@workos/openapi-spec 0.106.0 → 0.108.0

package/dist/types.d.ts

@@ -2236,7 +2236,7 @@ export interface paths {
         put: operations["DataIntegrationsOrganizationController_updateOrganizationDataInstallation"];
         /**
          * Import an organization connected account
-         * @description Imports an organization-owned [connected account](/reference/pipes/connected-account) by providing OAuth tokens directly. Use this to migrate existing connections or set up connections without going through the OAuth flow.
+         * @description Imports an organization-owned [connected account](/reference/pipes/connected-account) by providing OAuth tokens directly. Omit `connection_intent` to create only the compatibility connection, or set it to `add` to explicitly create another connection. This creation-only endpoint does not accept `connected_account_id` or reauthorization intent.
          */
         post: operations["DataIntegrationsOrganizationController_createOrganizationDataInstallation"];
         /**
@@ -5529,6 +5529,49 @@ export interface components {
             /** @description Updates to a custom provider's OAuth definition. Only valid for custom-provider integrations. */
             custom_provider?: components["schemas"]["UpdateCustomProviderDefinitionDto"];
         };
+        CreateOrganizationConnectedAccountDto: {
+            /**
+             * @description The OAuth access token for the connected account.
+             * @example gho_16C7e42F292c6912E7710c838347Ae178B4a
+             */
+            access_token?: string;
+            /**
+             * @description The OAuth refresh token for the connected account.
+             * @example ghr_xxxxxxxxxxxxxxxxxxxx
+             */
+            refresh_token?: string;
+            /**
+             * Format: date-time
+             * @description The ISO-8601 timestamp when the access token expires. Required when `access_token` is provided for tokens that expire.
+             * @example 2025-12-31T23:59:59.000Z
+             */
+            expires_at?: string;
+            /**
+             * @description The OAuth scopes granted for this connection.
+             * @example [
+             *       "repo",
+             *       "user:email"
+             *     ]
+             */
+            scopes?: string[];
+            /**
+             * @description Explicitly set the state of the connected account. When omitted, the state is derived from the token combination provided.
+             * @example connected
+             * @enum {string}
+             */
+            state?: "connected" | "needs_reauthorization";
+            /**
+             * @description The [User](/reference/authkit/user) identifier of the organization member on whose behalf the connected account is being imported or updated. The user must be an active member of the organization.
+             * @example user_01EHZNVPK3SFK441A1RGBFSHRT
+             */
+            user_id: string;
+            /**
+             * @description Set to `add` to create another connected account. Omit this field for permanent compatibility behavior.
+             * @example add
+             * @constant
+             */
+            connection_intent?: "add";
+        };
         OrganizationConnectedAccountDto: {
             /**
              * @description The OAuth access token for the connected account.
@@ -5566,6 +5609,44 @@ export interface components {
              */
             user_id: string;
         };
+        CreateConnectedAccountDto: {
+            /**
+             * @description The OAuth access token for the connected account.
+             * @example gho_16C7e42F292c6912E7710c838347Ae178B4a
+             */
+            access_token?: string;
+            /**
+             * @description The OAuth refresh token for the connected account.
+             * @example ghr_xxxxxxxxxxxxxxxxxxxx
+             */
+            refresh_token?: string;
+            /**
+             * Format: date-time
+             * @description The ISO-8601 timestamp when the access token expires. Required when `access_token` is provided for tokens that expire.
+             * @example 2025-12-31T23:59:59.000Z
+             */
+            expires_at?: string;
+            /**
+             * @description The OAuth scopes granted for this connection.
+             * @example [
+             *       "repo",
+             *       "user:email"
+             *     ]
+             */
+            scopes?: string[];
+            /**
+             * @description Explicitly set the state of the connected account. When omitted, the state is derived from the token combination provided.
+             * @example connected
+             * @enum {string}
+             */
+            state?: "connected" | "needs_reauthorization";
+            /**
+             * @description Set to `add` to create another connected account. Omit this field for permanent compatibility behavior.
