@workos/openapi-spec 0.116.0 → 0.118.0

package/dist/open-api-spec.yaml

@@ -3767,7 +3767,7 @@ paths:
       summary: Check authorization
       tags:
         - authorization
-      x-mutually-exclusive-body-groups: &ref_6
+      x-mutually-exclusive-body-groups: &ref_7
         resource_target:
           optional: false
           variants:
@@ -4411,7 +4411,7 @@ paths:
       summary: Assign a role
       tags:
         - authorization
-      x-mutually-exclusive-body-groups: &ref_7
+      x-mutually-exclusive-body-groups: &ref_8
         resource_target:
           optional: false
           variants:
@@ -4482,7 +4482,7 @@ paths:
       summary: Remove a role assignment
       tags:
         - authorization
-      x-mutually-exclusive-body-groups: &ref_8
+      x-mutually-exclusive-body-groups: &ref_9
         resource_target:
           optional: false
           variants:
@@ -6905,7 +6905,7 @@ paths:
       summary: Create an authorization resource
       tags:
         - authorization
-      x-mutually-exclusive-body-groups: &ref_9
+      x-mutually-exclusive-body-groups: &ref_10
         parent_resource:
           optional: true
           variants:
@@ -9073,7 +9073,7 @@ paths:
       tags:
         - connections
       x-feature-flag: connections-api-migrations-capabilities-api
-      x-mutually-exclusive-body-groups: &ref_10
+      x-mutually-exclusive-body-groups: &ref_11
         protocol_options:
           optional: false
           variants:
@@ -10315,7 +10315,7 @@ paths:
       tags:
         - connections
       x-feature-flag: connections-api-migrations-capabilities-api
-      x-mutually-exclusive-body-groups: &ref_13
+      x-mutually-exclusive-body-groups: &ref_14
         protocol_options:
           optional: true
           variants:
@@ -11185,18 +11185,37 @@ paths:
                 required:
                   - message
         '404':
-          description: The data integration or selected connected account was not found.
+          description: >-
+            The data integration or selected connected account was not found
+            (`entity_not_found`).
           content:
             application/json:
               schema:
-                type: object
-                properties:
-                  message:
-                    type: string
-                    description: A human-readable description of the error.
-                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
-                required:
-                  - message
+                anyOf:
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: entity_not_found
+                        const: entity_not_found
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: >-
+                          Organization not found:
+                          'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                    required:
+                      - message
         '409':
           description: >-
             Several connected accounts match the connection owner for the
@@ -11238,54 +11257,187 @@ paths:
         content:
           application/json:
             schema:
-              type: object
-              properties:
-                user_id:
-                  type: string
-                  description: >-
-                    The ID of the user to authorize. When `connection_owner` is
-                    `organization`, this is the user authorizing on behalf of
-                    the organization; they must be an active member of the
-                    organization and do not become the owner of the resulting
-                    connected account.
-                  example: user_01EHZNVPK3SFK441A1RGBFSHRT
-                organization_id:
-                  type: string
-                  description: >-
-                    An organization ID to scope the authorization to a specific
-                    organization. Required when `connection_owner` is
-                    `organization`.
-                  example: org_01EHZNVPK3SFK441A1RGBFSHRT
-                connection_owner:
-                  type: string
-                  enum:
-                    - user
-                    - organization
-                  description: >-
-                    Who will own the connected account. `user` (the default)
-                    connects the user's own account. `organization` connects the
-                    organization's shared account and requires
-                    `organization_id`.
-                  example: user
-                return_to:
-                  type: string
-                  format: uri
-                  description: The URL to redirect the user to after authorization.
-                  example: https://example.com/callback
-                config:
-                  type: object
-                  additionalProperties:
-                    type: string
-                  description: >-
-                    Connect-time config values for the provider-declared
-                    `installation`-scope fields (e.g. a Zendesk `subdomain`),
-                    keyed by the config field. Only fields the provider declares
-                    may be supplied, and required fields must be provided unless
-                    already pinned on the integration.
-                  example:
-                    subdomain: acme
-              required:
-                - user_id
+              oneOf:
+                - type: object
+                  properties:
+                    user_id:
+                      type: string
+                      description: >-
+                        The ID of the user to authorize. When `connection_owner`
+                        is `organization`, this is the user authorizing on
+                        behalf of the organization; they must be an active
+                        member of the organization and do not become the owner
+                        of the resulting connected account.
+                      example: user_01EHZNVPK3SFK441A1RGBFSHRT
+                    organization_id:
+                      type: string
+                      description: >-
+                        An organization ID to scope the authorization to a
+                        specific organization. Required when `connection_owner`
+                        is `organization`.
+                      example: org_01EHZNVPK3SFK441A1RGBFSHRT
+                    connection_owner:
+                      type: string
+                      enum:
+                        - user
+                        - organization
+                      description: >-
+                        Who will own the connected account. `user` (the default)
+                        connects the user's own account. `organization` connects
+                        the organization's shared account and requires
+                        `organization_id`.
