@workos/openapi-spec 0.107.0 → 0.109.0

package/dist/open-api-spec.yaml

@@ -43679,6 +43679,68 @@ components:
                 - data
                 - created_at
                 - object
+            - type: object
+              properties:
+                id:
+                  type: string
+                  description: Unique identifier for the event.
+                  example: event_01EHZNVPK3SFK441A1RGBFSHRT
+                event:
+                  type: string
+                  const: vault.dek.rekeyed
+                data:
+                  type: object
+                  properties:
+                    actor_id:
+                      type: string
+                      description: The unique identifier of the actor.
+                      example: user_01EHWNCE74X7JSDV0X3SZ3KJNY
+                    actor_source:
+                      type: string
+                      enum:
+                        - api
+                        - dashboard
+                    actor_name:
+                      type: string
+                      description: The name of the actor.
+                      example: Jane Doe
+                    key_ids:
+                      type: array
+                      items:
+                        type: string
+                      description: >-
+                        The unique identifiers of the re-encrypted data
+                        encryption keys.
+                      example:
+                        - dek_01EHWNCE74X7JSDV0X3SZ3KJNY
+                    key_context:
+                      type: object
+                      additionalProperties:
+                        type: string
+                  required:
+                    - actor_id
+                    - actor_source
+                    - actor_name
+                    - key_ids
+                    - key_context
+                  description: The event payload.
+                created_at:
+                  format: date-time
+                  type: string
+                  description: An ISO 8601 timestamp.
+                  example: '2026-01-15T12:00:00.000Z'
+                context:
+                  $ref: '#/components/schemas/EventContextDto'
+                object:
+                  type: string
+                  description: Distinguishes the Event object.
+                  const: event
+              required:
+                - id
+                - event
+                - data
+                - created_at
+                - object
             - type: object
               properties:
                 id:
@@ -45439,109 +45501,161 @@ components:
       required:
         - code
         - message
-    DataIntegrationCredentialsResponse:
+    DataIntegrationVendedCredential:
+      discriminator:
+        propertyName: auth_method
       oneOf:
         - type: object
           properties:
-            active:
-              type: boolean
-              description: Indicates credentials are available.
-              const: true
-            credential:
-              type: object
-              properties:
-                object:
-                  type: string
-                  description: Distinguishes the credential object.
-                  const: credential
-                auth_method:
-                  type: string
-                  description: >-
-                    The authentication method for this credential. Additional
-                    values may be added in the future; handle unknown values
-                    gracefully.
-                  x-extensible-enum:
-                    - oauth
-                    - api_key
-                    - client_credentials
-                  const: oauth
-                value:
-                  type: string
-                  format: password
-                  description: The OAuth access token.
-                  example: gho_16C7e42F292c6912E7710c838347Ae178B4a
-                expires_at:
-                  type:
-                    - string
-                    - 'null'
-                  description: >-
-                    The ISO-8601 formatted timestamp indicating when the
-                    credential expires.
-                  example: '2025-12-31T23:59:59.000Z'
-                scopes:
-                  type: array
-                  items:
-                    type: string
-                  description: The scopes granted to the access token.
-                  example:
-                    - repo
-                    - user:email
-                missing_scopes:
-                  type: array
-                  items:
-                    type: string
-                  description: >-
-                    If the integration has requested scopes that aren't present
-                    on the access token, they're listed here.
-                  example: []
-              required:
-                - object
-                - auth_method
-                - value
-                - expires_at
-                - scopes
-                - missing_scopes
-              description: The credential object containing the vended secret.
+            object:
+              type: string
+              description: Distinguishes the credential object.
+              const: credential
+            auth_method:
+              type: string
+              description: >-
+                The authentication method for this credential. Additional values
+                may be added in the future; handle unknown values gracefully.
+              x-extensible-enum:
+                - oauth
+                - api_key
+                - client_credentials
+              const: oauth
+            value:
+              type: string
+              format: password
+              description: >-
+                The vended secret. An OAuth access token when `auth_method` is
+                `oauth`, the API key when `api_key`, or the client-credentials
+                access token when `client_credentials`.
+              example: gho_16C7e42F292c6912E7710c838347Ae178B4a
+            expires_at:
+              type:
+                - string
+                - 'null'
+              description: >-
+                The ISO-8601 formatted timestamp indicating when the credential
+                expires, or `null` if it does not expire. Present for `oauth`
+                and `client_credentials` credentials; absent for `api_key`.
+              example: '2025-12-31T23:59:59.000Z'
+            scopes:
+              type: array
+              items:
+                type: string
+              description: >-
+                The scopes granted to the access token. Present for `oauth` and
+                `client_credentials` credentials; absent for `api_key`.
