@workos/openapi-spec 0.62.0 → 0.64.0

package/dist/open-api-spec.yaml

@@ -2292,7 +2292,10 @@ paths:
       description: >-
         Returns all permissions the organization membership effectively has on a
         resource, including permissions inherited through roles assigned to
-        ancestor resources.
+        ancestor resources. Results are not filtered by the resource type: a
+        permission is returned whenever a check for it on this resource would be
+        authorized, and each permission is labeled with the resource type it is
+        declared on.
       operationId: AuthorizationController_listEffectivePermissions
       parameters:
         - name: organization_membership_id
@@ -2409,7 +2412,10 @@ paths:
       description: >-
         Returns all permissions the organization membership effectively has on a
         resource identified by its external ID, including permissions inherited
-        through roles assigned to ancestor resources.
+        through roles assigned to ancestor resources. Results are not filtered
+        by the resource type: a permission is returned whenever a check for it
+        on this resource would be authorized, and each permission is labeled
+        with the resource type it is declared on.
       operationId: AuthorizationController_listEffectivePermissionsByExternalId
       parameters:
         - name: organization_membership_id
@@ -7701,7 +7707,6 @@ paths:
       summary: Upsert an API key for a connected account
       tags:
         - pipes
-      x-feature-flag: pipes-api-keys
   /data-integrations/{slug}/authorize:
     post:
       description: >-
@@ -8032,7 +8037,6 @@ paths:
       summary: Vend credentials for a connected account
       tags:
         - pipes
-      x-feature-flag: pipes-api-keys
   /data-integrations/{slug}/token:
     post:
       description: >-
@@ -8711,7 +8715,7 @@ paths:
           schema:
             $ref: '#/components/schemas/PaginationOrder'
         - name: events
-          required: false
+          required: true
           in: query
           description: >-
             Filter events by one or more event types (e.g.
@@ -10617,6 +10621,13 @@ paths:
             `after` fetches newer records).
           schema:
             $ref: '#/components/schemas/PaginationOrder'
+        - name: search
+          required: false
+          in: query
+          description: Search groups by name or by group ID.
+          schema:
+            example: Engineering
+            type: string
       responses:
         '200':
           description: OK
@@ -11201,37 +11212,25 @@ paths:
       summary: List authorized applications
       tags:
         - organizations.authorized-applications
-  /portal/generate_link:
-    post:
-      description: Generate a Portal Link scoped to an Organization.
-      operationId: PortalSessionsController_create
-      parameters: []
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/GenerateLinkDto'
+  /organizations/{organization_id}/it_contacts:
+    get:
+      description: Get the IT contacts for an organization.
+      operationId: ItContactsController_list
+      parameters:
+        - name: organization_id
+          required: true
+          in: path
+          description: The ID of the organization.
+          schema:
+            type: string
+            example: org_01EHWNCE74X7JSDV0X3SZ3KJNY
       responses:
-        '201':
-          description: Created
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/PortalLinkResponse'
-        '400':
-          description: Bad Request
+        '200':
+          description: OK
           content:
             application/json:
               schema:
-                type: object
-                properties:
-                  message:
-                    type: string
-                    description: A human-readable description of the error.
-                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
-                required:
-                  - message
+                $ref: '#/components/schemas/ItContactList'
         '403':
           description: Forbidden
           content:
@@ -11258,86 +11257,38 @@ paths:
                     example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
                 required:
                   - message
-        '422':
-          description: Unprocessable Entity
-          content:
-            application/json:
-              schema:
-                type: object
-                properties:
-                  message:
-                    type: string
-                    description: A human-readable description of the error.
-                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
-                required:
-                  - message
-      summary: Generate a Portal Link
+      summary: List IT contacts
       tags:
-        - admin-portal
-  /radar/attempts:
+        - organizations.it-contacts
     post:
-      description: Assess a request for risk using the Radar engine and receive a verdict.
-      operationId: RadarStandaloneController_assess
-      parameters: []
+      description: >-
+        Add an IT contact to an organization. No Admin Portal invitation is
+        sent, though the contact is notified if the organization has a
+        connection certificate nearing expiry.
+      operationId: ItContactsController_create
+      parameters:
+        - name: organization_id
+          required: true
+          in: path
+          description: The ID of the organization.
+          schema:
+            type: string
+            example: org_01EHWNCE74X7JSDV0X3SZ3KJNY
       requestBody:
         required: true
         content:
           application/json:
             schema:
-              type: object
-              properties:
-                ip_address:
-                  type: string
-                  description: The IP address of the request to assess.
-                  example: 49.78.240.97
-                user_agent:
-                  type: string
-                  description: The user agent string of the request to assess.
-                  example: Mozilla/5.0
-                email:
-                  type: string
-                  format: email
-                  description: The email address of the user making the request.
-                  example: user@example.com
-                auth_method:
-                  type: string
-                  enum:
-                    - Password
-                    - Passkey
-                    - Authenticator
-                    - SMS_OTP
-                    - Email_OTP
-                    - Social
-                    - SSO
-                    - Other
-                  description: The authentication method being used.
-                  example: Password
-                action:
-                  description: The action being performed.
-                  example: sign-in
-                  type: string
-                  enum:
-                    - sign-up
-                    - sign-in
-                signals_id:
-                  type: string
-                  description: An optional Radar signals ID for the request.
-                  example: 01JBS0GN92GC2RJQS4X9DBPQ2A
-              required:
-                - ip_address
-                - user_agent
-                - email
-                - auth_method
-                - action
+              $ref: '#/components/schemas/CreateItContactDto'
       responses:
-        '200':
-          description: OK
+        '201':
+          description: Created
           content:
             application/json:
               schema:
-                $ref: '#/components/schemas/RadarStandaloneResponse'
-        '400':
-          description: Standalone radar is not enabled.
+                $ref: '#/components/schemas/ItContact'
+        '403':
+          description: Forbidden
           content:
             application/json:
               schema:
@@ -11349,48 +11300,8 @@ paths:
                     example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
                 required:
                   - message
-      summary: Create an attempt
-      tags:
-        - radar
-  /radar/attempts/{id}:
-    put:
-      description: >-
-        You may optionally inform Radar that an authentication attempt or
-        challenge was successful using this endpoint. Some Radar controls depend
-        on tracking recent successful attempts, such as impossible travel.
-      operationId: RadarStandaloneController_updateRadarAttempt
-      parameters:
-        - name: id
-          required: true
-          in: path
-          description: The unique identifier of the Radar attempt to update.
-          schema:
-            example: radar_att_01HZBC6N1EB1ZY7KG32X
-            type: string
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              type: object
-              properties:
-                challenge_status:
-                  type: string
-                  description: Set to `"success"` to mark the challenge as completed.
-                  example: success
-                  const: success
-                attempt_status:
-                  type: string
-                  description: >-
-                    Set to `"success"` to mark the authentication attempt as
-                    successful.
