@workos/openapi-spec 0.10.0 → 0.11.0

package/dist/open-api-spec.yaml

@@ -7404,6 +7404,24 @@ paths:
           schema:
             example: directory_group_01E64QTDNS0EGJ0FMCVY9BWGZT
             type: string
+        - name: idp_id
+          required: false
+          in: query
+          description: >-
+            Filter Directory Users by the identity provider's unique identifier
+            (`idp_id`). Requires the `directory` parameter to also be provided.
+          schema:
+            example: '2836'
+            type: string
+        - name: email
+          required: false
+          in: query
+          description: >-
+            Filter Directory Users by their primary email address. Requires the
+            `directory` parameter to also be provided.
+          schema:
+            example: jane.doe@example.com
+            type: string
       responses:
         '200':
           description: OK
@@ -11710,6 +11728,14 @@ paths:
                                   The email address of the user that must
                                   authenticate via SSO.
                                 example: user@example.com
+                              pending_authentication_token:
+                                type: string
+                                description: >-
+                                  A token that links the subsequent SSO
+                                  authentication back to the pending
+                                  authentication so the authorization session
+                                  can be completed.
+                                example: pat_01FVYZ...
                             required:
                               - connection_ids
                               - email
@@ -13482,6 +13508,13 @@ paths:
                     description: >-
                       The primary role assigned to the user within the
                       organization.
+                  roles:
+                    type: array
+                    items:
+                      $ref: '#/components/schemas/SlimRole'
+                    description: >-
+                      The list of roles assigned to the user within the
+                      organization.
                   user:
                     $ref: '#/components/schemas/UserlandUser'
                     description: >-
@@ -13497,6 +13530,7 @@ paths:
                   - created_at
                   - updated_at
                   - role
+                  - roles
                   - user
                 x-inline-with-overrides: true
         '400':
@@ -13897,6 +13931,13 @@ paths:
                     description: >-
                       The primary role assigned to the user within the
                       organization.
+                  roles:
+                    type: array
+                    items:
+                      $ref: '#/components/schemas/SlimRole'
+                    description: >-
+                      The list of roles assigned to the user within the
+                      organization.
                   user:
                     $ref: '#/components/schemas/UserlandUser'
                     description: >-
@@ -13912,6 +13953,7 @@ paths:
                   - created_at
                   - updated_at
                   - role
+                  - roles
                   - user
                 x-inline-with-overrides: true
         '400':
@@ -20050,6 +20092,7 @@ components:
               - pipes.connected_account.disconnected
               - pipes.connected_account.reauthorization_needed
               - session.created
+              - session.reauthenticated
               - session.revoked
               - waitlist_user.approved
               - waitlist_user.created
@@ -20978,7 +21021,10 @@ components:
             - pending
             - ready
             - error
-          description: 'The state of the export. Possible values: pending, ready, error.'
+            - expired
+          description: >-
+            The state of the export. Possible values: pending, ready, error,
+            expired.
           example: ready
         url:
           type:
@@ -30467,6 +30513,150 @@ components:
                 - data
                 - created_at
                 - object
+            - type: object
+              properties:
+                id:
+                  type: string
+                  description: Unique identifier for the event.
+                  example: event_01EHZNVPK3SFK441A1RGBFSHRT
+                event:
+                  type: string
+                  const: session.reauthenticated
+                data:
+                  type: object
+                  properties:
+                    object:
+                      type: string
+                      description: Distinguishes the session object.
+                      const: session
+                    id:
+                      type: string
+                      description: The unique ID of the session.
+                      example: session_01H93ZY4F80QPBEZ1R5B2SHQG8
+                    impersonator:
+                      type: object
+                      properties:
+                        email:
+                          type: string
+                          description: >-
+                            The email address of the WorkOS Dashboard user who
+                            is impersonating the user.
+                          example: admin@foocorp.com
+                        reason:
+                          type:
+                            - string
+                            - 'null'
+                          description: >-
+                            The justification the impersonator gave for
+                            impersonating the user.
+                          example: Investigating an issue with the customer's account.
