@workos/openapi-spec 0.59.0 → 0.61.0

package/dist/open-api-spec.yaml

@@ -7089,6 +7089,7 @@ paths:
               - GoogleOIDC
               - GoogleSAML
               - GrokOAuth
+              - XOAuth
               - IntuitOAuth
               - JumpCloudSAML
               - KeycloakSAML
@@ -12531,11 +12532,19 @@ paths:
                       example: '123456'
                     verification_id:
                       type: string
-                      description: The ID of the Radar SMS verification being confirmed.
+                      description: >-
+                        The ID of the Radar SMS verification being confirmed.
+                        Required for sign-up challenges; omitted for sign-in
+                        challenges, where the verification is resolved
+                        server-side.
                       example: vrf_01HXYZ123456789ABCDEFGHIJ
                     phone_number:
                       type: string
-                      description: The phone number the Radar SMS challenge was sent to.
+                      description: >-
+                        The phone number the Radar SMS challenge was sent to.
+                        Required for sign-up challenges; omitted for sign-in
+                        challenges, where the phone number on file is resolved
+                        server-side.
                       example: '+15555550123'
                     pending_authentication_token:
                       type: string
@@ -12560,8 +12569,6 @@ paths:
                     - client_secret
                     - grant_type
                     - code
-                    - verification_id
-                    - phone_number
                     - pending_authentication_token
                 - type: object
                   properties:
@@ -12731,6 +12738,34 @@ paths:
                     required:
                       - code
                       - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: phone_number_required
+                        const: phone_number_required
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: verification_id_required
+                        const: verification_id_required
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
                   - type: object
                     properties:
                       error:
@@ -13231,6 +13266,20 @@ paths:
                     required:
                       - code
                       - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: radar_sms_sign_in_challenge
+                        const: radar_sms_sign_in_challenge
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
                   - type: object
                     properties:
                       code:
@@ -16648,6 +16697,20 @@ paths:
                     required:
                       - code
                       - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: password_salt_position_requires_password_hash
+                        const: password_salt_position_requires_password_hash
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
                   - type: object
                     properties:
                       code:
@@ -16706,6 +16769,10 @@ paths:
             hashed:
               - password_hash
               - password_hash_type
+              - password_salt_position
+          optionalFields:
+            hashed:
+              - password_salt_position
   /user_management/users/external_id/{external_id}:
     get:
       description: >-
@@ -16852,6 +16919,20 @@ paths:
                     required:
                       - code
                       - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: password_salt_position_requires_password_hash
+                        const: password_salt_position_requires_password_hash
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
                   - type: object
                     properties:
                       code:
@@ -16972,7 +17053,7 @@ paths:
       summary: Update a user
       tags:
         - user-management.users
-      x-mutually-exclusive-body-groups: &ref_15
+      x-mutually-exclusive-body-groups: &ref_16
         password:
           optional: true
           variants:
@@ -16981,6 +17062,10 @@ paths:
             hashed:
               - password_hash
               - password_hash_type
+              - password_salt_position
+          optionalFields:
+            hashed:
+              - password_salt_position
     get:
       description: Get the details of an existing user.
       operationId: UserlandUsersController_get[0]
@@ -17044,6 +17129,25 @@ paths:
                     example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
                 required:
                   - message
+        '409':
+          description: ''
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code:
+                    type: string
+                    description: The error code identifying the type of error.
+                    example: user_deletion_not_allowed
+                    const: user_deletion_not_allowed
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: Request could not be processed.
+                required:
+                  - code
+                  - message
       summary: Delete a user
       tags:
         - user-management.users
@@ -17732,6 +17836,7 @@ paths:
                         - GitLabOAuth
                         - GoogleOAuth
                         - GrokOAuth
+                        - XOAuth
                         - IntuitOAuth
                         - LinkedInOAuth
                         - MicrosoftOAuth
@@ -22125,6 +22230,11 @@ components:
                         x-exclude-from-lint: true
                     required:
                       - password_hash_type
+                  - properties:
+                      password_salt_position:
+                        x-exclude-from-lint: true
+                    required:
+                      - password_salt_position
             - type: object
               properties:
                 password:
@@ -22133,7 +22243,8 @@ components:
                     - 'null'
                   description: >-
                     The password to set for the user. Mutually exclusive with
-                    `password_hash` and `password_hash_type`.
+                    `password_hash`, `password_hash_type`, and
+                    `password_salt_position`.
                   example: strong_password_123!
               required:
                 - password
@@ -22149,6 +22260,11 @@ components:
                         x-exclude-from-lint: true
                     required:
                       - password_hash_type
+                  - properties:
+                      password_salt_position:
+                        x-exclude-from-lint: true
+                    required:
+                      - password_salt_position
             - type: object
               properties:
                 password_hash:
@@ -22172,6 +22288,19 @@ components:
                     when providing a `password_hash`. Required with
                     `password_hash`. Mutually exclusive with `password`.
                   example: bcrypt
+                password_salt_position:
+                  type: string
+                  enum: &ref_15
+                    - prefix
+                    - suffix
+                  description: >-
+                    The position of the salt relative to the password when the
+                    `password_hash` digest was computed: `prefix` for `hash(salt
+                    + password)` or `suffix` for `hash(password + salt)`. Only
+                    supported with the `ssha256` hash type and only valid when a
+                    `password_hash` is provided. Defaults to `suffix`. Mutually
+                    exclusive with `password`.
+                  example: prefix
               required:
                 - password_hash
                 - password_hash_type
@@ -22253,13 +22382,19 @@ components:
                         x-exclude-from-lint: true
                     required:
                       - password_hash_type
+                  - properties:
+                      password_salt_position:
+                        x-exclude-from-lint: true
+                    required:
+                      - password_salt_position
             - type: object
               properties:
                 password:
                   type: string
                   description: >-
                     The password to set for the user. Mutually exclusive with
-                    `password_hash` and `password_hash_type`.
