@workos/openapi-spec 0.110.0 → 0.112.0

package/dist/open-api-spec.yaml

@@ -4365,6 +4365,7 @@ paths:
                 source:
                   type: direct
                   group_role_assignment_id: null
+                  group: null
                 created_at: '2026-01-15T12:00:00.000Z'
                 updated_at: '2026-01-15T12:00:00.000Z'
           description: Created
@@ -11512,6 +11513,14 @@ paths:
         Returns credentials for a user's connected account. Branches on the
         installation's `auth_method`: OAuth installations return an access token
         (refreshed if needed); API-key installations return the stored secret.
+        Every active credential includes `config`: provider-declared, non-secret
+        values from the installation snapshot, with current provider defaults
+        for unset fields. Editing integration or organization configuration does
+        not change the snapshot; reconnect or explicitly rebind the connection
+        to adopt those edits. Defaults remain live, so a changed default can
+        appear in `config` before a cached token is refreshed or re-minted.
+        Credentials that never refresh require a reconnect or rebind when a
+        default changes their routing.
       operationId: DataIntegrationsController_vendCredentials
       parameters:
         - name: slug
@@ -11592,6 +11601,7 @@ paths:
                     - repo
                     - user:email
                   missing_scopes: []
+                  config: {}
         '400':
           description: Bad Request
           content:
@@ -32231,9 +32241,28 @@ components:
                 The ID of the group role assignment the role was derived from,
                 or null if direct.
               example: null
+            group:
+              description: The group the role was derived from, or null if direct.
+              example: null
+              oneOf:
+                - type: object
+                  properties:
+                    id:
+                      type: string
+                      description: The unique ID of the Group the role was derived from.
+                      example: group_01HXYZ123456789ABCDEFGHIJ
+                    name:
+                      type: string
+                      description: The name of the Group the role was derived from.
+                      example: Marketing team
+                  required:
+                    - id
+                    - name
+                - type: 'null'
           required:
             - type
             - group_role_assignment_id
+            - group
           description: The origin of the role assignment.
         created_at:
           format: date-time
@@ -45571,6 +45600,22 @@ components:
                 the access token, they're listed here. Present for `oauth` and
                 `client_credentials` credentials; absent for `api_key`.
               example: []
+            config:
+              type: object
+              additionalProperties:
+                type: string
+              description: >-
+                Provider-declared, non-secret config from the installation
+                snapshot, with current defaults for unset fields. Includes both
+                integration- and installation-scope fields; omits undeclared
+                fields and fields marked secret. Use these values to address a
+                per-tenant host, such as Snowflake's `account` or Zendesk's
+                `subdomain`. Empty when no values are disclosable. Changes to
+                integration or organization pins require reconnecting or
+                explicitly rebinding the connection. Defaults are live and can
+                differ from a cached token's audience until refresh or re-mint.
+              example: &ref_39
+                account: myorg-myaccount
           required:
             - object
             - auth_method
@@ -45578,6 +45623,7 @@ components:
             - expires_at
             - scopes
             - missing_scopes
+            - config
         - type: object
           properties:
             object:
@@ -45599,10 +45645,26 @@ components:
               format: password
               description: The API key secret.
               example: sk-1234567890abcdef
+            config:
+              type: object
+              additionalProperties:
+                type: string
+              description: >-
+                Provider-declared, non-secret config from the installation
+                snapshot, with current defaults for unset fields. Includes both
+                integration- and installation-scope fields; omits undeclared
+                fields and fields marked secret. Use these values to address a
+                per-tenant host, such as Snowflake's `account` or Zendesk's
+                `subdomain`. Empty when no values are disclosable. Changes to
+                integration or organization pins require reconnecting or
+                explicitly rebinding the connection. Defaults are live and can
+                differ from a cached token's audience until refresh or re-mint.
+              example: *ref_39
           required:
             - object
             - auth_method
             - value
+            - config
         - type: object
           properties:
             object:
@@ -45660,6 +45722,21 @@ components:
                 provider. Only present for `client_credentials` credentials.
               example:
                 instance_url: https://acme.my.salesforce.com
+            config:
+              type: object
+              additionalProperties:
+                type: string
+              description: >-
+                Provider-declared, non-secret config from the installation
+                snapshot, with current defaults for unset fields. Includes both
+                integration- and installation-scope fields; omits undeclared
+                fields and fields marked secret. Use these values to address a
+                per-tenant host, such as Snowflake's `account` or Zendesk's
+                `subdomain`. Empty when no values are disclosable. Changes to
+                integration or organization pins require reconnecting or
+                explicitly rebinding the connection. Defaults are live and can
+                differ from a cached token's audience until refresh or re-mint.
+              example: *ref_39
           required:
             - object
             - auth_method
@@ -45668,6 +45745,7 @@ components:
             - scopes
             - missing_scopes
             - metadata
+            - config
     DataIntegrationCredentialsResponse:
       oneOf:
         - type: object
@@ -46038,7 +46116,7 @@ components:
                         items:
                           type: string
                         description: The OAuth scopes granted for this connection.
-                        example: &ref_39
+                        example: &ref_40
                           - repo
                           - user:email
                       auth_method:
@@ -46088,7 +46166,7 @@ components:
                           `installation` scope, excluding any it declares as
                           secret. Only present when `auth_method` is
                           `client_credentials`.
-                        example: &ref_40
+                        example: &ref_41
                           instance_url: https://example.my.salesforce.com
                       state:
                         type: string
@@ -46217,7 +46295,7 @@ components:
                       items:
                         type: string
                       description: The OAuth scopes granted for this connection.
-                      example: *ref_39
+                      example: *ref_40
                     auth_method:
                       type: string
                       enum:
@@ -46264,7 +46342,7 @@ components:
                         `installation` scope, excluding any it declares as
                         secret. Only present when `auth_method` is
                         `client_credentials`.
-                      example: *ref_40
+                      example: *ref_41
                     state:
                       type: string
                       enum:

