9 @@ reference:
         - key: LastName
           type: string
           description: (profile.last_name)
-        - key: 'RawAttributes [Deprecated]'
+        - key: CustomAttributes
           type: 'Dictionary<string, object>'
-          description: (profile.raw_attributes)
+          description: (profile.custom_attributes)
   ruby:
     - url: /reference/sso/profile
       key: Profile
@@ -153,9 +154,9 @@ reference:
             - key: slug
               type: String
               description: (profile.role.slug)
-        - key: 'raw_attributes [Deprecated]'
+        - key: custom_attributes
           type: Hash
-          description: (profile.raw_attributes)
+          description: (profile.custom_attributes)
   php:
     - url: /reference/sso/profile
       key: Profile
@@ -187,9 +188,9 @@ reference:
         - key: idpId
           type: string
           description: (profile.idp_id)
-        - key: 'rawAttributes [Deprecated]'
+        - key: customAttributes
           type: array
-          description: (profile.raw_attributes)
+          description: (profile.custom_attributes)
   python:
     - url: /reference/sso/profile
       key: Profile
@@ -228,9 +229,9 @@ reference:
             - key: slug
               type: str
               description: (profile.role.slug)
-        - key: 'raw_attributes [Deprecated]'
+        - key: custom_attributes
           type: dict
-          description: (profile.raw_attributes)
+          description: (profile.custom_attributes)
   js:
     - url: /reference/sso/profile
       key: Profile
@@ -269,9 +270,9 @@ reference:
             - key: slug
               type: string
               description: (profile.role.slug)
-        - key: 'rawAttributes [Deprecated]'
+        - key: customAttributes
           type: object
-          description: (profile.raw_attributes)
+          description: (profile.custom_attributes)
   go:
     - url: /reference/sso/profile
       key: Profile
@@ -310,9 +311,9 @@ reference:
             - key: Slug
               type: string
               description: (profile.role.slug)
-        - key: 'RawAttributes [Deprecated]'
+        - key: CustomAttributes
           type: 'map[string]interface{}'
-          description: (profile.raw_attributes)
+          description: (profile.custom_attributes)
   java:
     - url: /reference/sso/profile
       key: Profile
@@ -347,18 +348,18 @@ reference:
         - key: lastName
           type: String
           description: (profile.last_name)
-        - key: 'rawAttributes [Deprecated]'
+        - key: customAttributes
           type: 'Map<String, Any>'
-          description: (profile.raw_attributes)
+          description: (profile.custom_attributes)
 originalPath: .tmp-workos-clone/packages/docs/content/reference/sso/profile/index.mdx
 ---
 
-## Profile
+# Profile
 
 A Profile is an object that represents an authenticated user. The Profile object contains information relevant to a user in the form of normalized attributes.
 
 After receiving the Profile for an authenticated user, use the Profile object attributes to persist relevant data to your application’s user model for the specific, authenticated user.
 
-No Profile attributes can be returned other than the normalized attributes listed below.
+To surface additional attributes on the Profile, refer to the [SSO custom attributes](/sso/attributes/custom-attributes) guide.
 
 <CodeBlock title="Example Profile" file="profile" referenceId="profile" />

package/.docs/organized/docs/reference/{testing.mdx → testing/index.mdx}

@@ -1,5 +1,5 @@
 ---
-originalPath: .tmp-workos-clone/packages/docs/content/reference/testing.mdx
+originalPath: .tmp-workos-clone/packages/docs/content/reference/testing/index.mdx
 ---
 # Testing the API
 

package/.docs/organized/docs/reference/vault/key/create-data-key.mdx

@@ -90,6 +90,35 @@ reference:
             - key: KeyContext
               type: vault.KeyContext
               description: (object_metadata.context)
+  python:
+    - key: create_data_key
+      id: create_data_key
+      title: vault.create_data_key()
+      parameters:
+        - key: key_context
+          type: vault.KeyContext
+          description: (object_metadata.context)
+      returns:
+        - key: data_key_pair
+          type: vault.DataKeyPair
+          unwrap: true
+          properties:
+            - key: data_key
+              type: vault.DataKey
+              unwrap: true
+              properties:
+                - key: id
+                  type: str
+                  description: (data_key.id)
+                - key: key
+                  type: str
+                  description: (data_key.key)
+            - key: encrypted_keys
+              type: str
+              description: (data_key.encrypted_keys)
+            - key: context
+              type: vault.KeyContext
+              description: (object_metadata.context)
 originalPath: >-
   .tmp-workos-clone/packages/docs/content/reference/vault/key/create-data-key.mdx
 ---

package/.docs/organized/docs/reference/vault/key/decrypt-data-key.mdx

@@ -70,6 +70,26 @@ reference:
             - key: Key
               type: string
               description: (data_key.key)
+  python:
+    - key: decrypt_data_key
+      id: decrypt_data_key
+      url: /reference/vault/key/decrypt-data-key
+      title: vault.decrypt_data_key()
+      parameters:
+        - key: keys
+          type: str
+          description: (data_key.encrypted_keys)
+      returns:
+        - key: data_key
+          type: vault.DataKey
+          unwrap: true
+          properties:
+            - key: id
+              type: str
+              description: (data_key.id)
+            - key: key
+              type: str
+              description: (data_key.key)
 originalPath: >-
   .tmp-workos-clone/packages/docs/content/reference/vault/key/decrypt-data-key.mdx
 ---