+              example:
+                - repo
+                - user:email
+            missing_scopes:
+              type: array
+              items:
+                type: string
+              description: >-
+                If the integration has requested scopes that aren't present on
+                the access token, they're listed here. Present for `oauth` and
+                `client_credentials` credentials; absent for `api_key`.
+              example: []
           required:
-            - active
-            - credential
+            - object
+            - auth_method
+            - value
+            - expires_at
+            - scopes
+            - missing_scopes
         - type: object
           properties:
-            active:
-              type: boolean
-              description: Indicates credentials are available.
-              const: true
-            credential:
+            object:
+              type: string
+              description: Distinguishes the credential object.
+              const: credential
+            auth_method:
+              type: string
+              description: >-
+                The authentication method for this credential. Additional values
+                may be added in the future; handle unknown values gracefully.
+              x-extensible-enum:
+                - oauth
+                - api_key
+                - client_credentials
+              const: api_key
+            value:
+              type: string
+              format: password
+              description: The API key secret.
+              example: sk-1234567890abcdef
+          required:
+            - object
+            - auth_method
+            - value
+        - type: object
+          properties:
+            object:
+              type: string
+              description: Distinguishes the credential object.
+              const: credential
+            auth_method:
+              type: string
+              description: >-
+                The authentication method for this credential. Additional values
+                may be added in the future; handle unknown values gracefully.
+              x-extensible-enum:
+                - oauth
+                - api_key
+                - client_credentials
+              const: client_credentials
+            value:
+              type: string
+              format: password
+              description: The client-credentials access token.
+              example: 00D5g000000XXXX!AQEAQ...
+            expires_at:
+              type:
+                - string
+                - 'null'
+              description: >-
+                The ISO-8601 formatted timestamp indicating when the credential
+                expires.
+              example: '2025-12-31T23:59:59.000Z'
+            scopes:
+              type: array
+              items:
+                type: string
+              description: The scopes granted to the access token.
+              example:
+                - api
+            missing_scopes:
+              type: array
+              items:
+                type: string
+              description: >-
+                If the integration has requested scopes that aren't present on
+                the access token, they're listed here. The scopes granted to a
+                client-credentials token are governed by the connected
+                organization's client application, so the integration's
+                configured scopes are requests or defaults rather than
+                guarantees.
+              example: []
+            metadata:
               type: object
-              properties:
-                object:
-                  type: string
-                  description: Distinguishes the credential object.
-                  const: credential
-                auth_method:
-                  type: string
-                  description: >-
-                    The authentication method for this credential. Additional
-                    values may be added in the future; handle unknown values
-                    gracefully.
-                  x-extensible-enum:
-                    - oauth
-                    - api_key
-                    - client_credentials
-                  const: api_key
-                value:
-                  type: string
-                  format: password
-                  description: The API key secret.
-                  example: sk-1234567890abcdef
-              required:
-                - object
-                - auth_method
-                - value
-              description: The credential object containing the vended secret.
+              additionalProperties: {}
+              description: >-
+                Non-sensitive fields captured from the provider token response
+                (e.g. Salesforce `instance_url`), as configured for the
+                provider. Only present for `client_credentials` credentials.
+              example:
+                instance_url: https://acme.my.salesforce.com
           required:
-            - active
-            - credential
+            - object
+            - auth_method
+            - value
+            - expires_at
+            - scopes
+            - missing_scopes
+            - metadata
+    DataIntegrationCredentialsResponse:
+      oneOf:
         - type: object
           properties:
             active:
@@ -45549,72 +45663,7 @@ components:
               description: Indicates credentials are available.
               const: true
             credential:
-              type: object
-              properties:
-                object:
-                  type: string
-                  description: Distinguishes the credential object.
-                  const: credential
-                auth_method:
-                  type: string
-                  description: >-
-                    The authentication method for this credential. Additional
-                    values may be added in the future; handle unknown values
-                    gracefully.
-                  x-extensible-enum:
-                    - oauth
-                    - api_key
-                    - client_credentials
-                  const: client_credentials
-                value:
-                  type: string
-                  format: password
-                  description: The client-credentials access token.
-                  example: 00D5g000000XXXX!AQEAQ...
-                expires_at:
-                  type:
-                    - string
-                    - 'null'
-                  description: >-
-                    The ISO-8601 formatted timestamp indicating when the
-                    credential expires.
-                  example: '2025-12-31T23:59:59.000Z'
-                scopes:
-                  type: array
-                  items:
-                    type: string
-                  description: The scopes granted to the access token.