+                      required:
+                        - email
+                        - reason
+                      description: >-
+                        Information about the impersonator if this session was
+                        created via impersonation.
+                    ip_address:
+                      type:
+                        - string
+                        - 'null'
+                      description: The IP address from which the session was created.
+                      example: 198.51.100.42
+                    organization_id:
+                      type: string
+                      description: >-
+                        The ID of the organization this session is associated
+                        with.
+                      example: org_01H945H0YD4F97JN9MATX7BYAG
+                    user_agent:
+                      type:
+                        - string
+                        - 'null'
+                      description: >-
+                        The user agent string from the device that created the
+                        session.
+                      example: >-
+                        Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)
+                        AppleWebKit/537.36
+                    user_id:
+                      type: string
+                      description: The ID of the user this session belongs to.
+                      example: user_01E4ZCR3C56J083X43JQXF3JK5
+                    auth_method:
+                      type: string
+                      enum:
+                        - cross_app_auth
+                        - external_auth
+                        - impersonation
+                        - magic_code
+                        - migrated_session
+                        - oauth
+                        - passkey
+                        - password
+                        - sso
+                        - unknown
+                      description: The authentication method used to create this session.
+                      example: sso
+                    status:
+                      type: string
+                      enum:
+                        - active
+                        - expired
+                        - revoked
+                      description: The current status of the session.
+                      example: active
+                    expires_at:
+                      format: date-time
+                      type: string
+                      description: The timestamp when the session expires.
+                      example: '2026-01-15T12:00:00.000Z'
+                    ended_at:
+                      format: date-time
+                      type:
+                        - string
+                        - 'null'
+                      description: The timestamp when the session ended.
+                      example: null
+                    created_at:
+                      format: date-time
+                      type: string
+                      description: An ISO 8601 timestamp.
+                      example: '2026-01-15T12:00:00.000Z'
+                    updated_at:
+                      format: date-time
+                      type: string
+                      description: An ISO 8601 timestamp.
+                      example: '2026-01-15T12:00:00.000Z'
+                  required:
+                    - object
+                    - id
+                    - ip_address
+                    - user_agent
+                    - user_id
+                    - auth_method
+                    - status
+                    - expires_at
+                    - ended_at
+                    - created_at
+                    - updated_at
+                  description: The event payload.
+                created_at:
+                  format: date-time
+                  type: string
+                  description: An ISO 8601 timestamp.
+                  example: '2026-01-15T12:00:00.000Z'
+                context:
+                  $ref: '#/components/schemas/EventContextDto'
+                object:
+                  type: string
+                  description: Distinguishes the Event object.
+                  const: event
+              required:
+                - id
+                - event
+                - data
+                - created_at
+                - object
             - type: object
               properties:
                 id:
@@ -33090,6 +33280,11 @@ components:
         role:
           $ref: '#/components/schemas/SlimRole'
           description: The primary role assigned to the user within the organization.
+        roles:
+          type: array
+          items:
+            $ref: '#/components/schemas/SlimRole'
+          description: The list of roles assigned to the user within the organization.
         user:
           $ref: '#/components/schemas/UserlandUser'
           description: The user that belongs to the organization through this membership.
