@workos/openapi-spec 0.106.0 → 0.108.0

package/dist/open-api-spec.yaml

@@ -3767,7 +3767,7 @@ paths:
       summary: Check authorization
       tags:
         - authorization
-      x-mutually-exclusive-body-groups: &ref_5
+      x-mutually-exclusive-body-groups: &ref_6
         resource_target:
           optional: false
           variants:
@@ -4410,7 +4410,7 @@ paths:
       summary: Assign a role
       tags:
         - authorization
-      x-mutually-exclusive-body-groups: &ref_6
+      x-mutually-exclusive-body-groups: &ref_7
         resource_target:
           optional: false
           variants:
@@ -4481,7 +4481,7 @@ paths:
       summary: Remove a role assignment
       tags:
         - authorization
-      x-mutually-exclusive-body-groups: &ref_7
+      x-mutually-exclusive-body-groups: &ref_8
         resource_target:
           optional: false
           variants:
@@ -6904,7 +6904,7 @@ paths:
       summary: Create an authorization resource
       tags:
         - authorization
-      x-mutually-exclusive-body-groups: &ref_8
+      x-mutually-exclusive-body-groups: &ref_9
         parent_resource:
           optional: true
           variants:
@@ -9043,7 +9043,7 @@ paths:
       tags:
         - connections
       x-feature-flag: connections-api-migrations-capabilities-api
-      x-mutually-exclusive-body-groups: &ref_9
+      x-mutually-exclusive-body-groups: &ref_10
         protocol_options:
           optional: false
           variants:
@@ -10271,7 +10271,7 @@ paths:
       tags:
         - connections
       x-feature-flag: connections-api-migrations-capabilities-api
-      x-mutually-exclusive-body-groups: &ref_12
+      x-mutually-exclusive-body-groups: &ref_13
         protocol_options:
           optional: true
           variants:
@@ -10772,49 +10772,184 @@ paths:
         content:
           application/json:
             schema:
-              type: object
-              properties:
-                user_id:
-                  type: string
-                  description: A [User](/reference/authkit/user) identifier.
-                  example: user_01EHZNVPK3SFK441A1RGBFSHRT
-                organization_id:
-                  type: string
-                  description: >-
-                    An [Organization](/reference/organization) identifier.
-                    Optional parameter to scope the connection to a specific
-                    organization. Required when `connection_owner` is
-                    `organization`.
-                  example: org_01EHZNVPK3SFK441A1RGBFSHRT
-                connected_account_id:
-                  type: string
-                  pattern: ^data_installation_.+$
-                  description: >-
-                    A [connected account](/reference/pipes/connected-account)
-                    identifier. Use this to rotate a specific existing
-                    connection.
-                  example: data_installation_01EHZNVPK3SFK441A1RGBFSHRT
-                connection_owner:
-                  type: string
-                  enum:
-                    - user
-                    - organization
-                  description: >-
-                    Whose connection to create or rotate. `user` (the default)
-                    addresses the connection owned by `user_id`. `organization`
-                    addresses the connection shared by every member of
-                    `organization_id`; `user_id` then identifies the member
-                    performing the request and must be an active member of the
-                    organization.
-                  example: user
-                secret:
-                  type: string
-                  minLength: 1
-                  description: The API key secret to store for this integration.
-                  example: sk-1234567890abcdef
-              required:
-                - user_id
-                - secret
+              oneOf:
+                - type: object
+                  properties:
+                    user_id:
+                      type: string
+                      description: A [User](/reference/authkit/user) identifier.
+                      example: user_01EHZNVPK3SFK441A1RGBFSHRT
+                    organization_id:
+                      type: string
+                      description: >-
+                        An [Organization](/reference/organization) identifier.
+                        Optional parameter to scope the connection to a specific
+                        organization. Required when `connection_owner` is
+                        `organization`.
+                      example: org_01EHZNVPK3SFK441A1RGBFSHRT
+                    connection_owner:
+                      type: string
+                      enum:
+                        - user
+                        - organization
+                      description: >-
+                        Whose connection to create or rotate. `user` (the
+                        default) addresses the connection owned by `user_id`.
+                        `organization` addresses the connection shared by every
+                        member of `organization_id`; `user_id` then identifies
+                        the member performing the request and must be an active
+                        member of the organization.
+                      example: user
+                    secret:
+                      type: string
+                      minLength: 1
+                      description: The API key secret to store for this integration.
+                      example: sk-1234567890abcdef
+                  required:
+                    - user_id
+                    - secret
+                  additionalProperties: false
+                - type: object
+                  properties:
+                    user_id:
+                      type: string
+                      description: A [User](/reference/authkit/user) identifier.
+                      example: user_01EHZNVPK3SFK441A1RGBFSHRT
+                    organization_id:
+                      type: string
+                      description: >-
+                        An [Organization](/reference/organization) identifier.
+                        Optional parameter to scope the connection to a specific
+                        organization. Required when `connection_owner` is
+                        `organization`.
+                      example: org_01EHZNVPK3SFK441A1RGBFSHRT
+                    connection_owner:
+                      type: string
+                      enum:
+                        - user
+                        - organization
+                      description: >-
+                        Whose connection to create or rotate. `user` (the
+                        default) addresses the connection owned by `user_id`.
+                        `organization` addresses the connection shared by every
+                        member of `organization_id`; `user_id` then identifies
+                        the member performing the request and must be an active
+                        member of the organization.
+                      example: user
+                    secret:
+                      type: string
+                      minLength: 1
+                      description: The API key secret to store for this integration.
+                      example: sk-1234567890abcdef
+                    connection_intent:
+                      type: string
+                      description: >-
+                        Create another connection. The first connection for an
+                        owner shape fills the compatibility slot; later
+                        connections are standard.
+                      example: add
+                      const: add
+                  required:
+                    - user_id
+                    - secret
+                    - connection_intent
+                  additionalProperties: false
+                - type: object
+                  properties:
+                    user_id:
+                      type: string
+                      description: A [User](/reference/authkit/user) identifier.