+                      example: user
+                    return_to:
+                      type: string
+                      format: uri
+                      description: The URL to redirect the user to after authorization.
+                      example: https://example.com/callback
+                    config:
+                      type: object
+                      additionalProperties:
+                        type: string
+                      description: >-
+                        Connect-time config values for the provider-declared
+                        `installation`-scope fields (e.g. a Zendesk
+                        `subdomain`), keyed by the config field. Only fields the
+                        provider declares may be supplied, and required fields
+                        must be provided unless already pinned on the
+                        integration.
+                      example: &ref_1
+                        subdomain: acme
+                  required:
+                    - user_id
+                  additionalProperties: false
+                - type: object
+                  properties:
+                    user_id:
+                      type: string
+                      description: >-
+                        The ID of the user to authorize. When `connection_owner`
+                        is `organization`, this is the user authorizing on
+                        behalf of the organization; they must be an active
+                        member of the organization and do not become the owner
+                        of the resulting connected account.
+                      example: user_01EHZNVPK3SFK441A1RGBFSHRT
+                    organization_id:
+                      type: string
+                      description: >-
+                        An organization ID to scope the authorization to a
+                        specific organization. Required when `connection_owner`
+                        is `organization`.
+                      example: org_01EHZNVPK3SFK441A1RGBFSHRT
+                    connection_owner:
+                      type: string
+                      enum:
+                        - user
+                        - organization
+                      description: >-
+                        Who will own the connected account. `user` (the default)
+                        connects the user's own account. `organization` connects
+                        the organization's shared account and requires
+                        `organization_id`.
+                      example: user
+                    return_to:
+                      type: string
+                      format: uri
+                      description: The URL to redirect the user to after authorization.
+                      example: https://example.com/callback
+                    config:
+                      type: object
+                      additionalProperties:
+                        type: string
+                      description: >-
+                        Connect-time config values for the provider-declared
+                        `installation`-scope fields (e.g. a Zendesk
+                        `subdomain`), keyed by the config field. Only fields the
+                        provider declares may be supplied, and required fields
+                        must be provided unless already pinned on the
+                        integration.
+                      example: *ref_1
+                    connection_intent:
+                      type: string
+                      description: >-
+                        Create another connection. The first connection for an
+                        owner shape fills the compatibility slot; later
+                        connections are standard. Creating an additional
+                        connection is not yet available: until it is, `add`
+                        succeeds only when the owner has no connection for this
+                        integration and otherwise returns 404
+                        `multiple_connections_unavailable`. Omit
+                        `connection_intent` to use the compatibility connection,
+                        or send `reauthorize` with `connected_account_id` to
+                        reauthorize one exact connection.
+                      example: add
+                      const: add
+                  required:
+                    - user_id
+                    - connection_intent
+                  additionalProperties: false
+                - type: object
+                  properties:
+                    user_id:
+                      type: string
+                      description: >-
+                        The ID of the user to authorize. When `connection_owner`
+                        is `organization`, this is the user authorizing on
+                        behalf of the organization; they must be an active
+                        member of the organization and do not become the owner
+                        of the resulting connected account.
+                      example: user_01EHZNVPK3SFK441A1RGBFSHRT
+                    organization_id:
+                      type: string
+                      description: >-
+                        An organization ID to scope the authorization to a
+                        specific organization. Required when `connection_owner`
+                        is `organization`.
+                      example: org_01EHZNVPK3SFK441A1RGBFSHRT
+                    connection_owner:
+                      type: string
+                      enum:
+                        - user
+                        - organization
+                      description: >-
+                        Who will own the connected account. `user` (the default)
+                        connects the user's own account. `organization` connects
+                        the organization's shared account and requires
+                        `organization_id`.
+                      example: user
+                    return_to:
+                      type: string
+                      format: uri
+                      description: The URL to redirect the user to after authorization.
+                      example: https://example.com/callback
+                    config:
+                      type: object
+                      additionalProperties:
+                        type: string
+                      description: >-
+                        Connect-time config values for the provider-declared
+                        `installation`-scope fields (e.g. a Zendesk
+                        `subdomain`), keyed by the config field. Only fields the
+                        provider declares may be supplied, and required fields
+                        must be provided unless already pinned on the
+                        integration.
+                      example: *ref_1
+                    connection_intent:
+                      type: string
+                      description: >-
+                        Reauthorize exactly the connection named by
+                        `connected_account_id`.
+                      example: reauthorize
+                      const: reauthorize
+                    connected_account_id:
+                      type: string
+                      pattern: ^data_installation_.+$
+                      description: >-
+                        The exact connected account to reauthorize. Required
+                        with `connection_intent: reauthorize`.