-                  example: success
-                  const: success
-      responses:
-        '204':
-          description: Radar attempt updated.
-        '400':
-          description: Bad Request
+        '404':
+          description: Not Found
           content:
             application/json:
               schema:
@@ -11402,148 +11313,759 @@ paths:
                     example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
                 required:
                   - message
-        '404':
-          description: Not Found
+        '409':
+          description: The email address is already an IT contact of the organization.
           content:
             application/json:
               schema:
                 type: object
                 properties:
+                  code:
+                    type: string
+                    description: The error code identifying the type of error.
+                    example: it_contact_already_exists
+                    const: it_contact_already_exists
                   message:
                     type: string
                     description: A human-readable description of the error.
-                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                    example: Request could not be processed.
                 required:
+                  - code
                   - message
-      summary: Update a Radar attempt
-      tags:
-        - radar
-  /radar/lists/{type}/{action}:
-    post:
-      description: Add an entry to a Radar list.
-      operationId: RadarStandaloneController_updateRadarList
-      parameters:
-        - name: type
-          required: true
-          in: path
-          description: The type of the Radar list (e.g. ip_address, domain, email).
-          schema:
-            type: string
-            enum:
-              - ip_address
-              - domain
-              - email
-              - device
-              - user_agent
-              - device_fingerprint
-              - country
-            example: ip_address
-        - name: action
-          required: true
-          in: path
-          description: >-
-            The list action indicating whether to add the entry to the allow or
-            block list.
-          schema:
-            type: string
-            enum:
-              - block
-              - allow
-            example: block
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              type: object
-              properties:
-                entry:
-                  type: string
-                  description: >-
-                    The value to add to the list. Must match the format of the
-                    list type (e.g. a valid IP address for `ip_address`, a valid
-                    email for `email`).
-                  example: 198.51.100.42
-              required:
-                - entry
-      responses:
-        '200':
-          description: Entry already present in the list.
+        '422':
+          description: Unprocessable Entity
           content:
             application/json:
               schema:
-                $ref: '#/components/schemas/RadarListEntryAlreadyPresentResponse'
-        '201':
-          description: Created
-        '204':
-          description: Entry successfully added to the list.
-        '400':
-          description: Bad Request
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '503':
+          description: ''
           content:
             application/json:
               schema:
                 type: object
                 properties:
+                  code:
+                    type: string
+                    description: The error code identifying the type of error.
+                    example: concurrent_request
+                    const: concurrent_request
                   message:
                     type: string
                     description: A human-readable description of the error.
-                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                    example: Request could not be processed.
                 required:
+                  - code
                   - message
-      summary: Add an entry to a Radar list
+      summary: Create an IT contact
       tags:
-        - radar
+        - organizations.it-contacts
+  /organizations/{organization_id}/it_contacts/{contact_id}:
     delete:
-      description: Remove an entry from a Radar list.
-      operationId: RadarStandaloneController_deleteRadarListEntry
+      description: >-
+        Remove an IT contact from an organization and revoke the contact's
+        active setup links.
+      operationId: ItContactsController_delete
       parameters:
-        - name: type
+        - name: organization_id
           required: true
           in: path
-          description: The type of the Radar list (e.g. ip_address, domain, email).
+          description: The ID of the organization.
           schema:
             type: string
-            enum:
-              - ip_address
-              - domain
-              - email
-              - device
-              - user_agent
-              - device_fingerprint
-              - country
-            example: ip_address
-        - name: action
+            example: org_01EHWNCE74X7JSDV0X3SZ3KJNY
+        - name: contact_id
           required: true
           in: path
-          description: >-
-            The list action indicating whether to remove the entry from the
-            allow or block list.
+          description: The ID of the IT contact.
           schema:
             type: string
-            enum:
-              - block
-              - allow
-            example: block
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              type: object
-              properties:
-                entry:
-                  type: string
-                  description: >-
-                    The value to remove from the list. Must match an existing
-                    entry.
-                  example: 198.51.100.42
-              required:
-                - entry
+            example: it_contact_01HXYZ123456789ABCDEFGHIJ
       responses:
         '204':
-          description: Radar list updated.
-        '400':
-          description: Bad Request
+          description: No Content
+        '403':
+          description: Forbidden
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '404':
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '503':
+          description: ''
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code:
+                    type: string
+                    description: The error code identifying the type of error.
+                    example: concurrent_request
+                    const: concurrent_request
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: Request could not be processed.
+                required:
+                  - code
+                  - message
+      summary: Delete an IT contact
+      tags:
+        - organizations.it-contacts
+  /organizations/{organization_id}/it_contacts/{contact_id}/invite:
+    post:
+      description: >-
+        Create an Admin Portal setup link and email it to the IT contact. An
+        organization can have at most one active invitation.
+      operationId: ItContactsController_invite
+      parameters:
+        - name: organization_id
+          required: true
+          in: path
+          description: The ID of the organization.
+          schema:
+            type: string
+            example: org_01EHWNCE74X7JSDV0X3SZ3KJNY
+        - name: contact_id
+          required: true
+          in: path
+          description: The ID of the IT contact.
+          schema:
+            type: string
+            example: it_contact_01HXYZ123456789ABCDEFGHIJ
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/InviteItContactDto'
+      responses:
+        '204':
+          description: No Content
+        '403':
+          description: Forbidden
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '404':
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '409':
+          description: >-
+            Another IT contact invitation is already active for the
+            organization.
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code:
+                    type: string
+                    description: The error code identifying the type of error.
+                    example: it_contact_invitation_already_active
+                    const: it_contact_invitation_already_active
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: Request could not be processed.
+                required:
+                  - code
+                  - message
+        '422':
+          description: Unprocessable Entity
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '503':
+          description: ''
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code:
+                    type: string
+                    description: The error code identifying the type of error.
+                    example: concurrent_request
+                    const: concurrent_request
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: Request could not be processed.
+                required:
+                  - code
+                  - message
+      summary: Invite an IT contact
+      tags:
+        - organizations.it-contacts
+      x-sends-email: true
+  /organizations/{organization_id}/it_contacts/{contact_id}/revoke:
+    post:
+      description: Revoke the organization's active Admin Portal invitation.
+      operationId: ItContactsController_revoke
+      parameters:
+        - name: organization_id
+          required: true
+          in: path
+          description: The ID of the organization.
+          schema:
+            type: string
+            example: org_01EHWNCE74X7JSDV0X3SZ3KJNY
+        - name: contact_id
+          required: true
+          in: path
+          description: The ID of the IT contact.
+          schema:
+            type: string
+            example: it_contact_01HXYZ123456789ABCDEFGHIJ
+      responses:
+        '204':
+          description: No Content
+        '403':
+          description: Forbidden
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '404':
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '503':
+          description: ''
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code:
+                    type: string
+                    description: The error code identifying the type of error.