package/.docs/organized/docs/reference/vault/key/decrypt-data.mdx

@@ -35,10 +35,34 @@ reference:
               type: string
               optional: true
               description: (data_encryption.aad)
+            - key: NonceSize
+              type: int
+              optional: true
+              description: >-
+                Number of bytes to use for a random nonce. Must be either 12
+                (default) or 32 (supported for backwards compatibility). No
+                other values are valid.
       returns:
         - key: plaintext
           type: string
           description: (data_encryption.plaintext)
+  python:
+    - key: decrypt
+      id: decrypt_data
+      url: /reference/vault/key/decrypt-data
+      title: vault.decrypt()
+      parameters:
+        - key: encrypted_data
+          type: str
+          description: (data_encryption.ciphertext)
+        - key: associated_data
+          type: str
+          optional: true
+          description: (data_encryption.aad)
+      returns:
+        - key: plaintext
+          type: str
+          description: (data_encryption.plaintext)
 originalPath: .tmp-workos-clone/packages/docs/content/reference/vault/key/decrypt-data.mdx
 ---
 

package/.docs/organized/docs/reference/vault/key/encrypt-data.mdx

@@ -45,6 +45,26 @@ reference:
         - key: ciphertext
           type: string
           description: (data_encryption.ciphertext)
+  python:
+    - key: encrypt
+      id: encrypt_data
+      url: /reference/vault/key/encrypt-data
+      title: vault.encrypt()
+      parameters:
+        - key: data
+          type: str
+          description: (data_encryption.plaintext)
+        - key: key_context
+          type: vault.KeyContext
+          description: (object_metadata.context)
+        - key: associated_data
+          type: str
+          optional: true
+          description: (data_encryption.aad)
+      returns:
+        - key: ciphertext
+          type: str
+          description: (data_encryption.ciphertext)
 originalPath: .tmp-workos-clone/packages/docs/content/reference/vault/key/encrypt-data.mdx
 ---
 

package/.docs/organized/docs/reference/vault/object/create.mdx

@@ -49,6 +49,23 @@ reference:
               description: (object_metadata.context)
       returns:
         - (Object.Metadata)
+  python:
+    - key: create_object
+      id: create_object
+      url: /reference/vault/object/create
+      title: vault.create_object()
+      parameters:
+        - key: name
+          type: str
+          description: (object.name)
+        - key: value
+          type: str
+          description: (object.value)
+        - key: key_context
+          type: vault.KeyContext
+          description: (object_metadata.context)
+      returns:
+        - (VaultObject.metadata)
 originalPath: .tmp-workos-clone/packages/docs/content/reference/vault/object/create.mdx
 ---
 

package/.docs/organized/docs/reference/vault/object/delete.mdx

@@ -62,6 +62,18 @@ reference:
               type: boolean
               description: Flag indicating whether the object was successfully deleted.
             - (Object.Name)
+  python:
+    - key: delete_object
+      id: delete_object
+      url: /reference/vault/object/delete
+      title: vault.delete_object()
+      parameters:
+        - key: object_id
+          type: str
+          description: (object.id)
+      returns:
+        - key: None
+          description: This method does not return a value
 originalPath: .tmp-workos-clone/packages/docs/content/reference/vault/object/delete.mdx
 ---
 

package/.docs/organized/docs/reference/vault/object/get-by-name.mdx

@@ -0,0 +1,61 @@
+---
+reference:
+  curl:
+    - key: read_object_by_name
+      id: read_object_by_name
+      url: /reference/vault/object/get-by-name
+      title: '/vault/v1/kv/name/:name'
+      type: GET
+      parameters:
+        - key: name
+          type: string
+          description: (object.name)
+      returns:
+        - (object)
+  js:
+    - key: readObjectByName
+      id: read_object_by_name
+      url: /reference/vault/object/get-by-name
+      title: vault.readObjectByName()
+      parameters:
+        - key: name
+          type: string
+          description: (object.name)
+      returns:
+        - (Object)
+  go:
+    - key: ReadObjectByName
+      id: read_object_by_name
+      url: /reference/vault/object/get-by-name
+      title: vault.ReadObjectByName()
+      parameters:
+        - (ctx)
+        - key: opts
+          type: vault.ReadObjectByNameOpts
+          expanded: true
+          properties:
+            - (Object.Name)
+      returns:
+        - (Object)
+  python:
+    - key: read_object_by_name
+      id: read_object_by_name
+      url: /reference/vault/object/get-by-name
+      title: vault.read_object_by_name()
+      parameters:
+        - key: name
+          type: str
+          description: (object.name)
+      returns:
+        - (VaultObject)
+originalPath: .tmp-workos-clone/packages/docs/content/reference/vault/object/get-by-name.mdx
+---
+
+## Get an object by name
+
+Get an existing object by its name. The stored value will be decrypted and returned.
+
+<CodeBlock referenceId="read_object_by_name">
+  <CodeBlockTab title="Request" file="get-object-by-name-request" />
+  <CodeBlockTab title="Response" file="get-object-full-response" />
+</CodeBlock>