+             * @example add
+             * @constant
+             */
+            connection_intent?: "add";
+        };
         ConnectedAccountDto: {
             /**
              * @description The OAuth access token for the connected account.
@@ -16796,6 +16877,51 @@ export interface components {
              * @constant
              */
             object: "event";
+        } | {
+            /**
+             * @description Unique identifier for the event.
+             * @example event_01EHZNVPK3SFK441A1RGBFSHRT
+             */
+            id: string;
+            /** @constant */
+            event: "vault.dek.rekeyed";
+            /** @description The event payload. */
+            data: {
+                /**
+                 * @description The unique identifier of the actor.
+                 * @example user_01EHWNCE74X7JSDV0X3SZ3KJNY
+                 */
+                actor_id: string;
+                /** @enum {string} */
+                actor_source: "api" | "dashboard";
+                /**
+                 * @description The name of the actor.
+                 * @example Jane Doe
+                 */
+                actor_name: string;
+                /**
+                 * @description The unique identifiers of the re-encrypted data encryption keys.
+                 * @example [
+                 *       "dek_01EHWNCE74X7JSDV0X3SZ3KJNY"
+                 *     ]
+                 */
+                key_ids: string[];
+                key_context: {
+                    [key: string]: string;
+                };
+            };
+            /**
+             * Format: date-time
+             * @description An ISO 8601 timestamp.
+             * @example 2026-01-15T12:00:00.000Z
+             */
+            created_at: string;
+            context?: components["schemas"]["EventContextDto"];
+            /**
+             * @description Distinguishes the Event object.
+             * @constant
+             */
+            object: "event";
         } | {
             /**
              * @description Unique identifier for the event.
@@ -29568,10 +29694,88 @@ export interface operations {
                      */
                     organization_id?: string;
                     /**
-                     * @description A [connected account](/reference/pipes/connected-account) identifier. Use this to rotate a specific existing connection.
+                     * @description Whose connection to create or rotate. `user` (the default) addresses the connection owned by `user_id`. `organization` addresses the connection shared by every member of `organization_id`; `user_id` then identifies the member performing the request and must be an active member of the organization.
+                     * @example user
+                     * @enum {string}
+                     */
+                    connection_owner?: "user" | "organization";
+                    /**
+                     * @description The API key secret to store for this integration.
+                     * @example sk-1234567890abcdef
+                     */
+                    secret: string;
+                } | {
+                    /**
+                     * @description A [User](/reference/authkit/user) identifier.
+                     * @example user_01EHZNVPK3SFK441A1RGBFSHRT
+                     */
+                    user_id: string;
+                    /**
+                     * @description An [Organization](/reference/organization) identifier. Optional parameter to scope the connection to a specific organization. Required when `connection_owner` is `organization`.
+                     * @example org_01EHZNVPK3SFK441A1RGBFSHRT
+                     */
+                    organization_id?: string;
+                    /**
+                     * @description Whose connection to create or rotate. `user` (the default) addresses the connection owned by `user_id`. `organization` addresses the connection shared by every member of `organization_id`; `user_id` then identifies the member performing the request and must be an active member of the organization.
+                     * @example user
+                     * @enum {string}
+                     */
+                    connection_owner?: "user" | "organization";
+                    /**
+                     * @description The API key secret to store for this integration.
+                     * @example sk-1234567890abcdef
+                     */
+                    secret: string;
+                    /**
+                     * @description Create another connection. The first connection for an owner shape fills the compatibility slot; later connections are standard.
+                     * @example add
+                     * @constant
+                     */
+                    connection_intent: "add";
+                } | {
+                    /**
+                     * @description A [User](/reference/authkit/user) identifier.
+                     * @example user_01EHZNVPK3SFK441A1RGBFSHRT
+                     */
+                    user_id: string;
+                    /**
+                     * @description An [Organization](/reference/organization) identifier. Optional parameter to scope the connection to a specific organization. Required when `connection_owner` is `organization`.
+                     * @example org_01EHZNVPK3SFK441A1RGBFSHRT
+                     */
+                    organization_id?: string;
+                    /**
+                     * @description Whose connection to create or rotate. `user` (the default) addresses the connection owned by `user_id`. `organization` addresses the connection shared by every member of `organization_id`; `user_id` then identifies the member performing the request and must be an active member of the organization.
+                     * @example user
+                     * @enum {string}
+                     */
+                    connection_owner?: "user" | "organization";
+                    /**
+                     * @description The API key secret to store for this integration.
+                     * @example sk-1234567890abcdef
+                     */
+                    secret: string;
+                    /**
+                     * @description Reauthorize exactly the connection named by `connected_account_id`.
+                     * @example reauthorize
+                     * @constant
+                     */
+                    connection_intent: "reauthorize";
+                    /**
+                     * @description The exact connected account to reauthorize. Required with `connection_intent: reauthorize`.
                      * @example data_installation_01EHZNVPK3SFK441A1RGBFSHRT
                      */
-                    connected_account_id?: string;
+                    connected_account_id: string;
+                } | {
+                    /**
+                     * @description A [User](/reference/authkit/user) identifier.
+                     * @example user_01EHZNVPK3SFK441A1RGBFSHRT
+                     */
+                    user_id: string;
+                    /**
+                     * @description An [Organization](/reference/organization) identifier. Optional parameter to scope the connection to a specific organization. Required when `connection_owner` is `organization`.
+                     * @example org_01EHZNVPK3SFK441A1RGBFSHRT
+                     */
+                    organization_id?: string;
                     /**
                      * @description Whose connection to create or rotate. `user` (the default) addresses the connection owned by `user_id`. `organization` addresses the connection shared by every member of `organization_id`; `user_id` then identifies the member performing the request and must be an active member of the organization.
                      * @example user
@@ -29583,6 +29787,11 @@ export interface operations {
                      * @example sk-1234567890abcdef
                      */
                     secret: string;
+                    /**
+                     * @description The exact connected account to reauthorize. The reauthorize intent may be omitted for compatibility.
+                     * @example data_installation_01EHZNVPK3SFK441A1RGBFSHRT
+                     */
+                    connected_account_id: string;
                 };
             };
         };
@@ -29820,10 +30029,130 @@ export interface operations {
                      */
                     organization_id?: string;
                     /**
-                     * @description A [connected account](/reference/pipes/connected-account) identifier. Use this to rotate a specific existing connection.
+                     * @description Whose connection to create or rotate. `user` (the default) addresses the connection owned by `user_id`. `organization` addresses the connection shared by every member of `organization_id`; `user_id` then identifies the member performing the request and must be an active member of the organization.
+                     * @example user
+                     * @enum {string}
+                     */
+                    connection_owner?: "user" | "organization";
+                    /**
+                     * @description The OAuth client ID to store for this integration.
+                     * @example 3MVG9...
+                     */
+                    client_id: string;
+                    /**
+                     * @description The OAuth client secret to store for this integration.
+                     * @example shhh-secret
+                     */
+                    client_secret: string;
+                    /**
+                     * @description Provider-specific configuration values collected for this installation, keyed by the provider's config field descriptors.
+                     * @example {
+                     *       "salesforce_host": "acme.my.salesforce.com"
+                     *     }
+                     */
+                    config?: {
+                        [key: string]: string;
+                    };
+                } | {
+                    /**
+                     * @description A [User](/reference/authkit/user) identifier.
+                     * @example user_01EHZNVPK3SFK441A1RGBFSHRT
+                     */
+                    user_id: string;
+                    /**
+                     * @description An [Organization](/reference/organization) identifier. Optional parameter to scope the connection to a specific organization. Required when `connection_owner` is `organization`.