+                    example: concurrent_request
+                    const: concurrent_request
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: Request could not be processed.
+                required:
+                  - code
+                  - message
+      summary: Revoke an IT contact's invitation
+      tags:
+        - organizations.it-contacts
+  /platform/teams:
+    post:
+      description: >-
+        Creates a team along with its default project, a staging environment,
+        and a production environment. An admin invitation is sent to
+        `admin_email`, onboarding is marked complete with AuthKit enabled, and
+        the calling platform is authorized to act inside the team.
+      operationId: TeamsController_createTeam
+      parameters: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/CreateTeamDto'
+      responses:
+        '201':
+          description: Created
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Team'
+        '409':
+          description: ''
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code:
+                    type: string
+                    description: The error code identifying the type of error.
+                    example: user_already_exists
+                    const: user_already_exists
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: Request could not be processed.
+                required:
+                  - code
+                  - message
+        '422':
+          description: Unprocessable Entity
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+      summary: Create a team
+      tags:
+        - platform.teams
+  /platform/teams/{team_id}:
+    get:
+      description: >-
+        Returns a team, and doubles as a health check on the platform's access
+        to it. Read `production_state` before attempting to create a production
+        environment.
+      operationId: TeamsController_getTeam
+      parameters:
+        - name: team_id
+          required: true
+          in: path
+          description: The ID of the team.
+          schema:
+            type: string
+            example: team_01JX9AN6E02HAG2Q2CKGC1XT5W
+      responses:
+        '200':
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Team'
+        '404':
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code:
+                    type: string
+                    description: The error code identifying the type of error.
+                    example: team_not_found
+                    const: team_not_found
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: Request could not be processed.
+                required:
+                  - code
+                  - message
+      summary: Get a team
+      tags:
+        - platform.teams
+  /portal/generate_link:
+    post:
+      description: Generate a Portal Link scoped to an Organization.
+      operationId: PortalSessionsController_create
+      parameters: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/GenerateLinkDto'
+      responses:
+        '201':
+          description: Created
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/PortalLinkResponse'
+        '400':
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '403':
+          description: Forbidden
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '404':
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '422':
+          description: Unprocessable Entity
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+      summary: Generate a Portal Link
+      tags:
+        - admin-portal
+  /radar/attempts:
+    post:
+      description: Assess a request for risk using the Radar engine and receive a verdict.
+      operationId: RadarStandaloneController_assess
+      parameters: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                ip_address:
+                  type: string
+                  description: The IP address of the request to assess.
+                  example: 49.78.240.97
+                user_agent:
+                  type: string
+                  description: The user agent string of the request to assess.
+                  example: Mozilla/5.0
+                email:
+                  type: string
+                  format: email
+                  description: The email address of the user making the request.
+                  example: user@example.com
+                auth_method:
+                  type: string
+                  enum:
+                    - Password
+                    - Passkey
+                    - Authenticator
+                    - SMS_OTP
+                    - Email_OTP
+                    - Social
+                    - SSO
+                    - Other
+                  description: The authentication method being used.
+                  example: Password
+                action:
+                  description: The action being performed.
+                  example: sign-in
+                  type: string
+                  enum:
+                    - sign-up
+                    - sign-in
+                signals_id:
+                  type: string
+                  description: An optional Radar signals ID for the request.
+                  example: 01JBS0GN92GC2RJQS4X9DBPQ2A
+              required:
+                - ip_address
+                - user_agent
+                - email
+                - auth_method
+                - action
+      responses:
+        '200':
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RadarStandaloneResponse'
+        '400':
+          description: Standalone radar is not enabled.
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+      summary: Create an attempt
+      tags:
+        - radar
+  /radar/attempts/{id}:
+    put:
+      description: >-
+        You may optionally inform Radar that an authentication attempt or
+        challenge was successful using this endpoint. Some Radar controls depend
+        on tracking recent successful attempts, such as impossible travel.
+      operationId: RadarStandaloneController_updateRadarAttempt
+      parameters:
+        - name: id
+          required: true
+          in: path
+          description: The unique identifier of the Radar attempt to update.
+          schema:
+            example: radar_att_01HZBC6N1EB1ZY7KG32X
+            type: string
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                challenge_status:
+                  type: string
+                  description: Set to `"success"` to mark the challenge as completed.
+                  example: success
+                  const: success
+                attempt_status:
+                  type: string
+                  description: >-
+                    Set to `"success"` to mark the authentication attempt as
+                    successful.
+                  example: success
+                  const: success
+      responses:
+        '204':
+          description: Radar attempt updated.
+        '400':
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '404':
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+      summary: Update a Radar attempt
+      tags:
+        - radar
+  /radar/lists/{type}/{action}:
+    post:
+      description: Add an entry to a Radar list.
+      operationId: RadarStandaloneController_updateRadarList
+      parameters:
+        - name: type
+          required: true
+          in: path
+          description: The type of the Radar list (e.g. ip_address, domain, email).
+          schema:
+            type: string
+            enum:
+              - ip_address
+              - domain
+              - email
+              - device
+              - user_agent
+              - device_fingerprint
+              - country
+            example: ip_address
+        - name: action
+          required: true
+          in: path
+          description: >-
+            The list action indicating whether to add the entry to the allow or
+            block list.
+          schema:
+            type: string
+            enum:
+              - block
+              - allow
+            example: block
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                entry:
+                  type: string
+                  description: >-
+                    The value to add to the list. Must match the format of the
+                    list type (e.g. a valid IP address for `ip_address`, a valid
+                    email for `email`).
+                  example: 198.51.100.42
+              required:
+                - entry
+      responses:
+        '200':
+          description: Entry already present in the list.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RadarListEntryAlreadyPresentResponse'
+        '201':
+          description: Created
+        '204':
+          description: Entry successfully added to the list.
+        '400':
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+      summary: Add an entry to a Radar list
+      tags:
+        - radar
+    delete:
+      description: Remove an entry from a Radar list.
+      operationId: RadarStandaloneController_deleteRadarListEntry
+      parameters:
+        - name: type
+          required: true
+          in: path
+          description: The type of the Radar list (e.g. ip_address, domain, email).
+          schema:
+            type: string
+            enum:
+              - ip_address
+              - domain
+              - email
+              - device
+              - user_agent
+              - device_fingerprint
+              - country
+            example: ip_address
+        - name: action
+          required: true
+          in: path
+          description: >-
+            The list action indicating whether to remove the entry from the
+            allow or block list.
+          schema:
+            type: string
+            enum:
+              - block
+              - allow
+            example: block
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                entry:
+                  type: string
+                  description: >-
+                    The value to remove from the list. Must match an existing
+                    entry.
+                  example: 198.51.100.42
+              required:
+                - entry
+      responses:
+        '204':
+          description: Radar list updated.