@@ -33103,6 +33298,7 @@ components:
         - created_at
         - updated_at
         - role
+        - roles
         - user
     UserlandUserOrganizationMembershipList:
       type: object

package/dist/types.d.ts

@@ -4350,7 +4350,7 @@ export interface components {
              *       "dsync.user.created"
              *     ]
              */
-            events: ("authentication.email_verification_succeeded" | "authentication.magic_auth_failed" | "authentication.magic_auth_succeeded" | "authentication.mfa_succeeded" | "authentication.oauth_failed" | "authentication.oauth_succeeded" | "authentication.password_failed" | "authentication.password_succeeded" | "authentication.passkey_failed" | "authentication.passkey_succeeded" | "authentication.sso_failed" | "authentication.sso_started" | "authentication.sso_succeeded" | "authentication.sso_timed_out" | "authentication.radar_risk_detected" | "api_key.created" | "api_key.revoked" | "api_key.updated" | "connection.activated" | "connection.deactivated" | "connection.saml_certificate_renewal_required" | "connection.saml_certificate_renewed" | "connection.deleted" | "dsync.activated" | "dsync.deleted" | "dsync.group.created" | "dsync.group.deleted" | "dsync.group.updated" | "dsync.group.user_added" | "dsync.group.user_removed" | "dsync.user.created" | "dsync.user.deleted" | "dsync.user.updated" | "email_verification.created" | "group.created" | "group.deleted" | "group.member_added" | "group.member_removed" | "group.updated" | "flag.created" | "flag.deleted" | "flag.updated" | "flag.rule_updated" | "invitation.accepted" | "invitation.created" | "invitation.resent" | "invitation.revoked" | "magic_auth.created" | "organization.created" | "organization.deleted" | "organization.updated" | "organization_domain.created" | "organization_domain.deleted" | "organization_domain.updated" | "organization_domain.verified" | "organization_domain.verification_failed" | "password_reset.created" | "password_reset.succeeded" | "user.created" | "user.updated" | "user.deleted" | "organization_membership.created" | "organization_membership.deleted" | "organization_membership.updated" | "role.created" | "role.deleted" | "role.updated" | "organization_role.created" | "organization_role.deleted" | "organization_role.updated" | "permission.created" | "permission.deleted" | "permission.updated" | "pipes.connected_account.connected" | "pipes.connected_account.disconnected" | "pipes.connected_account.reauthorization_needed" | "session.created" | "session.revoked" | "waitlist_user.approved" | "waitlist_user.created" | "waitlist_user.denied")[];
+            events: ("authentication.email_verification_succeeded" | "authentication.magic_auth_failed" | "authentication.magic_auth_succeeded" | "authentication.mfa_succeeded" | "authentication.oauth_failed" | "authentication.oauth_succeeded" | "authentication.password_failed" | "authentication.password_succeeded" | "authentication.passkey_failed" | "authentication.passkey_succeeded" | "authentication.sso_failed" | "authentication.sso_started" | "authentication.sso_succeeded" | "authentication.sso_timed_out" | "authentication.radar_risk_detected" | "api_key.created" | "api_key.revoked" | "api_key.updated" | "connection.activated" | "connection.deactivated" | "connection.saml_certificate_renewal_required" | "connection.saml_certificate_renewed" | "connection.deleted" | "dsync.activated" | "dsync.deleted" | "dsync.group.created" | "dsync.group.deleted" | "dsync.group.updated" | "dsync.group.user_added" | "dsync.group.user_removed" | "dsync.user.created" | "dsync.user.deleted" | "dsync.user.updated" | "email_verification.created" | "group.created" | "group.deleted" | "group.member_added" | "group.member_removed" | "group.updated" | "flag.created" | "flag.deleted" | "flag.updated" | "flag.rule_updated" | "invitation.accepted" | "invitation.created" | "invitation.resent" | "invitation.revoked" | "magic_auth.created" | "organization.created" | "organization.deleted" | "organization.updated" | "organization_domain.created" | "organization_domain.deleted" | "organization_domain.updated" | "organization_domain.verified" | "organization_domain.verification_failed" | "password_reset.created" | "password_reset.succeeded" | "user.created" | "user.updated" | "user.deleted" | "organization_membership.created" | "organization_membership.deleted" | "organization_membership.updated" | "role.created" | "role.deleted" | "role.updated" | "organization_role.created" | "organization_role.deleted" | "organization_role.updated" | "permission.created" | "permission.deleted" | "permission.updated" | "pipes.connected_account.connected" | "pipes.connected_account.disconnected" | "pipes.connected_account.reauthorization_needed" | "session.created" | "session.reauthenticated" | "session.revoked" | "waitlist_user.approved" | "waitlist_user.created" | "waitlist_user.denied")[];
         };
         UpdateWebhookEndpointDto: {
             /**