+                     * @example org_01EHZNVPK3SFK441A1RGBFSHRT
+                     */
+                    organization_id?: string;
+                    /**
+                     * @description Whose connection to create or rotate. `user` (the default) addresses the connection owned by `user_id`. `organization` addresses the connection shared by every member of `organization_id`; `user_id` then identifies the member performing the request and must be an active member of the organization.
+                     * @example user
+                     * @enum {string}
+                     */
+                    connection_owner?: "user" | "organization";
+                    /**
+                     * @description The OAuth client ID to store for this integration.
+                     * @example 3MVG9...
+                     */
+                    client_id: string;
+                    /**
+                     * @description The OAuth client secret to store for this integration.
+                     * @example shhh-secret
+                     */
+                    client_secret: string;
+                    /**
+                     * @description Provider-specific configuration values collected for this installation, keyed by the provider's config field descriptors.
+                     * @example {
+                     *       "salesforce_host": "acme.my.salesforce.com"
+                     *     }
+                     */
+                    config?: {
+                        [key: string]: string;
+                    };
+                    /**
+                     * @description Create another connection. The first connection for an owner shape fills the compatibility slot; later connections are standard.
+                     * @example add
+                     * @constant
+                     */
+                    connection_intent: "add";
+                } | {
+                    /**
+                     * @description A [User](/reference/authkit/user) identifier.
+                     * @example user_01EHZNVPK3SFK441A1RGBFSHRT
+                     */
+                    user_id: string;
+                    /**
+                     * @description An [Organization](/reference/organization) identifier. Optional parameter to scope the connection to a specific organization. Required when `connection_owner` is `organization`.
+                     * @example org_01EHZNVPK3SFK441A1RGBFSHRT
+                     */
+                    organization_id?: string;
+                    /**
+                     * @description Whose connection to create or rotate. `user` (the default) addresses the connection owned by `user_id`. `organization` addresses the connection shared by every member of `organization_id`; `user_id` then identifies the member performing the request and must be an active member of the organization.
+                     * @example user
+                     * @enum {string}
+                     */
+                    connection_owner?: "user" | "organization";
+                    /**
+                     * @description The OAuth client ID to store for this integration.
+                     * @example 3MVG9...
+                     */
+                    client_id: string;
+                    /**
+                     * @description The OAuth client secret to store for this integration.
+                     * @example shhh-secret
+                     */
+                    client_secret: string;
+                    /**
+                     * @description Provider-specific configuration values collected for this installation, keyed by the provider's config field descriptors.
+                     * @example {
+                     *       "salesforce_host": "acme.my.salesforce.com"
+                     *     }
+                     */
+                    config?: {
+                        [key: string]: string;
+                    };
+                    /**
+                     * @description Reauthorize exactly the connection named by `connected_account_id`.
+                     * @example reauthorize
+                     * @constant
+                     */
+                    connection_intent: "reauthorize";
+                    /**
+                     * @description The exact connected account to reauthorize. Required with `connection_intent: reauthorize`.
                      * @example data_installation_01EHZNVPK3SFK441A1RGBFSHRT
                      */
-                    connected_account_id?: string;
+                    connected_account_id: string;
+                } | {
+                    /**
+                     * @description A [User](/reference/authkit/user) identifier.
+                     * @example user_01EHZNVPK3SFK441A1RGBFSHRT
+                     */
+                    user_id: string;
+                    /**
+                     * @description An [Organization](/reference/organization) identifier. Optional parameter to scope the connection to a specific organization. Required when `connection_owner` is `organization`.
+                     * @example org_01EHZNVPK3SFK441A1RGBFSHRT
+                     */
+                    organization_id?: string;
                     /**
                      * @description Whose connection to create or rotate. `user` (the default) addresses the connection owned by `user_id`. `organization` addresses the connection shared by every member of `organization_id`; `user_id` then identifies the member performing the request and must be an active member of the organization.
                      * @example user
@@ -29849,6 +30178,11 @@ export interface operations {
                     config?: {
                         [key: string]: string;
                     };
+                    /**
+                     * @description The exact connected account to reauthorize. The reauthorize intent may be omitted for compatibility.
+                     * @example data_installation_01EHZNVPK3SFK441A1RGBFSHRT
+                     */
+                    connected_account_id: string;
                 };
             };
         };
@@ -33342,10 +33676,12 @@ export interface operations {
     DataIntegrationsOrganizationController_updateOrganizationDataInstallation: {
         parameters: {
             query?: {
-                /** @description Set to `true` to use the plural connection contract. When omitted or `false`, only the compatibility connection is considered. */
+                /** @description Accepted for compatibility; does not change update targeting. Omit intent and selector to update the compatibility connection, or supply `connected_account_id` to update an exact connection. */
                 supports_multiple_connections?: boolean;
                 /** @description A [connected account](/reference/pipes/connected-account) identifier. Use this to select the connection to update. */
                 connected_account_id?: string;
+                /** @description Set to `reauthorize` with `connected_account_id` to update one exact connection. The intent may be omitted when supplying an ID. Omit both for permanent compatibility behavior. */
+                connection_intent?: "reauthorize";
             };
             header?: never;
             path: {
@@ -33507,7 +33843,7 @@ export interface operations {
         };
         requestBody: {
             content: {
-                "application/json": components["schemas"]["OrganizationConnectedAccountDto"];
+                "application/json": components["schemas"]["CreateOrganizationConnectedAccountDto"];
             };
         };
         responses: {
@@ -33582,7 +33918,7 @@ export interface operations {
                     };
                 };
             };
-            /** @description A connected account already exists for this organization and integration. */
+            /** @description The compatibility connection already exists for this organization and integration. */
             409: {
                 headers: {
                     [name: string]: unknown;
@@ -33643,6 +33979,27 @@ export interface operations {
                     };
                 };
             };
+            /** @description Another connection is being created for this owner and provider. Retry the request. */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example concurrent_request
+                         * @constant
+                         */
+                        code: "concurrent_request";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    };
+                };
+            };
         };
     };
     DataIntegrationsOrganizationController_deleteOrganizationDataInstallation: {
@@ -40889,10 +41246,12 @@ export interface operations {
             query?: {
                 /** @description An [Organization](/reference/organization) identifier. Optional parameter if the connection is scoped to an organization. */
                 organization_id?: string;
-                /** @description Set to `true` to use the plural connection contract. When omitted or `false`, only the compatibility connection is considered. */
+                /** @description Accepted for compatibility; does not change update targeting. Omit intent and selector to update the compatibility connection, or supply `connected_account_id` to update an exact connection. */
                 supports_multiple_connections?: boolean;
                 /** @description A [connected account](/reference/pipes/connected-account) identifier. Use this to select the connection to update. */
                 connected_account_id?: string;
+                /** @description Set to `reauthorize` with `connected_account_id` to update one exact connection. The intent may be omitted when supplying an ID. Omit both for permanent compatibility behavior. */
+                connection_intent?: "reauthorize";
             };
             header?: never;
             path: {
@@ -41050,7 +41409,7 @@ export interface operations {
         };
         requestBody: {
             content: {
-                "application/json": components["schemas"]["ConnectedAccountDto"];
+                "application/json": components["schemas"]["CreateConnectedAccountDto"];
             };
         };
         responses: {
@@ -41146,7 +41505,7 @@ export interface operations {
                     };
                 };
             };
-            /** @description The WorkOS OAuth grant behind `refresh_token` is being changed by another request. Retry the request. */
+            /** @description Another connection is being created for this owner and provider, or the WorkOS OAuth grant behind `refresh_token` is being changed. Retry the request. */
             503: {
                 headers: {
                     [name: string]: unknown;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@workos/openapi-spec",
-  "version": "0.106.0",
+  "version": "0.108.0",
   "type": "module",
   "description": "WorkOS OpenAPI specification, TypeScript types, and SDK resolution policy",
   "license": "MIT",