+        '400':
+          description: Bad Request
           content:
             application/json:
               schema:
@@ -12017,9 +12539,11 @@ paths:
             example: sk_example_123456789
             type: string
         - name: code
-          required: true
+          required: false
           in: query
-          description: The authorization code received from the authorization callback.
+          description: >-
+            The authorization code received from the authorization callback.
+            Required when `grant_type` is `authorization_code`.
           schema:
             example: authorization_code_value
             type: string
@@ -12029,14 +12553,16 @@ paths:
           description: The grant type for the token request.
           schema:
             example: authorization_code
+            enum:
+              - authorization_code
+              - urn:ietf:params:oauth:grant-type:token-exchange
             type: string
-            const: authorization_code
       requestBody:
         required: true
         content:
           application/json:
             schema:
-              $ref: '#/components/schemas/TokenQueryDto'
+              $ref: '#/components/schemas/TokenBodyDto'
       responses:
         '200':
           description: OK
@@ -17129,25 +17655,6 @@ paths:
                     example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
                 required:
                   - message
-        '409':
-          description: ''
-          content:
-            application/json:
-              schema:
-                type: object
-                properties:
-                  code:
-                    type: string
-                    description: The error code identifying the type of error.
-                    example: user_deletion_not_allowed
-                    const: user_deletion_not_allowed
-                  message:
-                    type: string
-                    description: A human-readable description of the error.
-                    example: Request could not be processed.
-                required:
-                  - code
-                  - message
       summary: Delete a user
       tags:
         - user-management.users
@@ -18763,95 +19270,551 @@ paths:
                   message:
                     type: string
                     description: A human-readable description of the error.
-                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+      summary: Update a connected account
+      tags:
+        - user-management.data-providers
+      x-feature-flag: pipes-management-api
+  /user_management/users/{user_id}/data_providers:
+    get:
+      description: >-
+        Retrieves a list of available providers and the user's connection status
+        for each. Returns all providers configured for your environment, along
+        with the user's [connected account](/reference/pipes/connected-account)
+        information where applicable.
+      operationId: DataIntegrationsUserManagementController_getUserDataIntegrations
+      parameters:
+        - name: user_id
+          required: true
+          in: path
+          description: >-
+            A [User](/reference/authkit/user) identifier to list providers and
+            connected accounts for.
+          schema:
+            example: user_01EHZNVPK3SFK441A1RGBFSHRT
+            type: string
+        - name: organization_id
+          required: false
+          in: query
+          description: >-
+            An [Organization](/reference/organization) identifier. Optional
+            parameter to filter connections for a specific organization.
+          schema:
+            example: org_01EHZNVPK3SFK441A1RGBFSHRT
+            type: string
+      responses:
+        '200':
+          description: The list of data providers was retrieved successfully.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/DataIntegrationsListResponse'
+        '401':
+          description: The request is missing a valid API key.
+        '404':
+          description: The user or organization was not found.
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+      summary: List providers for a user
+      tags:
+        - user-management.data-providers
+  /user_management/users/{userlandUserId}/auth_factors:
+    post:
+      description: >-
+        Enrolls a user in a new [authentication
+        factor](/reference/authkit/mfa/authentication-factor).
+      operationId: UserlandUserAuthenticationFactorsController_create[0]
+      parameters:
+        - name: userlandUserId
+          required: true
+          in: path
+          description: The ID of the [user](/reference/authkit/user).
+          schema:
+            example: user_01E4ZCR3C56J083X43JQXF3JK5
+            type: string
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/EnrollUserlandUserAuthenticationFactorDto'
+      responses:
+        '201':
+          description: Created
+          content:
+            application/json:
+              schema:
+                $ref: >-
+                  #/components/schemas/UserlandUserAuthenticationFactorEnrollResponse
+        '422':
+          description: Unprocessable Entity
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+      summary: Enroll an authentication factor
+      tags:
+        - user-management.multi-factor-authentication
+    get:
+      description: >-
+        Lists the [authentication
+        factors](/reference/authkit/mfa/authentication-factor) for a user.
+      operationId: UserlandUserAuthenticationFactorsController_list[0]
+      parameters:
+        - name: userlandUserId
+          required: true
+          in: path
+          description: The ID of the [user](/reference/authkit/user).
+          schema:
+            example: user_01E4ZCR3C56J083X43JQXF3JK5
+            type: string
+        - name: before
+          required: false
+          in: query
+          description: >-
+            An object ID that defines your place in the list. When the ID is not
+            present, you are at the end of the list.
+          schema:
+            example: obj_1234567890
+            type: string
+        - name: after
+          required: false
+          in: query
+          description: >-
+            An object ID that defines your place in the list. When the ID is not
+            present, you are at the end of the list.
+          schema:
+            example: obj_1234567890
+            type: string
+        - name: limit
+          required: false
+          in: query
+          description: >-
+            Upper limit on the number of objects to return, between `1` and
+            `100`.
+          schema:
+            minimum: 1
+            maximum: 100
+            default: 10
+            example: 10
+            type: integer
+        - name: order
+          required: false
+          in: query
+          description: Order the results by the creation time.
+          schema:
+            $ref: '#/components/schemas/PaginationOrder'
+      responses:
+        '200':
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/UserlandUserAuthenticationFactorList'
+        '422':
+          description: Unprocessable Entity
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+      summary: List authentication factors
+      tags:
+        - user-management.multi-factor-authentication
+  /user_management/waitlist_entries/{id}:
+    delete:
+      description: >-
+        Removes the entry from the waitlist. An invitation created by approving
+        the entry stays valid, so revoke that invitation to withdraw access.
+      operationId: WaitlistEntriesController_delete
+      parameters:
+        - name: id
+          required: true
+          in: path
+          description: The unique ID of the waitlist entry.
+          schema:
+            example: wl_user_01E4ZCR3C56J083X43JQXF3JK5
+            type: string
+      responses:
+        '204':
+          description: No Content
+        '404':
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+      summary: Delete a waitlist entry
+      tags:
+        - user-management.waitlists
+  /user_management/waitlist_entries/{id}/approve:
+    post:
+      description: >-
+        Approve a waitlist entry and send the resulting user invitation email.
+        Also reverses a denial: a denied entry can be approved.
+      operationId: WaitlistEntriesController_approve
+      parameters:
+        - name: id
+          required: true
+          in: path
+          description: The unique ID of the waitlist entry.
+          schema:
+            example: wl_user_01E4ZCR3C56J083X43JQXF3JK5
+            type: string
+      responses:
+        '200':
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  id:
+                    type: string
+                    description: The unique ID of the waitlist entry.
+                    example: wl_user_01E4ZCR3C56J083X43JQXF3JK5
+                  email:
+                    type: string
+                    description: The email address of the user on the waitlist.
+                    example: marcelina.davis@example.com
+                  state:
+                    type: string
+                    enum:
+                      - pending
+                      - approved
+                      - denied
+                    description: The state of the waitlist entry.