package/dist/types.d.ts

@@ -1532,7 +1532,7 @@ export interface paths {
         put?: never;
         /**
          * Vend credentials for a connected account
-         * @description Returns credentials for a user's connected account. Branches on the installation's `auth_method`: OAuth installations return an access token (refreshed if needed); API-key installations return the stored secret.
+         * @description Returns credentials for a user's connected account. Branches on the installation's `auth_method`: OAuth installations return an access token (refreshed if needed); API-key installations return the stored secret. Every active credential includes `config`: provider-declared, non-secret values from the installation snapshot, with current provider defaults for unset fields. Editing integration or organization configuration does not change the snapshot; reconnect or explicitly rebind the connection to adopt those edits. Defaults remain live, so a changed default can appear in `config` before a cached token is refreshed or re-minted. Credentials that never refresh require a reconnect or rebind when a default changes their routing.
          */
         post: operations["DataIntegrationsController_vendCredentials"];
         delete?: never;
@@ -8051,6 +8051,22 @@ export interface components {
                  * @example null
                  */
                 group_role_assignment_id: string | null;
+                /**
+                 * @description The group the role was derived from, or null if direct.
+                 * @example null
+                 */
+                group: {
+                    /**
+                     * @description The unique ID of the Group the role was derived from.
+                     * @example group_01HXYZ123456789ABCDEFGHIJ
+                     */
+                    id: string;
+                    /**
+                     * @description The name of the Group the role was derived from.
+                     * @example Marketing team
+                     */
+                    name: string;
+                } | null;
             };
             /**
              * Format: date-time
@@ -18267,6 +18283,15 @@ export interface components {
              * @example []
              */
             missing_scopes: string[];
+            /**
+             * @description Provider-declared, non-secret config from the installation snapshot, with current defaults for unset fields. Includes both integration- and installation-scope fields; omits undeclared fields and fields marked secret. Use these values to address a per-tenant host, such as Snowflake's `account` or Zendesk's `subdomain`. Empty when no values are disclosable. Changes to integration or organization pins require reconnecting or explicitly rebinding the connection. Defaults are live and can differ from a cached token's audience until refresh or re-mint.
+             * @example {
+             *       "account": "myorg-myaccount"
+             *     }
+             */
+            config: {
+                [key: string]: string;
+            };
         } | {
             /**
              * @description Distinguishes the credential object.
@@ -18284,6 +18309,15 @@ export interface components {
              * @example sk-1234567890abcdef
              */
             value: string;
+            /**
+             * @description Provider-declared, non-secret config from the installation snapshot, with current defaults for unset fields. Includes both integration- and installation-scope fields; omits undeclared fields and fields marked secret. Use these values to address a per-tenant host, such as Snowflake's `account` or Zendesk's `subdomain`. Empty when no values are disclosable. Changes to integration or organization pins require reconnecting or explicitly rebinding the connection. Defaults are live and can differ from a cached token's audience until refresh or re-mint.
+             * @example {
+             *       "account": "myorg-myaccount"
+             *     }
+             */
+            config: {
+                [key: string]: string;
+            };
         } | {
             /**
              * @description Distinguishes the credential object.
@@ -18327,6 +18361,15 @@ export interface components {
             metadata: {
                 [key: string]: unknown;
             };
+            /**
+             * @description Provider-declared, non-secret config from the installation snapshot, with current defaults for unset fields. Includes both integration- and installation-scope fields; omits undeclared fields and fields marked secret. Use these values to address a per-tenant host, such as Snowflake's `account` or Zendesk's `subdomain`. Empty when no values are disclosable. Changes to integration or organization pins require reconnecting or explicitly rebinding the connection. Defaults are live and can differ from a cached token's audience until refresh or re-mint.
+             * @example {
+             *       "account": "myorg-myaccount"
+             *     }
+             */
+            config: {
+                [key: string]: string;
+            };
         };
         DataIntegrationCredentialsResponse: {
             /**
@@ -23811,7 +23854,8 @@ export interface operations {
                      *       },
                      *       "source": {
                      *         "type": "direct",
-                     *         "group_role_assignment_id": null
+                     *         "group_role_assignment_id": null,
+                     *         "group": null
                      *       },
                      *       "created_at": "2026-01-15T12:00:00.000Z",
                      *       "updated_at": "2026-01-15T12:00:00.000Z"
@@ -30342,7 +30386,8 @@ export interface operations {
                      *           "repo",
                      *           "user:email"
                      *         ],
-                     *         "missing_scopes": []
+                     *         "missing_scopes": [],
+                     *         "config": {}
                      *       }
                      *     }
                      */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@workos/openapi-spec",
-  "version": "0.110.0",
+  "version": "0.112.0",
   "type": "module",
   "description": "WorkOS OpenAPI specification, TypeScript types, and SDK resolution policy",
   "license": "MIT",