+                      example: data_installation_01EHZNVPK3SFK441A1RGBFSHRT
+                  required:
+                    - user_id
+                    - connection_intent
+                    - connected_account_id
+                  additionalProperties: false
       responses:
         '200':
           description: OK
@@ -11322,18 +11474,50 @@ paths:
                 required:
                   - message
         '404':
-          description: Not Found
+          description: >-
+            The integration or user was not found (`entity_not_found`);
+            `connected_account_not_found` when `connected_account_id` does not
+            name a connection for this owner and integration; or
+            `multiple_connections_unavailable` when `connection_intent: add`
+            would create an additional connection before that capability is
+            available.
           content:
             application/json:
               schema:
-                type: object
-                properties:
-                  message:
-                    type: string
-                    description: A human-readable description of the error.
-                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
-                required:
-                  - message
+                anyOf:
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        enum:
+                          - multiple_connections_unavailable
+                          - connected_account_not_found
+                          - entity_not_found
+                        description: The error code identifying the type of error.
+                        example: multiple_connections_unavailable
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: >-
+                          Organization not found:
+                          'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                    required:
+                      - message
+        '422':
+          description: The selected connected account does not use OAuth authentication.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/AuthMethodMismatchError'
       summary: Get authorization URL
       tags:
         - pipes
@@ -11605,7 +11789,7 @@ paths:
                         Provider-specific configuration values collected for
                         this installation, keyed by the provider's config field
                         descriptors.
-                      example: &ref_1
+                      example: &ref_2
                         salesforce_host: acme.my.salesforce.com
                   required:
                     - user_id
@@ -11657,7 +11841,7 @@ paths:
                         Provider-specific configuration values collected for
                         this installation, keyed by the provider's config field
                         descriptors.
-                      example: *ref_1
+                      example: *ref_2
                     connection_intent:
                       type: string
                       description: >-
@@ -11724,7 +11908,7 @@ paths:
                         Provider-specific configuration values collected for
                         this installation, keyed by the provider's config field
                         descriptors.
-                      example: *ref_1
+                      example: *ref_2
                     connected_account_id:
                       type: string
                       pattern: ^data_installation_.+$
@@ -11787,18 +11971,37 @@ paths:
                 required:
                   - message
         '404':
-          description: The data integration or selected connected account was not found.
+          description: >-
+            The data integration or selected connected account was not found
+            (`entity_not_found`).
           content:
             application/json:
               schema:
-                type: object
-                properties:
-                  message:
-                    type: string
-                    description: A human-readable description of the error.
-                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
-                required:
-                  - message
+                anyOf:
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: entity_not_found
+                        const: entity_not_found
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: >-
+                          Organization not found:
+                          'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                    required:
+                      - message
         '409':
           description: >-
             Several connected accounts match the connection owner for the
@@ -12557,6 +12760,129 @@ paths:
       summary: Delete a Directory
       tags:
         - directories
+  /directories/{id}/sync:
+    post:
+      description: >-
+        Request an asynchronous sync from the directory provider. Currently
+        supports Google Workspace directories in linked or validating state.
+        Manual requests share a five-minute per-directory cooldown across the
+        API, Dashboard, Admin Portal, and MCP. Acceptance means the request was
+        queued, not that the sync has started or completed. A running sync
+        prevents another request from being queued.
+      operationId: DirectoriesController_syncDirectory
+      parameters:
+        - name: id
+          required: true
+          in: path
+          description: Unique identifier for the Directory.
+          schema:
+            example: directory_01ECAZ4NV9QMV47GW873HDCX74
+            type: string
+      responses:
+        '202':
+          description: ''
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/DirectorySyncResponse'
+        '403':
+          description: Forbidden
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '404':
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '409':
+          description: A sync is already in progress. No additional sync was queued.
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code:
+                    type: string
+                    description: The error code identifying the type of error.
+                    example: directory_sync_in_progress
+                    const: directory_sync_in_progress
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: Request could not be processed.
+                required:
+                  - code
+                  - message
+        '422':
+          description: The directory provider or state does not support manual sync.
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code:
+                    type: string
+                    description: The error code identifying the type of error.
+                    example: directory_sync_unsupported
+                    const: directory_sync_unsupported
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: Request could not be processed.
+                required:
+                  - code
+                  - message
+        '429':
+          description: The directory is within the manual-sync cooldown window.
+          headers:
+            Retry-After:
+              description: Seconds to wait before requesting another manual sync.
+              schema:
+                type: integer
+                minimum: 1
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/DirectorySyncRateLimitError'
+        '503':
+          description: Directory syncing is temporarily paused. No sync was queued.
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code:
+                    type: string
+                    description: The error code identifying the type of error.
+                    example: directory_sync_disabled
+                    const: directory_sync_disabled
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: Request could not be processed.
+                required:
+                  - code
+                  - message
+      summary: Sync a Directory
+      tags:
+        - directories
   /directory_groups:
     get:
       description: >-
@@ -14383,7 +14709,7 @@ paths:
       summary: Set Retention
       tags:
         - audit-logs
-      x-mutually-exclusive-body-groups: &ref_5
+      x-mutually-exclusive-body-groups: &ref_6
         retention:
           optional: false
           variants:
@@ -16142,7 +16468,7 @@ paths:
                     credentialsType: oauth2
                     createdAt: '2024-01-15T10:30:00.000Z'
                     updatedAt: '2024-01-15T10:30:00.000Z'
-                    connected_account: &ref_2
+                    connected_account: &ref_3
                       object: connected_account
                       id: data_installation_01EHZNVPK3SFK441A1RGBFSHRT
                       user_id: null
@@ -16167,7 +16493,7 @@ paths:
                       createdAt: '2024-01-16T14:20:00.000Z'
                       updatedAt: '2024-01-16T14:20:00.000Z'
                     connected_accounts:
-                      - *ref_2
+                      - *ref_3
         '401':
           description: The request is missing a valid API key.
         '404':
@@ -21065,7 +21391,7 @@ paths:
       summary: Create an organization membership
       tags:
         - user-management.organization-membership
-      x-mutually-exclusive-body-groups: &ref_19
+      x-mutually-exclusive-body-groups: &ref_20
         role:
           optional: true
           variants:
@@ -21249,7 +21575,7 @@ paths:
       summary: Update an organization membership
       tags:
         - user-management.organization-membership
-      x-mutually-exclusive-body-groups: &ref_20
+      x-mutually-exclusive-body-groups: &ref_21
         role:
           optional: true
           variants:
@@ -22569,7 +22895,7 @@ paths:
       summary: Create a user
       tags:
         - user-management.users
-      x-mutually-exclusive-body-groups: &ref_21
+      x-mutually-exclusive-body-groups: &ref_22
         password:
           optional: true
           variants:
@@ -22881,7 +23207,7 @@ paths:
       summary: Update a user
       tags:
         - user-management.users
-      x-mutually-exclusive-body-groups: &ref_25
+      x-mutually-exclusive-body-groups: &ref_26
         password:
           optional: true
           variants:
@@ -26857,7 +27183,7 @@ components:
           example: An application for managing user access
         scopes:
           description: The OAuth scopes granted to the application.
-          example: &ref_3
+          example: &ref_4
             - openid
             - profile
             - email
@@ -26919,7 +27245,7 @@ components:
           example: An application for managing user access
         scopes:
           description: The OAuth scopes granted to the application.
-          example: *ref_3
+          example: *ref_4
           type:
             - array
             - 'null'
@@ -26992,7 +27318,7 @@ components:
             owner: user_01GBTCQ2
           maxProperties: 50
           additionalProperties: false
-          patternProperties: &ref_4
+          patternProperties: &ref_5
             ^[a-zA-Z0-9_-]{0,40}$:
               anyOf:
                 - type: string
@@ -27024,7 +27350,7 @@ components:
             owner: user_01GBTCQ2
           maxProperties: 50
           additionalProperties: false
-          patternProperties: *ref_4
+          patternProperties: *ref_5
       required:
         - id
         - type
@@ -27071,7 +27397,7 @@ components:
             owner: user_01GBTCQ2
           maxProperties: 50
           additionalProperties: false
-          patternProperties: *ref_4
+          patternProperties: *ref_5
         version:
           type: integer
           description: What schema version the event is associated with.
@@ -27153,7 +27479,7 @@ components:
         - range_start
         - range_end
     UpdateAuditLogsRetentionDto:
-      x-mutually-exclusive-body-groups: *ref_5
+      x-mutually-exclusive-body-groups: *ref_6
       oneOf:
         - type: object
           properties:
@@ -27338,7 +27664,7 @@ components:
                         x-exclude-from-lint: true
                     required:
                       - resource_id
-      x-mutually-exclusive-body-groups: *ref_6
+      x-mutually-exclusive-body-groups: *ref_7
     CreateGroupRoleAssignmentDto:
       type: object
       properties:
@@ -27479,7 +27805,7 @@ components:
                         x-exclude-from-lint: true
                     required:
                       - resource_id
-      x-mutually-exclusive-body-groups: *ref_7
+      x-mutually-exclusive-body-groups: *ref_8
     RemoveRoleDto:
       allOf:
         - type: object
@@ -27538,7 +27864,7 @@ components:
                         x-exclude-from-lint: true
                     required:
                       - resource_id
-      x-mutually-exclusive-body-groups: *ref_8
+      x-mutually-exclusive-body-groups: *ref_9
     SetRolePermissionsDto:
       type: object
       properties:
@@ -27888,7 +28214,7 @@ components:
                         x-exclude-from-lint: true
                     required:
                       - parent_resource_id
-      x-mutually-exclusive-body-groups: *ref_9
+      x-mutually-exclusive-body-groups: *ref_10
     CreateConnectionKeyPairDto:
       type: object
       properties:
@@ -28006,7 +28332,7 @@ components:
           default: true
         token_authentication_method:
           type: string
-          enum: &ref_11
+          enum: &ref_12
             - client_secret_post
             - client_secret_basic
             - private_key_jwt
@@ -28022,7 +28348,7 @@ components:
           $ref: '#/components/schemas/CreateConnectionKeyPairDto'
         id_token_signature_algorithm:
           type: string
-          enum: &ref_12
+          enum: &ref_13
             - ES256
             - ES384
             - ES512
@@ -28178,7 +28504,7 @@ components:
                         x-exclude-from-lint: true
                     required:
                       - saml_options
-      x-mutually-exclusive-body-groups: *ref_10
+      x-mutually-exclusive-body-groups: *ref_11
     PatchConnectionSamlOptionsDto:
       type: object
       properties:
@@ -28254,7 +28580,7 @@ components:
           example: true
         token_authentication_method:
           type: string
-          enum: *ref_11
+          enum: *ref_12
           description: >-
             The token-endpoint client authentication method. Moving to
             `private_key_jwt` generates a signing key pair if the connection has
@@ -28264,7 +28590,7 @@ components:
           example: client_secret_basic
         id_token_signature_algorithm:
           type: string
-          enum: *ref_12
+          enum: *ref_13
           description: The ID-token signing algorithm.
           example: RS256
         fetch_user_info:
@@ -28408,7 +28734,7 @@ components:
                         x-exclude-from-lint: true
                     required:
                       - saml_options
-      x-mutually-exclusive-body-groups: *ref_13
+      x-mutually-exclusive-body-groups: *ref_14
     CreateCorsOriginDto:
       type: object
       properties:
@@ -28590,11 +28916,11 @@ components:
           type:
             - object
             - 'null'
-          additionalProperties: &ref_14
+          additionalProperties: &ref_15
             type: string
             maxLength: 600
           maxProperties: 50
-          example: &ref_15
+          example: &ref_16
             tier: diamond
           description: >-
             Object containing [metadata](/authkit/metadata) key/value pairs
@@ -28649,9 +28975,9 @@ components:
           type:
             - object
             - 'null'
-          additionalProperties: *ref_14
+          additionalProperties: *ref_15
           maxProperties: 50
-          example: *ref_15
+          example: *ref_16
           description: >-
             Object containing [metadata](/authkit/metadata) key/value pairs
             associated with the Organization.
@@ -28785,7 +29111,7 @@ components:
           example: application/x-www-form-urlencoded
         authenticate_via:
           type: string
-          enum: &ref_16
+          enum: &ref_17
             - request_body
             - basic_auth_header
           description: >-
@@ -28953,7 +29279,7 @@ components:
           example: application/x-www-form-urlencoded
         authenticate_via:
           type: string
-          enum: *ref_16
+          enum: *ref_17
           description: >-
             How client credentials are sent when exchanging authorization codes
             and refreshing tokens.
@@ -29019,7 +29345,7 @@ components:
           format: date-time
         scopes:
           description: The OAuth scopes granted for this connection.
-          example: &ref_17
+          example: &ref_18
             - repo
             - user:email
           type: array
@@ -29027,7 +29353,7 @@ components:
             type: string
         state:
           type: string
-          enum: &ref_18
+          enum: &ref_19
             - connected
             - needs_reauthorization
           description: >-
@@ -29074,13 +29400,13 @@ components:
           format: date-time
         scopes:
           description: The OAuth scopes granted for this connection.
-          example: *ref_17
+          example: *ref_18
           type: array
           items:
             type: string
         state:
           type: string
-          enum: *ref_18
+          enum: *ref_19
           description: >-
             Explicitly set the state of the connected account. When omitted, the
             state is derived from the token combination provided.
@@ -29114,13 +29440,13 @@ components:
           format: date-time
         scopes:
           description: The OAuth scopes granted for this connection.
-          example: *ref_17
+          example: *ref_18
           type: array
           items:
             type: string
         state:
           type: string
-          enum: *ref_18
+          enum: *ref_19
           description: >-
             Explicitly set the state of the connected account. When omitted, the
             state is derived from the token combination provided.
@@ -29156,13 +29482,13 @@ components:
           format: date-time
         scopes:
           description: The OAuth scopes granted for this connection.
-          example: *ref_17
+          example: *ref_18
           type: array
           items:
             type: string
         state:
           type: string
-          enum: *ref_18
+          enum: *ref_19
           description: >-
             Explicitly set the state of the connected account. When omitted, the
             state is derived from the token combination provided.
@@ -29672,9 +29998,9 @@ components:
                         x-exclude-from-lint: true
                     required:
                       - role_slug
-      x-mutually-exclusive-body-groups: *ref_19
-    UpdateUserlandUserOrganizationMembershipDto:
       x-mutually-exclusive-body-groups: *ref_20
+    UpdateUserlandUserOrganizationMembershipDto:
+      x-mutually-exclusive-body-groups: *ref_21
       oneOf:
         - type: object
           not:
@@ -29798,9 +30124,9 @@ components:
               type:
                 - object
                 - 'null'
-              additionalProperties: *ref_14
+              additionalProperties: *ref_15
               maxProperties: 50
-              example: &ref_22
+              example: &ref_23
                 timezone: America/New_York
               description: >-
                 Object containing metadata key/value pairs associated with the
@@ -29899,7 +30225,7 @@ components:
                   example: $2a$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy
                 password_hash_type:
                   type: string
-                  enum: &ref_23
+                  enum: &ref_24
                     - bcrypt
                     - firebase-scrypt
                     - ssha
@@ -29914,7 +30240,7 @@ components:
                   example: bcrypt
                 password_salt_position:
                   type: string
-                  enum: &ref_24
+                  enum: &ref_25
                     - prefix
                     - suffix
                   description: >-
@@ -29935,7 +30261,7 @@ components:
                         x-exclude-from-lint: true
                     required:
                       - password
-      x-mutually-exclusive-body-groups: *ref_21
+      x-mutually-exclusive-body-groups: *ref_22
     UpdateUserlandUserDto:
       allOf:
         - type: object
@@ -29965,9 +30291,9 @@ components:
               type:
                 - object
                 - 'null'
-              additionalProperties: *ref_14
+              additionalProperties: *ref_15
               maxProperties: 50
-              example: *ref_22
+              example: *ref_23
               description: >-
                 Object containing metadata key/value pairs associated with the
                 user.
@@ -30049,7 +30375,7 @@ components:
                   example: $2a$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy
                 password_hash_type:
                   type: string
-                  enum: *ref_23
+                  enum: *ref_24
                   description: >-
                     The algorithm originally used to hash the password, used
                     when providing a `password_hash`. Required with
@@ -30057,7 +30383,7 @@ components:
                   example: bcrypt
                 password_salt_position:
                   type: string
-                  enum: *ref_24
+                  enum: *ref_25
                   description: >-
                     The position of the salt relative to the password when the
                     `password_hash` digest was computed: `prefix` for `hash(salt
@@ -30076,7 +30402,7 @@ components:
                         x-exclude-from-lint: true
                     required:
                       - password
-      x-mutually-exclusive-body-groups: *ref_25
+      x-mutually-exclusive-body-groups: *ref_26
     VerifyEmailAddressDto:
       type: object
       properties:
@@ -30185,7 +30511,7 @@ components:
           description: The events that the Webhook Endpoint is subscribed to.
           items:
             type: string
-            enum: &ref_26
+            enum: &ref_27
               - agent.blueprint.created
               - agent.blueprint.deleted
               - agent.blueprint.updated
@@ -30316,7 +30642,7 @@ components:
           description: The events that the Webhook Endpoint is subscribed to.
           items:
             type: string
-            enum: *ref_26
+            enum: *ref_27
           example:
             - user.created
             - dsync.user.created
@@ -33367,6 +33693,41 @@ components:
         - data
         - list_metadata
         - list_metadata
+    DirectorySyncResponse:
+      type: object
+      properties:
+        status:
+          type: string
+          description: >-
+            The sync request was queued for asynchronous processing. This does
+            not indicate that the sync has started or completed.
+          example: queued
+          const: queued
+      required:
+        - status
+    DirectorySyncRateLimitError:
+      type: object
+      properties:
+        code:
+          type: string
+          description: The error code identifying the type of error.
+          example: directory_sync_rate_limited
+          const: directory_sync_rate_limited
+        message:
+          type: string
+          description: A human-readable description of the error.
+          example: Request could not be processed.
+        retry_after_seconds:
+          type: integer
+          exclusiveMinimum: 0
+          description: >-
+            The number of seconds to wait before requesting another manual sync
+            of this directory.
+          example: 120
+      required:
+        - code
+        - message
+        - retry_after_seconds
     DirectoryGroup:
       type: object
       properties:
@@ -34010,7 +34371,7 @@ components:
           description: >-
             An object containing the custom attribute mapping for the Directory
             Provider.
-          example: &ref_33
+          example: &ref_34
             department: Engineering
             job_title: Software Engineer
         role:
@@ -34249,7 +34610,7 @@ components:
               type: object
               additionalProperties: {}
               description: The event payload.
-              example: &ref_27
+              example: &ref_28
                 id: directory_user_01E1JG7J09H96KYP8HM9B0G5SJ
                 directory_id: directory_01ECAZ4NV9QMV47GW873HDCX74
                 organization_id: org_01EZTR6WYX1A0DSE2CYMGXQ24Y
@@ -34284,11 +34645,11 @@ components:
             - data
             - created_at
           description: An event emitted by WorkOS.
-          example: &ref_38
+          example: &ref_39
             object: event
             id: event_01EHZNVPK3SFK441A1RGBFSHRT
             event: dsync.user.created
-            data: *ref_27
+            data: *ref_28
             created_at: '2021-06-25T19:07:33.155Z'
             context: {}
         - oneOf:
@@ -34488,7 +34849,7 @@ components:
                       description: >-
                         Permission slugs forming the ceiling on what sessions
                         minted from this blueprint may do.
-                      example: &ref_28
+                      example: &ref_29
                         - crm:read
                         - email:send
                     invocable_by:
@@ -34501,7 +34862,7 @@ components:
                           description: >-
                             Role slugs whose members may mint user-delegated
                             sessions from this blueprint.
-                          example: &ref_29
+                          example: &ref_30
                             - manager
                         organization_ids:
                           type: array
@@ -34510,7 +34871,7 @@ components:
                           description: >-
                             Organizations in which autonomous sessions may be
                             minted from this blueprint.
-                          example: &ref_30
+                          example: &ref_31
                             - org_01EHWNCE74X7JSDV0X3SZ3KJNY
                       required:
                         - role_slugs
@@ -34530,7 +34891,7 @@ components:
                             Instance types that may be minted from this
                             blueprint: `delegated` (acting for a user) and/or
                             `autonomous` (acting as the agent itself).
-                          example: &ref_31
+                          example: &ref_32
                             - delegated
                             - autonomous
                       required:
@@ -34690,7 +35051,7 @@ components:
                       description: >-
                         Permission slugs forming the ceiling on what sessions
                         minted from this blueprint may do.
-                      example: *ref_28
+                      example: *ref_29
                     invocable_by:
                       type: object
                       properties:
@@ -34701,7 +35062,7 @@ components:
                           description: >-
                             Role slugs whose members may mint user-delegated
                             sessions from this blueprint.
-                          example: *ref_29
+                          example: *ref_30
                         organization_ids:
                           type: array
                           items:
@@ -34709,7 +35070,7 @@ components:
                           description: >-
                             Organizations in which autonomous sessions may be
                             minted from this blueprint.
-                          example: *ref_30
+                          example: *ref_31
                       required:
                         - role_slugs
                         - organization_ids
@@ -34728,7 +35089,7 @@ components:
                             Instance types that may be minted from this
                             blueprint: `delegated` (acting for a user) and/or
                             `autonomous` (acting as the agent itself).
-                          example: *ref_31
+                          example: *ref_32
                       required:
                         - instance_types
                       description: How sessions may be minted from this blueprint.
@@ -35764,7 +36125,7 @@ components:
                       items:
                         type: string
                       description: The permissions granted to the API key.
-                      example: &ref_32
+                      example: &ref_33
                         - users:read
                         - users:write
                     created_at:
@@ -35890,7 +36251,7 @@ components:
                       items:
                         type: string
                       description: The permissions granted to the API key.
-                      example: *ref_32
+                      example: *ref_33
                     created_at:
                       type: string
                       description: The timestamp when the API key was created.
@@ -36014,7 +36375,7 @@ components:
                       items:
                         type: string
                       description: The permissions granted to the API key.
-                      example: *ref_32
+                      example: *ref_33
                     created_at:
                       type: string
                       description: The timestamp when the API key was created.
@@ -38881,7 +39242,7 @@ components:
                       description: >-
                         An object containing the custom attribute mapping for
                         the Directory Provider.
-                      example: *ref_33
+                      example: *ref_34
                     role:
                       $ref: '#/components/schemas/SlimRole'
                     roles:
@@ -39071,7 +39432,7 @@ components:
                       description: >-
                         Labels assigned to the Feature Flag for categorizing and
                         filtering.
-                      example: &ref_34
+                      example: &ref_35
                         - reports
                     enabled:
                       type: boolean
@@ -39232,7 +39593,7 @@ components:
                       description: >-
                         Labels assigned to the Feature Flag for categorizing and
                         filtering.
-                      example: *ref_34
+                      example: *ref_35
                     enabled:
                       type: boolean
                       description: >-
@@ -39392,7 +39753,7 @@ components:
                       description: >-
                         Labels assigned to the Feature Flag for categorizing and
                         filtering.
-                      example: *ref_34
+                      example: *ref_35
                     enabled:
                       type: boolean
                       description: >-
@@ -39672,7 +40033,7 @@ components:
                       description: >-
                         Labels assigned to the Feature Flag for categorizing and
                         filtering.
-                      example: *ref_34
+                      example: *ref_35
                     enabled:
                       type: boolean
                       description: >-
@@ -40660,7 +41021,7 @@ components:
                       description: >-
                         Object containing [metadata](/authkit/metadata)
                         key/value pairs associated with the Organization.
-                      example: &ref_35
+                      example: &ref_36
                         tier: diamond
                       propertyNames:
                         maxLength: 40
@@ -40810,7 +41171,7 @@ components:
                       description: >-
                         Object containing [metadata](/authkit/metadata)
                         key/value pairs associated with the Organization.
-                      example: *ref_35
+                      example: *ref_36
                       propertyNames:
                         maxLength: 40
                       maxProperties: 50
@@ -41637,7 +41998,7 @@ components:
                       items:
                         type: string
                       description: The permissions granted by the role.
-                      example: &ref_36
+                      example: &ref_37
                         - users:read
                         - users:write
                     created_at:
@@ -41721,7 +42082,7 @@ components:
                       items:
                         type: string
                       description: The permissions granted by the role.
-                      example: *ref_36
+                      example: *ref_37
                     created_at:
                       format: date-time
                       type: string
@@ -41803,7 +42164,7 @@ components:
                       items:
                         type: string
                       description: The permissions granted by the role.
-                      example: *ref_36
+                      example: *ref_37
                     created_at:
                       format: date-time
                       type: string
@@ -41940,7 +42301,7 @@ components:
                       description: >-
                         Object containing [metadata](/authkit/metadata)
                         key/value pairs associated with the Organization.
-                      example: *ref_35
+                      example: *ref_36
                       propertyNames:
                         maxLength: 40
                       maxProperties: 50
@@ -43136,7 +43497,7 @@ components:
                       items:
                         type: string
                       description: The permissions granted by the role.
-                      example: &ref_37
+                      example: &ref_38
                         - users:read
                         - users:write
                     created_at:
@@ -43202,7 +43563,7 @@ components:
                       items:
                         type: string
                       description: The permissions granted by the role.
-                      example: *ref_37
+                      example: *ref_38
                     created_at:
                       format: date-time
                       type: string
@@ -43266,7 +43627,7 @@ components:
                       items:
                         type: string
                       description: The permissions granted by the role.
-                      example: *ref_37
+                      example: *ref_38
                     created_at:
                       format: date-time
                       type: string
@@ -44468,7 +44829,7 @@ components:
                 - data
                 - created_at
                 - object
-      example: *ref_38
+      example: *ref_39
       description: An event emitted by WorkOS.
     EventList:
       type: object
@@ -44503,7 +44864,7 @@ components:
       example:
         object: list
         data:
-          - *ref_38
+          - *ref_39
         list_metadata:
           after: event_01EHZNVPK3SFK441A1RGBFSHRT
     JwtTemplate:
@@ -45810,6 +46171,25 @@ components:
             https://api.workos.com/data-integrations/q2czJKmVAraSBg8xFpT7M9uR/authorize-redirect
       required:
         - url
+    AuthMethodMismatchError:
+      type: object
+      properties:
+        code:
+          type: string
+          description: >-
+            Error code indicating the endpoint does not match the installation
+            auth method.
+          example: auth_method_mismatch
+          const: auth_method_mismatch
+        message:
+          type: string
+          description: A human-readable explanation of the mismatch.
+          example: >-
+            This installation uses oauth authentication. Use the POST
+            /:slug/token endpoint instead.
+      required:
+        - code
+        - message
     DataIntegrationAccessTokenResponse:
       oneOf:
         - type: object
@@ -45909,25 +46289,6 @@ components:
       required:
         - code
         - message
-    AuthMethodMismatchError:
-      type: object
-      properties:
-        code:
-          type: string
-          description: >-
-            Error code indicating the endpoint does not match the installation
-            auth method.
-          example: auth_method_mismatch
-          const: auth_method_mismatch
-        message:
-          type: string
-          description: A human-readable explanation of the mismatch.
-          example: >-
-            This installation uses oauth authentication. Use the POST
-            /:slug/token endpoint instead.
-      required:
-        - code
-        - message
     DataIntegrationVendedCredential:
       discriminator:
         propertyName: auth_method
@@ -45998,7 +46359,7 @@ components:
                 integration or organization pins require reconnecting or
                 explicitly rebinding the connection. Defaults are live and can
                 differ from a cached token's audience until refresh or re-mint.
-              example: &ref_39
+              example: &ref_40
                 account: myorg-myaccount
           required:
             - object
@@ -46043,7 +46404,7 @@ components:
                 integration or organization pins require reconnecting or
                 explicitly rebinding the connection. Defaults are live and can
                 differ from a cached token's audience until refresh or re-mint.
-              example: *ref_39
+              example: *ref_40
           required:
             - object
             - auth_method
@@ -46120,7 +46481,7 @@ components:
                 integration or organization pins require reconnecting or
                 explicitly rebinding the connection. Defaults are live and can
                 differ from a cached token's audience until refresh or re-mint.
-              example: *ref_39
+              example: *ref_40
           required:
             - object
             - auth_method
@@ -46500,7 +46861,7 @@ components:
                         items:
                           type: string
                         description: The OAuth scopes granted for this connection.
-                        example: &ref_40
+                        example: &ref_41
                           - repo
                           - user:email
                       auth_method:
@@ -46550,7 +46911,7 @@ components:
                           `installation` scope, excluding secret and undeclared
                           fields. Returned for every authentication method;
                           empty when no stored values can be disclosed.
-                        example: &ref_41
+                        example: &ref_42
                           instance_url: https://example.my.salesforce.com
                       state:
                         type: string
@@ -46679,7 +47040,7 @@ components:
                       items:
                         type: string
                       description: The OAuth scopes granted for this connection.
-                      example: *ref_40
+                      example: *ref_41
                     auth_method:
                       type: string
                       enum:
@@ -46726,7 +47087,7 @@ components:
                         `installation` scope, excluding secret and undeclared
                         fields. Returned for every authentication method; empty
                         when no stored values can be disclosed.
-                      example: *ref_41
+                      example: *ref_42
                     state:
                       type: string
                       enum: