@workos/openapi-spec 0.53.0 → 0.55.0

package/dist/open-api-spec.yaml

@@ -7273,7 +7273,9 @@ paths:
         `custom` to use your own OAuth app credentials or `organization` to have
         each organization supply its own. Set `auth_methods` to `["api_key"]` to
         create an API key integration; you may optionally supply an `api_key`
-        block to install a first tenant in the same call. For a built-in
+        block to install a first tenant in the same call. Set `auth_methods` to
+        `["client_credentials"]` to create a client-credentials integration;
+        client credentials are installed per-tenant afterwards. For a built-in
         provider, pass its slug as `provider`. For a custom provider, pass a new
         slug plus a `custom_provider` definition.
       operationId: DataIntegrationsManagementController_createDataIntegration
@@ -7802,6 +7804,133 @@ paths:
       summary: Get authorization URL
       tags:
         - pipes
+  /data-integrations/{slug}/client-credentials:
+    put:
+      description: >-
+        Creates or updates a client-credentials-based installation for the
+        specified integration and user. If an installation already exists, the
+        stored client credentials are rotated to the new values.
+      operationId: DataIntegrationsController_upsertClientCredentials
+      parameters:
+        - name: slug
+          required: true
+          in: path
+          description: The identifier of the integration.
+          schema:
+            example: salesforce
+            type: string
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                user_id:
+                  type: string
+                  description: A [User](/reference/authkit/user) identifier.
+                  example: user_01EHZNVPK3SFK441A1RGBFSHRT
+                organization_id:
+                  type: string
+                  description: >-
+                    An [Organization](/reference/organization) identifier.
+                    Optional parameter to scope the connection to a specific
+                    organization.
+                  example: org_01EHZNVPK3SFK441A1RGBFSHRT
+                client_id:
+                  type: string
+                  minLength: 1
+                  description: The OAuth client ID to store for this integration.
+                  example: 3MVG9...
+                client_secret:
+                  type: string
+                  minLength: 1
+                  description: The OAuth client secret to store for this integration.
+                  example: shhh-secret
+                config:
+                  type: object
+                  additionalProperties:
+                    type: string
+                  description: >-
+                    Provider-specific configuration values collected for this
+                    installation, keyed by the provider's config field
+                    descriptors.
+                  example:
+                    mydomain: acme
+              required:
+                - user_id
+                - client_id
+                - client_secret
+      responses:
+        '200':
+          description: The resulting connected account after the upsert.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ConnectedAccount'
+              example:
+                object: connected_account
+                id: data_installation_01EHZNVPK3SFK441A1RGBFSHRT
+                user_id: user_01EHZNVPK3SFK441A1RGBFSHRT
+                organization_id: org_01EHZNVPK3SFK441A1RGBFSHRT
+                scopes: []
+                auth_method: client_credentials
+                state: connected
+                created_at: '2024-01-16T14:20:00.000Z'
+                updated_at: '2024-01-16T14:20:00.000Z'
+        '400':
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '401':
+          description: Unauthorized
+        '403':
+          description: Forbidden
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '404':
+          description: Data integration not found for the given provider slug.
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '422':
+          description: >-
+            The matched installation uses a different auth method than this
+            endpoint expects.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/AuthMethodMismatchError'
+      summary: Upsert client credentials for a connected account
+      tags:
+        - pipes
+      x-feature-flag: pipes-client-credentials
   /data-integrations/{slug}/credentials:
     post:
       description: >-
@@ -21157,12 +21286,16 @@ components:
             How accounts authenticate with the provider. Defaults to
             `["oauth"]`. Use `["api_key"]` to declare an API key integration;
             `credentials` is then not required and keys are supplied per-tenant
-            (optionally via `api_key` on this request).
+            (optionally via `api_key` on this request). Use
+            `["client_credentials"]` to declare a client-credentials
+            integration; `credentials` is likewise not required and client
+            credentials are supplied per-tenant.
           items:
             type: string
             enum:
               - oauth
               - api_key
+              - client_credentials
           example:
             - oauth
         config:
@@ -35775,40 +35908,46 @@ components:
           example:
             - oauth
         credentials:
-          type: object
-          properties:
-            type:
-              type: string
-              enum:
-                - custom
-                - organization
-              description: >-
-                The credentials type. `custom` uses your own OAuth app
-                credentials; `organization` has each organization supply its own
-                credentials (so `client_id`/`redacted_client_secret` are null on
-                the integration itself).
-              example: custom
-            client_id:
-              type:
-                - string
-                - 'null'
-              description: >-
-                The OAuth client ID configured for the provider app. Null for
-                `organization` credentials.
-              example: Iv1.abc123
-            redacted_client_secret:
-              type:
-                - string
-                - 'null'
-              description: >-
-                The last four characters of the OAuth client secret. The full
-                secret is never returned. Null for `organization` credentials.
-              example: '6789'
-          required:
-            - type
-            - client_id
-            - redacted_client_secret
-          description: The credentials configured for the Data Integration.
+          description: >-
+            The integration-level OAuth app credentials. `null` for `api_key`
+            integrations, which hold no OAuth credentials (keys are installed
+            per-tenant).
+          oneOf:
+            - type: object
+              properties:
+                type:
+                  type: string
+                  enum:
+                    - custom
+                    - organization
+                  description: >-
+                    The credentials type. `custom` uses your own OAuth app
+                    credentials; `organization` has each organization supply its
+                    own credentials (so `client_id`/`redacted_client_secret` are
+                    null on the integration itself).
+                  example: custom
+                client_id:
+                  type:
+                    - string
+                    - 'null'
+                  description: >-
+                    The OAuth client ID configured for the provider app. Null
+                    for `organization` credentials.
+                  example: Iv1.abc123
+                redacted_client_secret:
+                  type:
+                    - string
+                    - 'null'
+                  description: >-
+                    The last four characters of the OAuth client secret. The
+                    full secret is never returned. Null for `organization`
+                    credentials.
+                  example: '6789'
+              required:
+                - type
+                - client_id
+                - redacted_client_secret
+            - type: 'null'
         installation:
           description: >-
             The tenant installation created when an API key was supplied at