+                      example: user_01EHZNVPK3SFK441A1RGBFSHRT
+                    organization_id:
+                      type: string
+                      description: >-
+                        An [Organization](/reference/organization) identifier.
+                        Optional parameter to scope the connection to a specific
+                        organization. Required when `connection_owner` is
+                        `organization`.
+                      example: org_01EHZNVPK3SFK441A1RGBFSHRT
+                    connection_owner:
+                      type: string
+                      enum:
+                        - user
+                        - organization
+                      description: >-
+                        Whose connection to create or rotate. `user` (the
+                        default) addresses the connection owned by `user_id`.
+                        `organization` addresses the connection shared by every
+                        member of `organization_id`; `user_id` then identifies
+                        the member performing the request and must be an active
+                        member of the organization.
+                      example: user
+                    secret:
+                      type: string
+                      minLength: 1
+                      description: The API key secret to store for this integration.
+                      example: sk-1234567890abcdef
+                    connection_intent:
+                      type: string
+                      description: >-
+                        Reauthorize exactly the connection named by
+                        `connected_account_id`.
+                      example: reauthorize
+                      const: reauthorize
+                    connected_account_id:
+                      type: string
+                      pattern: ^data_installation_.+$
+                      description: >-
+                        The exact connected account to reauthorize. Required
+                        with `connection_intent: reauthorize`.
+                      example: data_installation_01EHZNVPK3SFK441A1RGBFSHRT
+                  required:
+                    - user_id
+                    - secret
+                    - connection_intent
+                    - connected_account_id
+                  additionalProperties: false
+                - type: object
+                  properties:
+                    user_id:
+                      type: string
+                      description: A [User](/reference/authkit/user) identifier.
+                      example: user_01EHZNVPK3SFK441A1RGBFSHRT
+                    organization_id:
+                      type: string
+                      description: >-
+                        An [Organization](/reference/organization) identifier.
+                        Optional parameter to scope the connection to a specific
+                        organization. Required when `connection_owner` is
+                        `organization`.
+                      example: org_01EHZNVPK3SFK441A1RGBFSHRT
+                    connection_owner:
+                      type: string
+                      enum:
+                        - user
+                        - organization
+                      description: >-
+                        Whose connection to create or rotate. `user` (the
+                        default) addresses the connection owned by `user_id`.
+                        `organization` addresses the connection shared by every
+                        member of `organization_id`; `user_id` then identifies
+                        the member performing the request and must be an active
+                        member of the organization.
+                      example: user
+                    secret:
+                      type: string
+                      minLength: 1
+                      description: The API key secret to store for this integration.
+                      example: sk-1234567890abcdef
+                    connected_account_id:
+                      type: string
+                      pattern: ^data_installation_.+$
+                      description: >-
+                        The exact connected account to reauthorize. The
+                        reauthorize intent may be omitted for compatibility.
+                      example: data_installation_01EHZNVPK3SFK441A1RGBFSHRT
+                  required:
+                    - user_id
+                    - secret
+                    - connected_account_id
+                  additionalProperties: false
       responses:
         '200':
           description: The resulting connected account after the upsert.
@@ -11038,65 +11173,245 @@ paths:
         content:
           application/json:
             schema:
-              type: object
-              properties:
-                user_id:
-                  type: string
-                  description: A [User](/reference/authkit/user) identifier.
-                  example: user_01EHZNVPK3SFK441A1RGBFSHRT
-                organization_id:
-                  type: string
-                  description: >-
-                    An [Organization](/reference/organization) identifier.
-                    Optional parameter to scope the connection to a specific
-                    organization. Required when `connection_owner` is
-                    `organization`.
-                  example: org_01EHZNVPK3SFK441A1RGBFSHRT
-                connected_account_id:
-                  type: string
-                  pattern: ^data_installation_.+$
-                  description: >-
-                    A [connected account](/reference/pipes/connected-account)
-                    identifier. Use this to rotate a specific existing
-                    connection.
-                  example: data_installation_01EHZNVPK3SFK441A1RGBFSHRT
-                connection_owner:
-                  type: string
-                  enum:
-                    - user
-                    - organization
-                  description: >-
-                    Whose connection to create or rotate. `user` (the default)
-                    addresses the connection owned by `user_id`. `organization`
-                    addresses the connection shared by every member of
-                    `organization_id`; `user_id` then identifies the member
-                    performing the request and must be an active member of the
-                    organization.
-                  example: user
-                client_id:
-                  type: string
-                  minLength: 1
-                  description: The OAuth client ID to store for this integration.
-                  example: 3MVG9...
-                client_secret:
-                  type: string
-                  minLength: 1
-                  description: The OAuth client secret to store for this integration.
-                  example: shhh-secret
-                config:
-                  type: object
-                  additionalProperties:
-                    type: string
-                  description: >-
-                    Provider-specific configuration values collected for this
-                    installation, keyed by the provider's config field
-                    descriptors.
-                  example:
-                    salesforce_host: acme.my.salesforce.com
-              required:
-                - user_id
-                - client_id
-                - client_secret
+              oneOf:
+                - type: object
+                  properties:
+                    user_id:
+                      type: string
+                      description: A [User](/reference/authkit/user) identifier.
+                      example: user_01EHZNVPK3SFK441A1RGBFSHRT
+                    organization_id:
+                      type: string
+                      description: >-
+                        An [Organization](/reference/organization) identifier.
+                        Optional parameter to scope the connection to a specific
+                        organization. Required when `connection_owner` is
+                        `organization`.
+                      example: org_01EHZNVPK3SFK441A1RGBFSHRT
+                    connection_owner:
+                      type: string
+                      enum:
+                        - user
+                        - organization
+                      description: >-
+                        Whose connection to create or rotate. `user` (the
+                        default) addresses the connection owned by `user_id`.
+                        `organization` addresses the connection shared by every
+                        member of `organization_id`; `user_id` then identifies
+                        the member performing the request and must be an active
+                        member of the organization.
+                      example: user
+                    client_id:
+                      type: string
+                      minLength: 1
+                      description: The OAuth client ID to store for this integration.
+                      example: 3MVG9...