-                  example:
-                    - api
-                missing_scopes:
-                  type: array
-                  items:
-                    type: string
-                  description: >-
-                    If the integration has requested scopes that aren't present
-                    on the access token, they're listed here. The scopes granted
-                    to a client-credentials token are governed by the connected
-                    organization's client application, so the integration's
-                    configured scopes are requests or defaults rather than
-                    guarantees.
-                  example: []
-                metadata:
-                  type: object
-                  additionalProperties: {}
-                  description: >-
-                    Non-sensitive fields captured from the provider token
-                    response (e.g. Salesforce `instance_url`), as configured for
-                    the provider.
-                  example:
-                    instance_url: https://acme.my.salesforce.com
-              required:
-                - object
-                - auth_method
-                - value
-                - expires_at
-                - scopes
-                - missing_scopes
-                - metadata
+              $ref: '#/components/schemas/DataIntegrationVendedCredential'
               description: The credential object containing the vended secret.
           required:
             - active

package/dist/types.d.ts

@@ -16877,6 +16877,51 @@ export interface components {
              * @constant
              */
             object: "event";
+        } | {
+            /**
+             * @description Unique identifier for the event.
+             * @example event_01EHZNVPK3SFK441A1RGBFSHRT
+             */
+            id: string;
+            /** @constant */
+            event: "vault.dek.rekeyed";
+            /** @description The event payload. */
+            data: {
+                /**
+                 * @description The unique identifier of the actor.
+                 * @example user_01EHWNCE74X7JSDV0X3SZ3KJNY
+                 */
+                actor_id: string;
+                /** @enum {string} */
+                actor_source: "api" | "dashboard";
+                /**
+                 * @description The name of the actor.
+                 * @example Jane Doe
+                 */
+                actor_name: string;
+                /**
+                 * @description The unique identifiers of the re-encrypted data encryption keys.
+                 * @example [
+                 *       "dek_01EHWNCE74X7JSDV0X3SZ3KJNY"
+                 *     ]
+                 */
+                key_ids: string[];
+                key_context: {
+                    [key: string]: string;
+                };
+            };
+            /**
+             * Format: date-time
+             * @description An ISO 8601 timestamp.
+             * @example 2026-01-15T12:00:00.000Z
+             */
+            created_at: string;
+            context?: components["schemas"]["EventContextDto"];
+            /**
+             * @description Distinguishes the Event object.
+             * @constant
+             */
+            object: "event";
         } | {
             /**
              * @description Unique identifier for the event.
@@ -18187,125 +18232,110 @@ export interface components {
              */
             message: string;
         };
-        DataIntegrationCredentialsResponse: {
+        DataIntegrationVendedCredential: {
             /**
-             * @description Indicates credentials are available.
+             * @description Distinguishes the credential object.
              * @constant
              */
-            active: true;
-            /** @description The credential object containing the vended secret. */
-            credential: {
-                /**
-                 * @description Distinguishes the credential object.
-                 * @constant
-                 */
-                object: "credential";
-                /**
-                 * @description The authentication method for this credential. Additional values may be added in the future; handle unknown values gracefully.
-                 * @constant
-                 */
-                auth_method: "oauth";
-                /**
-                 * Format: password
-                 * @description The OAuth access token.
-                 * @example gho_16C7e42F292c6912E7710c838347Ae178B4a
-                 */
-                value: string;
-                /**
-                 * @description The ISO-8601 formatted timestamp indicating when the credential expires.
-                 * @example 2025-12-31T23:59:59.000Z
-                 */
-                expires_at: string | null;
-                /**
-                 * @description The scopes granted to the access token.
-                 * @example [
-                 *       "repo",
-                 *       "user:email"
-                 *     ]
-                 */
-                scopes: string[];
-                /**
-                 * @description If the integration has requested scopes that aren't present on the access token, they're listed here.
-                 * @example []
-                 */
-                missing_scopes: string[];
-            };
+            object: "credential";
+            /**
+             * @description The authentication method for this credential. Additional values may be added in the future; handle unknown values gracefully.
+             * @constant
+             */
+            auth_method: "oauth";
+            /**
+             * Format: password
+             * @description The vended secret. An OAuth access token when `auth_method` is `oauth`, the API key when `api_key`, or the client-credentials access token when `client_credentials`.
+             * @example gho_16C7e42F292c6912E7710c838347Ae178B4a
+             */
+            value: string;
+            /**
+             * @description The ISO-8601 formatted timestamp indicating when the credential expires, or `null` if it does not expire. Present for `oauth` and `client_credentials` credentials; absent for `api_key`.
+             * @example 2025-12-31T23:59:59.000Z
+             */
+            expires_at: string | null;
+            /**
+             * @description The scopes granted to the access token. Present for `oauth` and `client_credentials` credentials; absent for `api_key`.
+             * @example [
+             *       "repo",
+             *       "user:email"
+             *     ]
+             */
+            scopes: string[];
+            /**
+             * @description If the integration has requested scopes that aren't present on the access token, they're listed here. Present for `oauth` and `client_credentials` credentials; absent for `api_key`.
+             * @example []
+             */
+            missing_scopes: string[];
         } | {
             /**
-             * @description Indicates credentials are available.
+             * @description Distinguishes the credential object.
              * @constant
              */
-            active: true;
-            /** @description The credential object containing the vended secret. */
-            credential: {
-                /**
-                 * @description Distinguishes the credential object.
-                 * @constant
-                 */
-                object: "credential";
-                /**
-                 * @description The authentication method for this credential. Additional values may be added in the future; handle unknown values gracefully.
-                 * @constant
-                 */
-                auth_method: "api_key";
-                /**
-                 * Format: password
-                 * @description The API key secret.
-                 * @example sk-1234567890abcdef
-                 */
-                value: string;
-            };
+            object: "credential";
+            /**
+             * @description The authentication method for this credential. Additional values may be added in the future; handle unknown values gracefully.
+             * @constant
+             */
+            auth_method: "api_key";
+            /**
+             * Format: password
+             * @description The API key secret.
+             * @example sk-1234567890abcdef
+             */
+            value: string;
         } | {
+            /**
+             * @description Distinguishes the credential object.
+             * @constant
+             */
+            object: "credential";
+            /**
+             * @description The authentication method for this credential. Additional values may be added in the future; handle unknown values gracefully.
+             * @constant
+             */
+            auth_method: "client_credentials";
+            /**
+             * Format: password
+             * @description The client-credentials access token.
+             * @example 00D5g000000XXXX!AQEAQ...
+             */
+            value: string;
+            /**
+             * @description The ISO-8601 formatted timestamp indicating when the credential expires.
+             * @example 2025-12-31T23:59:59.000Z
+             */
+            expires_at: string | null;
+            /**
+             * @description The scopes granted to the access token.
+             * @example [
+             *       "api"
+             *     ]
+             */
+            scopes: string[];
+            /**
+             * @description If the integration has requested scopes that aren't present on the access token, they're listed here. The scopes granted to a client-credentials token are governed by the connected organization's client application, so the integration's configured scopes are requests or defaults rather than guarantees.
+             * @example []
+             */
+            missing_scopes: string[];
+            /**
+             * @description Non-sensitive fields captured from the provider token response (e.g. Salesforce `instance_url`), as configured for the provider. Only present for `client_credentials` credentials.
+             * @example {
+             *       "instance_url": "https://acme.my.salesforce.com"
+             *     }
+             */
+            metadata: {
+                [key: string]: unknown;
+            };
+        };
+        DataIntegrationCredentialsResponse: {
             /**
              * @description Indicates credentials are available.
              * @constant
              */
             active: true;
             /** @description The credential object containing the vended secret. */
-            credential: {
-                /**
-                 * @description Distinguishes the credential object.
-                 * @constant
-                 */
-                object: "credential";
-                /**
-                 * @description The authentication method for this credential. Additional values may be added in the future; handle unknown values gracefully.
-                 * @constant
-                 */
-                auth_method: "client_credentials";
-                /**
-                 * Format: password
-                 * @description The client-credentials access token.
-                 * @example 00D5g000000XXXX!AQEAQ...
-                 */
-                value: string;
-                /**
-                 * @description The ISO-8601 formatted timestamp indicating when the credential expires.
-                 * @example 2025-12-31T23:59:59.000Z
-                 */
-                expires_at: string | null;
-                /**
-                 * @description The scopes granted to the access token.
-                 * @example [
-                 *       "api"
-                 *     ]
-                 */
-                scopes: string[];
-                /**
-                 * @description If the integration has requested scopes that aren't present on the access token, they're listed here. The scopes granted to a client-credentials token are governed by the connected organization's client application, so the integration's configured scopes are requests or defaults rather than guarantees.
-                 * @example []
-                 */
-                missing_scopes: string[];
-                /**
-                 * @description Non-sensitive fields captured from the provider token response (e.g. Salesforce `instance_url`), as configured for the provider.
-                 * @example {
-                 *       "instance_url": "https://acme.my.salesforce.com"
-                 *     }
-                 */
-                metadata: {
-                    [key: string]: unknown;
-                };
-            };
+            credential: components["schemas"]["DataIntegrationVendedCredential"];
         } | {
             /**
              * @description Indicates credentials are not available.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@workos/openapi-spec",
-  "version": "0.107.0",
+  "version": "0.109.0",
   "type": "module",
   "description": "WorkOS OpenAPI specification, TypeScript types, and SDK resolution policy",
   "license": "MIT",