package/dist/services.mjs

@@ -705,6 +705,11 @@ const serviceEndpoints = {
 			"path": "/data-integrations/{slug}/authorize",
 			"name": "authorize_data_integration"
 		},
+		{
+			"method": "PUT",
+			"path": "/data-integrations/{slug}/client-credentials",
+			"name": "update_data_integration_client_credentials"
+		},
 		{
 			"method": "POST",
 			"path": "/data-integrations/{slug}/credentials",

package/dist/types.d.ts

@@ -1088,7 +1088,7 @@ export interface paths {
         put?: never;
         /**
          * Create a data integration
-         * @description Creates a data integration for a provider. Set `credentials.type` to `custom` to use your own OAuth app credentials or `organization` to have each organization supply its own. Set `auth_methods` to `["api_key"]` to create an API key integration; you may optionally supply an `api_key` block to install a first tenant in the same call. For a built-in provider, pass its slug as `provider`. For a custom provider, pass a new slug plus a `custom_provider` definition.
+         * @description Creates a data integration for a provider. Set `credentials.type` to `custom` to use your own OAuth app credentials or `organization` to have each organization supply its own. Set `auth_methods` to `["api_key"]` to create an API key integration; you may optionally supply an `api_key` block to install a first tenant in the same call. Set `auth_methods` to `["client_credentials"]` to create a client-credentials integration; client credentials are installed per-tenant afterwards. For a built-in provider, pass its slug as `provider`. For a custom provider, pass a new slug plus a `custom_provider` definition.
          */
         post: operations["DataIntegrationsManagementController_createDataIntegration"];
         delete?: never;
@@ -1165,6 +1165,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/data-integrations/{slug}/client-credentials": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        /**
+         * Upsert client credentials for a connected account
+         * @description Creates or updates a client-credentials-based installation for the specified integration and user. If an installation already exists, the stored client credentials are rotated to the new values.
+         */
+        put: operations["DataIntegrationsController_upsertClientCredentials"];
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/data-integrations/{slug}/credentials": {
         parameters: {
             query?: never;
@@ -4322,12 +4342,12 @@ export interface components {
              */
             scopes?: string[] | null;
             /**
-             * @description How accounts authenticate with the provider. Defaults to `["oauth"]`. Use `["api_key"]` to declare an API key integration; `credentials` is then not required and keys are supplied per-tenant (optionally via `api_key` on this request).
+             * @description How accounts authenticate with the provider. Defaults to `["oauth"]`. Use `["api_key"]` to declare an API key integration; `credentials` is then not required and keys are supplied per-tenant (optionally via `api_key` on this request). Use `["client_credentials"]` to declare a client-credentials integration; `credentials` is likewise not required and client credentials are supplied per-tenant.
              * @example [
              *       "oauth"
              *     ]
              */
-            auth_methods?: ("oauth" | "api_key")[];
+            auth_methods?: ("oauth" | "api_key" | "client_credentials")[];
             /**
              * @description Provider-specific config values (e.g. a Snowflake `account_identifier`), keyed by the config field. Only fields the built-in provider declares are accepted.
              * @example {
@@ -15358,7 +15378,7 @@ export interface components {
              *     ]
              */
             auth_methods: ("oauth" | "api_key" | "client_credentials")[];
-            /** @description The credentials configured for the Data Integration. */
+            /** @description The integration-level OAuth app credentials. `null` for `api_key` integrations, which hold no OAuth credentials (keys are installed per-tenant). */
             credentials: {
                 /**
                  * @description The credentials type. `custom` uses your own OAuth app credentials; `organization` has each organization supply its own credentials (so `client_id`/`redacted_client_secret` are null on the integration itself).
@@ -15376,7 +15396,7 @@ export interface components {
                  * @example 6789
                  */
                 redacted_client_secret: string | null;
-            };
+            } | null;
             /**
              * @description The tenant installation created when an API key was supplied at creation time; `null` otherwise. Not populated on list/get responses.
              * @example null
@@ -24000,6 +24020,137 @@ export interface operations {
             };
         };
     };
+    DataIntegrationsController_upsertClientCredentials: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The identifier of the integration. */
+                slug: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /**
+                     * @description A [User](/reference/authkit/user) identifier.
+                     * @example user_01EHZNVPK3SFK441A1RGBFSHRT
+                     */
+                    user_id: string;
+                    /**
+                     * @description An [Organization](/reference/organization) identifier. Optional parameter to scope the connection to a specific organization.
+                     * @example org_01EHZNVPK3SFK441A1RGBFSHRT
+                     */
+                    organization_id?: string;
+                    /**
+                     * @description The OAuth client ID to store for this integration.
+                     * @example 3MVG9...
+                     */
+                    client_id: string;
+                    /**
+                     * @description The OAuth client secret to store for this integration.
+                     * @example shhh-secret
+                     */
+                    client_secret: string;
+                    /**
+                     * @description Provider-specific configuration values collected for this installation, keyed by the provider's config field descriptors.
+                     * @example {
+                     *       "mydomain": "acme"
+                     *     }
+                     */
+                    config?: {
+                        [key: string]: string;
+                    };
+                };
+            };
+        };
+        responses: {
+            /** @description The resulting connected account after the upsert. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "object": "connected_account",
+                     *       "id": "data_installation_01EHZNVPK3SFK441A1RGBFSHRT",
+                     *       "user_id": "user_01EHZNVPK3SFK441A1RGBFSHRT",
+                     *       "organization_id": "org_01EHZNVPK3SFK441A1RGBFSHRT",
+                     *       "scopes": [],
+                     *       "auth_method": "client_credentials",
+                     *       "state": "connected",
+                     *       "created_at": "2024-01-16T14:20:00.000Z",
+                     *       "updated_at": "2024-01-16T14:20:00.000Z"
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ConnectedAccount"];
+                };
+            };
+            /** @description Bad Request */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            /** @description Unauthorized */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Forbidden */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            /** @description Data integration not found for the given provider slug. */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            /** @description The matched installation uses a different auth method than this endpoint expects. */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AuthMethodMismatchError"];
+                };
+            };
+        };
+    };
     DataIntegrationsController_vendCredentials: {
         parameters: {
             query?: never;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@workos/openapi-spec",
-  "version": "0.53.0",
+  "version": "0.55.0",
   "type": "module",
   "description": "WorkOS OpenAPI specification, TypeScript types, and SDK resolution policy",
   "license": "MIT",