+                    `password_hash`, `password_hash_type`, and
+                    `password_salt_position`.
                   example: strong_password_123!
               required:
                 - password
@@ -22275,6 +22410,11 @@ components:
                         x-exclude-from-lint: true
                     required:
                       - password_hash_type
+                  - properties:
+                      password_salt_position:
+                        x-exclude-from-lint: true
+                    required:
+                      - password_salt_position
             - type: object
               properties:
                 password_hash:
@@ -22291,6 +22431,17 @@ components:
                     when providing a `password_hash`. Required with
                     `password_hash`. Mutually exclusive with `password`.
                   example: bcrypt
+                password_salt_position:
+                  type: string
+                  enum: *ref_15
+                  description: >-
+                    The position of the salt relative to the password when the
+                    `password_hash` digest was computed: `prefix` for `hash(salt
+                    + password)` or `suffix` for `hash(password + salt)`. Only
+                    supported with the `ssha256` hash type and only valid when a
+                    `password_hash` is provided. Defaults to `suffix`. Mutually
+                    exclusive with `password`.
+                  example: prefix
               required:
                 - password_hash
                 - password_hash_type
@@ -22301,7 +22452,7 @@ components:
                         x-exclude-from-lint: true
                     required:
                       - password
-      x-mutually-exclusive-body-groups: *ref_15
+      x-mutually-exclusive-body-groups: *ref_16
     VerifyEmailAddressDto:
       type: object
       properties:
@@ -22376,7 +22527,7 @@ components:
           description: The events that the Webhook Endpoint is subscribed to.
           items:
             type: string
-            enum: &ref_16
+            enum: &ref_17
               - agent.registration.created
               - agent.registration.claim.attempt.created
               - agent.registration.claim.completed
@@ -22495,7 +22646,7 @@ components:
           description: The events that the Webhook Endpoint is subscribed to.
           items:
             type: string
-            enum: *ref_16
+            enum: *ref_17
           example:
             - user.created
             - dsync.user.created
@@ -24828,6 +24979,7 @@ components:
             - GoogleOIDC
             - GoogleSAML
             - GrokOAuth
+            - XOAuth
             - IntuitOAuth
             - JumpCloudSAML
             - KeycloakSAML
@@ -25797,7 +25949,7 @@ components:
           description: >-
             An object containing the custom attribute mapping for the Directory
             Provider.
-          example: &ref_19
+          example: &ref_20
             department: Engineering
             job_title: Software Engineer
         role:
@@ -25981,7 +26133,7 @@ components:
               type: object
               additionalProperties: {}
               description: The event payload.
-              example: &ref_17
+              example: &ref_18
                 id: directory_user_01E1JG7J09H96KYP8HM9B0G5SJ
                 directory_id: directory_01ECAZ4NV9QMV47GW873HDCX74
                 organization_id: org_01EZTR6WYX1A0DSE2CYMGXQ24Y
@@ -26016,11 +26168,11 @@ components:
             - data
             - created_at
           description: An event emitted by WorkOS.
-          example: &ref_24
+          example: &ref_25
             object: event
             id: event_01EHZNVPK3SFK441A1RGBFSHRT
             event: dsync.user.created
-            data: *ref_17
+            data: *ref_18
             created_at: '2021-06-25T19:07:33.155Z'
             context: {}
         - oneOf:
@@ -26836,7 +26988,7 @@ components:
                       items:
                         type: string
                       description: The permissions granted to the API key.
-                      example: &ref_18
+                      example: &ref_19
                         - users:read
                         - users:write
                     created_at:
@@ -26962,7 +27114,7 @@ components:
                       items:
                         type: string
                       description: The permissions granted to the API key.
-                      example: *ref_18
+                      example: *ref_19
                     created_at:
                       type: string
                       description: The timestamp when the API key was created.
@@ -27086,7 +27238,7 @@ components:
                       items:
                         type: string
                       description: The permissions granted to the API key.
-                      example: *ref_18
+                      example: *ref_19
                     created_at:
                       type: string
                       description: The timestamp when the API key was created.
@@ -28627,6 +28779,7 @@ components:
                         - GoogleOIDC
                         - GoogleSAML
                         - GrokOAuth
+                        - XOAuth
                         - IntuitOAuth
                         - JumpCloudSAML
                         - KeycloakSAML
@@ -28793,6 +28946,7 @@ components:
                         - GoogleOIDC
                         - GoogleSAML
                         - GrokOAuth
+                        - XOAuth
                         - IntuitOAuth
                         - JumpCloudSAML
                         - KeycloakSAML
@@ -28959,6 +29113,7 @@ components:
                         - GoogleOIDC
                         - GoogleSAML
                         - GrokOAuth
+                        - XOAuth
                         - IntuitOAuth
                         - JumpCloudSAML
                         - KeycloakSAML
@@ -29951,7 +30106,7 @@ components:
                       description: >-
                         An object containing the custom attribute mapping for
                         the Directory Provider.
-                      example: *ref_19
+                      example: *ref_20
                     role:
                       $ref: '#/components/schemas/SlimRole'
                     roles:
@@ -30141,7 +30296,7 @@ components:
                       description: >-
                         Labels assigned to the Feature Flag for categorizing and
                         filtering.
-                      example: &ref_20
+                      example: &ref_21
                         - reports
                     enabled:
                       type: boolean
@@ -30302,7 +30457,7 @@ components:
                       description: >-
                         Labels assigned to the Feature Flag for categorizing and
                         filtering.
-                      example: *ref_20
+                      example: *ref_21
                     enabled:
                       type: boolean
                       description: >-
@@ -30462,7 +30617,7 @@ components:
                       description: >-
                         Labels assigned to the Feature Flag for categorizing and
                         filtering.