+                    client_secret:
+                      type: string
+                      minLength: 1
+                      description: The OAuth client secret to store for this integration.
+                      example: shhh-secret
+                    config:
+                      type: object
+                      additionalProperties:
+                        type: string
+                      description: >-
+                        Provider-specific configuration values collected for
+                        this installation, keyed by the provider's config field
+                        descriptors.
+                      example: &ref_1
+                        salesforce_host: acme.my.salesforce.com
+                  required:
+                    - user_id
+                    - client_id
+                    - client_secret
+                  additionalProperties: false
+                - type: object
+                  properties:
+                    user_id:
+                      type: string
+                      description: A [User](/reference/authkit/user) identifier.
+                      example: user_01EHZNVPK3SFK441A1RGBFSHRT
+                    organization_id:
+                      type: string
+                      description: >-
+                        An [Organization](/reference/organization) identifier.
+                        Optional parameter to scope the connection to a specific
+                        organization. Required when `connection_owner` is
+                        `organization`.
+                      example: org_01EHZNVPK3SFK441A1RGBFSHRT
+                    connection_owner:
+                      type: string
+                      enum:
+                        - user
+                        - organization
+                      description: >-
+                        Whose connection to create or rotate. `user` (the
+                        default) addresses the connection owned by `user_id`.
+                        `organization` addresses the connection shared by every
+                        member of `organization_id`; `user_id` then identifies
+                        the member performing the request and must be an active
+                        member of the organization.
+                      example: user
+                    client_id:
+                      type: string
+                      minLength: 1
+                      description: The OAuth client ID to store for this integration.
+                      example: 3MVG9...
+                    client_secret:
+                      type: string
+                      minLength: 1
+                      description: The OAuth client secret to store for this integration.
+                      example: shhh-secret
+                    config:
+                      type: object
+                      additionalProperties:
+                        type: string
+                      description: >-
+                        Provider-specific configuration values collected for
+                        this installation, keyed by the provider's config field
+                        descriptors.
+                      example: *ref_1
+                    connection_intent:
+                      type: string
+                      description: >-
+                        Create another connection. The first connection for an
+                        owner shape fills the compatibility slot; later
+                        connections are standard.
+                      example: add
+                      const: add
+                  required:
+                    - user_id
+                    - client_id
+                    - client_secret
+                    - connection_intent
+                  additionalProperties: false
+                - type: object
+                  properties:
+                    user_id:
+                      type: string
+                      description: A [User](/reference/authkit/user) identifier.
+                      example: user_01EHZNVPK3SFK441A1RGBFSHRT
+                    organization_id:
+                      type: string
+                      description: >-
+                        An [Organization](/reference/organization) identifier.
+                        Optional parameter to scope the connection to a specific
+                        organization. Required when `connection_owner` is
+                        `organization`.
+                      example: org_01EHZNVPK3SFK441A1RGBFSHRT
+                    connection_owner:
+                      type: string
+                      enum:
+                        - user
+                        - organization
+                      description: >-
+                        Whose connection to create or rotate. `user` (the
+                        default) addresses the connection owned by `user_id`.
+                        `organization` addresses the connection shared by every
+                        member of `organization_id`; `user_id` then identifies
+                        the member performing the request and must be an active
+                        member of the organization.
+                      example: user
+                    client_id:
+                      type: string
+                      minLength: 1
+                      description: The OAuth client ID to store for this integration.
+                      example: 3MVG9...
+                    client_secret:
+                      type: string
+                      minLength: 1
+                      description: The OAuth client secret to store for this integration.
+                      example: shhh-secret
+                    config:
+                      type: object
+                      additionalProperties:
+                        type: string
+                      description: >-
+                        Provider-specific configuration values collected for
+                        this installation, keyed by the provider's config field
+                        descriptors.
+                      example: *ref_1
+                    connection_intent:
+                      type: string
+                      description: >-
+                        Reauthorize exactly the connection named by
+                        `connected_account_id`.
+                      example: reauthorize
+                      const: reauthorize
+                    connected_account_id:
+                      type: string
+                      pattern: ^data_installation_.+$
+                      description: >-
+                        The exact connected account to reauthorize. Required
+                        with `connection_intent: reauthorize`.
+                      example: data_installation_01EHZNVPK3SFK441A1RGBFSHRT
+                  required:
+                    - user_id
+                    - client_id
+                    - client_secret
+                    - connection_intent
+                    - connected_account_id
+                  additionalProperties: false
+                - type: object
+                  properties:
+                    user_id:
+                      type: string
+                      description: A [User](/reference/authkit/user) identifier.
+                      example: user_01EHZNVPK3SFK441A1RGBFSHRT
+                    organization_id:
+                      type: string
+                      description: >-
+                        An [Organization](/reference/organization) identifier.
+                        Optional parameter to scope the connection to a specific
+                        organization. Required when `connection_owner` is
+                        `organization`.
+                      example: org_01EHZNVPK3SFK441A1RGBFSHRT
+                    connection_owner:
+                      type: string
+                      enum:
+                        - user
+                        - organization
+                      description: >-
+                        Whose connection to create or rotate. `user` (the
+                        default) addresses the connection owned by `user_id`.
+                        `organization` addresses the connection shared by every
+                        member of `organization_id`; `user_id` then identifies
+                        the member performing the request and must be an active
+                        member of the organization.
+                      example: user
+                    client_id:
+                      type: string
+                      minLength: 1
+                      description: The OAuth client ID to store for this integration.
+                      example: 3MVG9...
+                    client_secret:
+                      type: string
+                      minLength: 1
+                      description: The OAuth client secret to store for this integration.
+                      example: shhh-secret
+                    config:
+                      type: object
+                      additionalProperties:
+                        type: string
+                      description: >-
+                        Provider-specific configuration values collected for
+                        this installation, keyed by the provider's config field
+                        descriptors.
+                      example: *ref_1
+                    connected_account_id:
+                      type: string
+                      pattern: ^data_installation_.+$
+                      description: >-
+                        The exact connected account to reauthorize. The
+                        reauthorize intent may be omitted for compatibility.