+                    example: approved
+                  approved_at:
+                    format: date-time
+                    type:
+                      - string
+                      - 'null'
+                    description: >-
+                      The timestamp when the entry was approved, or null if not
+                      yet approved.
+                    example: '2026-01-15T12:00:00.000Z'
+                  additional_fields:
+                    type: object
+                    additionalProperties:
+                      type: string
+                    description: >-
+                      Additional fields submitted when the user joined the
+                      waitlist. Values are user-provided — treat them as
+                      untrusted input when rendering or exporting.
+                    example:
+                      company: Example Corp
+                  waitlist_id:
+                    type:
+                      - string
+                      - 'null'
+                    description: The unique ID of the waitlist the entry belongs to.
+                    example: waitlist_01E4ZCR3C56J083X43JQXF3JK5
+                  created_at:
+                    format: date-time
+                    type: string
+                    description: An ISO 8601 timestamp.
+                    example: '2026-01-15T12:00:00.000Z'
+                  updated_at:
+                    format: date-time
+                    type: string
+                    description: An ISO 8601 timestamp.
+                    example: '2026-01-15T12:00:00.000Z'
+                  object:
+                    type: string
+                    description: Distinguishes the Waitlist Entry object.
+                    const: waitlist_entry
+                required:
+                  - id
+                  - email
+                  - state
+                  - approved_at
+                  - created_at
+                  - updated_at
+                  - object
+                x-inline-with-overrides: true
+        '404':
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '422':
+          description: Unprocessable Entity
+          content:
+            application/json:
+              schema:
+                oneOf:
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: invalid_state
+                        const: invalid_state
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: invitation_email_not_sent
+                        const: invitation_email_not_sent
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+      summary: Approve a waitlist entry
+      tags:
+        - user-management.waitlists
+      x-sends-email: true
+  /user_management/waitlist_entries/{id}/deny:
+    post:
+      description: >-
+        Deny a pending waitlist entry. A denial can be reversed by approving the
+        entry.
+      operationId: WaitlistEntriesController_deny
+      parameters:
+        - name: id
+          required: true
+          in: path
+          description: The unique ID of the waitlist entry.
+          schema:
+            example: wl_user_01E4ZCR3C56J083X43JQXF3JK5
+            type: string
+      responses:
+        '200':
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  id:
+                    type: string
+                    description: The unique ID of the waitlist entry.
+                    example: wl_user_01E4ZCR3C56J083X43JQXF3JK5
+                  email:
+                    type: string
+                    description: The email address of the user on the waitlist.
+                    example: marcelina.davis@example.com
+                  state:
+                    type: string
+                    enum:
+                      - pending
+                      - approved
+                      - denied
+                    description: The state of the waitlist entry.
+                    example: denied
+                  approved_at:
+                    format: date-time
+                    type:
+                      - string
+                      - 'null'
+                    description: >-
+                      The timestamp when the entry was approved, or null if not
+                      yet approved.
+                    example: null
+                  additional_fields:
+                    type: object
+                    additionalProperties:
+                      type: string
+                    description: >-
+                      Additional fields submitted when the user joined the
+                      waitlist. Values are user-provided — treat them as
+                      untrusted input when rendering or exporting.
+                    example:
+                      company: Example Corp
+                  waitlist_id:
+                    type:
+                      - string
+                      - 'null'
+                    description: The unique ID of the waitlist the entry belongs to.
+                    example: waitlist_01E4ZCR3C56J083X43JQXF3JK5
+                  created_at:
+                    format: date-time
+                    type: string
+                    description: An ISO 8601 timestamp.
+                    example: '2026-01-15T12:00:00.000Z'
+                  updated_at:
+                    format: date-time
+                    type: string
+                    description: An ISO 8601 timestamp.
+                    example: '2026-01-15T12:00:00.000Z'
+                  object:
+                    type: string
+                    description: Distinguishes the Waitlist Entry object.
+                    const: waitlist_entry
+                required:
+                  - id
+                  - email
+                  - state
+                  - approved_at
+                  - created_at
+                  - updated_at
+                  - object
+                x-inline-with-overrides: true
+        '404':
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '422':
+          description: Unprocessable Entity
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code:
+                    type: string
+                    description: The error code identifying the type of error.
+                    example: invalid_state
+                    const: invalid_state
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: Request could not be processed.
                 required:
+                  - code
                   - message
-      summary: Update a connected account
+      summary: Deny a waitlist entry
       tags:
-        - user-management.data-providers
-      x-feature-flag: pipes-management-api
-  /user_management/users/{user_id}/data_providers:
+        - user-management.waitlists
+  /user_management/waitlists:
     get:
-      description: >-
-        Retrieves a list of available providers and the user's connection status
-        for each. Returns all providers configured for your environment, along
-        with the user's [connected account](/reference/pipes/connected-account)
-        information where applicable.
-      operationId: DataIntegrationsUserManagementController_getUserDataIntegrations
-      parameters:
-        - name: user_id
-          required: true
-          in: path
-          description: >-
-            A [User](/reference/authkit/user) identifier to list providers and
-            connected accounts for.
-          schema:
-            example: user_01EHZNVPK3SFK441A1RGBFSHRT
-            type: string
-        - name: organization_id
-          required: false
-          in: query
-          description: >-
-            An [Organization](/reference/organization) identifier. Optional
-            parameter to filter connections for a specific organization.
-          schema:
-            example: org_01EHZNVPK3SFK441A1RGBFSHRT
-            type: string
+      description: Get a list of the waitlists in the environment.
+      operationId: WaitlistsController_list
+      parameters: []
       responses:
         '200':
-          description: The list of data providers was retrieved successfully.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/DataIntegrationsListResponse'
-        '401':
-          description: The request is missing a valid API key.
-        '404':
-          description: The user or organization was not found.
+          description: OK
           content:
             application/json:
               schema:
                 type: object
                 properties:
-                  message:
+                  object:
                     type: string
-                    description: A human-readable description of the error.
-                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                    description: Indicates this is a list response.
+                    const: list
+                  data:
+                    type: array
+                    items:
+                      $ref: '#/components/schemas/Waitlist'
+                    description: The list of records for the current page.
+                  list_metadata:
+                    type: object
+                    properties:
+                      before:
+                        type:
+                          - string
+                          - 'null'
+                        description: >-
+                          An object ID that defines your place in the list. When
+                          the ID is not present, you are at the start of the
+                          list.
+                        example: null
+                      after:
+                        type:
+                          - string
+                          - 'null'
+                        description: >-
+                          An object ID that defines your place in the list. When
+                          the ID is not present, you are at the end of the list.