-                      example: *ref_20
+                      example: *ref_21
                     enabled:
                       type: boolean
                       description: >-
@@ -30742,7 +30897,7 @@ components:
                       description: >-
                         Labels assigned to the Feature Flag for categorizing and
                         filtering.
-                      example: *ref_20
+                      example: *ref_21
                     enabled:
                       type: boolean
                       description: >-
@@ -31730,7 +31885,7 @@ components:
                       description: >-
                         Object containing [metadata](/authkit/metadata)
                         key/value pairs associated with the Organization.
-                      example: &ref_21
+                      example: &ref_22
                         tier: diamond
                       propertyNames:
                         maxLength: 40
@@ -31880,7 +32035,7 @@ components:
                       description: >-
                         Object containing [metadata](/authkit/metadata)
                         key/value pairs associated with the Organization.
-                      example: *ref_21
+                      example: *ref_22
                       propertyNames:
                         maxLength: 40
                       maxProperties: 50
@@ -32707,7 +32862,7 @@ components:
                       items:
                         type: string
                       description: The permissions granted by the role.
-                      example: &ref_22
+                      example: &ref_23
                         - users:read
                         - users:write
                     created_at:
@@ -32791,7 +32946,7 @@ components:
                       items:
                         type: string
                       description: The permissions granted by the role.
-                      example: *ref_22
+                      example: *ref_23
                     created_at:
                       format: date-time
                       type: string
@@ -32873,7 +33028,7 @@ components:
                       items:
                         type: string
                       description: The permissions granted by the role.
-                      example: *ref_22
+                      example: *ref_23
                     created_at:
                       format: date-time
                       type: string
@@ -33010,7 +33165,7 @@ components:
                       description: >-
                         Object containing [metadata](/authkit/metadata)
                         key/value pairs associated with the Organization.
-                      example: *ref_21
+                      example: *ref_22
                       propertyNames:
                         maxLength: 40
                       maxProperties: 50
@@ -33693,7 +33848,7 @@ components:
                       items:
                         type: string
                       description: The permissions granted by the role.
-                      example: &ref_23
+                      example: &ref_24
                         - users:read
                         - users:write
                     created_at:
@@ -33759,7 +33914,7 @@ components:
                       items:
                         type: string
                       description: The permissions granted by the role.
-                      example: *ref_23
+                      example: *ref_24
                     created_at:
                       format: date-time
                       type: string
@@ -33823,7 +33978,7 @@ components:
                       items:
                         type: string
                       description: The permissions granted by the role.
-                      example: *ref_23
+                      example: *ref_24
                     created_at:
                       format: date-time
                       type: string
@@ -34963,7 +35118,7 @@ components:
                 - data
                 - created_at
                 - object
-      example: *ref_24
+      example: *ref_25
       description: An event emitted by WorkOS.
     EventList:
       type: object
@@ -34998,7 +35153,7 @@ components:
       example:
         object: list
         data:
-          - *ref_24
+          - *ref_25
         list_metadata:
           after: event_01EHZNVPK3SFK441A1RGBFSHRT
     JwtTemplate:
@@ -36538,6 +36693,34 @@ components:
             The last four characters of the API key, or `null` for OAuth
             connections.
           example: null
+        client_id:
+          type:
+            - string
+            - 'null'
+          description: >-
+            The client ID supplied for this connection. Only present when
+            `auth_method` is `client_credentials`.
+          example: 3MVG9dZJodJWxft2VoStSCVwPFsx0eDcpVc
+        client_secret_last_4:
+          type:
+            - string
+            - 'null'
+          description: >-
+            The last four characters of the client secret supplied for this
+            connection, or `null` when it can't be read. Only present when
+            `auth_method` is `client_credentials`.
+          example: cdef
+        config:
+          type: object
+          additionalProperties:
+            type: string
+          description: >-
+            The connection-level configuration values stored for this connection
+            — the fields the provider declares at `installation` scope,
+            excluding any it declares as secret. Only present when `auth_method`
+            is `client_credentials`.
+          example:
+            instance_url: https://example.my.salesforce.com
         state:
           type: string
           enum:
@@ -36733,6 +36916,36 @@ components:
                           The last four characters of the API key, or `null` for
                           OAuth connections.
                         example: null
+                      client_id:
+                        type:
+                          - string
+                          - 'null'
+                        description: >-
+                          The client ID supplied for this connection. Only
+                          present when `auth_method` is `client_credentials`.
+                        example: 3MVG9dZJodJWxft2VoStSCVwPFsx0eDcpVc
+                      client_secret_last_4:
+                        type:
+                          - string
+                          - 'null'
+                        description: >-
+                          The last four characters of the client secret supplied
+                          for this connection, or `null` when it can't be read.
+                          Only present when `auth_method` is
+                          `client_credentials`.
+                        example: cdef
+                      config:
+                        type: object
+                        additionalProperties:
+                          type: string
+                        description: >-
+                          The connection-level configuration values stored for
+                          this connection — the fields the provider declares at
+                          `installation` scope, excluding any it declares as
+                          secret. Only present when `auth_method` is
+                          `client_credentials`.
+                        example:
+                          instance_url: https://example.my.salesforce.com
                       state:
                         type: string
                         enum:
@@ -37810,6 +38023,7 @@ components:
             - GitLabOAuth
             - GoogleOAuth
             - GrokOAuth
+            - XOAuth
             - IntuitOAuth
             - LinkedInOAuth
             - MicrosoftOAuth
@@ -38089,6 +38303,7 @@ components:
             - GoogleOIDC
             - GoogleSAML
             - GrokOAuth
+            - XOAuth
             - IntuitOAuth
             - JumpCloudSAML
             - KeycloakSAML

package/dist/types.d.ts

@@ -4781,7 +4781,7 @@ export interface components {
             signals_id?: string;
         } & (Record<string, never> | {
             /**
-             * @description The password to set for the user. Mutually exclusive with `password_hash` and `password_hash_type`.
+             * @description The password to set for the user. Mutually exclusive with `password_hash`, `password_hash_type`, and `password_salt_position`.
              * @example strong_password_123!
              */
             password: string | null;
@@ -4797,6 +4797,12 @@ export interface components {
              * @enum {string}
              */
             password_hash_type: "bcrypt" | "firebase-scrypt" | "ssha" | "ssha256" | "scrypt" | "pbkdf2" | "argon2";
+            /**
+             * @description The position of the salt relative to the password when the `password_hash` digest was computed: `prefix` for `hash(salt + password)` or `suffix` for `hash(password + salt)`. Only supported with the `ssha256` hash type and only valid when a `password_hash` is provided. Defaults to `suffix`. Mutually exclusive with `password`.
+             * @example prefix
+             * @enum {string}
+             */
+            password_salt_position?: "prefix" | "suffix";
         });
         UpdateUserlandUserDto: {
             /**
@@ -4846,7 +4852,7 @@ export interface components {
             locale?: string | null;
         } & (Record<string, never> | {
             /**
-             * @description The password to set for the user. Mutually exclusive with `password_hash` and `password_hash_type`.
+             * @description The password to set for the user. Mutually exclusive with `password_hash`, `password_hash_type`, and `password_salt_position`.
              * @example strong_password_123!
              */
             password: string;
@@ -4862,6 +4868,12 @@ export interface components {
              * @enum {string}
              */
             password_hash_type: "bcrypt" | "firebase-scrypt" | "ssha" | "ssha256" | "scrypt" | "pbkdf2" | "argon2";
+            /**
+             * @description The position of the salt relative to the password when the `password_hash` digest was computed: `prefix` for `hash(salt + password)` or `suffix` for `hash(password + salt)`. Only supported with the `ssha256` hash type and only valid when a `password_hash` is provided. Defaults to `suffix`. Mutually exclusive with `password`.
+             * @example prefix
+             * @enum {string}
+             */
+            password_salt_position?: "prefix" | "suffix";
         });
         VerifyEmailAddressDto: {
             /**
@@ -6789,7 +6801,7 @@ export interface components {
              * @example OktaSAML
              * @enum {string}
              */
-            connection_type: "Pending" | "ADFSSAML" | "AdpOidc" | "AppleOAuth" | "Auth0Migration" | "Auth0SAML" | "AzureSAML" | "BitbucketOAuth" | "CasSAML" | "ClassLinkSAML" | "CleverOIDC" | "CloudflareSAML" | "CyberArkSAML" | "DiscordOAuth" | "DuoSAML" | "EntraIdOIDC" | "GenericOIDC" | "GenericSAML" | "GitHubOAuth" | "GitLabOAuth" | "GoogleOAuth" | "GoogleOIDC" | "GoogleSAML" | "GrokOAuth" | "IntuitOAuth" | "JumpCloudSAML" | "KeycloakSAML" | "LastPassSAML" | "LinkedInOAuth" | "LoginGovOidc" | "MagicLink" | "MicrosoftOAuth" | "MiniOrangeSAML" | "NetIqSAML" | "OktaOIDC" | "OktaSAML" | "OneLoginSAML" | "OracleSAML" | "PingFederateSAML" | "PingOneSAML" | "RipplingSAML" | "SalesforceSAML" | "ShibbolethGenericSAML" | "ShibbolethSAML" | "SimpleSamlPhpSAML" | "SalesforceOAuth" | "SlackOAuth" | "TestIdp" | "VercelMarketplaceOAuth" | "VercelOAuth" | "VMwareSAML" | "XeroOAuth";
+            connection_type: "Pending" | "ADFSSAML" | "AdpOidc" | "AppleOAuth" | "Auth0Migration" | "Auth0SAML" | "AzureSAML" | "BitbucketOAuth" | "CasSAML" | "ClassLinkSAML" | "CleverOIDC" | "CloudflareSAML" | "CyberArkSAML" | "DiscordOAuth" | "DuoSAML" | "EntraIdOIDC" | "GenericOIDC" | "GenericSAML" | "GitHubOAuth" | "GitLabOAuth" | "GoogleOAuth" | "GoogleOIDC" | "GoogleSAML" | "GrokOAuth" | "XOAuth" | "IntuitOAuth" | "JumpCloudSAML" | "KeycloakSAML" | "LastPassSAML" | "LinkedInOAuth" | "LoginGovOidc" | "MagicLink" | "MicrosoftOAuth" | "MiniOrangeSAML" | "NetIqSAML" | "OktaOIDC" | "OktaSAML" | "OneLoginSAML" | "OracleSAML" | "PingFederateSAML" | "PingOneSAML" | "RipplingSAML" | "SalesforceSAML" | "ShibbolethGenericSAML" | "ShibbolethSAML" | "SimpleSamlPhpSAML" | "SalesforceOAuth" | "SlackOAuth" | "TestIdp" | "VercelMarketplaceOAuth" | "VercelOAuth" | "VMwareSAML" | "XeroOAuth";
             /**
              * @description A human-readable name for the Connection. This will most commonly be the organization's name.
              * @example Foo Corp
@@ -9683,7 +9695,7 @@ export interface components {
                  * @example OktaSAML
                  * @enum {string}
                  */
-                connection_type: "ADFSSAML" | "AdpOidc" | "AppleOAuth" | "Auth0Migration" | "Auth0SAML" | "AzureSAML" | "BitbucketOAuth" | "CasSAML" | "ClassLinkSAML" | "CleverOIDC" | "CloudflareSAML" | "CyberArkSAML" | "DiscordOAuth" | "DuoSAML" | "EntraIdOIDC" | "GenericOIDC" | "GenericSAML" | "GitHubOAuth" | "GitLabOAuth" | "GoogleOAuth" | "GoogleOIDC" | "GoogleSAML" | "GrokOAuth" | "IntuitOAuth" | "JumpCloudSAML" | "KeycloakSAML" | "LastPassSAML" | "LinkedInOAuth" | "LoginGovOidc" | "MagicLink" | "MicrosoftOAuth" | "MiniOrangeSAML" | "NetIqSAML" | "OktaOIDC" | "OktaSAML" | "OneLoginSAML" | "OracleSAML" | "PingFederateSAML" | "PingOneSAML" | "RipplingSAML" | "SalesforceSAML" | "ShibbolethGenericSAML" | "ShibbolethSAML" | "SimpleSamlPhpSAML" | "SalesforceOAuth" | "SlackOAuth" | "TestIdp" | "VercelMarketplaceOAuth" | "VercelOAuth" | "VMwareSAML" | "XeroOAuth";
+                connection_type: "ADFSSAML" | "AdpOidc" | "AppleOAuth" | "Auth0Migration" | "Auth0SAML" | "AzureSAML" | "BitbucketOAuth" | "CasSAML" | "ClassLinkSAML" | "CleverOIDC" | "CloudflareSAML" | "CyberArkSAML" | "DiscordOAuth" | "DuoSAML" | "EntraIdOIDC" | "GenericOIDC" | "GenericSAML" | "GitHubOAuth" | "GitLabOAuth" | "GoogleOAuth" | "GoogleOIDC" | "GoogleSAML" | "GrokOAuth" | "XOAuth" | "IntuitOAuth" | "JumpCloudSAML" | "KeycloakSAML" | "LastPassSAML" | "LinkedInOAuth" | "LoginGovOidc" | "MagicLink" | "MicrosoftOAuth" | "MiniOrangeSAML" | "NetIqSAML" | "OktaOIDC" | "OktaSAML" | "OneLoginSAML" | "OracleSAML" | "PingFederateSAML" | "PingOneSAML" | "RipplingSAML" | "SalesforceSAML" | "ShibbolethGenericSAML" | "ShibbolethSAML" | "SimpleSamlPhpSAML" | "SalesforceOAuth" | "SlackOAuth" | "TestIdp" | "VercelMarketplaceOAuth" | "VercelOAuth" | "VMwareSAML" | "XeroOAuth";
                 /**
                  * @description The ID of the organization the connection belongs to.
                  * @example org_01EHWNCE74X7JSDV0X3SZ3KJNY
@@ -9779,7 +9791,7 @@ export interface components {
                  * @example OktaSAML
                  * @enum {string}
                  */
-                connection_type: "ADFSSAML" | "AdpOidc" | "AppleOAuth" | "Auth0Migration" | "Auth0SAML" | "AzureSAML" | "BitbucketOAuth" | "CasSAML" | "ClassLinkSAML" | "CleverOIDC" | "CloudflareSAML" | "CyberArkSAML" | "DiscordOAuth" | "DuoSAML" | "EntraIdOIDC" | "GenericOIDC" | "GenericSAML" | "GitHubOAuth" | "GitLabOAuth" | "GoogleOAuth" | "GoogleOIDC" | "GoogleSAML" | "GrokOAuth" | "IntuitOAuth" | "JumpCloudSAML" | "KeycloakSAML" | "LastPassSAML" | "LinkedInOAuth" | "LoginGovOidc" | "MagicLink" | "MicrosoftOAuth" | "MiniOrangeSAML" | "NetIqSAML" | "OktaOIDC" | "OktaSAML" | "OneLoginSAML" | "OracleSAML" | "PingFederateSAML" | "PingOneSAML" | "RipplingSAML" | "SalesforceSAML" | "ShibbolethGenericSAML" | "ShibbolethSAML" | "SimpleSamlPhpSAML" | "SalesforceOAuth" | "SlackOAuth" | "TestIdp" | "VercelMarketplaceOAuth" | "VercelOAuth" | "VMwareSAML" | "XeroOAuth";
+                connection_type: "ADFSSAML" | "AdpOidc" | "AppleOAuth" | "Auth0Migration" | "Auth0SAML" | "AzureSAML" | "BitbucketOAuth" | "CasSAML" | "ClassLinkSAML" | "CleverOIDC" | "CloudflareSAML" | "CyberArkSAML" | "DiscordOAuth" | "DuoSAML" | "EntraIdOIDC" | "GenericOIDC" | "GenericSAML" | "GitHubOAuth" | "GitLabOAuth" | "GoogleOAuth" | "GoogleOIDC" | "GoogleSAML" | "GrokOAuth" | "XOAuth" | "IntuitOAuth" | "JumpCloudSAML" | "KeycloakSAML" | "LastPassSAML" | "LinkedInOAuth" | "LoginGovOidc" | "MagicLink" | "MicrosoftOAuth" | "MiniOrangeSAML" | "NetIqSAML" | "OktaOIDC" | "OktaSAML" | "OneLoginSAML" | "OracleSAML" | "PingFederateSAML" | "PingOneSAML" | "RipplingSAML" | "SalesforceSAML" | "ShibbolethGenericSAML" | "ShibbolethSAML" | "SimpleSamlPhpSAML" | "SalesforceOAuth" | "SlackOAuth" | "TestIdp" | "VercelMarketplaceOAuth" | "VercelOAuth" | "VMwareSAML" | "XeroOAuth";
                 /**
                  * @description The ID of the organization the connection belongs to.
                  * @example org_01EHWNCE74X7JSDV0X3SZ3KJNY
@@ -9875,7 +9887,7 @@ export interface components {
                  * @example OktaSAML
                  * @enum {string}
                  */
-                connection_type: "ADFSSAML" | "AdpOidc" | "AppleOAuth" | "Auth0Migration" | "Auth0SAML" | "AzureSAML" | "BitbucketOAuth" | "CasSAML" | "ClassLinkSAML" | "CleverOIDC" | "CloudflareSAML" | "CyberArkSAML" | "DiscordOAuth" | "DuoSAML" | "EntraIdOIDC" | "GenericOIDC" | "GenericSAML" | "GitHubOAuth" | "GitLabOAuth" | "GoogleOAuth" | "GoogleOIDC" | "GoogleSAML" | "GrokOAuth" | "IntuitOAuth" | "JumpCloudSAML" | "KeycloakSAML" | "LastPassSAML" | "LinkedInOAuth" | "LoginGovOidc" | "MagicLink" | "MicrosoftOAuth" | "MiniOrangeSAML" | "NetIqSAML" | "OktaOIDC" | "OktaSAML" | "OneLoginSAML" | "OracleSAML" | "PingFederateSAML" | "PingOneSAML" | "RipplingSAML" | "SalesforceSAML" | "ShibbolethGenericSAML" | "ShibbolethSAML" | "SimpleSamlPhpSAML" | "SalesforceOAuth" | "SlackOAuth" | "TestIdp" | "VercelMarketplaceOAuth" | "VercelOAuth" | "VMwareSAML" | "XeroOAuth";
+                connection_type: "ADFSSAML" | "AdpOidc" | "AppleOAuth" | "Auth0Migration" | "Auth0SAML" | "AzureSAML" | "BitbucketOAuth" | "CasSAML" | "ClassLinkSAML" | "CleverOIDC" | "CloudflareSAML" | "CyberArkSAML" | "DiscordOAuth" | "DuoSAML" | "EntraIdOIDC" | "GenericOIDC" | "GenericSAML" | "GitHubOAuth" | "GitLabOAuth" | "GoogleOAuth" | "GoogleOIDC" | "GoogleSAML" | "GrokOAuth" | "XOAuth" | "IntuitOAuth" | "JumpCloudSAML" | "KeycloakSAML" | "LastPassSAML" | "LinkedInOAuth" | "LoginGovOidc" | "MagicLink" | "MicrosoftOAuth" | "MiniOrangeSAML" | "NetIqSAML" | "OktaOIDC" | "OktaSAML" | "OneLoginSAML" | "OracleSAML" | "PingFederateSAML" | "PingOneSAML" | "RipplingSAML" | "SalesforceSAML" | "ShibbolethGenericSAML" | "ShibbolethSAML" | "SimpleSamlPhpSAML" | "SalesforceOAuth" | "SlackOAuth" | "TestIdp" | "VercelMarketplaceOAuth" | "VercelOAuth" | "VMwareSAML" | "XeroOAuth";
                 /**
                  * @description The ID of the organization the connection belongs to.
                  * @example org_01EHWNCE74X7JSDV0X3SZ3KJNY
@@ -15777,6 +15789,25 @@ export interface components {
              * @example null
              */
             api_key_last_4?: string | null;
+            /**
+             * @description The client ID supplied for this connection. Only present when `auth_method` is `client_credentials`.
+             * @example 3MVG9dZJodJWxft2VoStSCVwPFsx0eDcpVc
+             */
+            client_id?: string | null;
+            /**
+             * @description The last four characters of the client secret supplied for this connection, or `null` when it can't be read. Only present when `auth_method` is `client_credentials`.
+             * @example cdef
+             */
+            client_secret_last_4?: string | null;
+            /**
+             * @description The connection-level configuration values stored for this connection — the fields the provider declares at `installation` scope, excluding any it declares as secret. Only present when `auth_method` is `client_credentials`.
+             * @example {
+             *       "instance_url": "https://example.my.salesforce.com"
+             *     }
+             */
+            config?: {
+                [key: string]: string;
+            };
             /**
              * @description The state of the connected account:
              *     - `connected`: The connection is active and tokens are valid.
@@ -15931,6 +15962,25 @@ export interface components {
                      * @example null
                      */
                     api_key_last_4?: string | null;
+                    /**
+                     * @description The client ID supplied for this connection. Only present when `auth_method` is `client_credentials`.
+                     * @example 3MVG9dZJodJWxft2VoStSCVwPFsx0eDcpVc
+                     */
+                    client_id?: string | null;
+                    /**
+                     * @description The last four characters of the client secret supplied for this connection, or `null` when it can't be read. Only present when `auth_method` is `client_credentials`.
+                     * @example cdef
+                     */
+                    client_secret_last_4?: string | null;
+                    /**
+                     * @description The connection-level configuration values stored for this connection — the fields the provider declares at `installation` scope, excluding any it declares as secret. Only present when `auth_method` is `client_credentials`.
+                     * @example {
+                     *       "instance_url": "https://example.my.salesforce.com"
+                     *     }
+                     */
+                    config?: {
+                        [key: string]: string;
+                    };
                     /**
                      * @description The state of the connected account:
                      *     - `connected`: The connection is active and tokens are valid.