+                      example: data_installation_01EHZNVPK3SFK441A1RGBFSHRT
+                  required:
+                    - user_id
+                    - client_id
+                    - client_secret
+                    - connected_account_id
+                  additionalProperties: false
       responses:
         '200':
           description: The resulting connected account after the upsert.
@@ -13733,7 +14048,7 @@ paths:
       summary: Set Retention
       tags:
         - audit-logs
-      x-mutually-exclusive-body-groups: &ref_4
+      x-mutually-exclusive-body-groups: &ref_5
         retention:
           optional: false
           variants:
@@ -15045,8 +15360,10 @@ paths:
       description: >-
         Imports an organization-owned [connected
         account](/reference/pipes/connected-account) by providing OAuth tokens
-        directly. Use this to migrate existing connections or set up connections
-        without going through the OAuth flow.
+        directly. Omit `connection_intent` to create only the compatibility
+        connection, or set it to `add` to explicitly create another connection.
+        This creation-only endpoint does not accept `connected_account_id` or
+        reauthorization intent.
       operationId: >-
         DataIntegrationsOrganizationController_createOrganizationDataInstallation
       parameters:
@@ -15071,7 +15388,7 @@ paths:
         content:
           application/json:
             schema:
-              $ref: '#/components/schemas/OrganizationConnectedAccountDto'
+              $ref: '#/components/schemas/CreateOrganizationConnectedAccountDto'
       responses:
         '201':
           description: The connected account was created successfully.
@@ -15129,8 +15446,8 @@ paths:
                   - message
         '409':
           description: >-
-            A connected account already exists for this organization and
-            integration.
+            The compatibility connection already exists for this organization
+            and integration.
           content:
             application/json:
               schema:
@@ -15205,6 +15522,27 @@ paths:
                       - code
                       - message
                       - errors
+        '503':
+          description: >-
+            Another connection is being created for this owner and provider.
+            Retry the request.
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code:
+                    type: string
+                    description: The error code identifying the type of error.
+                    example: concurrent_request
+                    const: concurrent_request
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: Request could not be processed.
+                required:
+                  - code
+                  - message
       summary: Import an organization connected account
       tags:
         - organizations.data-providers
@@ -15237,8 +15575,9 @@ paths:
           required: false
           in: query
           description: >-
-            Set to `true` to use the plural connection contract. When omitted or
-            `false`, only the compatibility connection is considered.
+            Accepted for compatibility; does not change update targeting. Omit
+            intent and selector to update the compatibility connection, or
+            supply `connected_account_id` to update an exact connection.
           schema:
             example: true
             type: boolean
@@ -15252,6 +15591,17 @@ paths:
             minLength: 1
             example: data_installation_01EHZNVPK3SFK441A1RGBFSHRT
             type: string
+        - name: connection_intent
+          required: false
+          in: query
+          description: >-
+            Set to `reauthorize` with `connected_account_id` to update one exact
+            connection. The intent may be omitted when supplying an ID. Omit
+            both for permanent compatibility behavior.
+          schema:
+            type: string
+            example: reauthorize
+            const: reauthorize
       requestBody:
         required: true
         content:
@@ -15434,7 +15784,7 @@ paths:
                     credentialsType: oauth2
                     createdAt: '2024-01-15T10:30:00.000Z'
                     updatedAt: '2024-01-15T10:30:00.000Z'
-                    connected_account: &ref_1
+                    connected_account: &ref_2
                       object: connected_account
                       id: data_installation_01EHZNVPK3SFK441A1RGBFSHRT
                       user_id: null
@@ -15459,7 +15809,7 @@ paths:
                       createdAt: '2024-01-16T14:20:00.000Z'
                       updatedAt: '2024-01-16T14:20:00.000Z'
                     connected_accounts:
-                      - *ref_1
+                      - *ref_2
         '401':
           description: The request is missing a valid API key.
         '404':
@@ -20357,7 +20707,7 @@ paths:
       summary: Create an organization membership
       tags:
         - user-management.organization-membership
-      x-mutually-exclusive-body-groups: &ref_18
+      x-mutually-exclusive-body-groups: &ref_19
         role:
           optional: true
           variants:
@@ -20541,7 +20891,7 @@ paths:
       summary: Update an organization membership
       tags:
         - user-management.organization-membership
-      x-mutually-exclusive-body-groups: &ref_19
+      x-mutually-exclusive-body-groups: &ref_20
         role:
           optional: true
           variants:
@@ -21861,7 +22211,7 @@ paths:
       summary: Create a user
       tags:
         - user-management.users
-      x-mutually-exclusive-body-groups: &ref_20
+      x-mutually-exclusive-body-groups: &ref_21
         password:
           optional: true
           variants:
@@ -22154,7 +22504,7 @@ paths:
       summary: Update a user
       tags:
         - user-management.users
-      x-mutually-exclusive-body-groups: &ref_24
+      x-mutually-exclusive-body-groups: &ref_25
         password:
           optional: true
           variants:
@@ -23833,7 +24183,7 @@ paths:
         content:
           application/json:
             schema:
-              $ref: '#/components/schemas/ConnectedAccountDto'
+              $ref: '#/components/schemas/CreateConnectedAccountDto'
       responses:
         '201':
           description: The connected account was created successfully.
@@ -23938,8 +24288,9 @@ paths:
                       - errors
         '503':
           description: >-
-            The WorkOS OAuth grant behind `refresh_token` is being changed by
-            another request. Retry the request.
+            Another connection is being created for this owner and provider, or
+            the WorkOS OAuth grant behind `refresh_token` is being changed.
+            Retry the request.
           content:
             application/json:
               schema:
@@ -23995,8 +24346,9 @@ paths:
           required: false
           in: query
           description: >-
-            Set to `true` to use the plural connection contract. When omitted or
-            `false`, only the compatibility connection is considered.