@@ -4371,7 +4371,7 @@ export interface components {
              *       "dsync.user.created"
              *     ]
              */
-            events?: ("authentication.email_verification_succeeded" | "authentication.magic_auth_failed" | "authentication.magic_auth_succeeded" | "authentication.mfa_succeeded" | "authentication.oauth_failed" | "authentication.oauth_succeeded" | "authentication.password_failed" | "authentication.password_succeeded" | "authentication.passkey_failed" | "authentication.passkey_succeeded" | "authentication.sso_failed" | "authentication.sso_started" | "authentication.sso_succeeded" | "authentication.sso_timed_out" | "authentication.radar_risk_detected" | "api_key.created" | "api_key.revoked" | "api_key.updated" | "connection.activated" | "connection.deactivated" | "connection.saml_certificate_renewal_required" | "connection.saml_certificate_renewed" | "connection.deleted" | "dsync.activated" | "dsync.deleted" | "dsync.group.created" | "dsync.group.deleted" | "dsync.group.updated" | "dsync.group.user_added" | "dsync.group.user_removed" | "dsync.user.created" | "dsync.user.deleted" | "dsync.user.updated" | "email_verification.created" | "group.created" | "group.deleted" | "group.member_added" | "group.member_removed" | "group.updated" | "flag.created" | "flag.deleted" | "flag.updated" | "flag.rule_updated" | "invitation.accepted" | "invitation.created" | "invitation.resent" | "invitation.revoked" | "magic_auth.created" | "organization.created" | "organization.deleted" | "organization.updated" | "organization_domain.created" | "organization_domain.deleted" | "organization_domain.updated" | "organization_domain.verified" | "organization_domain.verification_failed" | "password_reset.created" | "password_reset.succeeded" | "user.created" | "user.updated" | "user.deleted" | "organization_membership.created" | "organization_membership.deleted" | "organization_membership.updated" | "role.created" | "role.deleted" | "role.updated" | "organization_role.created" | "organization_role.deleted" | "organization_role.updated" | "permission.created" | "permission.deleted" | "permission.updated" | "pipes.connected_account.connected" | "pipes.connected_account.disconnected" | "pipes.connected_account.reauthorization_needed" | "session.created" | "session.revoked" | "waitlist_user.approved" | "waitlist_user.created" | "waitlist_user.denied")[];
+            events?: ("authentication.email_verification_succeeded" | "authentication.magic_auth_failed" | "authentication.magic_auth_succeeded" | "authentication.mfa_succeeded" | "authentication.oauth_failed" | "authentication.oauth_succeeded" | "authentication.password_failed" | "authentication.password_succeeded" | "authentication.passkey_failed" | "authentication.passkey_succeeded" | "authentication.sso_failed" | "authentication.sso_started" | "authentication.sso_succeeded" | "authentication.sso_timed_out" | "authentication.radar_risk_detected" | "api_key.created" | "api_key.revoked" | "api_key.updated" | "connection.activated" | "connection.deactivated" | "connection.saml_certificate_renewal_required" | "connection.saml_certificate_renewed" | "connection.deleted" | "dsync.activated" | "dsync.deleted" | "dsync.group.created" | "dsync.group.deleted" | "dsync.group.updated" | "dsync.group.user_added" | "dsync.group.user_removed" | "dsync.user.created" | "dsync.user.deleted" | "dsync.user.updated" | "email_verification.created" | "group.created" | "group.deleted" | "group.member_added" | "group.member_removed" | "group.updated" | "flag.created" | "flag.deleted" | "flag.updated" | "flag.rule_updated" | "invitation.accepted" | "invitation.created" | "invitation.resent" | "invitation.revoked" | "magic_auth.created" | "organization.created" | "organization.deleted" | "organization.updated" | "organization_domain.created" | "organization_domain.deleted" | "organization_domain.updated" | "organization_domain.verified" | "organization_domain.verification_failed" | "password_reset.created" | "password_reset.succeeded" | "user.created" | "user.updated" | "user.deleted" | "organization_membership.created" | "organization_membership.deleted" | "organization_membership.updated" | "role.created" | "role.deleted" | "role.updated" | "organization_role.created" | "organization_role.deleted" | "organization_role.updated" | "permission.created" | "permission.deleted" | "permission.updated" | "pipes.connected_account.connected" | "pipes.connected_account.disconnected" | "pipes.connected_account.reauthorization_needed" | "session.created" | "session.reauthenticated" | "session.revoked" | "waitlist_user.approved" | "waitlist_user.created" | "waitlist_user.denied")[];
         };
         WidgetSessionTokenDto: {
             /**
@@ -5097,11 +5097,11 @@ export interface components {
              */
             id: string;
             /**
-             * @description The state of the export. Possible values: pending, ready, error.