@@ -16728,7 +16778,7 @@ export interface components {
              * @example SSO
              * @enum {string}
              */
-            authentication_method?: "SSO" | "Password" | "Passkey" | "AppleOAuth" | "BitbucketOAuth" | "CrossAppAuth" | "DiscordOAuth" | "ExternalAuth" | "GitHubOAuth" | "GitLabOAuth" | "GoogleOAuth" | "GrokOAuth" | "IntuitOAuth" | "LinkedInOAuth" | "MicrosoftOAuth" | "SalesforceOAuth" | "SlackOAuth" | "VercelMarketplaceOAuth" | "VercelOAuth" | "XeroOAuth" | "MagicAuth" | "Impersonation" | "MigratedSession";
+            authentication_method?: "SSO" | "Password" | "Passkey" | "AppleOAuth" | "BitbucketOAuth" | "CrossAppAuth" | "DiscordOAuth" | "ExternalAuth" | "GitHubOAuth" | "GitLabOAuth" | "GoogleOAuth" | "GrokOAuth" | "XOAuth" | "IntuitOAuth" | "LinkedInOAuth" | "MicrosoftOAuth" | "SalesforceOAuth" | "SlackOAuth" | "VercelMarketplaceOAuth" | "VercelOAuth" | "XeroOAuth" | "MagicAuth" | "Impersonation" | "MigratedSession";
             /** @description Information about the impersonator if this session was created via impersonation. */
             impersonator?: {
                 /**
@@ -16928,7 +16978,7 @@ export interface components {
              * @example OktaSAML
              * @enum {string}
              */
-            connection_type: "Pending" | "ADFSSAML" | "AdpOidc" | "AppleOAuth" | "Auth0Migration" | "Auth0SAML" | "AzureSAML" | "BitbucketOAuth" | "CasSAML" | "ClassLinkSAML" | "CleverOIDC" | "CloudflareSAML" | "CyberArkSAML" | "DiscordOAuth" | "DuoSAML" | "EntraIdOIDC" | "GenericOIDC" | "GenericSAML" | "GitHubOAuth" | "GitLabOAuth" | "GoogleOAuth" | "GoogleOIDC" | "GoogleSAML" | "GrokOAuth" | "IntuitOAuth" | "JumpCloudSAML" | "KeycloakSAML" | "LastPassSAML" | "LinkedInOAuth" | "LoginGovOidc" | "MagicLink" | "MicrosoftOAuth" | "MiniOrangeSAML" | "NetIqSAML" | "OktaOIDC" | "OktaSAML" | "OneLoginSAML" | "OracleSAML" | "PingFederateSAML" | "PingOneSAML" | "RipplingSAML" | "SalesforceSAML" | "ShibbolethGenericSAML" | "ShibbolethSAML" | "SimpleSamlPhpSAML" | "SalesforceOAuth" | "SlackOAuth" | "TestIdp" | "VercelMarketplaceOAuth" | "VercelOAuth" | "VMwareSAML" | "XeroOAuth";
+            connection_type: "Pending" | "ADFSSAML" | "AdpOidc" | "AppleOAuth" | "Auth0Migration" | "Auth0SAML" | "AzureSAML" | "BitbucketOAuth" | "CasSAML" | "ClassLinkSAML" | "CleverOIDC" | "CloudflareSAML" | "CyberArkSAML" | "DiscordOAuth" | "DuoSAML" | "EntraIdOIDC" | "GenericOIDC" | "GenericSAML" | "GitHubOAuth" | "GitLabOAuth" | "GoogleOAuth" | "GoogleOIDC" | "GoogleSAML" | "GrokOAuth" | "XOAuth" | "IntuitOAuth" | "JumpCloudSAML" | "KeycloakSAML" | "LastPassSAML" | "LinkedInOAuth" | "LoginGovOidc" | "MagicLink" | "MicrosoftOAuth" | "MiniOrangeSAML" | "NetIqSAML" | "OktaOIDC" | "OktaSAML" | "OneLoginSAML" | "OracleSAML" | "PingFederateSAML" | "PingOneSAML" | "RipplingSAML" | "SalesforceSAML" | "ShibbolethGenericSAML" | "ShibbolethSAML" | "SimpleSamlPhpSAML" | "SalesforceOAuth" | "SlackOAuth" | "TestIdp" | "VercelMarketplaceOAuth" | "VercelOAuth" | "VMwareSAML" | "XeroOAuth";
             /**
              * @description The user's unique identifier from the identity provider.
              * @example 103456789012345678901
@@ -23362,7 +23412,7 @@ export interface operations {
                 /** @description Order the results by the creation time. */
                 order?: components["schemas"]["PaginationOrder"];
                 /** @description Filter Connections by their type. */
-                connection_type?: "ADFSSAML" | "AdpOidc" | "AppleOAuth" | "Auth0SAML" | "AzureSAML" | "BitbucketOAuth" | "CasSAML" | "CloudflareSAML" | "ClassLinkSAML" | "CleverOIDC" | "CyberArkSAML" | "DiscordOAuth" | "DuoSAML" | "EntraIdOIDC" | "GenericOIDC" | "GenericSAML" | "GithubOAuth" | "GitLabOAuth" | "GoogleOAuth" | "GoogleOIDC" | "GoogleSAML" | "GrokOAuth" | "IntuitOAuth" | "JumpCloudSAML" | "KeycloakSAML" | "LastPassSAML" | "LinkedInOAuth" | "LoginGovOidc" | "MagicLink" | "MicrosoftOAuth" | "MiniOrangeSAML" | "NetIqSAML" | "OktaOIDC" | "OktaSAML" | "OneLoginSAML" | "OracleSAML" | "PingFederateSAML" | "PingOneSAML" | "RipplingSAML" | "SalesforceSAML" | "ShibbolethGenericSAML" | "ShibbolethSAML" | "SimpleSamlPhpSAML" | "SalesforceOAuth" | "SlackOAuth" | "VercelMarketplaceOAuth" | "VercelOAuth" | "VMwareSAML" | "XeroOAuth";
+                connection_type?: "ADFSSAML" | "AdpOidc" | "AppleOAuth" | "Auth0SAML" | "AzureSAML" | "BitbucketOAuth" | "CasSAML" | "CloudflareSAML" | "ClassLinkSAML" | "CleverOIDC" | "CyberArkSAML" | "DiscordOAuth" | "DuoSAML" | "EntraIdOIDC" | "GenericOIDC" | "GenericSAML" | "GithubOAuth" | "GitLabOAuth" | "GoogleOAuth" | "GoogleOIDC" | "GoogleSAML" | "GrokOAuth" | "XOAuth" | "IntuitOAuth" | "JumpCloudSAML" | "KeycloakSAML" | "LastPassSAML" | "LinkedInOAuth" | "LoginGovOidc" | "MagicLink" | "MicrosoftOAuth" | "MiniOrangeSAML" | "NetIqSAML" | "OktaOIDC" | "OktaSAML" | "OneLoginSAML" | "OracleSAML" | "PingFederateSAML" | "PingOneSAML" | "RipplingSAML" | "SalesforceSAML" | "ShibbolethGenericSAML" | "ShibbolethSAML" | "SimpleSamlPhpSAML" | "SalesforceOAuth" | "SlackOAuth" | "VercelMarketplaceOAuth" | "VercelOAuth" | "VMwareSAML" | "XeroOAuth";
                 /** @description Filter Connections by their associated domain. */
                 domain?: string;
                 /** @description Filter Connections by their associated organization. */
@@ -28242,15 +28292,15 @@ export interface operations {
                      */
                     code: string;
                     /**
-                     * @description The ID of the Radar SMS verification being confirmed.