+            Accepted for compatibility; does not change update targeting. Omit
+            intent and selector to update the compatibility connection, or
+            supply `connected_account_id` to update an exact connection.
           schema:
             example: true
             type: boolean
@@ -24010,6 +24362,17 @@ paths:
             minLength: 1
             example: data_installation_01EHZNVPK3SFK441A1RGBFSHRT
             type: string
+        - name: connection_intent
+          required: false
+          in: query
+          description: >-
+            Set to `reauthorize` with `connected_account_id` to update one exact
+            connection. The intent may be omitted when supplying an ID. Omit
+            both for permanent compatibility behavior.
+          schema:
+            type: string
+            example: reauthorize
+            const: reauthorize
       requestBody:
         required: true
         content:
@@ -26094,7 +26457,7 @@ components:
           example: An application for managing user access
         scopes:
           description: The OAuth scopes granted to the application.
-          example: &ref_2
+          example: &ref_3
             - openid
             - profile
             - email
@@ -26156,7 +26519,7 @@ components:
           example: An application for managing user access
         scopes:
           description: The OAuth scopes granted to the application.
-          example: *ref_2
+          example: *ref_3
           type:
             - array
             - 'null'
@@ -26229,7 +26592,7 @@ components:
             owner: user_01GBTCQ2
           maxProperties: 50
           additionalProperties: false
-          patternProperties: &ref_3
+          patternProperties: &ref_4
             ^[a-zA-Z0-9_-]{0,40}$:
               anyOf:
                 - type: string
@@ -26261,7 +26624,7 @@ components:
             owner: user_01GBTCQ2
           maxProperties: 50
           additionalProperties: false
-          patternProperties: *ref_3
+          patternProperties: *ref_4
       required:
         - id
         - type
@@ -26308,7 +26671,7 @@ components:
             owner: user_01GBTCQ2
           maxProperties: 50
           additionalProperties: false
-          patternProperties: *ref_3
+          patternProperties: *ref_4
         version:
           type: integer
           description: What schema version the event is associated with.
@@ -26390,7 +26753,7 @@ components:
         - range_start
         - range_end
     UpdateAuditLogsRetentionDto:
-      x-mutually-exclusive-body-groups: *ref_4
+      x-mutually-exclusive-body-groups: *ref_5
       oneOf:
         - type: object
           properties:
@@ -26575,7 +26938,7 @@ components:
                         x-exclude-from-lint: true
                     required:
                       - resource_id
-      x-mutually-exclusive-body-groups: *ref_5
+      x-mutually-exclusive-body-groups: *ref_6
     CreateGroupRoleAssignmentDto:
       type: object
       properties:
@@ -26716,7 +27079,7 @@ components:
                         x-exclude-from-lint: true
                     required:
                       - resource_id
-      x-mutually-exclusive-body-groups: *ref_6
+      x-mutually-exclusive-body-groups: *ref_7
     RemoveRoleDto:
       allOf:
         - type: object
@@ -26775,7 +27138,7 @@ components:
                         x-exclude-from-lint: true
                     required:
                       - resource_id
-      x-mutually-exclusive-body-groups: *ref_7
+      x-mutually-exclusive-body-groups: *ref_8
     SetRolePermissionsDto:
       type: object
       properties:
@@ -27125,7 +27488,7 @@ components:
                         x-exclude-from-lint: true
                     required:
                       - parent_resource_id
-      x-mutually-exclusive-body-groups: *ref_8
+      x-mutually-exclusive-body-groups: *ref_9
     CreateConnectionKeyPairDto:
       type: object
       properties:
@@ -27243,7 +27606,7 @@ components:
           default: true
         token_authentication_method:
           type: string
-          enum: &ref_10
+          enum: &ref_11
             - client_secret_post
             - client_secret_basic
             - private_key_jwt
@@ -27259,7 +27622,7 @@ components:
           $ref: '#/components/schemas/CreateConnectionKeyPairDto'
         id_token_signature_algorithm:
           type: string
-          enum: &ref_11
+          enum: &ref_12
             - ES256
             - ES384
             - ES512
@@ -27415,7 +27778,7 @@ components:
                         x-exclude-from-lint: true
                     required:
                       - saml_options
-      x-mutually-exclusive-body-groups: *ref_9
+      x-mutually-exclusive-body-groups: *ref_10
     PatchConnectionSamlOptionsDto:
       type: object
       properties:
@@ -27491,7 +27854,7 @@ components:
           example: true
         token_authentication_method:
           type: string
-          enum: *ref_10
+          enum: *ref_11
           description: >-
             The token-endpoint client authentication method. Moving to
             `private_key_jwt` generates a signing key pair if the connection has
@@ -27501,7 +27864,7 @@ components:
           example: client_secret_basic
         id_token_signature_algorithm:
           type: string
-          enum: *ref_11
+          enum: *ref_12
           description: The ID-token signing algorithm.
           example: RS256
         fetch_user_info:
@@ -27645,7 +28008,7 @@ components:
                         x-exclude-from-lint: true
                     required:
                       - saml_options
-      x-mutually-exclusive-body-groups: *ref_12
+      x-mutually-exclusive-body-groups: *ref_13
     CreateCorsOriginDto:
       type: object
       properties:
@@ -27827,11 +28190,11 @@ components:
           type:
             - object
             - 'null'
-          additionalProperties: &ref_13
+          additionalProperties: &ref_14
             type: string
             maxLength: 600
           maxProperties: 50
-          example: &ref_14
+          example: &ref_15
             tier: diamond
           description: >-
             Object containing [metadata](/authkit/metadata) key/value pairs
@@ -27886,9 +28249,9 @@ components:
           type:
             - object
             - 'null'
-          additionalProperties: *ref_13
+          additionalProperties: *ref_14
           maxProperties: 50
-          example: *ref_14
+          example: *ref_15
           description: >-
             Object containing [metadata](/authkit/metadata) key/value pairs
             associated with the Organization.
@@ -28022,7 +28385,7 @@ components:
           example: application/x-www-form-urlencoded
         authenticate_via:
           type: string
-          enum: &ref_15
+          enum: &ref_16
             - request_body
             - basic_auth_header
           description: >-
@@ -28190,7 +28553,7 @@ components:
           example: application/x-www-form-urlencoded
         authenticate_via:
           type: string
-          enum: *ref_15
+          enum: *ref_16
           description: >-
             How client credentials are sent when exchanging authorization codes
             and refreshing tokens.
@@ -28236,7 +28599,7 @@ components:
             Updates to a custom provider's OAuth definition. Only valid for
             custom-provider integrations.
           $ref: '#/components/schemas/UpdateCustomProviderDefinitionDto'
-    OrganizationConnectedAccountDto:
+    CreateOrganizationConnectedAccountDto:
       type: object
       properties:
         access_token:
@@ -28256,7 +28619,7 @@ components:
           format: date-time
         scopes:
           description: The OAuth scopes granted for this connection.
-          example: &ref_16
+          example: &ref_17
             - repo
             - user:email
           type: array
@@ -28264,7 +28627,7 @@ components:
             type: string
         state:
           type: string
-          enum: &ref_17
+          enum: &ref_18
             - connected
             - needs_reauthorization
           description: >-
@@ -28278,8 +28641,93 @@ components:
             member on whose behalf the connected account is being imported or
             updated. The user must be an active member of the organization.
           example: user_01EHZNVPK3SFK441A1RGBFSHRT
+        connection_intent:
+          type: string
+          description: >-
+            Set to `add` to create another connected account. Omit this field
+            for permanent compatibility behavior.
+          example: add
+          const: add
+      required:
+        - user_id
+    OrganizationConnectedAccountDto:
+      type: object
+      properties:
+        access_token:
+          type: string
+          description: The OAuth access token for the connected account.
+          example: gho_16C7e42F292c6912E7710c838347Ae178B4a
+        refresh_token:
+          type: string
+          description: The OAuth refresh token for the connected account.
+          example: ghr_xxxxxxxxxxxxxxxxxxxx
+        expires_at:
+          type: string
+          description: >-
+            The ISO-8601 timestamp when the access token expires. Required when
+            `access_token` is provided for tokens that expire.
+          example: '2025-12-31T23:59:59.000Z'
+          format: date-time
+        scopes:
+          description: The OAuth scopes granted for this connection.
+          example: *ref_17
+          type: array
+          items:
+            type: string
+        state:
+          type: string
+          enum: *ref_18
+          description: >-
+            Explicitly set the state of the connected account. When omitted, the
+            state is derived from the token combination provided.
+          example: connected
+        user_id:
+          type: string
+          description: >-
+            The [User](/reference/authkit/user) identifier of the organization
+            member on whose behalf the connected account is being imported or
+            updated. The user must be an active member of the organization.
+          example: user_01EHZNVPK3SFK441A1RGBFSHRT
       required:
         - user_id
+    CreateConnectedAccountDto:
+      type: object
+      properties:
+        access_token:
+          type: string
+          description: The OAuth access token for the connected account.
+          example: gho_16C7e42F292c6912E7710c838347Ae178B4a
+        refresh_token:
+          type: string
+          description: The OAuth refresh token for the connected account.
+          example: ghr_xxxxxxxxxxxxxxxxxxxx
+        expires_at:
+          type: string
+          description: >-
+            The ISO-8601 timestamp when the access token expires. Required when
+            `access_token` is provided for tokens that expire.
+          example: '2025-12-31T23:59:59.000Z'
+          format: date-time
+        scopes:
+          description: The OAuth scopes granted for this connection.
+          example: *ref_17
+          type: array
+          items:
+            type: string
+        state:
+          type: string
+          enum: *ref_18
+          description: >-
+            Explicitly set the state of the connected account. When omitted, the
+            state is derived from the token combination provided.
+          example: connected
+        connection_intent:
+          type: string
+          description: >-
+            Set to `add` to create another connected account. Omit this field
+            for permanent compatibility behavior.
+          example: add
+          const: add
     ConnectedAccountDto:
       type: object
       properties:
@@ -28300,13 +28748,13 @@ components:
           format: date-time
         scopes:
           description: The OAuth scopes granted for this connection.
-          example: *ref_16
+          example: *ref_17
           type: array
           items:
             type: string
         state:
           type: string
-          enum: *ref_17
+          enum: *ref_18
           description: >-
             Explicitly set the state of the connected account. When omitted, the
             state is derived from the token combination provided.
@@ -28816,9 +29264,9 @@ components:
                         x-exclude-from-lint: true
                     required:
                       - role_slug
-      x-mutually-exclusive-body-groups: *ref_18
-    UpdateUserlandUserOrganizationMembershipDto:
       x-mutually-exclusive-body-groups: *ref_19
+    UpdateUserlandUserOrganizationMembershipDto:
+      x-mutually-exclusive-body-groups: *ref_20
       oneOf:
         - type: object
           not:
@@ -28942,9 +29390,9 @@ components:
               type:
                 - object
                 - 'null'
-              additionalProperties: *ref_13
+              additionalProperties: *ref_14
               maxProperties: 50
-              example: &ref_21
+              example: &ref_22
                 timezone: America/New_York
               description: >-
                 Object containing metadata key/value pairs associated with the
@@ -29043,7 +29491,7 @@ components:
                   example: $2a$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy
                 password_hash_type:
                   type: string
-                  enum: &ref_22
+                  enum: &ref_23
                     - bcrypt
                     - firebase-scrypt
                     - ssha
@@ -29058,7 +29506,7 @@ components:
                   example: bcrypt
                 password_salt_position:
                   type: string
-                  enum: &ref_23
+                  enum: &ref_24
                     - prefix
                     - suffix
                   description: >-
@@ -29079,7 +29527,7 @@ components:
                         x-exclude-from-lint: true
                     required:
                       - password
-      x-mutually-exclusive-body-groups: *ref_20
+      x-mutually-exclusive-body-groups: *ref_21
     UpdateUserlandUserDto:
       allOf:
         - type: object
@@ -29109,9 +29557,9 @@ components:
               type:
                 - object
                 - 'null'
-              additionalProperties: *ref_13
+              additionalProperties: *ref_14
               maxProperties: 50
-              example: *ref_21
+              example: *ref_22
               description: >-
                 Object containing metadata key/value pairs associated with the
                 user.
@@ -29193,7 +29641,7 @@ components:
                   example: $2a$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy
                 password_hash_type:
                   type: string
-                  enum: *ref_22
+                  enum: *ref_23
                   description: >-
                     The algorithm originally used to hash the password, used
                     when providing a `password_hash`. Required with
@@ -29201,7 +29649,7 @@ components:
                   example: bcrypt
                 password_salt_position:
                   type: string
-                  enum: *ref_23
+                  enum: *ref_24
                   description: >-
                     The position of the salt relative to the password when the
                     `password_hash` digest was computed: `prefix` for `hash(salt
@@ -29220,7 +29668,7 @@ components:
                         x-exclude-from-lint: true
                     required:
                       - password
-      x-mutually-exclusive-body-groups: *ref_24
+      x-mutually-exclusive-body-groups: *ref_25
     VerifyEmailAddressDto:
       type: object
       properties:
@@ -29329,7 +29777,7 @@ components:
           description: The events that the Webhook Endpoint is subscribed to.
           items:
             type: string
-            enum: &ref_25
+            enum: &ref_26
               - agent.blueprint.created
               - agent.blueprint.deleted
               - agent.blueprint.updated
@@ -29460,7 +29908,7 @@ components:
           description: The events that the Webhook Endpoint is subscribed to.
           items:
             type: string
-            enum: *ref_25
+            enum: *ref_26
           example:
             - user.created
             - dsync.user.created
@@ -33135,7 +33583,7 @@ components:
           description: >-
             An object containing the custom attribute mapping for the Directory
             Provider.
-          example: &ref_32
+          example: &ref_33
             department: Engineering
             job_title: Software Engineer
         role:
@@ -33374,7 +33822,7 @@ components:
               type: object
               additionalProperties: {}
               description: The event payload.
-              example: &ref_26
+              example: &ref_27
                 id: directory_user_01E1JG7J09H96KYP8HM9B0G5SJ
                 directory_id: directory_01ECAZ4NV9QMV47GW873HDCX74
                 organization_id: org_01EZTR6WYX1A0DSE2CYMGXQ24Y
@@ -33409,11 +33857,11 @@ components:
             - data
             - created_at
           description: An event emitted by WorkOS.
-          example: &ref_37
+          example: &ref_38
             object: event
             id: event_01EHZNVPK3SFK441A1RGBFSHRT
             event: dsync.user.created
-            data: *ref_26
+            data: *ref_27
             created_at: '2021-06-25T19:07:33.155Z'
             context: {}
         - oneOf:
@@ -33613,7 +34061,7 @@ components:
                       description: >-
                         Permission slugs forming the ceiling on what sessions
                         minted from this blueprint may do.
-                      example: &ref_27
+                      example: &ref_28
                         - crm:read
                         - email:send
                     invocable_by:
@@ -33626,7 +34074,7 @@ components:
                           description: >-
                             Role slugs whose members may mint user-delegated
                             sessions from this blueprint.
-                          example: &ref_28
+                          example: &ref_29
                             - manager
                         organization_ids:
                           type: array
@@ -33635,7 +34083,7 @@ components:
                           description: >-
                             Organizations in which autonomous sessions may be
                             minted from this blueprint.
-                          example: &ref_29
+                          example: &ref_30
                             - org_01EHWNCE74X7JSDV0X3SZ3KJNY
                       required:
                         - role_slugs
@@ -33655,7 +34103,7 @@ components:
                             Instance types that may be minted from this
                             blueprint: `delegated` (acting for a user) and/or
                             `autonomous` (acting as the agent itself).
-                          example: &ref_30
+                          example: &ref_31
                             - delegated
                             - autonomous
                       required:
@@ -33815,7 +34263,7 @@ components:
                       description: >-
                         Permission slugs forming the ceiling on what sessions
                         minted from this blueprint may do.
-                      example: *ref_27
+                      example: *ref_28
                     invocable_by:
                       type: object
                       properties:
@@ -33826,7 +34274,7 @@ components:
                           description: >-
                             Role slugs whose members may mint user-delegated
                             sessions from this blueprint.
-                          example: *ref_28
+                          example: *ref_29
                         organization_ids:
                           type: array
                           items:
@@ -33834,7 +34282,7 @@ components:
                           description: >-
                             Organizations in which autonomous sessions may be
                             minted from this blueprint.
-                          example: *ref_29
+                          example: *ref_30
                       required:
                         - role_slugs
                         - organization_ids
@@ -33853,7 +34301,7 @@ components:
                             Instance types that may be minted from this
                             blueprint: `delegated` (acting for a user) and/or
                             `autonomous` (acting as the agent itself).
-                          example: *ref_30
+                          example: *ref_31
                       required:
                         - instance_types
                       description: How sessions may be minted from this blueprint.
@@ -34889,7 +35337,7 @@ components:
                       items:
                         type: string
                       description: The permissions granted to the API key.
-                      example: &ref_31
+                      example: &ref_32
                         - users:read
                         - users:write
                     created_at:
@@ -35015,7 +35463,7 @@ components:
                       items:
                         type: string
                       description: The permissions granted to the API key.
-                      example: *ref_31
+                      example: *ref_32
                     created_at:
                       type: string
                       description: The timestamp when the API key was created.
@@ -35139,7 +35587,7 @@ components:
                       items:
                         type: string
                       description: The permissions granted to the API key.
-                      example: *ref_31
+                      example: *ref_32
                     created_at:
                       type: string
                       description: The timestamp when the API key was created.
@@ -38006,7 +38454,7 @@ components:
                       description: >-
                         An object containing the custom attribute mapping for
                         the Directory Provider.
-                      example: *ref_32
+                      example: *ref_33
                     role:
                       $ref: '#/components/schemas/SlimRole'
                     roles:
@@ -38196,7 +38644,7 @@ components:
                       description: >-
                         Labels assigned to the Feature Flag for categorizing and
                         filtering.
-                      example: &ref_33
+                      example: &ref_34
                         - reports
                     enabled:
                       type: boolean
@@ -38357,7 +38805,7 @@ components:
                       description: >-
                         Labels assigned to the Feature Flag for categorizing and
                         filtering.
-                      example: *ref_33
+                      example: *ref_34
                     enabled:
                       type: boolean
                       description: >-
@@ -38517,7 +38965,7 @@ components:
                       description: >-
                         Labels assigned to the Feature Flag for categorizing and
                         filtering.
-                      example: *ref_33
+                      example: *ref_34
                     enabled:
                       type: boolean
                       description: >-
@@ -38797,7 +39245,7 @@ components:
                       description: >-
                         Labels assigned to the Feature Flag for categorizing and
                         filtering.
-                      example: *ref_33
+                      example: *ref_34
                     enabled:
                       type: boolean
                       description: >-
@@ -39785,7 +40233,7 @@ components:
                       description: >-
                         Object containing [metadata](/authkit/metadata)
                         key/value pairs associated with the Organization.
-                      example: &ref_34
+                      example: &ref_35
                         tier: diamond
                       propertyNames:
                         maxLength: 40
@@ -39935,7 +40383,7 @@ components:
                       description: >-
                         Object containing [metadata](/authkit/metadata)
                         key/value pairs associated with the Organization.
-                      example: *ref_34
+                      example: *ref_35
                       propertyNames:
                         maxLength: 40
                       maxProperties: 50
@@ -40762,7 +41210,7 @@ components:
                       items:
                         type: string
                       description: The permissions granted by the role.
-                      example: &ref_35
+                      example: &ref_36
                         - users:read
                         - users:write
                     created_at:
@@ -40846,7 +41294,7 @@ components:
                       items:
                         type: string
                       description: The permissions granted by the role.
-                      example: *ref_35
+                      example: *ref_36
                     created_at:
                       format: date-time
                       type: string
@@ -40928,7 +41376,7 @@ components:
                       items:
                         type: string
                       description: The permissions granted by the role.
-                      example: *ref_35
+                      example: *ref_36
                     created_at:
                       format: date-time
                       type: string
@@ -41065,7 +41513,7 @@ components:
                       description: >-
                         Object containing [metadata](/authkit/metadata)
                         key/value pairs associated with the Organization.
-                      example: *ref_34
+                      example: *ref_35
                       propertyNames:
                         maxLength: 40
                       maxProperties: 50
@@ -42261,7 +42709,7 @@ components:
                       items:
                         type: string
                       description: The permissions granted by the role.
-                      example: &ref_36
+                      example: &ref_37
                         - users:read
                         - users:write
                     created_at:
@@ -42327,7 +42775,7 @@ components:
                       items:
                         type: string
                       description: The permissions granted by the role.
-                      example: *ref_36
+                      example: *ref_37
                     created_at:
                       format: date-time
                       type: string
@@ -42391,7 +42839,7 @@ components:
                       items:
                         type: string
                       description: The permissions granted by the role.
-                      example: *ref_36
+                      example: *ref_37
                     created_at:
                       format: date-time
                       type: string
@@ -43231,6 +43679,68 @@ components:
                 - data
                 - created_at
                 - object
+            - type: object
+              properties:
+                id:
+                  type: string
+                  description: Unique identifier for the event.
+                  example: event_01EHZNVPK3SFK441A1RGBFSHRT
+                event:
+                  type: string
+                  const: vault.dek.rekeyed
+                data:
+                  type: object
+                  properties:
+                    actor_id:
+                      type: string
+                      description: The unique identifier of the actor.
+                      example: user_01EHWNCE74X7JSDV0X3SZ3KJNY
+                    actor_source:
+                      type: string
+                      enum:
+                        - api
+                        - dashboard
+                    actor_name:
+                      type: string
+                      description: The name of the actor.
+                      example: Jane Doe
+                    key_ids:
+                      type: array
+                      items:
+                        type: string
+                      description: >-
+                        The unique identifiers of the re-encrypted data
+                        encryption keys.
+                      example:
+                        - dek_01EHWNCE74X7JSDV0X3SZ3KJNY
+                    key_context:
+                      type: object
+                      additionalProperties:
+                        type: string
+                  required:
+                    - actor_id
+                    - actor_source
+                    - actor_name
+                    - key_ids
+                    - key_context
+                  description: The event payload.
+                created_at:
+                  format: date-time
+                  type: string
+                  description: An ISO 8601 timestamp.
+                  example: '2026-01-15T12:00:00.000Z'
+                context:
+                  $ref: '#/components/schemas/EventContextDto'
+                object:
+                  type: string
+                  description: Distinguishes the Event object.
+                  const: event
+              required:
+                - id
+                - event
+                - data
+                - created_at
+                - object
             - type: object
               properties:
                 id:
@@ -43531,7 +44041,7 @@ components:
                 - data
                 - created_at
                 - object
-      example: *ref_37
+      example: *ref_38
       description: An event emitted by WorkOS.
     EventList:
       type: object
@@ -43566,7 +44076,7 @@ components:
       example:
         object: list
         data:
-          - *ref_37
+          - *ref_38
         list_metadata:
           after: event_01EHZNVPK3SFK441A1RGBFSHRT
     JwtTemplate:
@@ -45527,7 +46037,7 @@ components:
                         items:
                           type: string
                         description: The OAuth scopes granted for this connection.
-                        example: &ref_38
+                        example: &ref_39
                           - repo
                           - user:email
                       auth_method:
@@ -45577,7 +46087,7 @@ components:
                           `installation` scope, excluding any it declares as
                           secret. Only present when `auth_method` is
                           `client_credentials`.
-                        example: &ref_39
+                        example: &ref_40
                           instance_url: https://example.my.salesforce.com
                       state:
                         type: string
@@ -45706,7 +46216,7 @@ components:
                       items:
                         type: string
                       description: The OAuth scopes granted for this connection.
-                      example: *ref_38
+                      example: *ref_39
                     auth_method:
                       type: string
                       enum:
@@ -45753,7 +46263,7 @@ components:
                         `installation` scope, excluding any it declares as
                         secret. Only present when `auth_method` is
                         `client_credentials`.
-                      example: *ref_39
+                      example: *ref_40
                     state:
                       type: string
                       enum: