@workos/openapi-spec 0.38.0 → 0.40.0

package/dist/open-api-spec.yaml

@@ -1412,7 +1412,6 @@ paths:
       summary: List role assignments for a group
       tags:
         - authorization
-      x-feature-flag: user-groups-role-assignment-enabled
     post:
       description: Assign a role to a group on a specific resource.
       operationId: AuthorizationGroupRoleAssignmentsController_create
@@ -1498,7 +1497,6 @@ paths:
       summary: Assign a role to a group
       tags:
         - authorization
-      x-feature-flag: user-groups-role-assignment-enabled
     put:
       description: >-
         Replace all role assignments for a group with the provided list.
@@ -1567,7 +1565,6 @@ paths:
       summary: Replace all role assignments for a group
       tags:
         - authorization
-      x-feature-flag: user-groups-role-assignment-enabled
     delete:
       description: >-
         Remove role assignments from a group that match the provided criteria.
@@ -1632,7 +1629,6 @@ paths:
       summary: Remove group role assignments by criteria
       tags:
         - authorization
-      x-feature-flag: user-groups-role-assignment-enabled
   /authorization/groups/{group_id}/role_assignments/{role_assignment_id}:
     get:
       description: Get a specific role assignment for a group by its ID.
@@ -1688,7 +1684,6 @@ paths:
       summary: Get a group role assignment
       tags:
         - authorization
-      x-feature-flag: user-groups-role-assignment-enabled
     delete:
       description: Remove a specific role assignment from a group by its ID.
       operationId: AuthorizationGroupRoleAssignmentsController_removeGroupRoleAssignment
@@ -1739,7 +1734,6 @@ paths:
       summary: Remove a group role assignment
       tags:
         - authorization
-      x-feature-flag: user-groups-role-assignment-enabled
   /authorization/organization_memberships/{organization_membership_id}/check:
     post:
       description: >-
@@ -6988,10 +6982,12 @@ paths:
     post:
       description: >-
         Creates a data integration for a provider. Set `credentials.type` to
-        `custom` to use your own OAuth app credentials, or `organization` to
-        have each organization supply its own. For a built-in provider, pass its
-        slug as `provider`. For a custom provider, pass a new slug plus a
-        `custom_provider` definition.
+        `custom` to use your own OAuth app credentials or `organization` to have
+        each organization supply its own. Set `auth_methods` to `["api_key"]` to
+        create an API key integration; you may optionally supply an `api_key`
+        block to install a first tenant in the same call. For a built-in
+        provider, pass its slug as `provider`. For a custom provider, pass a new
+        slug plus a `custom_provider` definition.
       operationId: DataIntegrationsManagementController_createDataIntegration
       parameters: []
       requestBody:
@@ -7022,6 +7018,19 @@ paths:
                   - message
         '401':
           description: Unauthorized
+        '403':
+          description: Forbidden
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
         '404':
           description: Not Found
           content:
@@ -7035,6 +7044,19 @@ paths:
                     example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
                 required:
                   - message
+        '409':
+          description: A data integration with this slug already exists in the environment.
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
         '422':
           description: Unprocessable Entity
           content:
@@ -7055,7 +7077,8 @@ paths:
     get:
       description: >-
         Lists the environment's data integrations configured with `custom` or
-        `organization` credentials, including custom providers.
+        `organization` credentials, including custom providers and API key
+        integrations.
       operationId: DataIntegrationsManagementController_listDataIntegrations
       parameters:
         - name: before
@@ -7197,6 +7220,19 @@ paths:
                   - message
         '401':
           description: Unauthorized
+        '403':
+          description: Forbidden
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
         '404':
           description: Not Found
           content:
@@ -12999,7 +13035,7 @@ paths:
   /user_management/cors_origins:
     post:
       description: >-
-        Creates a new CORS origin for the current environment. CORS origins
+        Creates a new CORS origin for the API key's application. CORS origins
         allow browser-based applications to make requests to the WorkOS API.
       operationId: CorsOriginsController_createCorsOrigin
       parameters: []
@@ -19738,12 +19774,10 @@ components:
           type: string
           description: The external ID of the resource.
           example: proj-456
-          x-feature-flag: user-groups-role-assignment-enabled
         resource_type_slug:
           type: string
           description: The resource type slug.
           example: project
-          x-feature-flag: user-groups-role-assignment-enabled
       required:
         - role_slug
     ReplaceGroupRoleAssignmentEntryDto:
@@ -20524,6 +20558,27 @@ components:
           example: secret_…
       required:
         - type
+    ApiKeyInstallationDto:
+      type: object
+      properties:
+        secret:
+          type: string
+          minLength: 5
+          description: The API key secret to store for the tenant.
+          example: sk-1234567890abcdef
+        user_id:
+          type: string
+          description: The User identifier the API key is installed for.
+          example: user_01EHZNVPK3SFK441A1RGBFSHRT
+        organization_id:
+          type: string
+          description: >-
+            An Organization identifier to scope the installation to a specific
+            organization.
+          example: org_01EHZNVPK3SFK441A1RGBFSHRT
+      required:
+        - secret
+        - user_id
     CustomProviderDefinitionDto:
       type: object
       properties:
@@ -20632,11 +20687,32 @@ components:
             - 'null'
           items:
             type: string
+        auth_methods:
+          type: array
+          description: >-
+            How accounts authenticate with the provider. Defaults to
+            `["oauth"]`. Use `["api_key"]` to declare an API key integration;
+            `credentials` is then not required and keys are supplied per-tenant
+            (optionally via `api_key` on this request).
+          items:
+            type: string
+            enum:
+              - oauth
+              - api_key
+          example:
+            - oauth
         credentials:
           description: >-
-            The credentials to configure for the Data Integration. Required for
-            both built-in and custom providers.
+            The OAuth credentials to configure for the Data Integration.
+            Required for OAuth integrations; omit when `auth_methods` is
+            `["api_key"]`.
           $ref: '#/components/schemas/DataIntegrationCredentialsDto'
+        api_key:
+          description: >-
+            An optional API key to install for the first tenant on an `api_key`
+            integration. Omit to declare a keyless integration; tenants can be
+            added later via the per-installation API key path.
+          $ref: '#/components/schemas/ApiKeyInstallationDto'
         custom_provider:
           description: >-
             The OAuth definition for a custom provider. Supply this to define a
@@ -20736,9 +20812,15 @@ components:
             type: string
         credentials:
           description: >-
-            New credentials for the Data Integration. When provided, rotates the
-            stored client secret.
+            New OAuth credentials for the Data Integration. When provided,
+            rotates the stored client secret. Mutually exclusive with `api_key`.
           $ref: '#/components/schemas/DataIntegrationCredentialsDto'
+        api_key:
+          description: >-
+            An API key to install or rotate for a tenant on an `api_key`
+            integration. Upserts the tenant installation identified by `user_id`
+            (and optional `organization_id`).
+          $ref: '#/components/schemas/ApiKeyInstallationDto'
         custom_provider:
           description: >-
             Updates to a custom provider's OAuth definition. Only valid for
@@ -35031,6 +35113,18 @@ components:
             configuring the custom application.
           example: >-
             https://api.workos.com/data-integrations/github/dik_01EHZNVPK3SFK441A1RGBFSHRT/callback
+        auth_methods:
+          type: array
+          items:
+            type: string
+            enum:
+              - oauth
+              - api_key
+          description: >-
+            How accounts authenticate with the provider for this Data
+            Integration.
+          example:
+            - oauth
         credentials:
           type: object
           properties:
@@ -35066,6 +35160,45 @@ components:
             - client_id
             - redacted_client_secret
           description: The credentials configured for the Data Integration.
+        installation:
+          description: >-
+            The tenant installation created when an API key was supplied at
+            creation time; `null` otherwise. Not populated on list/get
+            responses.
+          example: null
+          oneOf:
+            - type: object
+              properties:
+                id:
+                  type: string
+                  description: Unique identifier of the installation.
+                  example: data_installation_01EHZNVPK3SFK441A1RGBFSHRT
+                user_id:
+                  type: string
+                  description: The User the API key was installed for.
+                  example: user_01EHZNVPK3SFK441A1RGBFSHRT
+                organization_id:
+                  type:
+                    - string
+                    - 'null'
+                  description: >-
+                    The Organization the installation is scoped to, or null when
+                    unscoped.
+                  example: null
+                api_key_last_4:
+                  type:
+                    - string
+                    - 'null'
+                  description: >-
+                    The last four characters of the stored API key. The full key
+                    is never returned.
+                  example: cdef
+              required:
+                - id
+                - user_id
+                - organization_id
+                - api_key_last_4
+            - type: 'null'
         custom_provider:
           description: >-
             The OAuth definition when this is a custom provider; `null` for
@@ -35170,7 +35303,9 @@ components:
         - state
         - scopes
         - redirect_uri
+        - auth_methods
         - credentials
+        - installation
         - custom_provider
         - created_at
         - updated_at

package/dist/types.d.ts

@@ -1062,13 +1062,13 @@ export interface paths {
         };
         /**
          * List data integrations
-         * @description Lists the environment's data integrations configured with `custom` or `organization` credentials, including custom providers.
+         * @description Lists the environment's data integrations configured with `custom` or `organization` credentials, including custom providers and API key integrations.
          */
         get: operations["DataIntegrationsManagementController_listDataIntegrations"];
         put?: never;
         /**
          * Create a data integration
-         * @description Creates a data integration for a provider. Set `credentials.type` to `custom` to use your own OAuth app credentials, or `organization` to have each organization supply its own. For a built-in provider, pass its slug as `provider`. For a custom provider, pass a new slug plus a `custom_provider` definition.
+         * @description Creates a data integration for a provider. Set `credentials.type` to `custom` to use your own OAuth app credentials or `organization` to have each organization supply its own. Set `auth_methods` to `["api_key"]` to create an API key integration; you may optionally supply an `api_key` block to install a first tenant in the same call. For a built-in provider, pass its slug as `provider`. For a custom provider, pass a new slug plus a `custom_provider` definition.
          */
         post: operations["DataIntegrationsManagementController_createDataIntegration"];
         delete?: never;
@@ -2074,7 +2074,7 @@ export interface paths {
         put?: never;
         /**
          * Create a CORS origin
-         * @description Creates a new CORS origin for the current environment. CORS origins allow browser-based applications to make requests to the WorkOS API.
+         * @description Creates a new CORS origin for the API key's application. CORS origins allow browser-based applications to make requests to the WorkOS API.
          */
         post: operations["CorsOriginsController_createCorsOrigin"];
         delete?: never;
@@ -4175,6 +4175,23 @@ export interface components {
              */
             client_secret?: string;
         };
+        ApiKeyInstallationDto: {
+            /**
+             * @description The API key secret to store for the tenant.
+             * @example sk-1234567890abcdef
+             */
+            secret: string;
+            /**
+             * @description The User identifier the API key is installed for.
+             * @example user_01EHZNVPK3SFK441A1RGBFSHRT
+             */
+            user_id: string;
+            /**
+             * @description An Organization identifier to scope the installation to a specific organization.
+             * @example org_01EHZNVPK3SFK441A1RGBFSHRT
+             */
+            organization_id?: string;
+        };
         CustomProviderDefinitionDto: {
             /**
              * @description A descriptive name for the custom provider.
@@ -4264,8 +4281,17 @@ export interface components {
              *     ]
              */
             scopes?: string[] | null;
-            /** @description The credentials to configure for the Data Integration. Required for both built-in and custom providers. */
+            /**
+             * @description How accounts authenticate with the provider. Defaults to `["oauth"]`. Use `["api_key"]` to declare an API key integration; `credentials` is then not required and keys are supplied per-tenant (optionally via `api_key` on this request).
+             * @example [
+             *       "oauth"
+             *     ]
+             */
+            auth_methods?: ("oauth" | "api_key")[];
+            /** @description The OAuth credentials to configure for the Data Integration. Required for OAuth integrations; omit when `auth_methods` is `["api_key"]`. */
             credentials?: components["schemas"]["DataIntegrationCredentialsDto"];
+            /** @description An optional API key to install for the first tenant on an `api_key` integration. Omit to declare a keyless integration; tenants can be added later via the per-installation API key path. */
+            api_key?: components["schemas"]["ApiKeyInstallationDto"];
             /** @description The OAuth definition for a custom provider. Supply this to define a custom provider; omit it to create an integration for a built-in provider. */
             custom_provider?: components["schemas"]["CustomProviderDefinitionDto"];
         };
@@ -4353,8 +4379,10 @@ export interface components {
              *     ]
              */
             scopes?: string[] | null;
-            /** @description New credentials for the Data Integration. When provided, rotates the stored client secret. */
+            /** @description New OAuth credentials for the Data Integration. When provided, rotates the stored client secret. Mutually exclusive with `api_key`. */
             credentials?: components["schemas"]["DataIntegrationCredentialsDto"];
+            /** @description An API key to install or rotate for a tenant on an `api_key` integration. Upserts the tenant installation identified by `user_id` (and optional `organization_id`). */
+            api_key?: components["schemas"]["ApiKeyInstallationDto"];
             /** @description Updates to a custom provider's OAuth definition. Only valid for custom-provider integrations. */
             custom_provider?: components["schemas"]["UpdateCustomProviderDefinitionDto"];
         };
@@ -15150,6 +15178,13 @@ export interface components {
              * @example https://api.workos.com/data-integrations/github/dik_01EHZNVPK3SFK441A1RGBFSHRT/callback
              */
             redirect_uri: string;
+            /**
+             * @description How accounts authenticate with the provider for this Data Integration.
+             * @example [
+             *       "oauth"
+             *     ]
+             */
+            auth_methods: ("oauth" | "api_key")[];
             /** @description The credentials configured for the Data Integration. */
             credentials: {
                 /**
@@ -15169,6 +15204,32 @@ export interface components {
                  */
                 redacted_client_secret: string | null;
             };
+            /**
+             * @description The tenant installation created when an API key was supplied at creation time; `null` otherwise. Not populated on list/get responses.
+             * @example null
+             */
+            installation: {
+                /**
+                 * @description Unique identifier of the installation.
+                 * @example data_installation_01EHZNVPK3SFK441A1RGBFSHRT
+                 */
+                id: string;
+                /**
+                 * @description The User the API key was installed for.
+                 * @example user_01EHZNVPK3SFK441A1RGBFSHRT
+                 */
+                user_id: string;
+                /**
+                 * @description The Organization the installation is scoped to, or null when unscoped.
+                 * @example null
+                 */
+                organization_id: string | null;
+                /**
+                 * @description The last four characters of the stored API key. The full key is never returned.
+                 * @example cdef
+                 */
+                api_key_last_4: string | null;
+            } | null;
             /** @description The OAuth definition when this is a custom provider; `null` for built-in providers. */
             custom_provider: {
                 /**
@@ -23036,6 +23097,21 @@ export interface operations {
                 };
                 content?: never;
             };
+            /** @description Forbidden */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
             /** @description Not Found */
             404: {
                 headers: {
@@ -23051,6 +23127,21 @@ export interface operations {
                     };
                 };
             };
+            /** @description A data integration with this slug already exists in the environment. */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
             /** @description Unprocessable Entity */
             422: {
                 headers: {
@@ -23160,6 +23251,21 @@ export interface operations {
                 };
                 content?: never;
             };
+            /** @description Forbidden */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
             /** @description Not Found */
             404: {
                 headers: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@workos/openapi-spec",
-  "version": "0.38.0",
+  "version": "0.40.0",
   "type": "module",
   "description": "WorkOS OpenAPI specification, TypeScript types, and SDK resolution policy",
   "license": "MIT",