+                     * @description The ID of the Radar SMS verification being confirmed. Required for sign-up challenges; omitted for sign-in challenges, where the verification is resolved server-side.
                      * @example vrf_01HXYZ123456789ABCDEFGHIJ
                      */
-                    verification_id: string;
+                    verification_id?: string;
                     /**
-                     * @description The phone number the Radar SMS challenge was sent to.
+                     * @description The phone number the Radar SMS challenge was sent to. Required for sign-up challenges; omitted for sign-in challenges, where the phone number on file is resolved server-side.
                      * @example +15555550123
                      */
-                    phone_number: string;
+                    phone_number?: string;
                     /**
                      * @description The pending authentication token from a previous authentication attempt.
                      * @example cTDQJTTkTkkVYxbn...
@@ -28426,6 +28476,30 @@ export interface operations {
                          * @example Request could not be processed.
                          */
                         message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example phone_number_required
+                         * @constant
+                         */
+                        code: "phone_number_required";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example verification_id_required
+                         * @constant
+                         */
+                        code: "verification_id_required";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
                     } | {
                         /**
                          * @description The OAuth error code.
@@ -28835,6 +28909,18 @@ export interface operations {
                          * @example Request could not be processed.
                          */
                         message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example radar_sms_sign_in_challenge
+                         * @constant
+                         */
+                        code: "radar_sms_sign_in_challenge";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
                     } | {
                         /**
                          * @description The error code identifying the type of error.
@@ -31710,6 +31796,18 @@ export interface operations {
                          * @example Request could not be processed.
                          */
                         message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example password_salt_position_requires_password_hash
+                         * @constant
+                         */
+                        code: "password_salt_position_requires_password_hash";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
                     } | {
                         /**
                          * @description The error code identifying the type of error.
@@ -31931,6 +32029,18 @@ export interface operations {
                          * @example Request could not be processed.
                          */
                         message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example password_salt_position_requires_password_hash
+                         * @constant
+                         */
+                        code: "password_salt_position_requires_password_hash";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
                     } | {
                         /**
                          * @description The error code identifying the type of error.
@@ -32075,6 +32185,26 @@ export interface operations {
                     };
                 };
             };
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example user_deletion_not_allowed
+                         * @constant
+                         */
+                        code: "user_deletion_not_allowed";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    };
+                };
+            };
         };
     };
     UserlandUsersController_confirmEmailChange: {
@@ -32719,7 +32849,7 @@ export interface operations {
                          * @example MicrosoftOAuth
                          * @enum {string}
                          */
-                        provider: "AppleOAuth" | "BitbucketOAuth" | "DiscordOAuth" | "GithubOAuth" | "GitLabOAuth" | "GoogleOAuth" | "GrokOAuth" | "IntuitOAuth" | "LinkedInOAuth" | "MicrosoftOAuth" | "SalesforceOAuth" | "SlackOAuth" | "VercelMarketplaceOAuth" | "VercelOAuth" | "XeroOAuth";
+                        provider: "AppleOAuth" | "BitbucketOAuth" | "DiscordOAuth" | "GithubOAuth" | "GitLabOAuth" | "GoogleOAuth" | "GrokOAuth" | "XOAuth" | "IntuitOAuth" | "LinkedInOAuth" | "MicrosoftOAuth" | "SalesforceOAuth" | "SlackOAuth" | "VercelMarketplaceOAuth" | "VercelOAuth" | "XeroOAuth";
                     }[];
                 };
             };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@workos/openapi-spec",
-  "version": "0.59.0",
+  "version": "0.61.0",
   "type": "module",
   "description": "WorkOS OpenAPI specification, TypeScript types, and SDK resolution policy",
   "license": "MIT",
@@ -52,20 +52,19 @@
     "prepare": "husky"
   },
   "overrides": {
-    "js-yaml": "^4.1.1",
+    "js-yaml": "^5.2.3",
     "lodash": "^4.17.23"
   },
   "devDependencies": {
-    "@types/js-yaml": "^4.0.9",
     "@types/node": "^26.1.2",
-    "@workos/oagen": "^0.28.1",
-    "@workos/oagen-emitters": "^0.22.0",
+    "@workos/oagen": "^0.29.2",
+    "@workos/oagen-emitters": "^0.24.0",
     "diff2html": "^3.4.56",
     "husky": "^9.1.7",
-    "js-yaml": "^4.1.1",
-    "openapi-to-postmanv2": "^6.3.1",
+    "js-yaml": "^5.2.3",
+    "openapi-to-postmanv2": "^6.3.2",
     "tsdown": "^0.22.14",
-    "tsx": "^4.23.1",
+    "tsx": "^4.23.9",
     "typescript": "^7.0.2"
   }
 }