+             * @description The state of the export. Possible values: pending, ready, error, expired.
              * @example ready
              * @enum {string}
              */
-            state: "pending" | "ready" | "error";
+            state: "pending" | "ready" | "error" | "expired";
             /**
              * @description A URL to the CSV file. Only defined when the Audit Log Export is ready.
              * @example https://exports.audit-logs.com/audit-log-exports/export.csv
@@ -12450,6 +12450,108 @@ export interface components {
              * @constant
              */
             object: "event";
+        } | {
+            /**
+             * @description Unique identifier for the event.
+             * @example event_01EHZNVPK3SFK441A1RGBFSHRT
+             */
+            id: string;
+            /** @constant */
+            event: "session.reauthenticated";
+            /** @description The event payload. */
+            data: {
+                /**
+                 * @description Distinguishes the session object.
+                 * @constant
+                 */
+                object: "session";
+                /**
+                 * @description The unique ID of the session.
+                 * @example session_01H93ZY4F80QPBEZ1R5B2SHQG8
+                 */
+                id: string;
+                /** @description Information about the impersonator if this session was created via impersonation. */
+                impersonator?: {
+                    /**
+                     * @description The email address of the WorkOS Dashboard user who is impersonating the user.
+                     * @example admin@foocorp.com
+                     */
+                    email: string;
+                    /**
+                     * @description The justification the impersonator gave for impersonating the user.
+                     * @example Investigating an issue with the customer's account.
+                     */
+                    reason: string | null;
+                };
+                /**
+                 * @description The IP address from which the session was created.
+                 * @example 198.51.100.42
+                 */
+                ip_address: string | null;
+                /**
+                 * @description The ID of the organization this session is associated with.
+                 * @example org_01H945H0YD4F97JN9MATX7BYAG
+                 */
+                organization_id?: string;
+                /**
+                 * @description The user agent string from the device that created the session.
+                 * @example Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36
+                 */
+                user_agent: string | null;
+                /**
+                 * @description The ID of the user this session belongs to.
+                 * @example user_01E4ZCR3C56J083X43JQXF3JK5
+                 */
+                user_id: string;
+                /**
+                 * @description The authentication method used to create this session.
+                 * @example sso
+                 * @enum {string}
+                 */
+                auth_method: "cross_app_auth" | "external_auth" | "impersonation" | "magic_code" | "migrated_session" | "oauth" | "passkey" | "password" | "sso" | "unknown";
+                /**
+                 * @description The current status of the session.
+                 * @example active
+                 * @enum {string}
+                 */
+                status: "active" | "expired" | "revoked";
+                /**
+                 * Format: date-time
+                 * @description The timestamp when the session expires.
+                 * @example 2026-01-15T12:00:00.000Z
+                 */
+                expires_at: string;
+                /**
+                 * Format: date-time
+                 * @description The timestamp when the session ended.
+                 * @example null
+                 */
+                ended_at: string | null;
+                /**
+                 * Format: date-time
+                 * @description An ISO 8601 timestamp.
+                 * @example 2026-01-15T12:00:00.000Z
+                 */
+                created_at: string;
+                /**
+                 * Format: date-time
+                 * @description An ISO 8601 timestamp.
+                 * @example 2026-01-15T12:00:00.000Z
+                 */
+                updated_at: string;
+            };
+            /**
+             * Format: date-time
+             * @description An ISO 8601 timestamp.
+             * @example 2026-01-15T12:00:00.000Z
+             */
+            created_at: string;
+            context?: components["schemas"]["EventContextDto"];
+            /**
+             * @description Distinguishes the Event object.
+             * @constant
+             */
+            object: "event";
         } | {
             /**
              * @description Unique identifier for the event.
@@ -14434,6 +14536,8 @@ export interface components {
             updated_at: string;
             /** @description The primary role assigned to the user within the organization. */
             role: components["schemas"]["SlimRole"];
+            /** @description The list of roles assigned to the user within the organization. */
+            roles: components["schemas"]["SlimRole"][];
             /** @description The user that belongs to the organization through this membership. */
             user: components["schemas"]["UserlandUser"];
         };
@@ -21708,6 +21812,10 @@ export interface operations {
                 directory?: string;
                 /** @description Unique identifier of the WorkOS Directory Group. This value can be obtained from the WorkOS API. */
                 group?: string;
+                /** @description Filter Directory Users by the identity provider's unique identifier (`idp_id`). Requires the `directory` parameter to also be provided. */
+                idp_id?: string;
+                /** @description Filter Directory Users by their primary email address. Requires the `directory` parameter to also be provided. */
+                email?: string;
             };
             header?: never;
             path?: never;
@@ -25530,6 +25638,11 @@ export interface operations {
                          * @example user@example.com
                          */
                         email: string;
+                        /**
+                         * @description A token that links the subsequent SSO authentication back to the pending authentication so the authorization session can be completed.
+                         * @example pat_01FVYZ...
+                         */
+                        pending_authentication_token?: string;
                     }));
                 };
             };
@@ -27000,6 +27113,8 @@ export interface operations {
                         updated_at: string;
                         /** @description The primary role assigned to the user within the organization. */
                         role: components["schemas"]["SlimRole"];
+                        /** @description The list of roles assigned to the user within the organization. */
+                        roles: components["schemas"]["SlimRole"][];
                         /** @description The user that belongs to the organization through this membership. */
                         user: components["schemas"]["UserlandUser"];
                     };
@@ -27363,6 +27478,8 @@ export interface operations {
                         updated_at: string;
                         /** @description The primary role assigned to the user within the organization. */
                         role: components["schemas"]["SlimRole"];
+                        /** @description The list of roles assigned to the user within the organization. */
+                        roles: components["schemas"]["SlimRole"][];
                         /** @description The user that belongs to the organization through this membership. */
                         user: components["schemas"]["UserlandUser"];
                     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@workos/openapi-spec",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "type": "module",
   "description": "WorkOS OpenAPI specification, TypeScript types, and SDK resolution policy",
   "license": "MIT",
@@ -30,11 +30,12 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@workos/oagen": "^0.22.6"
+    "@workos/oagen": "^0.23.0"
   },
   "scripts": {
     "generate:services": "node scripts/generate-services.mjs",
     "build:policy": "npm run generate:services && tsdown",
+    "test": "node --test scripts/__tests__/*.spec.mjs",
     "generate:postman": "tsx scripts/postman/generate.ts",
     "generate:postman:local": "tsx scripts/postman/generate.ts --local",
     "sdk:resolve": "npx oagen resolve --spec spec/open-api-spec.yaml",
@@ -54,16 +55,16 @@
     "prepare": "husky"
   },
   "overrides": {
-    "js-yaml": "^4.2.0",
+    "js-yaml": "^4.1.1",
     "lodash": "^4.17.23"
   },
   "devDependencies": {
     "@types/js-yaml": "^4.0.9",
-    "@types/node": "^25.9.3",
-    "@workos/oagen-emitters": "^0.18.3",
+    "@types/node": "^26.0.0",
+    "@workos/oagen-emitters": "^0.19.0",
     "diff2html": "^3.4.56",
     "husky": "^9.1.7",
-    "js-yaml": "^4.2.0",
+    "js-yaml": "^4.1.1",
     "openapi-to-postmanv2": "^6.1.0",
     "tsdown": "^0.22.3",
     "tsx": "^4.22.4",