+                        example: null
+                    required:
+                      - before
+                      - after
+                    description: >-
+                      Pagination cursors for navigating between pages of
+                      results.
                 required:
-                  - message
-      summary: List providers for a user
+                  - object
+                  - data
+                  - list_metadata
+                x-inline-with-overrides: true
+      summary: List waitlists
       tags:
-        - user-management.data-providers
-  /user_management/users/{userlandUserId}/auth_factors:
-    post:
-      description: >-
-        Enrolls a user in a new [authentication
-        factor](/reference/authkit/mfa/authentication-factor).
-      operationId: UserlandUserAuthenticationFactorsController_create[0]
+        - user-management.waitlists
+  /user_management/waitlists/{id}:
+    get:
+      description: Get the details of an existing waitlist.
+      operationId: WaitlistsController_find
       parameters:
-        - name: userlandUserId
+        - name: id
           required: true
           in: path
-          description: The ID of the [user](/reference/authkit/user).
+          description: >-
+            The unique ID of the waitlist, or the literal `default` for the
+            environment's default waitlist.
           schema:
-            example: user_01E4ZCR3C56J083X43JQXF3JK5
             type: string
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/EnrollUserlandUserAuthenticationFactorDto'
+            example: waitlist_01E4ZCR3C56J083X43JQXF3JK5
       responses:
-        '201':
-          description: Created
+        '200':
+          description: OK
           content:
             application/json:
               schema:
-                $ref: >-
-                  #/components/schemas/UserlandUserAuthenticationFactorEnrollResponse
-        '422':
-          description: Unprocessable Entity
+                $ref: '#/components/schemas/Waitlist'
+        '404':
+          description: Not Found
           content:
             application/json:
               schema:
@@ -18863,39 +19826,46 @@ paths:
                     example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
                 required:
                   - message
-      summary: Enroll an authentication factor
+      summary: Get a waitlist
       tags:
-        - user-management.multi-factor-authentication
+        - user-management.waitlists
+  /user_management/waitlists/{id}/entries:
     get:
-      description: >-
-        Lists the [authentication
-        factors](/reference/authkit/mfa/authentication-factor) for a user.
-      operationId: UserlandUserAuthenticationFactorsController_list[0]
+      description: Get a list of entries on a waitlist matching the criteria specified.
+      operationId: WaitlistsController_listEntries
       parameters:
-        - name: userlandUserId
+        - name: id
           required: true
           in: path
-          description: The ID of the [user](/reference/authkit/user).
+          description: >-
+            The unique ID of the waitlist, or the literal `default` for the
+            environment's default waitlist.
           schema:
-            example: user_01E4ZCR3C56J083X43JQXF3JK5
             type: string
+            example: waitlist_01E4ZCR3C56J083X43JQXF3JK5
         - name: before
           required: false
           in: query
           description: >-
             An object ID that defines your place in the list. When the ID is not
-            present, you are at the end of the list.
+            present, you are at the end of the list. For example, if you make a
+            list request and receive 100 objects, ending with `"obj_123"`, your
+            subsequent call can include `before="obj_123"` to fetch a new batch
+            of objects before `"obj_123"`.
           schema:
-            example: obj_1234567890
+            example: xxx_01HXYZ123456789ABCDEFGHIJ
             type: string
         - name: after
           required: false
           in: query
           description: >-
             An object ID that defines your place in the list. When the ID is not
-            present, you are at the end of the list.
+            present, you are at the end of the list. For example, if you make a
+            list request and receive 100 objects, ending with `"obj_123"`, your
+            subsequent call can include `after="obj_123"` to fetch a new batch
+            of objects after `"obj_123"`.
           schema:
-            example: obj_1234567890
+            example: xxx_01HXYZ987654321KJIHGFEDCBA
             type: string
         - name: limit
           required: false
@@ -18912,18 +19882,144 @@ paths:
         - name: order
           required: false
           in: query
-          description: Order the results by the creation time.
+          description: >-
+            Order the results by the creation time. Supported values are `"asc"`
+            (ascending), `"desc"` (descending), and `"normal"` (descending with
+            reversed cursor semantics where `before` fetches older records and
+            `after` fetches newer records).
           schema:
             $ref: '#/components/schemas/PaginationOrder'
+        - name: state
+          required: false
+          in: query
+          description: Filter waitlist entries by their state.
+          schema:
+            example: pending
+            enum:
+              - pending
+              - approved
+              - denied
+            type: string
+        - name: email
+          required: false
+          in: query
+          description: Filter waitlist entries by their exact email address.
+          schema:
+            example: marcelina.davis@example.com
+            type: string
       responses:
         '200':
           description: OK
           content:
             application/json:
               schema:
-                $ref: '#/components/schemas/UserlandUserAuthenticationFactorList'
+                allOf:
+                  - type: object
+                    properties:
+                      object:
+                        type: string
+                        description: Indicates this is a list response.
+                        const: list
+                      list_metadata:
+                        type: object
+                        properties:
+                          before:
+                            type:
+                              - string
+                              - 'null'
+                            description: >-
+                              An object ID that defines your place in the list.
+                              When the ID is not present, you are at the start
+                              of the list.
+                            example: wl_user_01HXYZ123456789ABCDEFGHIJ
+                          after:
+                            type:
+                              - string
+                              - 'null'
+                            description: >-
+                              An object ID that defines your place in the list.
+                              When the ID is not present, you are at the end of
+                              the list.
+                            example: wl_user_01HXYZ987654321KJIHGFEDCBA
+                        required:
+                          - before
+                          - after
+                        description: >-
+                          Pagination cursors for navigating between pages of
+                          results.
+                  - type: object
+                    properties:
+                      data:
+                        type: array
+                        description: The list of records for the current page.
+                        items:
+                          $ref: '#/components/schemas/WaitlistEntry'
+        '404':
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
         '422':
           description: Unprocessable Entity
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code:
+                    type: string
+                    description: The error code identifying the type of error.
+                    example: invalid_request_parameters
+                    const: invalid_request_parameters
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: Validation failed.
+                required:
+                  - code
+                  - message
+      summary: List waitlist entries
+      tags:
+        - user-management.waitlists
+    post:
+      description: >-
+        Add an email address to the waitlist. Creating an entry is idempotent
+        per email address: a request for an email address already on the
+        waitlist returns the existing entry.
+      operationId: WaitlistsController_createEntry
+      parameters:
+        - name: id
+          required: true
+          in: path
+          description: >-
+            The unique ID of the waitlist, or the literal `default` for the
+            environment's default waitlist.
+          schema:
+            type: string
+            example: waitlist_01E4ZCR3C56J083X43JQXF3JK5
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/CreateWaitlistEntryDto'
+      responses:
+        '201':
+          description: Created
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/WaitlistEntry'
+        '404':
+          description: Not Found
           content:
             application/json:
               schema:
@@ -18935,9 +20031,44 @@ paths:
                     example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
                 required:
                   - message
-      summary: List authentication factors
+        '422':
+          description: Unprocessable Entity
+          content:
+            application/json:
+              schema:
+                oneOf:
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: user_already_exists
+                        const: user_already_exists
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: invalid_request_parameters
+                        const: invalid_request_parameters
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Validation failed.
+                    required:
+                      - code
+                      - message
+      summary: Create a waitlist entry
       tags:
-        - user-management.multi-factor-authentication
+        - user-management.waitlists
+      x-sends-email: true
   /vault/v1/keys/data-key:
     post:
       description: Generate an isolated encryption key for local encryption operations.
@@ -19815,12 +20946,16 @@ tags:
     description: Manage authorized applications for organizations.
   - name: organizations.feature-flags
     description: Manage organization-scoped feature flags.
+  - name: organizations.it-contacts
+    description: Manage IT contacts for organizations.
   - name: permissions
     description: Manage permissions.
   - name: pipes
     description: Data integration endpoints.
   - name: pipes.provider
     description: Manage organization-scoped provider configurations.
+  - name: platform.teams
+    description: Manage teams for platforms.
   - name: radar
     description: Radar fraud detection.
   - name: sso
@@ -19853,6 +20988,8 @@ tags:
     description: Manage authorized applications for users.
   - name: user-management.users.feature-flags
     description: Manage user-scoped feature flags.
+  - name: user-management.waitlists
+    description: Manage waitlists and waitlist entries.
   - name: vault
     description: Vault data encryption endpoints.
   - name: webhooks
@@ -21121,6 +22258,37 @@ components:
           example: '2030-01-01T00:00:00.000Z'
       required:
         - name
+    CreateItContactDto:
+      type: object
+      properties:
+        email:
+          type: string
+          format: email
+          description: The email address of the IT contact.
+          example: it-contact@example.com
+      required:
+        - email
+    InviteItContactDto:
+      type: object
+      properties:
+        intents:
+          type: array
+          description: The Admin Portal features that the IT contact can configure.
+          example:
+            - sso
+            - directory_sync
+          uniqueItems: true
+          minItems: 1
+          items:
+            type: string
+            enum:
+              - sso
+              - directory_sync
+              - log_streams
+              - domain_verification
+              - bring_your_own_key
+      required:
+        - intents
     OrganizationDomainDataDto:
       type: object
       properties:
@@ -21157,6 +22325,7 @@ components:
             `domain_data`.
           example:
             - example.com
+          deprecated: true
           type: array
           items:
             type: string
@@ -21687,6 +22856,23 @@ components:
           example: https://example.com/callback
       required:
         - uri
+    CreateTeamDto:
+      type: object
+      properties:
+        admin_email:
+          type: string
+          format: email
+          description: >-
+            The email address of the person who will administer the team. An
+            invitation is sent to this address.
+          example: alice@example.com
+        name:
+          type: string
+          description: Name of the team.
+          example: Example Team
+      required:
+        - admin_email
+        - name
     EnrollUserlandUserAuthenticationFactorDto:
       type: object
       properties:
@@ -22515,6 +23701,37 @@ components:
           example: session_01H93ZY4F80QPBEZ1R5B2SHQG8
       required:
         - session_id
+    CreateWaitlistEntryDto:
+      type: object
+      properties:
+        email:
+          type: string
+          format: email
+          description: The email address of the user joining the waitlist.
+          example: marcelina.davis@example.com
+        additional_fields:
+          type: object
+          description: >-
+            Object containing additional key/value pairs collected with the
+            waitlist entry. Values are user-provided — treat them as untrusted
+            input when rendering or exporting.
+          additionalProperties:
+            type: string
+            maxLength: 600
+          maxProperties: 50
+          example:
+            company: Example Corp
+        send_confirmation_email:
+          type: boolean
+          description: >-
+            Whether to send the waitlist confirmation email to the user.
+            Defaults to `false`. No email is sent when the waitlist confirmation
+            email is disabled in the environment, even if
+            `send_confirmation_email` is `true`.
+          default: false
+          example: false
+      required:
+        - email
     CreateWebhookEndpointDto:
       type: object
       properties:
@@ -22694,7 +23911,7 @@ components:
       required:
         - organization_id
         - user_id
-    TokenQueryDto:
+    TokenBodyDto:
       type: object
       properties:
         client_id:
@@ -22707,17 +23924,43 @@ components:
           example: sk_example_123456789
         code:
           type: string
-          description: The authorization code received from the authorization callback.
+          description: >-
+            The authorization code received from the authorization callback.
+            Required when `grant_type` is `authorization_code`.
           example: authorization_code_value
         grant_type:
           type: string
           description: The grant type for the token request.
+          enum:
+            - authorization_code
+            - urn:ietf:params:oauth:grant-type:token-exchange
           example: authorization_code
-          const: authorization_code
+        subject_token:
+          type: string
+          description: >-
+            The OIDC ID token to exchange. Required when `grant_type` is
+            `urn:ietf:params:oauth:grant-type:token-exchange`. Must be sent in
+            the request body.
+          example: eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjMifQ.example
+        subject_token_type:
+          type: string
+          description: >-
+            The type of the subject token. Required when `grant_type` is
+            `urn:ietf:params:oauth:grant-type:token-exchange`. Must be sent in
+            the request body.
+          example: urn:ietf:params:oauth:token-type:id_token
+          const: urn:ietf:params:oauth:token-type:id_token
+        organization_id:
+          type: string
+          description: >-
+            The ID of the organization whose connection the subject token is
+            validated against. Required when `grant_type` is
+            `urn:ietf:params:oauth:grant-type:token-exchange`. Must be sent in
+            the request body.
+          example: org_01EHQMYV6MBK39QC5PZXHY59C3
       required:
         - client_id
         - client_secret
-        - code
         - grant_type
     Actor:
       description: The user or API key that performed an action.
@@ -26060,17 +27303,13 @@ components:
     WaitlistUser:
       type: object
       properties:
-        object:
-          type: string
-          description: Distinguishes the Waitlist User object.
-          const: waitlist_user
         id:
           type: string
-          description: The unique ID of the Waitlist User.
+          description: The unique ID of the waitlist entry.
           example: wl_user_01E4ZCR3C56J083X43JQXF3JK5
         email:
           type: string
-          description: The email address of the Waitlist User.
+          description: The email address of the user on the waitlist.
           example: marcelina.davis@example.com
         state:
           type: string
@@ -26078,7 +27317,7 @@ components:
             - pending
             - approved
             - denied
-          description: The state of the Waitlist User.
+          description: The state of the waitlist entry.
           example: pending
         approved_at:
           format: date-time
@@ -26086,14 +27325,24 @@ components:
             - string
             - 'null'
           description: >-
-            The timestamp when the Waitlist User was approved, or null if not
-            yet approved.
+            The timestamp when the entry was approved, or null if not yet
+            approved.
           example: null
+        additional_fields:
+          type: object
+          additionalProperties:
+            type: string
+          description: >-
+            Additional fields submitted when the user joined the waitlist.
+            Values are user-provided — treat them as untrusted input when
+            rendering or exporting.
+          example:
+            company: Example Corp
         waitlist_id:
           type:
             - string
             - 'null'
-          description: The unique ID of the Waitlist that the Waitlist User joined.
+          description: The unique ID of the waitlist the entry belongs to.
           example: waitlist_01E4ZCR3C56J083X43JQXF3JK5
         created_at:
           format: date-time
@@ -26105,14 +27354,18 @@ components:
           type: string
           description: An ISO 8601 timestamp.
           example: '2026-01-15T12:00:00.000Z'
+        object:
+          type: string
+          description: Distinguishes the Waitlist User object.
+          const: waitlist_user
       required:
-        - object
         - id
         - email
         - state
         - approved_at
         - created_at
         - updated_at
+        - object
     EventSchema:
       allOf:
         - type: object
@@ -35580,6 +36833,78 @@ components:
         - created_at
         - updated_at
         - value
+    ItContact:
+      type: object
+      properties:
+        object:
+          type: string
+          description: The IT Contact object.
+          example: it_contact
+          const: it_contact
+        id:
+          type: string
+          description: The unique ID of the IT Contact.
+          example: it_contact_01HXYZ123456789ABCDEFGHIJ
+        email:
+          type: string
+          format: email
+          description: The email address of the IT Contact.
+          example: it-contact@example.com
+        created_at:
+          format: date-time
+          type: string
+          description: An ISO 8601 timestamp.
+          example: '2026-01-15T12:00:00.000Z'
+        updated_at:
+          format: date-time
+          type: string
+          description: An ISO 8601 timestamp.
+          example: '2026-01-15T12:00:00.000Z'
+      required:
+        - object
+        - id
+        - email
+        - created_at
+        - updated_at
+    ItContactList:
+      type: object
+      properties:
+        object:
+          type: string
+          description: Indicates this is a list response.
+          const: list
+        data:
+          type: array
+          items:
+            $ref: '#/components/schemas/ItContact'
+          description: The list of records for the current page.
+        list_metadata:
+          type: object
+          properties:
+            before:
+              type:
+                - string
+                - 'null'
+              description: >-
+                An object ID that defines your place in the list. When the ID is
+                not present, you are at the start of the list.
+              example: it_contact_01HXYZ123456789ABCDEFGHIJ
+            after:
+              type:
+                - string
+                - 'null'
+              description: >-
+                An object ID that defines your place in the list. When the ID is
+                not present, you are at the end of the list.
+              example: it_contact_01HXYZ987654321KJIHGFEDCBA
+          required:
+            - before
+            - after
+          description: Pagination cursors for navigating between pages of results.
+      required:
+        - object
+        - data
+        - list_metadata
     Organization:
       type: object
       properties:
@@ -37204,6 +38529,61 @@ components:
         - default
         - created_at
         - updated_at
+    Team:
+      type: object
+      properties:
+        object:
+          type: string
+          description: Distinguishes the team object.
+          const: team
+        id:
+          type: string
+          description: Unique identifier of the team.
+          example: team_01JX9AN6E02HAG2Q2CKGC1XT5W
+        name:
+          type: string
+          description: The name of the team.
+          example: Example Team
+        production_state:
+          type: string
+          enum:
+            - Active
+            - Inactive
+            - Suspended
+            - Deleting
+          description: >-
+            Whether the team can host production environments. `Active` means
+            billing is set up. `Inactive` means a team admin must add a payment
+            method in the WorkOS Dashboard. `Suspended` and `Deleting` mean the
+            team can't be provisioned into.
+          example: Active
+        production_enabled_at:
+          type:
+            - string
+            - 'null'
+          format: date-time
+          description: >-
+            The timestamp when production was enabled for the team, or `null` if
+            it never has been.
+          example: '2024-01-01T00:00:00.000Z'
+        created_at:
+          type: string
+          format: date-time
+          description: The timestamp when the team was created.
+          example: '2024-01-01T00:00:00.000Z'
+        updated_at:
+          type: string
+          format: date-time
+          description: The timestamp when the team was last updated.
+          example: '2024-01-01T00:00:00.000Z'
+      required:
+        - object
+        - id
+        - name
+        - production_state
+        - production_enabled_at
+        - created_at
+        - updated_at
     UserlandUserAuthenticationFactorList:
       type: object
       properties:
@@ -38133,6 +39513,98 @@ components:
         - user_code
         - verification_uri
         - expires_in
+    Waitlist:
+      type: object
+      properties:
+        object:
+          type: string
+          description: Distinguishes the Waitlist object.
+          const: waitlist
+        id:
+          type: string
+          description: The unique ID of the Waitlist.
+          example: waitlist_01E4ZCR3C56J083X43JQXF3JK5
+        created_at:
+          format: date-time
+          type: string
+          description: An ISO 8601 timestamp.
+          example: '2026-01-15T12:00:00.000Z'
+        updated_at:
+          format: date-time
+          type: string
+          description: An ISO 8601 timestamp.
+          example: '2026-01-15T12:00:00.000Z'
+      required:
+        - object
+        - id
+        - created_at
+        - updated_at
+    WaitlistEntry:
+      type: object
+      properties:
+        id:
+          type: string
+          description: The unique ID of the waitlist entry.
+          example: wl_user_01E4ZCR3C56J083X43JQXF3JK5
+        email:
+          type: string
+          description: The email address of the user on the waitlist.
+          example: marcelina.davis@example.com
+        state:
+          type: string
+          enum:
+            - pending
+            - approved
+            - denied
+          description: The state of the waitlist entry.
+          example: pending
+        approved_at:
+          format: date-time
+          type:
+            - string
+            - 'null'
+          description: >-
+            The timestamp when the entry was approved, or null if not yet
+            approved.
+          example: null
+        additional_fields:
+          type: object
+          additionalProperties:
+            type: string
+          description: >-
+            Additional fields submitted when the user joined the waitlist.
+            Values are user-provided — treat them as untrusted input when
+            rendering or exporting.
+          example:
+            company: Example Corp
+        waitlist_id:
+          type:
+            - string
+            - 'null'
+          description: The unique ID of the waitlist the entry belongs to.
+          example: waitlist_01E4ZCR3C56J083X43JQXF3JK5
+        created_at:
+          format: date-time
+          type: string
+          description: An ISO 8601 timestamp.
+          example: '2026-01-15T12:00:00.000Z'
+        updated_at:
+          format: date-time
+          type: string
+          description: An ISO 8601 timestamp.
+          example: '2026-01-15T12:00:00.000Z'
+        object:
+          type: string
+          description: Distinguishes the Waitlist Entry object.
+          const: waitlist_entry
+      required:
+        - id
+        - email
+        - state
+        - approved_at
+        - created_at
+        - updated_at
+        - object
     WebhookEndpointJson:
       type: object
       properties: