@workos/openapi-spec 0.68.0 → 0.70.0

package/dist/open-api-spec.yaml

@@ -631,7 +631,7 @@ paths:
         - name: order
           required: false
           in: query
-          description: Order the results by the creation time.
+          description: Order the results by the creation time. Defaults to `normal`.
           schema:
             $ref: '#/components/schemas/PaginationOrder'
       responses:
@@ -800,7 +800,7 @@ paths:
         - name: order
           required: false
           in: query
-          description: Order the results by the creation time.
+          description: Order the results by the creation time. Defaults to `normal`.
           schema:
             $ref: '#/components/schemas/PaginationOrder'
       responses:
@@ -1661,7 +1661,7 @@ paths:
             Order the results by the creation time. Supported values are `"asc"`
             (ascending), `"desc"` (descending), and `"normal"` (descending with
             reversed cursor semantics where `before` fetches older records and
-            `after` fetches newer records).
+            `after` fetches newer records). Defaults to `normal`.
           schema:
             $ref: '#/components/schemas/PaginationOrder'
       responses:
@@ -2165,7 +2165,7 @@ paths:
             Order the results by the creation time. Supported values are `"asc"`
             (ascending), `"desc"` (descending), and `"normal"` (descending with
             reversed cursor semantics where `before` fetches older records and
-            `after` fetches newer records).
+            `after` fetches newer records). Defaults to `normal`.
           schema:
             $ref: '#/components/schemas/PaginationOrder'
         - name: permission_slug
@@ -2355,7 +2355,7 @@ paths:
             Order the results by the creation time. Supported values are `"asc"`
             (ascending), `"desc"` (descending), and `"normal"` (descending with
             reversed cursor semantics where `before` fetches older records and
-            `after` fetches newer records).
+            `after` fetches newer records). Defaults to `normal`.
           schema:
             $ref: '#/components/schemas/PaginationOrder'
       responses:
@@ -2482,7 +2482,7 @@ paths:
             Order the results by the creation time. Supported values are `"asc"`
             (ascending), `"desc"` (descending), and `"normal"` (descending with
             reversed cursor semantics where `before` fetches older records and
-            `after` fetches newer records).
+            `after` fetches newer records). Defaults to `normal`.
           schema:
             $ref: '#/components/schemas/PaginationOrder'
       responses:
@@ -2594,7 +2594,7 @@ paths:
             Order the results by the creation time. Supported values are `"asc"`
             (ascending), `"desc"` (descending), and `"normal"` (descending with
             reversed cursor semantics where `before` fetches older records and
-            `after` fetches newer records).
+            `after` fetches newer records). Defaults to `normal`.
           schema:
             $ref: '#/components/schemas/PaginationOrder'
         - name: resource_id
@@ -4291,7 +4291,7 @@ paths:
             Order the results by the creation time. Supported values are `"asc"`
             (ascending), `"desc"` (descending), and `"normal"` (descending with
             reversed cursor semantics where `before` fetches older records and
-            `after` fetches newer records).
+            `after` fetches newer records). Defaults to `normal`.
           schema:
             $ref: '#/components/schemas/PaginationOrder'
         - name: permission_slug
@@ -4457,7 +4457,7 @@ paths:
             Order the results by the creation time. Supported values are `"asc"`
             (ascending), `"desc"` (descending), and `"normal"` (descending with
             reversed cursor semantics where `before` fetches older records and
-            `after` fetches newer records).
+            `after` fetches newer records). Defaults to `normal`.
           schema:
             $ref: '#/components/schemas/PaginationOrder'
         - name: role_slug
@@ -4551,7 +4551,7 @@ paths:
             Order the results by the creation time. Supported values are `"asc"`
             (ascending), `"desc"` (descending), and `"normal"` (descending with
             reversed cursor semantics where `before` fetches older records and
-            `after` fetches newer records).
+            `after` fetches newer records). Defaults to `normal`.
           schema:
             $ref: '#/components/schemas/PaginationOrder'
       responses:
@@ -4925,7 +4925,7 @@ paths:
             Order the results by the creation time. Supported values are `"asc"`
             (ascending), `"desc"` (descending), and `"normal"` (descending with
             reversed cursor semantics where `before` fetches older records and
-            `after` fetches newer records).
+            `after` fetches newer records). Defaults to `normal`.
           schema:
             $ref: '#/components/schemas/PaginationOrder'
         - name: organization_id
@@ -5630,7 +5630,7 @@ paths:
             Order the results by the creation time. Supported values are `"asc"`
             (ascending), `"desc"` (descending), and `"normal"` (descending with
             reversed cursor semantics where `before` fetches older records and
-            `after` fetches newer records).
+            `after` fetches newer records). Defaults to `normal`.
           schema:
             $ref: '#/components/schemas/PaginationOrder'
         - name: permission_slug
@@ -5780,7 +5780,7 @@ paths:
             Order the results by the creation time. Supported values are `"asc"`
             (ascending), `"desc"` (descending), and `"normal"` (descending with
             reversed cursor semantics where `before` fetches older records and
-            `after` fetches newer records).
+            `after` fetches newer records). Defaults to `normal`.
           schema:
             $ref: '#/components/schemas/PaginationOrder'
         - name: role_slug
@@ -6638,7 +6638,7 @@ paths:
             Order the results by the creation time. Supported values are `"asc"`
             (ascending), `"desc"` (descending), and `"normal"` (descending with
             reversed cursor semantics where `before` fetches older records and
-            `after` fetches newer records).
+            `after` fetches newer records). Defaults to `normal`.
           schema:
             $ref: '#/components/schemas/PaginationOrder'
         - name: registration_types
@@ -7024,131 +7024,1471 @@ paths:
       tags:
         - application.client-secrets
   /connections:
+    post:
+      description: >-
+        Creates a new connection for an organization. Provide `saml_options` or
+        `oidc_options` to configure the identity provider. When `external_id`
+        matches an existing connection in the organization, that connection is
+        returned instead of creating a duplicate.
+      operationId: ConnectionsController_create
+      parameters: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/CreateConnectionDto'
+      responses:
+        '201':
+          description: Created
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Connection'
+        '400':
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                oneOf:
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: external_id_already_in_use
+                        const: external_id_already_in_use
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: connection_type_not_supported
+                        const: connection_type_not_supported
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: connection_type_or_options_required
+                        const: connection_type_or_options_required
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: connection_type_conflicts_with_options
+                        const: connection_type_conflicts_with_options
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: both_saml_and_oidc_options_provided
+                        const: both_saml_and_oidc_options_provided
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: ambiguous_saml_options
+                        const: ambiguous_saml_options
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: incomplete_saml_options
+                        const: incomplete_saml_options
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: saml_options_required
+                        const: saml_options_required
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: oidc_options_required
+                        const: oidc_options_required
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: invalid_certificate
+                        const: invalid_certificate
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: client_secret_required
+                        const: client_secret_required
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: client_secret_not_accepted
+                        const: client_secret_not_accepted
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: key_pair_not_accepted
+                        const: key_pair_not_accepted
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: discovery_endpoint_must_use_https
+                        const: discovery_endpoint_must_use_https
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: token_authentication_method_not_supported
+                        const: token_authentication_method_not_supported
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+        '403':
+          description: Forbidden
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '404':
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '409':
+          description: ''
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code:
+                    type: string
+                    description: The error code identifying the type of error.
+                    example: connection_deletion_in_progress
+                    const: connection_deletion_in_progress
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: Request could not be processed.
+                required:
+                  - code
+                  - message
+        '422':
+          description: Unprocessable Entity
+          content:
+            application/json:
+              schema:
+                oneOf:
+                  - type: object
+                    properties:
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: >-
+                          Organization not found:
+                          'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                    required:
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: idp_metadata_fetch_failed
+                        const: idp_metadata_fetch_failed
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: connection_could_not_be_verified
+                        const: connection_could_not_be_verified
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: invalid_idp_sso_url
+                        const: invalid_idp_sso_url
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+      summary: Create a Connection
+      tags:
+        - connections
+      x-feature-flag: connections-api-migrations-capabilities-api
+      x-mutually-exclusive-body-groups: &ref_7
+        protocol_options:
+          optional: false
+          variants:
+            saml:
+              - saml_options
+            oidc:
+              - oidc_options
     get:
       description: >-
-        Get a list of all of your existing connections matching the criteria
-        specified.
-      operationId: ConnectionsController_list
+        Get a list of all of your existing connections matching the criteria
+        specified.
+      operationId: ConnectionsController_list
+      parameters:
+        - name: before
+          required: false
+          in: query
+          description: >-
+            An object ID that defines your place in the list. When the ID is not
+            present, you are at the end of the list.
+          schema:
+            example: obj_1234567890
+            type: string
+        - name: after
+          required: false
+          in: query
+          description: >-
+            An object ID that defines your place in the list. When the ID is not
+            present, you are at the end of the list.
+          schema:
+            example: obj_1234567890
+            type: string
+        - name: limit
+          required: false
+          in: query
+          description: >-
+            Upper limit on the number of objects to return, between `1` and
+            `100`.
+          schema:
+            minimum: 1
+            maximum: 100
+            default: 10
+            example: 10
+            type: integer
+        - name: order
+          required: false
+          in: query
+          description: Order the results by the creation time. Defaults to `normal`.
+          schema:
+            $ref: '#/components/schemas/PaginationOrder'
+        - name: connection_type
+          required: false
+          in: query
+          description: Filter Connections by their type.
+          schema:
+            example: GithubOAuth
+            enum:
+              - ADFSSAML
+              - AdpOidc
+              - AppleOAuth
+              - Auth0SAML
+              - AzureSAML
+              - BitbucketOAuth
+              - CasSAML
+              - CloudflareSAML
+              - ClassLinkSAML
+              - CleverOIDC
+              - CyberArkSAML
+              - DuoSAML
+              - EntraIdOIDC
+              - GenericOIDC
+              - GenericSAML
+              - GithubOAuth
+              - GitLabOAuth
+              - GoogleOAuth
+              - GoogleOIDC
+              - GoogleSAML
+              - IntuitOAuth
+              - JumpCloudSAML
+              - KeycloakSAML
+              - LastPassSAML
+              - LinkedInOAuth
+              - LoginGovOidc
+              - MagicLink
+              - MicrosoftOAuth
+              - MiniOrangeSAML
+              - NetIqSAML
+              - OktaOIDC
+              - OktaSAML
+              - OneLoginSAML
+              - OracleSAML
+              - PingFederateSAML
+              - PingOneSAML
+              - RipplingSAML
+              - SalesforceSAML
+              - ShibbolethGenericSAML
+              - ShibbolethSAML
+              - SimpleSamlPhpSAML
+              - SalesforceOAuth
+              - SlackOAuth
+              - VercelMarketplaceOAuth
+              - VercelOAuth
+              - VMwareSAML
+              - XeroOAuth
+            type: string
+        - name: domain
+          required: false
+          in: query
+          description: Filter Connections by their associated domain.
+          schema:
+            example: foo-corp.com
+            type: string
+        - name: organization_id
+          required: false
+          in: query
+          description: Filter Connections by their associated organization.
+          schema:
+            example: org_01EHWNCE74X7JSDV0X3SZ3KJNY
+            type: string
+        - name: search
+          required: false
+          in: query
+          description: Searchable text to match against Connection names.
+          schema:
+            example: Foo Corp
+            type: string
+      responses:
+        '200':
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ConnectionList'
+        '403':
+          description: Forbidden
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '422':
+          description: Unprocessable Entity
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+      summary: List Connections
+      tags:
+        - connections
+  /connections/{connectionId}/saml_idp_signing_certs:
+    get:
+      description: >-
+        Lists every Identity Provider signing certificate on the connection,
+        including expired ones, oldest first.
+      operationId: SamlIdpSigningCertificatesController_list
+      parameters:
+        - name: connectionId
+          required: true
+          in: path
+          description: Unique identifier for the Connection.
+          schema:
+            example: conn_01E4ZCR3C56J083X43JQXF3JK5
+            type: string
+      responses:
+        '200':
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/SamlIdpSigningCertificateList'
+        '400':
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code:
+                    type: string
+                    description: The error code identifying the type of error.
+                    example: connection_is_not_saml
+                    const: connection_is_not_saml
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: Request could not be processed.
+                required:
+                  - code
+                  - message
+        '403':
+          description: Forbidden
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '404':
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+      summary: List IdP signing certificates
+      tags:
+        - connections
+      x-feature-flag: connections-api-migrations-capabilities-api
+    post:
+      description: >-
+        Adds an Identity Provider signing certificate to the connection, so SAML
+        responses signed with its key can be verified. Use this to import a new
+        certificate ahead of an Identity Provider rotation — the existing
+        certificates keep working until they are deleted or expire.
+      operationId: SamlIdpSigningCertificatesController_create
+      parameters:
+        - name: connectionId
+          required: true
+          in: path
+          description: Unique identifier for the Connection.
+          schema:
+            example: conn_01E4ZCR3C56J083X43JQXF3JK5
+            type: string
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/CreateSamlIdpSigningCertificateDto'
+      responses:
+        '201':
+          description: Created
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/SamlIdpSigningCertificate'
+        '400':
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                oneOf:
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: connection_is_not_saml
+                        const: connection_is_not_saml
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: invalid_certificate
+                        const: invalid_certificate
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: certificate_expired
+                        const: certificate_expired
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+        '403':
+          description: Forbidden
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '404':
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '422':
+          description: Unprocessable Entity
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+      summary: Create an IdP signing certificate
+      tags:
+        - connections
+      x-feature-flag: connections-api-migrations-capabilities-api
+  /connections/{connectionId}/saml_idp_signing_certs/{certificateId}:
+    delete:
+      description: >-
+        Removes an Identity Provider signing certificate from the connection.
+        The last remaining certificate cannot be deleted. A certificate still
+        published in the Identity Provider metadata may be restored by a
+        metadata refresh.
+      operationId: SamlIdpSigningCertificatesController_delete
+      parameters:
+        - name: connectionId
+          required: true
+          in: path
+          description: Unique identifier for the Connection.
+          schema:
+            example: conn_01E4ZCR3C56J083X43JQXF3JK5
+            type: string
+        - name: certificateId
+          required: true
+          in: path
+          description: Unique identifier for the Identity Provider signing certificate.
+          schema:
+            example: saml_x509_cert_01E4ZCR3C56J083X43JQXF3JK5
+            type: string
+      responses:
+        '204':
+          description: No Content
+        '400':
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code:
+                    type: string
+                    description: The error code identifying the type of error.
+                    example: cannot_delete_last_certificate
+                    const: cannot_delete_last_certificate
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: Request could not be processed.
+                required:
+                  - code
+                  - message
+        '403':
+          description: Forbidden
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '404':
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+      summary: Delete an IdP signing certificate
+      tags:
+        - connections
+      x-feature-flag: connections-api-migrations-capabilities-api
+  /connections/{connectionId}/saml_sp_encryption_certs:
+    get:
+      description: >-
+        Lists the public certificates the Identity Provider can use to encrypt
+        SAML responses sent to WorkOS, including expired ones, oldest first.
+      operationId: SamlSpEncryptionCertificatesController_list
+      parameters:
+        - name: connectionId
+          required: true
+          in: path
+          description: Unique identifier for the Connection.
+          schema:
+            example: conn_01E4ZCR3C56J083X43JQXF3JK5
+            type: string
+      responses:
+        '200':
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/SamlSpEncryptionCertificateList'
+        '400':
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code:
+                    type: string
+                    description: The error code identifying the type of error.
+                    example: connection_is_not_saml
+                    const: connection_is_not_saml
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: Request could not be processed.
+                required:
+                  - code
+                  - message
+        '403':
+          description: Forbidden
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '404':
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+      summary: List SP encryption certificates
+      tags:
+        - connections
+      x-feature-flag: connections-api-migrations-capabilities-api
+    post:
+      description: >-
+        Generates a new encryption key pair for the connection and returns its
+        public certificate. WorkOS holds the private key, so the request takes
+        no body — to bring your own key pairs, provide
+        `saml_options.sp_encryption_key_pairs` when creating the connection
+        instead. Creating a certificate appends rather than replaces: every
+        active private key is tried when decrypting, which lets a rotation
+        overlap the old and new certificates.
+      operationId: SamlSpEncryptionCertificatesController_create
+      parameters:
+        - name: connectionId
+          required: true
+          in: path
+          description: Unique identifier for the Connection.
+          schema:
+            example: conn_01E4ZCR3C56J083X43JQXF3JK5
+            type: string
+      responses:
+        '201':
+          description: Created
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/SamlSpEncryptionCertificate'
+        '400':
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                oneOf:
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: connection_is_not_saml
+                        const: connection_is_not_saml
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: key_pair_not_accepted
+                        const: key_pair_not_accepted
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+        '403':
+          description: Forbidden
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '404':
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '409':
+          description: ''
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code:
+                    type: string
+                    description: The error code identifying the type of error.
+                    example: too_many_sp_encryption_certs
+                    const: too_many_sp_encryption_certs
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: Request could not be processed.
+                required:
+                  - code
+                  - message
+        '503':
+          description: ''
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code:
+                    type: string
+                    description: The error code identifying the type of error.
+                    example: concurrent_request
+                    const: concurrent_request
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: Request could not be processed.
+                required:
+                  - code
+                  - message
+      summary: Create an SP encryption certificate
+      tags:
+        - connections
+      x-feature-flag: connections-api-migrations-capabilities-api
+  /connections/{connectionId}/saml_sp_encryption_certs/{certificateId}:
+    delete:
+      description: >-
+        Removes an encryption key pair from the connection. SAML responses
+        encrypted with its certificate can no longer be decrypted, so remove the
+        certificate from the Identity Provider first when rotating.
+      operationId: SamlSpEncryptionCertificatesController_delete
+      parameters:
+        - name: connectionId
+          required: true
+          in: path
+          description: Unique identifier for the Connection.
+          schema:
+            example: conn_01E4ZCR3C56J083X43JQXF3JK5
+            type: string
+        - name: certificateId
+          required: true
+          in: path
+          description: >-
+            Unique identifier for the Service Provider encryption key pair.
+            WorkOS holds the corresponding private key, which is never exposed.
+          schema:
+            example: saml_enc_key_pair_01E4ZCR3C56J083X43JQXF3JK5
+            type: string
+      responses:
+        '204':
+          description: No Content
+        '403':
+          description: Forbidden
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '404':
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+      summary: Delete an SP encryption certificate
+      tags:
+        - connections
+      x-feature-flag: connections-api-migrations-capabilities-api
+  /connections/{connectionId}/saml_sp_signing_cert:
+    get:
+      description: >-
+        Returns the public certificate the Identity Provider can use to verify
+        the signature of SAML requests sent by WorkOS. Responds with `404` when
+        the connection has no request signing key pair.
+      operationId: SamlSpSigningCertificatesController_get
+      parameters:
+        - name: connectionId
+          required: true
+          in: path
+          description: Unique identifier for the Connection.
+          schema:
+            example: conn_01E4ZCR3C56J083X43JQXF3JK5
+            type: string
+      responses:
+        '200':
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/SamlSpSigningCertificate'
+        '400':
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code:
+                    type: string
+                    description: The error code identifying the type of error.
+                    example: connection_is_not_saml
+                    const: connection_is_not_saml
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: Request could not be processed.
+                required:
+                  - code
+                  - message
+        '403':
+          description: Forbidden
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '404':
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+      summary: Get the SP signing certificate
+      tags:
+        - connections
+      x-feature-flag: connections-api-migrations-capabilities-api
+    post:
+      description: >-
+        Generates a new request signing key pair for the connection and returns
+        its public certificate. WorkOS holds the private key, so the request
+        takes no body — to bring your own key pair, provide
+        `saml_options.sp_signing_key_pair` when creating the connection instead.
+        A connection signs with one key pair at a time: delete the existing
+        certificate before creating its replacement.
+      operationId: SamlSpSigningCertificatesController_create
       parameters:
-        - name: before
-          required: false
-          in: query
-          description: >-
-            An object ID that defines your place in the list. When the ID is not
-            present, you are at the end of the list.
+        - name: connectionId
+          required: true
+          in: path
+          description: Unique identifier for the Connection.
           schema:
-            example: obj_1234567890
+            example: conn_01E4ZCR3C56J083X43JQXF3JK5
             type: string
-        - name: after
-          required: false
-          in: query
-          description: >-
-            An object ID that defines your place in the list. When the ID is not
-            present, you are at the end of the list.
+      responses:
+        '201':
+          description: Created
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/SamlSpSigningCertificate'
+        '400':
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                oneOf:
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: connection_is_not_saml
+                        const: connection_is_not_saml
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: key_pair_not_accepted
+                        const: key_pair_not_accepted
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: connection_type_not_supported
+                        const: connection_type_not_supported
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+        '403':
+          description: Forbidden
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '404':
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '409':
+          description: ''
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code:
+                    type: string
+                    description: The error code identifying the type of error.
+                    example: sp_signing_cert_already_exists
+                    const: sp_signing_cert_already_exists
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: Request could not be processed.
+                required:
+                  - code
+                  - message
+        '503':
+          description: ''
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code:
+                    type: string
+                    description: The error code identifying the type of error.
+                    example: concurrent_request
+                    const: concurrent_request
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: Request could not be processed.
+                required:
+                  - code
+                  - message
+      summary: Create an SP signing certificate
+      tags:
+        - connections
+      x-feature-flag: connections-api-migrations-capabilities-api
+  /connections/{connectionId}/saml_sp_signing_cert/{certificateId}:
+    delete:
+      description: >-
+        Removes the request signing key pair from the connection, after which
+        SAML requests are sent unsigned. Delete the certificate before creating
+        its replacement when rotating.
+      operationId: SamlSpSigningCertificatesController_delete
+      parameters:
+        - name: connectionId
+          required: true
+          in: path
+          description: Unique identifier for the Connection.
           schema:
-            example: obj_1234567890
+            example: conn_01E4ZCR3C56J083X43JQXF3JK5
             type: string
-        - name: limit
-          required: false
-          in: query
+        - name: certificateId
+          required: true
+          in: path
           description: >-
-            Upper limit on the number of objects to return, between `1` and
-            `100`.
-          schema:
-            minimum: 1
-            maximum: 100
-            default: 10
-            example: 10
-            type: integer
-        - name: order
-          required: false
-          in: query
-          description: Order the results by the creation time.
-          schema:
-            $ref: '#/components/schemas/PaginationOrder'
-        - name: connection_type
-          required: false
-          in: query
-          description: Filter Connections by their type.
-          schema:
-            example: GithubOAuth
-            enum:
-              - ADFSSAML
-              - AdpOidc
-              - AppleOAuth
-              - Auth0SAML
-              - AzureSAML
-              - BitbucketOAuth
-              - CasSAML
-              - CloudflareSAML
-              - ClassLinkSAML
-              - CleverOIDC
-              - CyberArkSAML
-              - DuoSAML
-              - EntraIdOIDC
-              - GenericOIDC
-              - GenericSAML
-              - GithubOAuth
-              - GitLabOAuth
-              - GoogleOAuth
-              - GoogleOIDC
-              - GoogleSAML
-              - IntuitOAuth
-              - JumpCloudSAML
-              - KeycloakSAML
-              - LastPassSAML
-              - LinkedInOAuth
-              - LoginGovOidc
-              - MagicLink
-              - MicrosoftOAuth
-              - MiniOrangeSAML
-              - NetIqSAML
-              - OktaOIDC
-              - OktaSAML
-              - OneLoginSAML
-              - OracleSAML
-              - PingFederateSAML
-              - PingOneSAML
-              - RipplingSAML
-              - SalesforceSAML
-              - ShibbolethGenericSAML
-              - ShibbolethSAML
-              - SimpleSamlPhpSAML
-              - SalesforceOAuth
-              - SlackOAuth
-              - VercelMarketplaceOAuth
-              - VercelOAuth
-              - VMwareSAML
-              - XeroOAuth
-            type: string
-        - name: domain
-          required: false
-          in: query
-          description: Filter Connections by their associated domain.
-          schema:
-            example: foo-corp.com
-            type: string
-        - name: organization_id
-          required: false
-          in: query
-          description: Filter Connections by their associated organization.
+            Unique identifier for the Service Provider signing key pair. WorkOS
+            holds the corresponding private key, which is never exposed.
           schema:
-            example: org_01EHWNCE74X7JSDV0X3SZ3KJNY
+            example: saml_party_trust_01E4ZCR3C56J083X43JQXF3JK5
             type: string
-        - name: search
-          required: false
-          in: query
-          description: Searchable text to match against Connection names.
+      responses:
+        '204':
+          description: No Content
+        '403':
+          description: Forbidden
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '404':
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+      summary: Delete the SP signing certificate
+      tags:
+        - connections
+      x-feature-flag: connections-api-migrations-capabilities-api
+  /connections/{id}:
+    patch:
+      description: >-
+        Updates an existing connection. Only the provided fields are changed;
+        fields that accept `null` are reset to their default behavior.
+      operationId: ConnectionsController_patch
+      parameters:
+        - name: id
+          required: true
+          in: path
+          description: Unique identifier for the Connection.
           schema:
-            example: Foo Corp
+            example: conn_01E4ZCR3C56J083X43JQXF3JK5
             type: string
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/PatchConnectionDto'
       responses:
         '200':
           description: OK
           content:
             application/json:
               schema:
-                $ref: '#/components/schemas/ConnectionList'
+                $ref: '#/components/schemas/Connection'
+        '400':
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                oneOf:
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: external_id_already_in_use
+                        const: external_id_already_in_use
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: connection_type_not_supported
+                        const: connection_type_not_supported
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: connection_type_conflicts_with_options
+                        const: connection_type_conflicts_with_options
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: both_saml_and_oidc_options_provided
+                        const: both_saml_and_oidc_options_provided
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: ambiguous_saml_options
+                        const: ambiguous_saml_options
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: token_authentication_method_not_supported
+                        const: token_authentication_method_not_supported
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: id_token_signature_algorithm_not_supported
+                        const: id_token_signature_algorithm_not_supported
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: client_secret_required
+                        const: client_secret_required
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: client_secret_not_accepted
+                        const: client_secret_not_accepted
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: discovery_endpoint_must_use_https
+                        const: discovery_endpoint_must_use_https
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
         '403':
           description: Forbidden
           content:
@@ -7162,8 +8502,8 @@ paths:
                     example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
                 required:
                   - message
-        '422':
-          description: Unprocessable Entity
+        '404':
+          description: Not Found
           content:
             application/json:
               schema:
@@ -7175,10 +8515,95 @@ paths:
                     example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
                 required:
                   - message
-      summary: List Connections
+        '409':
+          description: ''
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code:
+                    type: string
+                    description: The error code identifying the type of error.
+                    example: connection_deletion_in_progress
+                    const: connection_deletion_in_progress
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: Request could not be processed.
+                required:
+                  - code
+                  - message
+        '422':
+          description: Unprocessable Entity
+          content:
+            application/json:
+              schema:
+                oneOf:
+                  - type: object
+                    properties:
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: >-
+                          Organization not found:
+                          'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                    required:
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: connection_type_not_updatable
+                        const: connection_type_not_updatable
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: idp_metadata_fetch_failed
+                        const: idp_metadata_fetch_failed
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: connection_could_not_be_verified
+                        const: connection_could_not_be_verified
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+      summary: Update a Connection
       tags:
         - connections
-  /connections/{id}:
+      x-feature-flag: connections-api-migrations-capabilities-api
+      x-mutually-exclusive-body-groups: &ref_10
+        protocol_options:
+          optional: true
+          variants:
+            saml:
+              - saml_options
+            oidc:
+              - oidc_options
     get:
       description: Get the details of an existing connection.
       operationId: ConnectionsController_find
@@ -7419,7 +8844,7 @@ paths:
             Order the results by the creation time. Supported values are `"asc"`
             (ascending), `"desc"` (descending), and `"normal"` (descending with
             reversed cursor semantics where `before` fetches older records and
-            `after` fetches newer records).
+            `after` fetches newer records). Defaults to `normal`.
           schema:
             $ref: '#/components/schemas/PaginationOrder'
       responses:
@@ -7860,7 +9285,7 @@ paths:
                     installation, keyed by the provider's config field
                     descriptors.
                   example:
-                    mydomain: acme
+                    salesforce_host: acme.my.salesforce.com
               required:
                 - user_id
                 - client_id
@@ -8155,7 +9580,7 @@ paths:
         - name: order
           required: false
           in: query
-          description: Order the results by the creation time.
+          description: Order the results by the creation time. Defaults to `normal`.
           schema:
             $ref: '#/components/schemas/PaginationOrder'
         - name: organization_id
@@ -8349,7 +9774,7 @@ paths:
             Order the results by the creation time. Supported values are `"asc"`
             (ascending), `"desc"` (descending), and `"normal"` (descending with
             reversed cursor semantics where `before` fetches older records and
-            `after` fetches newer records).
+            `after` fetches newer records). Defaults to `normal`.
           schema:
             $ref: '#/components/schemas/PaginationOrder'
         - name: directory
@@ -8517,7 +9942,7 @@ paths:
             Order the results by the creation time. Supported values are `"asc"`
             (ascending), `"desc"` (descending), and `"normal"` (descending with
             reversed cursor semantics where `before` fetches older records and
-            `after` fetches newer records).
+            `after` fetches newer records). Defaults to `normal`.
           schema:
             $ref: '#/components/schemas/PaginationOrder'
         - name: directory
@@ -8708,7 +10133,7 @@ paths:
             Order the results by the creation time. Supported values are `"asc"`
             (ascending), `"desc"` (descending), and `"normal"` (descending with
             reversed cursor semantics where `before` fetches older records and
-            `after` fetches newer records).
+            `after` fetches newer records). Defaults to `normal`.
           schema:
             $ref: '#/components/schemas/PaginationOrder'
         - name: events
@@ -8843,7 +10268,7 @@ paths:
         - name: order
           required: false
           in: query
-          description: Order the results by the creation time.
+          description: Order the results by the creation time. Defaults to `normal`.
           schema:
             $ref: '#/components/schemas/PaginationOrder'
       responses:
@@ -9594,7 +11019,7 @@ paths:
             Order the results by the creation time. Supported values are `"asc"`
             (ascending), `"desc"` (descending), and `"normal"` (descending with
             reversed cursor semantics where `before` fetches older records and
-            `after` fetches newer records).
+            `after` fetches newer records). Defaults to `normal`.
           schema:
             $ref: '#/components/schemas/PaginationOrder'
         - name: domains
@@ -10170,7 +11595,7 @@ paths:
         - name: order
           required: false
           in: query
-          description: Order the results by the creation time.
+          description: Order the results by the creation time. Defaults to `normal`.
           schema:
             $ref: '#/components/schemas/PaginationOrder'
       responses:
@@ -10447,7 +11872,7 @@ paths:
         - name: order
           required: false
           in: query
-          description: Order the results by the creation time.
+          description: Order the results by the creation time. Defaults to `desc`.
           schema:
             $ref: '#/components/schemas/PaginationOrder'
       responses:
@@ -10613,7 +12038,7 @@ paths:
             Order the results by the creation time. Supported values are `"asc"`
             (ascending), `"desc"` (descending), and `"normal"` (descending with
             reversed cursor semantics where `before` fetches older records and
-            `after` fetches newer records).
+            `after` fetches newer records). Defaults to `normal`.
           schema:
             $ref: '#/components/schemas/PaginationOrder'
         - name: search
@@ -11012,7 +12437,7 @@ paths:
             Order the results by the creation time. Supported values are `"asc"`
             (ascending), `"desc"` (descending), and `"normal"` (descending with
             reversed cursor semantics where `before` fetches older records and
-            `after` fetches newer records).
+            `after` fetches newer records). Defaults to `normal`.
           schema:
             $ref: '#/components/schemas/PaginationOrder'
       responses:
@@ -11167,7 +12592,7 @@ paths:
             Order the results by the creation time. Supported values are `"asc"`
             (ascending), `"desc"` (descending), and `"normal"` (descending with
             reversed cursor semantics where `before` fetches older records and
-            `after` fetches newer records).
+            `after` fetches newer records). Defaults to `normal`.
           schema:
             $ref: '#/components/schemas/PaginationOrder'
       responses:
@@ -14262,7 +15687,7 @@ paths:
             Order the results by the creation time. Supported values are `"asc"`
             (ascending), `"desc"` (descending), and `"normal"` (descending with
             reversed cursor semantics where `before` fetches older records and
-            `after` fetches newer records).
+            `after` fetches newer records). Defaults to `normal`.
           schema:
             $ref: '#/components/schemas/PaginationOrder'
       responses:
@@ -14413,7 +15838,7 @@ paths:
             Order the results by the creation time. Supported values are `"asc"`
             (ascending), `"desc"` (descending), and `"normal"` (descending with
             reversed cursor semantics where `before` fetches older records and
-            `after` fetches newer records).
+            `after` fetches newer records). Defaults to `desc`.
           schema:
             $ref: '#/components/schemas/PaginationOrder'
         - name: organization_id
@@ -15450,7 +16875,7 @@ paths:
             Order the results by the creation time. Supported values are `"asc"`
             (ascending), `"desc"` (descending), and `"normal"` (descending with
             reversed cursor semantics where `before` fetches older records and
-            `after` fetches newer records).
+            `after` fetches newer records). Defaults to `desc`.
           schema:
             $ref: '#/components/schemas/PaginationOrder'
         - name: organization_id
@@ -15777,7 +17202,7 @@ paths:
       summary: Create an organization membership
       tags:
         - user-management.organization-membership
-      x-mutually-exclusive-body-groups: &ref_10
+      x-mutually-exclusive-body-groups: &ref_14
         role:
           optional: true
           variants:
@@ -15961,7 +17386,7 @@ paths:
       summary: Update an organization membership
       tags:
         - user-management.organization-membership
-      x-mutually-exclusive-body-groups: &ref_11
+      x-mutually-exclusive-body-groups: &ref_15
         role:
           optional: true
           variants:
@@ -16296,7 +17721,7 @@ paths:
             Order the results by the creation time. Supported values are `"asc"`
             (ascending), `"desc"` (descending), and `"normal"` (descending with
             reversed cursor semantics where `before` fetches older records and
-            `after` fetches newer records).
+            `after` fetches newer records). Defaults to `normal`.
           schema:
             $ref: '#/components/schemas/PaginationOrder'
       responses:
@@ -16760,7 +18185,7 @@ paths:
             Order the results by the creation time. Supported values are `"asc"`
             (ascending), `"desc"` (descending), and `"normal"` (descending with
             reversed cursor semantics where `before` fetches older records and
-            `after` fetches newer records).
+            `after` fetches newer records). Defaults to `normal`.
           schema:
             $ref: '#/components/schemas/PaginationOrder'
       responses:
@@ -17024,7 +18449,7 @@ paths:
             Order the results by the creation time. Supported values are `"asc"`
             (ascending), `"desc"` (descending), and `"normal"` (descending with
             reversed cursor semantics where `before` fetches older records and
-            `after` fetches newer records).
+            `after` fetches newer records). Defaults to `desc`.
           schema:
             $ref: '#/components/schemas/PaginationOrder'
         - name: organization
@@ -17281,7 +18706,7 @@ paths:
       summary: Create a user
       tags:
         - user-management.users
-      x-mutually-exclusive-body-groups: &ref_12
+      x-mutually-exclusive-body-groups: &ref_16
         password:
           optional: true
           variants:
@@ -17574,7 +18999,7 @@ paths:
       summary: Update a user
       tags:
         - user-management.users
-      x-mutually-exclusive-body-groups: &ref_16
+      x-mutually-exclusive-body-groups: &ref_20
         password:
           optional: true
           variants:
@@ -18421,7 +19846,7 @@ paths:
             Order the results by the creation time. Supported values are `"asc"`
             (ascending), `"desc"` (descending), and `"normal"` (descending with
             reversed cursor semantics where `before` fetches older records and
-            `after` fetches newer records).
+            `after` fetches newer records). Defaults to `desc`.
           schema:
             $ref: '#/components/schemas/PaginationOrder'
       responses:
@@ -18672,7 +20097,7 @@ paths:
         - name: order
           required: false
           in: query
-          description: Order the results by the creation time.
+          description: Order the results by the creation time. Defaults to `normal`.
           schema:
             $ref: '#/components/schemas/PaginationOrder'
         - name: organization_id
@@ -18844,7 +20269,7 @@ paths:
         - name: order
           required: false
           in: query
-          description: Order the results by the creation time.
+          description: Order the results by the creation time. Defaults to `desc`.
           schema:
             $ref: '#/components/schemas/PaginationOrder'
       responses:
@@ -18925,7 +20350,7 @@ paths:
             Order the results by the creation time. Supported values are `"asc"`
             (ascending), `"desc"` (descending), and `"normal"` (descending with
             reversed cursor semantics where `before` fetches older records and
-            `after` fetches newer records).
+            `after` fetches newer records). Defaults to `normal`.
           schema:
             $ref: '#/components/schemas/PaginationOrder'
       responses:
@@ -19411,7 +20836,7 @@ paths:
         - name: order
           required: false
           in: query
-          description: Order the results by the creation time.
+          description: Order the results by the creation time. Defaults to `normal`.
           schema:
             $ref: '#/components/schemas/PaginationOrder'
       responses:
@@ -19440,8 +20865,11 @@ paths:
   /user_management/waitlist_entries/{id}:
     delete:
       description: >-
-        Removes the entry from the waitlist. An invitation created by approving
-        the entry stays valid, so revoke that invitation to withdraw access.
+        Remove the entry from the waitlist. Its email address can join again
+        unless a user with that email now exists in the environment. Deleting
+        the entry does not revoke an invitation created by approving it —
+        [revoke that invitation](/reference/authkit/invitation/revoke)
+        separately to withdraw access.
       operationId: WaitlistEntriesController_delete
       parameters:
         - name: id
@@ -19473,8 +20901,20 @@ paths:
   /user_management/waitlist_entries/{id}/approve:
     post:
       description: >-
-        Approve a waitlist entry and send the resulting user invitation email.
-        Also reverses a denial: a denied entry can be approved.
+        Approve a waitlist entry, create an invitation for its email address,
+        and send the invitation email. Approving a denied entry reverses the
+        denial. The approval is saved even when the invitation steps fail, so
+        instead of retrying the approval, recover based on the outcome:
+
+
+        - `200` — the entry is approved. If invitation creation failed, no
+        invitation exists yet; [send](/reference/authkit/invitation/send) one.
+
+        - `422` with code `invitation_email_not_sent` — the entry is approved
+        and an invitation exists, but its email was not sent;
+        [resend](/reference/authkit/invitation/resend) it.
+
+        - `422` with code `invalid_state` — the entry was already approved.
       operationId: WaitlistEntriesController_approve
       parameters:
         - name: id
@@ -19610,8 +21050,9 @@ paths:
   /user_management/waitlist_entries/{id}/deny:
     post:
       description: >-
-        Deny a pending waitlist entry. A denial can be reversed by approving the
-        entry.
+        Deny a pending waitlist entry. Denying an entry that is not pending
+        fails with the code `invalid_state`. A denial can be reversed by
+        approving the entry.
       operationId: WaitlistEntriesController_deny
       parameters:
         - name: id
@@ -19730,7 +21171,10 @@ paths:
         - user-management.waitlists
   /user_management/waitlists:
     get:
-      description: Get a list of the waitlists in the environment.
+      description: >-
+        Get a list of the waitlists in the environment. All waitlists are
+        returned in a single response — this endpoint is not paginated, so the
+        `list_metadata` cursors are always `null`.
       operationId: WaitlistsController_list
       parameters: []
       responses:
@@ -19794,7 +21238,9 @@ paths:
           in: path
           description: >-
             The unique ID of the waitlist, or the literal `default` for the
-            environment's default waitlist.
+            environment's default waitlist. The default waitlist is created when
+            its first entry is added, so read requests for `default` return a
+            `404` until then.
           schema:
             type: string
             example: waitlist_01E4ZCR3C56J083X43JQXF3JK5
@@ -19831,7 +21277,9 @@ paths:
           in: path
           description: >-
             The unique ID of the waitlist, or the literal `default` for the
-            environment's default waitlist.
+            environment's default waitlist. The default waitlist is created when
+            its first entry is added, so read requests for `default` return a
+            `404` until then.
           schema:
             type: string
             example: waitlist_01E4ZCR3C56J083X43JQXF3JK5
@@ -19878,7 +21326,7 @@ paths:
             Order the results by the creation time. Supported values are `"asc"`
             (ascending), `"desc"` (descending), and `"normal"` (descending with
             reversed cursor semantics where `before` fetches older records and
-            `after` fetches newer records).
+            `after` fetches newer records). Defaults to `normal`.
           schema:
             $ref: '#/components/schemas/PaginationOrder'
         - name: state
@@ -19983,9 +21431,12 @@ paths:
         - user-management.waitlists
     post:
       description: >-
-        Add an email address to the waitlist. Creating an entry is idempotent
-        per email address: a request for an email address already on the
-        waitlist returns the existing entry.
+        Add an email address to the waitlist. Email addresses are normalized and
+        unique per environment: a request for an email address already on the
+        waitlist returns the existing entry unchanged (still with status `201`)
+        and does not send another confirmation email. If a user with the email
+        address already exists in the environment, the request fails with the
+        code `user_already_exists`.
       operationId: WaitlistsController_createEntry
       parameters:
         - name: id
@@ -19993,10 +21444,11 @@ paths:
           in: path
           description: >-
             The unique ID of the waitlist, or the literal `default` for the
-            environment's default waitlist.
+            environment's default waitlist. Use `default` when adding the first
+            entry — the default waitlist is created automatically.
           schema:
             type: string
-            example: waitlist_01E4ZCR3C56J083X43JQXF3JK5
+            example: default
       requestBody:
         required: true
         content:
@@ -20535,7 +21987,7 @@ paths:
             Order the results by the creation time. Supported values are `"asc"`
             (ascending), `"desc"` (descending), and `"normal"` (descending with
             reversed cursor semantics where `before` fetches older records and
-            `after` fetches newer records).
+            `after` fetches newer records). Defaults to `normal`.
           schema:
             $ref: '#/components/schemas/PaginationOrder'
       responses:
@@ -21140,7 +22592,6 @@ components:
         - desc
         - asc
       example: desc
-      default: desc
     RedirectUriDto:
       type: object
       properties:
@@ -22151,6 +23602,525 @@ components:
                     required:
                       - parent_resource_id
       x-mutually-exclusive-body-groups: *ref_6
+    CreateConnectionKeyPairDto:
+      type: object
+      properties:
+        key:
+          type: string
+          description: The PEM-encoded private key.
+          example: |-
+            -----BEGIN PRIVATE KEY-----
+            MIIE...
+            -----END PRIVATE KEY-----
+        cert:
+          type: string
+          description: The PEM-encoded X.509 certificate for the key.
+          example: |-
+            -----BEGIN CERTIFICATE-----
+            MIIC...
+            -----END CERTIFICATE-----
+      required:
+        - key
+        - cert
+    CreateConnectionSamlOptionsDto:
+      type: object
+      properties:
+        idp_metadata_url:
+          type: string
+          format: uri
+          description: >-
+            The Identity Provider metadata URL. When provided, the IdP fields
+            and signing certificates are imported from the metadata document.
+            Mutually exclusive with the manual IdP fields.
+          example: https://idp.example.com/metadata.xml
+        acs_url:
+          type: string
+          format: uri
+          description: >-
+            A custom Assertion Consumer Service (ACS) URL override. When
+            omitted, the standard WorkOS-generated ACS URL is used.
+          example: https://example.auth0.com/login/callback?connection=123
+        sp_entity_id:
+          type: string
+          description: >-
+            A custom Service Provider Entity ID (audience) override. When
+            omitted, the connection external key is used.
+          example: https://example.auth0.com/login/callback?connection=123
+        idp_entity_id:
+          type: string
+          description: The Identity Provider Entity ID.
+          example: https://idp.example.com/entity
+        idp_sso_url:
+          type: string
+          format: uri
+          description: >-
+            The Identity Provider SSO URL. Required when configuring the
+            connection with manual IdP fields.
+          example: https://idp.example.com/sso
+        idp_signing_certs:
+          description: >-
+            The X.509 certificates used to verify signed SAML responses from the
+            Identity Provider. Required when configuring the connection with
+            manual IdP fields.
+          example:
+            - |-
+              -----BEGIN CERTIFICATE-----
+              MIIC...
+              -----END CERTIFICATE-----
+          type: array
+          items:
+            type: string
+        sp_signing_key_pair:
+          description: >-
+            The customer-owned key pair used to sign SAML requests sent to the
+            Identity Provider. When omitted, WorkOS generates and manages the
+            signing key pair.
+          $ref: '#/components/schemas/CreateConnectionKeyPairDto'
+        sp_encryption_key_pairs:
+          description: >-
+            The customer-owned key pairs used to decrypt encrypted SAML
+            responses from the Identity Provider. When omitted, WorkOS generates
+            and manages the encryption key pair.
+          type: array
+          items:
+            $ref: '#/components/schemas/CreateConnectionKeyPairDto'
+    CreateConnectionOidcOptionsDto:
+      type: object
+      properties:
+        discovery_endpoint:
+          type: string
+          format: uri
+          description: The OIDC discovery endpoint.
+          example: https://idp.example.com/.well-known/openid-configuration
+        client_id:
+          type: string
+          description: The OIDC client ID.
+          example: client_123
+        client_secret:
+          type: string
+          description: >-
+            The OIDC client secret. Required for `client_secret_basic` and
+            `client_secret_post`, and rejected for `private_key_jwt`, which
+            authenticates with a key pair instead. This value is write-only and
+            is never returned.
+          example: secret_xyz
+        redirect_uri:
+          type: string
+          format: uri
+          description: >-
+            A custom OAuth callback URL override. When omitted, the standard
+            WorkOS-generated redirect URI is used.
+          example: https://auth.workos.com/sso/oidc/conn_externalkey/callback
+        pkce:
+          type: boolean
+          description: Whether PKCE is enabled for the connection.
+          example: true
+          default: true
+        token_authentication_method:
+          type: string
+          enum: &ref_8
+            - client_secret_post
+            - client_secret_basic
+            - private_key_jwt
+          description: The token-endpoint client authentication method.
+          example: client_secret_basic
+          default: client_secret_basic
+        jwt_signing_key_pair:
+          description: >-
+            A key pair for WorkOS to sign `private_key_jwt` client assertions
+            with. Only accepted when `token_authentication_method` is
+            `private_key_jwt`; when omitted, WorkOS generates one and returns
+            its certificate in `oidc_options.jwt_signing_certs`.
+          $ref: '#/components/schemas/CreateConnectionKeyPairDto'
+        id_token_signature_algorithm:
+          type: string
+          enum: &ref_9
+            - ES256
+            - ES384
+            - ES512
+            - EdDSA
+            - HS256
+            - HS384
+            - HS512
+            - PS256
+            - PS384
+            - PS512
+            - RS256
+            - RS384
+            - RS512
+          description: The ID-token signing algorithm.
+          example: RS256
+        fetch_user_info:
+          type: boolean
+          description: >-
+            Whether to fetch additional profile attributes from the userinfo
+            endpoint.
+          example: false
+      required:
+        - discovery_endpoint
+        - client_id
+    CreateConnectionStandardAttributesDto:
+      type: object
+      properties:
+        idp_id:
+          type: string
+          description: >-
+            The IdP attribute or claim the profile's `idp_id` is mapped from.
+            When omitted, the default for the connection type is used.
+          example: sub
+        email:
+          type: string
+          description: >-
+            The IdP attribute or claim the profile's `email` is mapped from.
+            When omitted, the default for the connection type is used.
+          example: email
+        first_name:
+          type: string
+          description: >-
+            The IdP attribute or claim the profile's `first_name` is mapped
+            from. When omitted, the default for the connection type is used.
+          example: given_name
+        last_name:
+          type: string
+          description: >-
+            The IdP attribute or claim the profile's `last_name` is mapped from.
+            When omitted, the default for the connection type is used.
+          example: family_name
+        groups:
+          type:
+            - string
+            - 'null'
+          description: >-
+            The IdP attribute or claim the profile's `groups` are mapped from.
+            `null` leaves the mapping unset.
+          example: memberOf
+        name:
+          type:
+            - string
+            - 'null'
+          description: >-
+            The IdP attribute or claim the profile's `name` is mapped from.
+            `null` leaves the mapping unset.
+          example: displayName
+    CreateConnectionAttributeMapsDto:
+      type: object
+      properties:
+        standard_attributes:
+          description: >-
+            How IdP attributes or claims map onto the standard WorkOS profile
+            fields. Provided fields override the defaults for the connection
+            type.
+          $ref: '#/components/schemas/CreateConnectionStandardAttributesDto'
+        custom_attributes:
+          type: object
+          description: >-
+            How IdP attributes or claims map onto custom attributes, keyed by
+            custom attribute name. Custom attributes must already be defined in
+            the WorkOS dashboard.
+          additionalProperties:
+            type: string
+          example:
+            company: company_claim
+    CreateConnectionDto:
+      allOf:
+        - type: object
+          properties:
+            organization_id:
+              type: string
+              description: >-
+                Unique identifier for the Organization in which the Connection
+                resides.
+              example: org_01EHWNCE74X7JSDV0X3SZ3KJNY
+            name:
+              type: string
+              description: >-
+                A human-readable name for the Connection. This will most
+                commonly be the organization's name.
+              example: Foo Corp
+            external_id:
+              type: string
+              maxLength: 128
+              pattern: ^[\x00-\x7F]+$
+              description: The customer-owned identifier for the Connection.
+              example: acme-legacy-conn-42
+            connection_type:
+              type: string
+              description: >-
+                The type of the Connection. Only SAML and OIDC connection types
+                may be created. When omitted, the type is inferred from the
+                provided options.
+              example: OktaSAML
+            attribute_maps:
+              description: >-
+                How IdP attributes or claims map onto WorkOS profile fields.
+                Provided fields override the defaults for the connection type.
+              $ref: '#/components/schemas/CreateConnectionAttributeMapsDto'
+          required:
+            - organization_id
+        - oneOf:
+            - type: object
+              properties:
+                saml_options:
+                  description: >-
+                    Protocol configuration for SAML connections. Mutually
+                    exclusive with `oidc_options`.
+                  $ref: '#/components/schemas/CreateConnectionSamlOptionsDto'
+              required:
+                - saml_options
+              not:
+                anyOf:
+                  - properties:
+                      oidc_options:
+                        x-exclude-from-lint: true
+                    required:
+                      - oidc_options
+            - type: object
+              properties:
+                oidc_options:
+                  description: >-
+                    Protocol configuration for OIDC connections. Mutually
+                    exclusive with `saml_options`.
+                  $ref: '#/components/schemas/CreateConnectionOidcOptionsDto'
+              required:
+                - oidc_options
+              not:
+                anyOf:
+                  - properties:
+                      saml_options:
+                        x-exclude-from-lint: true
+                    required:
+                      - saml_options
+      x-mutually-exclusive-body-groups: *ref_7
+    PatchConnectionSamlOptionsDto:
+      type: object
+      properties:
+        idp_metadata_url:
+          type:
+            - string
+            - 'null'
+          format: uri
+          description: >-
+            The Identity Provider metadata URL. When provided, the IdP fields
+            and signing certificates are re-imported from the metadata document,
+            replacing the current set. Mutually exclusive with the manual IdP
+            fields. Set to `null` to stop tracking a metadata URL.
+          example: https://idp.example.com/metadata.xml
+        acs_url:
+          type:
+            - string
+            - 'null'
+          format: uri
+          description: >-
+            A custom Assertion Consumer Service (ACS) URL override. Set to
+            `null` to revert to the standard WorkOS-generated ACS URL.
+          example: https://example.auth0.com/login/callback?connection=123
+        sp_entity_id:
+          type:
+            - string
+            - 'null'
+          description: >-
+            A custom Service Provider Entity ID (audience) override. Set to
+            `null` to revert to the connection external key.
+          example: https://example.auth0.com/login/callback?connection=123
+        idp_entity_id:
+          type: string
+          description: The Identity Provider Entity ID.
+          example: https://idp.example.com/entity
+        idp_sso_url:
+          type: string
+          format: uri
+          description: The Identity Provider SSO URL.
+          example: https://idp.example.com/sso
+    PatchConnectionOidcOptionsDto:
+      type: object
+      properties:
+        discovery_endpoint:
+          type: string
+          format: uri
+          description: The OIDC discovery endpoint.
+          example: https://idp.example.com/.well-known/openid-configuration
+        client_id:
+          type: string
+          description: The OIDC client ID.
+          example: client_123
+        client_secret:
+          type: string
+          description: >-
+            The OIDC client secret. Required when moving the connection to
+            `client_secret_basic` or `client_secret_post`, and rejected for
+            `private_key_jwt`, which authenticates with a key pair instead. This
+            value is write-only and is never returned.
+          example: secret_xyz
+        redirect_uri:
+          type:
+            - string
+            - 'null'
+          format: uri
+          description: >-
+            A custom OAuth callback URL override. Set to `null` to revert to the
+            standard WorkOS-generated redirect URI.
+          example: https://auth.workos.com/sso/oidc/conn_externalkey/callback
+        pkce:
+          type: boolean
+          description: Whether PKCE is enabled for the connection.
+          example: true
+        token_authentication_method:
+          type: string
+          enum: *ref_8
+          description: >-
+            The token-endpoint client authentication method. Moving to
+            `private_key_jwt` generates a signing key pair if the connection has
+            none; its certificate is returned in
+            `oidc_options.jwt_signing_certs` and must be registered at the
+            Identity Provider.
+          example: client_secret_basic
+        id_token_signature_algorithm:
+          type: string
+          enum: *ref_9
+          description: The ID-token signing algorithm.
+          example: RS256
+        fetch_user_info:
+          type: boolean
+          description: >-
+            Whether to fetch additional profile attributes from the userinfo
+            endpoint.
+          example: false
+    PatchConnectionStandardAttributesDto:
+      type: object
+      properties:
+        idp_id:
+          type: string
+          description: The IdP attribute or claim the profile's `idp_id` is mapped from.
+          example: sub
+        email:
+          type: string
+          description: The IdP attribute or claim the profile's `email` is mapped from.
+          example: email
+        first_name:
+          type: string
+          description: >-
+            The IdP attribute or claim the profile's `first_name` is mapped
+            from.
+          example: given_name
+        last_name:
+          type: string
+          description: The IdP attribute or claim the profile's `last_name` is mapped from.
+          example: family_name
+        groups:
+          type:
+            - string
+            - 'null'
+          description: >-
+            The IdP attribute or claim the profile's `groups` are mapped from.
+            Set to `null` to unset the mapping.
+          example: memberOf
+        name:
+          type:
+            - string
+            - 'null'
+          description: >-
+            The IdP attribute or claim the profile's `name` is mapped from. Set
+            to `null` to unset the mapping.
+          example: displayName
+    PatchConnectionAttributeMapsDto:
+      type: object
+      properties:
+        standard_attributes:
+          description: >-
+            How IdP attributes or claims map onto the standard WorkOS profile
+            fields. Only the provided fields are updated.
+          $ref: '#/components/schemas/PatchConnectionStandardAttributesDto'
+        custom_attributes:
+          type: object
+          description: >-
+            How IdP attributes or claims map onto custom attributes, keyed by
+            custom attribute name. Custom attributes must already be defined in
+            the WorkOS dashboard. Only the provided keys are updated; a `null`
+            value unsets that mapping.
+          additionalProperties:
+            oneOf:
+              - type: string
+              - type: 'null'
+          example:
+            company: company_claim
+    PatchConnectionDto:
+      allOf:
+        - type: object
+          properties:
+            name:
+              type: string
+              description: A human-readable name for the Connection.
+              example: Foo Corp
+            external_id:
+              type:
+                - string
+                - 'null'
+              maxLength: 128
+              pattern: ^[\x00-\x7F]+$
+              description: >-
+                The customer-owned identifier for the Connection. Set to `null`
+                to stop tracking one.
+              example: acme-legacy-conn-42
+            connection_type:
+              type: string
+              description: >-
+                The type of the Connection. Immutable after creation — it may be
+                sent, but only with the Connection current type.
+              example: OktaSAML
+            attribute_maps:
+              description: >-
+                How IdP attributes or claims map onto WorkOS profile fields.
+                Only the provided fields are updated.
+              $ref: '#/components/schemas/PatchConnectionAttributeMapsDto'
+        - oneOf:
+            - type: object
+              not:
+                anyOf:
+                  - properties:
+                      saml_options:
+                        x-exclude-from-lint: true
+                    required:
+                      - saml_options
+                  - properties:
+                      oidc_options:
+                        x-exclude-from-lint: true
+                    required:
+                      - oidc_options
+            - type: object
+              properties:
+                saml_options:
+                  description: >-
+                    Protocol configuration for SAML connections. Only the
+                    provided fields are updated. Mutually exclusive with
+                    `oidc_options`.
+                  $ref: '#/components/schemas/PatchConnectionSamlOptionsDto'
+              required:
+                - saml_options
+              not:
+                anyOf:
+                  - properties:
+                      oidc_options:
+                        x-exclude-from-lint: true
+                    required:
+                      - oidc_options
+            - type: object
+              properties:
+                oidc_options:
+                  description: >-
+                    Protocol configuration for OIDC connections. Only the
+                    provided fields are updated. Mutually exclusive with
+                    `saml_options`.
+                  $ref: '#/components/schemas/PatchConnectionOidcOptionsDto'
+              required:
+                - oidc_options
+              not:
+                anyOf:
+                  - properties:
+                      saml_options:
+                        x-exclude-from-lint: true
+                    required:
+                      - saml_options
+      x-mutually-exclusive-body-groups: *ref_10
     CreateCorsOriginDto:
       type: object
       properties:
@@ -22332,11 +24302,11 @@ components:
           type:
             - object
             - 'null'
-          additionalProperties: &ref_7
+          additionalProperties: &ref_11
             type: string
             maxLength: 600
           maxProperties: 50
-          example: &ref_8
+          example: &ref_12
             tier: diamond
           description: >-
             Object containing [metadata](/authkit/metadata) key/value pairs
@@ -22391,9 +24361,9 @@ components:
           type:
             - object
             - 'null'
-          additionalProperties: *ref_7
+          additionalProperties: *ref_11
           maxProperties: 50
-          example: *ref_8
+          example: *ref_12
           description: >-
             Object containing [metadata](/authkit/metadata) key/value pairs
             associated with the Organization.
@@ -22467,14 +24437,19 @@ components:
           format: uri
           description: >-
             The provider's OAuth authorization endpoint. Required for OAuth
-            providers; omit for `api_key` providers.
+            providers; omit for `api_key` providers. Must be a static URL:
+            `${config.…}` placeholders are resolved against a provider's
+            declared config fields, which custom providers cannot declare.
           example: https://provider.example.com/oauth/authorize
         token_url:
           type: string
           format: uri
           description: >-
-            The provider's OAuth token endpoint. Required for OAuth providers;
-            omit for `api_key` providers.
+            The provider's OAuth token endpoint. Required for OAuth and
+            `client_credentials` providers; omit for `api_key` providers. Must
+            be a static URL: `${config.…}` placeholders are resolved against a
+            provider's declared config fields, which custom providers cannot
+            declare.
           example: https://provider.example.com/oauth/token
         refresh_token_url:
           type:
@@ -22483,7 +24458,7 @@ components:
           format: uri
           description: >-
             The endpoint used to refresh tokens, if different from the token
-            endpoint.
+            endpoint. Must be a static URL, like the other endpoints.
           example: https://provider.example.com/oauth/token
         pkce_enabled:
           type: boolean
@@ -22522,7 +24497,7 @@ components:
           example: application/x-www-form-urlencoded
         authenticate_via:
           type: string
-          enum: &ref_9
+          enum: &ref_13
             - request_body
             - basic_auth_header
           description: >-
@@ -22623,12 +24598,18 @@ components:
         authorization_url:
           type: string
           format: uri
-          description: The provider's OAuth authorization endpoint.
+          description: >-
+            The provider's OAuth authorization endpoint. Must be a static URL:
+            `${config.…}` placeholders are resolved against a provider's
+            declared config fields, which custom providers cannot declare.
           example: https://provider.example.com/oauth/authorize
         token_url:
           type: string
           format: uri
-          description: The provider's OAuth token endpoint.
+          description: >-
+            The provider's OAuth token endpoint. Must be a static URL:
+            `${config.…}` placeholders are resolved against a provider's
+            declared config fields, which custom providers cannot declare.
           example: https://provider.example.com/oauth/token
         refresh_token_url:
           type:
@@ -22637,7 +24618,7 @@ components:
           format: uri
           description: >-
             The endpoint used to refresh tokens, if different from the token
-            endpoint.
+            endpoint. Must be a static URL, like the other endpoints.
           example: https://provider.example.com/oauth/token
         pkce_enabled:
           type: boolean
@@ -22672,7 +24653,7 @@ components:
           example: application/x-www-form-urlencoded
         authenticate_via:
           type: string
-          enum: *ref_9
+          enum: *ref_13
           description: >-
             How client credentials are sent when exchanging authorization codes
             and refreshing tokens.
@@ -22848,6 +24829,15 @@ components:
           example: https://example.com/callback
       required:
         - uri
+    CreateSamlIdpSigningCertificateDto:
+      type: object
+      properties:
+        value:
+          type: string
+          description: The PEM-encoded X.509 certificate.
+          example: '-----BEGIN CERTIFICATE-----MIIC...-----END CERTIFICATE-----'
+      required:
+        - value
     CreateTeamDto:
       type: object
       properties:
@@ -23228,9 +25218,9 @@ components:
                         x-exclude-from-lint: true
                     required:
                       - role_slug
-      x-mutually-exclusive-body-groups: *ref_10
+      x-mutually-exclusive-body-groups: *ref_14
     UpdateUserlandUserOrganizationMembershipDto:
-      x-mutually-exclusive-body-groups: *ref_11
+      x-mutually-exclusive-body-groups: *ref_15
       oneOf:
         - type: object
           not:
@@ -23352,9 +25342,9 @@ components:
               type:
                 - object
                 - 'null'
-              additionalProperties: *ref_7
+              additionalProperties: *ref_11
               maxProperties: 50
-              example: &ref_13
+              example: &ref_17
                 timezone: America/New_York
               description: >-
                 Object containing metadata key/value pairs associated with the
@@ -23453,7 +25443,7 @@ components:
                   example: $2a$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy
                 password_hash_type:
                   type: string
-                  enum: &ref_14
+                  enum: &ref_18
                     - bcrypt
                     - firebase-scrypt
                     - ssha
@@ -23468,7 +25458,7 @@ components:
                   example: bcrypt
                 password_salt_position:
                   type: string
-                  enum: &ref_15
+                  enum: &ref_19
                     - prefix
                     - suffix
                   description: >-
@@ -23489,7 +25479,7 @@ components:
                         x-exclude-from-lint: true
                     required:
                       - password
-      x-mutually-exclusive-body-groups: *ref_12
+      x-mutually-exclusive-body-groups: *ref_16
     UpdateUserlandUserDto:
       allOf:
         - type: object
@@ -23519,9 +25509,9 @@ components:
               type:
                 - object
                 - 'null'
-              additionalProperties: *ref_7
+              additionalProperties: *ref_11
               maxProperties: 50
-              example: *ref_13
+              example: *ref_17
               description: >-
                 Object containing metadata key/value pairs associated with the
                 user.
@@ -23603,7 +25593,7 @@ components:
                   example: $2a$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy
                 password_hash_type:
                   type: string
-                  enum: *ref_14
+                  enum: *ref_18
                   description: >-
                     The algorithm originally used to hash the password, used
                     when providing a `password_hash`. Required with
@@ -23611,7 +25601,7 @@ components:
                   example: bcrypt
                 password_salt_position:
                   type: string
-                  enum: *ref_15
+                  enum: *ref_19
                   description: >-
                     The position of the salt relative to the password when the
                     `password_hash` digest was computed: `prefix` for `hash(salt
@@ -23630,7 +25620,7 @@ components:
                         x-exclude-from-lint: true
                     required:
                       - password
-      x-mutually-exclusive-body-groups: *ref_16
+      x-mutually-exclusive-body-groups: *ref_20
     VerifyEmailAddressDto:
       type: object
       properties:
@@ -23705,8 +25695,9 @@ components:
           type: object
           description: >-
             Object containing additional key/value pairs collected with the
-            waitlist entry. Values are user-provided — treat them as untrusted
-            input when rendering or exporting.
+            waitlist entry. Supports up to 50 string pairs, with keys up to 40
+            characters and values up to 600 characters. Values are user-provided
+            — treat them as untrusted input when rendering or exporting.
           additionalProperties:
             type: string
             maxLength: 600
@@ -23736,7 +25727,14 @@ components:
           description: The events that the Webhook Endpoint is subscribed to.
           items:
             type: string
-            enum: &ref_17
+            enum: &ref_21
+              - agent.blueprint.created
+              - agent.blueprint.deleted
+              - agent.blueprint.updated
+              - agent.instance.created
+              - agent.instance.deleted
+              - agent.instance.session.created
+              - agent.instance.session.revoked
               - agent.registration.created
               - agent.registration.claim.attempt.created
               - agent.registration.claim.completed
@@ -23855,7 +25853,7 @@ components:
           description: The events that the Webhook Endpoint is subscribed to.
           items:
             type: string
-            enum: *ref_17
+            enum: *ref_21
           example:
             - user.created
             - dsync.user.created
@@ -27181,7 +29179,7 @@ components:
           description: >-
             An object containing the custom attribute mapping for the Directory
             Provider.
-          example: &ref_20
+          example: &ref_27
             department: Engineering
             job_title: Software Engineer
         role:
@@ -27375,7 +29373,7 @@ components:
               type: object
               additionalProperties: {}
               description: The event payload.
-              example: &ref_18
+              example: &ref_22
                 id: directory_user_01E1JG7J09H96KYP8HM9B0G5SJ
                 directory_id: directory_01ECAZ4NV9QMV47GW873HDCX74
                 organization_id: org_01EZTR6WYX1A0DSE2CYMGXQ24Y
@@ -27410,11 +29408,11 @@ components:
             - data
             - created_at
           description: An event emitted by WorkOS.
-          example: &ref_25
+          example: &ref_32
             object: event
             id: event_01EHZNVPK3SFK441A1RGBFSHRT
             event: dsync.user.created
-            data: *ref_18
+            data: *ref_22
             created_at: '2021-06-25T19:07:33.155Z'
             context: {}
         - oneOf:
@@ -27426,70 +29424,529 @@ components:
                   example: event_01EHZNVPK3SFK441A1RGBFSHRT
                 event:
                   type: string
-                  const: action.authentication.denied
+                  const: action.authentication.denied
+                data:
+                  type: object
+                  properties:
+                    action_endpoint_id:
+                      type: string
+                      description: The ID of the action endpoint.
+                      example: action_endpoint_01EHWNCE74X7JSDV0X3SZ3KJNY
+                    action_execution_id:
+                      type: string
+                      description: The ID of the action execution.
+                      example: action_execution_01EHWNCE74X7JSDV0X3SZ3KJNY
+                    type:
+                      type: string
+                      description: The type of action that was denied.
+                      const: authentication
+                    verdict:
+                      type: string
+                      description: The verdict of the action.
+                      const: Deny
+                    user_id:
+                      type: string
+                      description: The ID of the user.
+                      example: user_01EHWNCE74X7JSDV0X3SZ3KJNY
+                    organization_id:
+                      type:
+                        - string
+                        - 'null'
+                      description: The ID of the organization.
+                      example: org_01EHWNCE74X7JSDV0X3SZ3KJNY
+                    email:
+                      type: string
+                      description: The email address of the user.
+                      example: user@example.com
+                    ip_address:
+                      type:
+                        - string
+                        - 'null'
+                      description: The IP address of the request.
+                      example: 203.0.113.1
+                    user_agent:
+                      type:
+                        - string
+                        - 'null'
+                      description: The user agent of the request.
+                      example: Mozilla/5.0
+                  required:
+                    - action_endpoint_id
+                    - action_execution_id
+                    - type
+                    - verdict
+                    - user_id
+                    - organization_id
+                    - email
+                    - ip_address
+                    - user_agent
+                  description: The event payload.
+                context:
+                  $ref: '#/components/schemas/EventContextDto'
+                created_at:
+                  format: date-time
+                  type: string
+                  description: An ISO 8601 timestamp.
+                  example: '2026-01-15T12:00:00.000Z'
+                object:
+                  type: string
+                  description: Distinguishes the Event object.
+                  const: event
+              required:
+                - id
+                - event
+                - data
+                - created_at
+                - object
+            - type: object
+              properties:
+                id:
+                  type: string
+                  description: Unique identifier for the event.
+                  example: event_01EHZNVPK3SFK441A1RGBFSHRT
+                event:
+                  type: string
+                  const: action.user_registration.denied
+                data:
+                  type: object
+                  properties:
+                    action_endpoint_id:
+                      type: string
+                      description: The ID of the action endpoint.
+                      example: action_endpoint_01EHWNCE74X7JSDV0X3SZ3KJNY
+                    action_execution_id:
+                      type: string
+                      description: The ID of the action execution.
+                      example: action_execution_01EHWNCE74X7JSDV0X3SZ3KJNY
+                    type:
+                      type: string
+                      description: The type of action that was denied.
+                      const: user_registration
+                    verdict:
+                      type: string
+                      description: The verdict of the action.
+                      const: Deny
+                    organization_id:
+                      type:
+                        - string
+                        - 'null'
+                      description: The ID of the organization.
+                      example: org_01EHWNCE74X7JSDV0X3SZ3KJNY
+                    email:
+                      type: string
+                      description: The email address of the user.
+                      example: user@example.com
+                    ip_address:
+                      type:
+                        - string
+                        - 'null'
+                      description: The IP address of the request.
+                      example: 203.0.113.1
+                    user_agent:
+                      type:
+                        - string
+                        - 'null'
+                      description: The user agent of the request.
+                      example: Mozilla/5.0
+                  required:
+                    - action_endpoint_id
+                    - action_execution_id
+                    - type
+                    - verdict
+                    - organization_id
+                    - email
+                    - ip_address
+                    - user_agent
+                  description: The event payload.
+                context:
+                  $ref: '#/components/schemas/EventContextDto'
+                created_at:
+                  format: date-time
+                  type: string
+                  description: An ISO 8601 timestamp.
+                  example: '2026-01-15T12:00:00.000Z'
+                object:
+                  type: string
+                  description: Distinguishes the Event object.
+                  const: event
+              required:
+                - id
+                - event
+                - data
+                - created_at
+                - object
+            - type: object
+              properties:
+                id:
+                  type: string
+                  description: Unique identifier for the event.
+                  example: event_01EHZNVPK3SFK441A1RGBFSHRT
+                event:
+                  type: string
+                  const: agent.blueprint.created
+                data:
+                  type: object
+                  properties:
+                    object:
+                      type: string
+                      description: Distinguishes the agent blueprint object.
+                      const: agent_blueprint
+                    id:
+                      type: string
+                      description: Unique identifier of the agent blueprint.
+                      example: agent_blueprint_01EHWNCE74X7JSDV0X3SZ3KJNY
+                    name:
+                      type: string
+                      description: Human-readable name of the agent blueprint.
+                      example: Prospecting Agent
+                    description:
+                      type:
+                        - string
+                        - 'null'
+                      description: Human-readable description of the agent blueprint.
+                      example: Finds and qualifies sales prospects.
+                    permissions:
+                      type: array
+                      items:
+                        type: string
+                      description: >-
+                        Permission slugs forming the ceiling on what sessions
+                        minted from this blueprint may do.
+                      example: &ref_23
+                        - crm:read
+                        - email:send
+                    invocable_by:
+                      type: object
+                      properties:
+                        role_slugs:
+                          type: array
+                          items:
+                            type: string
+                          description: >-
+                            Role slugs whose members may mint user-delegated
+                            sessions from this blueprint.
+                          example: &ref_24
+                            - manager
+                        organization_ids:
+                          type: array
+                          items:
+                            type: string
+                          description: >-
+                            Organizations in which autonomous sessions may be
+                            minted from this blueprint.
+                          example: &ref_25
+                            - org_01EHWNCE74X7JSDV0X3SZ3KJNY
+                      required:
+                        - role_slugs
+                        - organization_ids
+                      description: Who may mint sessions from this blueprint.
+                    session_settings:
+                      type: object
+                      properties:
+                        max_age_seconds:
+                          type: number
+                          description: >-
+                            Maximum lifetime of a session in seconds; refreshes
+                            never extend a session past this.
+                          example: 3600
+                        access_token_ttl_seconds:
+                          type: number
+                          description: Lifetime of each minted access token in seconds.
+                          example: 300
+                        refresh_token_ttl_seconds:
+                          type: number
+                          description: Lifetime of each rotated refresh token in seconds.
+                          example: 3600
+                      required:
+                        - max_age_seconds
+                        - access_token_ttl_seconds
+                        - refresh_token_ttl_seconds
+                      description: >-
+                        Token and session lifetimes for sessions minted from
+                        this blueprint.
+                    created_at:
+                      type: string
+                      description: The timestamp when the agent blueprint was created.
+                      example: '2026-01-15T12:00:00.000Z'
+                    updated_at:
+                      type: string
+                      description: The timestamp when the agent blueprint was last updated.
+                      example: '2026-01-15T12:00:00.000Z'
+                  required:
+                    - object
+                    - id
+                    - name
+                    - description
+                    - permissions
+                    - invocable_by
+                    - session_settings
+                    - created_at
+                    - updated_at
+                  description: The event payload.
+                created_at:
+                  format: date-time
+                  type: string
+                  description: An ISO 8601 timestamp.
+                  example: '2026-01-15T12:00:00.000Z'
+                context:
+                  $ref: '#/components/schemas/EventContextDto'
+                object:
+                  type: string
+                  description: Distinguishes the Event object.
+                  const: event
+              required:
+                - id
+                - event
+                - data
+                - created_at
+                - object
+            - type: object
+              properties:
+                id:
+                  type: string
+                  description: Unique identifier for the event.
+                  example: event_01EHZNVPK3SFK441A1RGBFSHRT
+                event:
+                  type: string
+                  const: agent.blueprint.deleted
+                data:
+                  type: object
+                  properties:
+                    object:
+                      type: string
+                      description: Distinguishes the agent blueprint object.
+                      const: agent_blueprint
+                    id:
+                      type: string
+                      description: Unique identifier of the agent blueprint.
+                      example: agent_blueprint_01EHWNCE74X7JSDV0X3SZ3KJNY
+                    name:
+                      type: string
+                      description: Human-readable name of the agent blueprint.
+                      example: Prospecting Agent
+                    created_at:
+                      type: string
+                      description: The timestamp when the agent blueprint was created.
+                      example: '2026-01-15T12:00:00.000Z'
+                    updated_at:
+                      type: string
+                      description: The timestamp when the agent blueprint was last updated.
+                      example: '2026-01-15T12:00:00.000Z'
+                  required:
+                    - object
+                    - id
+                    - name
+                    - created_at
+                    - updated_at
+                  description: The event payload.
+                created_at:
+                  format: date-time
+                  type: string
+                  description: An ISO 8601 timestamp.
+                  example: '2026-01-15T12:00:00.000Z'
+                context:
+                  $ref: '#/components/schemas/EventContextDto'
+                object:
+                  type: string
+                  description: Distinguishes the Event object.
+                  const: event
+              required:
+                - id
+                - event
+                - data
+                - created_at
+                - object
+            - type: object
+              properties:
+                id:
+                  type: string
+                  description: Unique identifier for the event.
+                  example: event_01EHZNVPK3SFK441A1RGBFSHRT
+                event:
+                  type: string
+                  const: agent.blueprint.updated
                 data:
                   type: object
                   properties:
-                    action_endpoint_id:
-                      type: string
-                      description: The ID of the action endpoint.
-                      example: action_endpoint_01EHWNCE74X7JSDV0X3SZ3KJNY
-                    action_execution_id:
-                      type: string
-                      description: The ID of the action execution.
-                      example: action_execution_01EHWNCE74X7JSDV0X3SZ3KJNY
-                    type:
+                    object:
                       type: string
-                      description: The type of action that was denied.
-                      const: authentication
-                    verdict:
+                      description: Distinguishes the agent blueprint object.
+                      const: agent_blueprint
+                    id:
                       type: string
-                      description: The verdict of the action.
-                      const: Deny
-                    user_id:
+                      description: Unique identifier of the agent blueprint.
+                      example: agent_blueprint_01EHWNCE74X7JSDV0X3SZ3KJNY
+                    name:
                       type: string
-                      description: The ID of the user.
-                      example: user_01EHWNCE74X7JSDV0X3SZ3KJNY
-                    organization_id:
+                      description: Human-readable name of the agent blueprint.
+                      example: Prospecting Agent
+                    description:
                       type:
                         - string
                         - 'null'
-                      description: The ID of the organization.
-                      example: org_01EHWNCE74X7JSDV0X3SZ3KJNY
-                    email:
+                      description: Human-readable description of the agent blueprint.
+                      example: Finds and qualifies sales prospects.
+                    permissions:
+                      type: array
+                      items:
+                        type: string
+                      description: >-
+                        Permission slugs forming the ceiling on what sessions
+                        minted from this blueprint may do.
+                      example: *ref_23
+                    invocable_by:
+                      type: object
+                      properties:
+                        role_slugs:
+                          type: array
+                          items:
+                            type: string
+                          description: >-
+                            Role slugs whose members may mint user-delegated
+                            sessions from this blueprint.
+                          example: *ref_24
+                        organization_ids:
+                          type: array
+                          items:
+                            type: string
+                          description: >-
+                            Organizations in which autonomous sessions may be
+                            minted from this blueprint.
+                          example: *ref_25
+                      required:
+                        - role_slugs
+                        - organization_ids
+                      description: Who may mint sessions from this blueprint.
+                    session_settings:
+                      type: object
+                      properties:
+                        max_age_seconds:
+                          type: number
+                          description: >-
+                            Maximum lifetime of a session in seconds; refreshes
+                            never extend a session past this.
+                          example: 3600
+                        access_token_ttl_seconds:
+                          type: number
+                          description: Lifetime of each minted access token in seconds.
+                          example: 300
+                        refresh_token_ttl_seconds:
+                          type: number
+                          description: Lifetime of each rotated refresh token in seconds.
+                          example: 3600
+                      required:
+                        - max_age_seconds
+                        - access_token_ttl_seconds
+                        - refresh_token_ttl_seconds
+                      description: >-
+                        Token and session lifetimes for sessions minted from
+                        this blueprint.
+                    created_at:
                       type: string
-                      description: The email address of the user.
-                      example: user@example.com
-                    ip_address:
-                      type:
-                        - string
-                        - 'null'
-                      description: The IP address of the request.
-                      example: 203.0.113.1
-                    user_agent:
+                      description: The timestamp when the agent blueprint was created.
+                      example: '2026-01-15T12:00:00.000Z'
+                    updated_at:
+                      type: string
+                      description: The timestamp when the agent blueprint was last updated.
+                      example: '2026-01-15T12:00:00.000Z'
+                  required:
+                    - object
+                    - id
+                    - name
+                    - description
+                    - permissions
+                    - invocable_by
+                    - session_settings
+                    - created_at
+                    - updated_at
+                  description: The event payload.
+                created_at:
+                  format: date-time
+                  type: string
+                  description: An ISO 8601 timestamp.
+                  example: '2026-01-15T12:00:00.000Z'
+                context:
+                  $ref: '#/components/schemas/EventContextDto'
+                object:
+                  type: string
+                  description: Distinguishes the Event object.
+                  const: event
+              required:
+                - id
+                - event
+                - data
+                - created_at
+                - object
+            - type: object
+              properties:
+                id:
+                  type: string
+                  description: Unique identifier for the event.
+                  example: event_01EHZNVPK3SFK441A1RGBFSHRT
+                event:
+                  type: string
+                  const: agent.instance.created
+                data:
+                  type: object
+                  properties:
+                    object:
+                      type: string
+                      description: Distinguishes the agent instance object.
+                      const: agent_instance
+                    id:
+                      type: string
+                      description: Unique identifier of the agent instance.
+                      example: agent_01EHWNCE74X7JSDV0X3SZ3KJNY
+                    agent_blueprint_id:
+                      type: string
+                      description: The agent blueprint this instance was minted from.
+                      example: agent_blueprint_01EHWNCE74X7JSDV0X3SZ3KJNY
+                    organization_id:
+                      type: string
+                      description: The organization the instance acts within.
+                      example: org_01EHWNCE74X7JSDV0X3SZ3KJNY
+                    organization_membership_id:
                       type:
                         - string
                         - 'null'
-                      description: The user agent of the request.
-                      example: Mozilla/5.0
+                      description: >-
+                        The organization membership the instance acts on behalf
+                        of; `null` for an autonomous instance.
+                      example: om_01EHWNCE74X7JSDV0X3SZ3KJNY
+                    type:
+                      type: string
+                      enum:
+                        - delegated
+                        - autonomous
+                      description: >-
+                        Whether the instance acts on behalf of a user
+                        (`delegated`) or as itself within an organization
+                        (`autonomous`).
+                    created_at:
+                      type: string
+                      description: The timestamp when the agent instance was created.
+                      example: '2026-01-15T12:00:00.000Z'
+                    updated_at:
+                      type: string
+                      description: The timestamp when the agent instance was last updated.
+                      example: '2026-01-15T12:00:00.000Z'
                   required:
-                    - action_endpoint_id
-                    - action_execution_id
-                    - type
-                    - verdict
-                    - user_id
+                    - object
+                    - id
+                    - agent_blueprint_id
                     - organization_id
-                    - email
-                    - ip_address
-                    - user_agent
+                    - organization_membership_id
+                    - type
+                    - created_at
+                    - updated_at
                   description: The event payload.
-                context:
-                  $ref: '#/components/schemas/EventContextDto'
                 created_at:
                   format: date-time
                   type: string
                   description: An ISO 8601 timestamp.
                   example: '2026-01-15T12:00:00.000Z'
+                context:
+                  $ref: '#/components/schemas/EventContextDto'
                 object:
                   type: string
                   description: Distinguishes the Event object.
@@ -27508,65 +29965,226 @@ components:
                   example: event_01EHZNVPK3SFK441A1RGBFSHRT
                 event:
                   type: string
-                  const: action.user_registration.denied
+                  const: agent.instance.deleted
                 data:
                   type: object
                   properties:
-                    action_endpoint_id:
-                      type: string
-                      description: The ID of the action endpoint.
-                      example: action_endpoint_01EHWNCE74X7JSDV0X3SZ3KJNY
-                    action_execution_id:
+                    object:
                       type: string
-                      description: The ID of the action execution.
-                      example: action_execution_01EHWNCE74X7JSDV0X3SZ3KJNY
-                    type:
+                      description: Distinguishes the agent instance object.
+                      const: agent_instance
+                    id:
                       type: string
-                      description: The type of action that was denied.
-                      const: user_registration
-                    verdict:
+                      description: Unique identifier of the agent instance.
+                      example: agent_01EHWNCE74X7JSDV0X3SZ3KJNY
+                    agent_blueprint_id:
                       type: string
-                      description: The verdict of the action.
-                      const: Deny
+                      description: The agent blueprint this instance was minted from.
+                      example: agent_blueprint_01EHWNCE74X7JSDV0X3SZ3KJNY
                     organization_id:
+                      type: string
+                      description: The organization the instance acts within.
+                      example: org_01EHWNCE74X7JSDV0X3SZ3KJNY
+                    organization_membership_id:
                       type:
                         - string
                         - 'null'
-                      description: The ID of the organization.
+                      description: >-
+                        The organization membership the instance acts on behalf
+                        of; `null` for an autonomous instance.
+                      example: om_01EHWNCE74X7JSDV0X3SZ3KJNY
+                    type:
+                      type: string
+                      enum:
+                        - delegated
+                        - autonomous
+                      description: >-
+                        Whether the instance acts on behalf of a user
+                        (`delegated`) or as itself within an organization
+                        (`autonomous`).
+                    created_at:
+                      type: string
+                      description: The timestamp when the agent instance was created.
+                      example: '2026-01-15T12:00:00.000Z'
+                    updated_at:
+                      type: string
+                      description: The timestamp when the agent instance was last updated.
+                      example: '2026-01-15T12:00:00.000Z'
+                  required:
+                    - object
+                    - id
+                    - agent_blueprint_id
+                    - organization_id
+                    - organization_membership_id
+                    - type
+                    - created_at
+                    - updated_at
+                  description: The event payload.
+                created_at:
+                  format: date-time
+                  type: string
+                  description: An ISO 8601 timestamp.
+                  example: '2026-01-15T12:00:00.000Z'
+                context:
+                  $ref: '#/components/schemas/EventContextDto'
+                object:
+                  type: string
+                  description: Distinguishes the Event object.
+                  const: event
+              required:
+                - id
+                - event
+                - data
+                - created_at
+                - object
+            - type: object
+              properties:
+                id:
+                  type: string
+                  description: Unique identifier for the event.
+                  example: event_01EHZNVPK3SFK441A1RGBFSHRT
+                event:
+                  type: string
+                  const: agent.instance.session.created
+                data:
+                  type: object
+                  properties:
+                    object:
+                      type: string
+                      description: Distinguishes the agent instance session object.
+                      const: agent_instance_session
+                    id:
+                      type: string
+                      description: Unique identifier of the agent instance session.
+                      example: agent_session_01EHWNCE74X7JSDV0X3SZ3KJNY
+                    agent_instance_id:
+                      type: string
+                      description: The agent instance the session belongs to.
+                      example: agent_01EHWNCE74X7JSDV0X3SZ3KJNY
+                    organization_id:
+                      type: string
+                      description: The organization the owning agent instance belongs to.
                       example: org_01EHWNCE74X7JSDV0X3SZ3KJNY
-                    email:
+                    expires_at:
                       type: string
-                      description: The email address of the user.
-                      example: user@example.com
-                    ip_address:
+                      description: Timestamp when the session expires.
+                      example: '2026-01-15T13:00:00.000Z'
+                    revoked_at:
                       type:
                         - string
                         - 'null'
-                      description: The IP address of the request.
-                      example: 203.0.113.1
-                    user_agent:
+                      description: >-
+                        Timestamp when the session was revoked; `null` if it has
+                        not been revoked.
+                      example: null
+                    created_at:
+                      type: string
+                      description: The timestamp when the session was created.
+                      example: '2026-01-15T12:00:00.000Z'
+                    updated_at:
+                      type: string
+                      description: The timestamp when the session was last updated.
+                      example: '2026-01-15T12:00:00.000Z'
+                    permission_slugs:
+                      type: array
+                      items:
+                        type: string
+                      description: The permissions granted to the session at mint time.
+                      example:
+                        - crm:read
+                  required:
+                    - object
+                    - id
+                    - agent_instance_id
+                    - organization_id
+                    - expires_at
+                    - revoked_at
+                    - created_at
+                    - updated_at
+                    - permission_slugs
+                  description: The event payload.
+                created_at:
+                  format: date-time
+                  type: string
+                  description: An ISO 8601 timestamp.
+                  example: '2026-01-15T12:00:00.000Z'
+                context:
+                  $ref: '#/components/schemas/EventContextDto'
+                object:
+                  type: string
+                  description: Distinguishes the Event object.
+                  const: event
+              required:
+                - id
+                - event
+                - data
+                - created_at
+                - object
+            - type: object
+              properties:
+                id:
+                  type: string
+                  description: Unique identifier for the event.
+                  example: event_01EHZNVPK3SFK441A1RGBFSHRT
+                event:
+                  type: string
+                  const: agent.instance.session.revoked
+                data:
+                  type: object
+                  properties:
+                    object:
+                      type: string
+                      description: Distinguishes the agent instance session object.
+                      const: agent_instance_session
+                    id:
+                      type: string
+                      description: Unique identifier of the agent instance session.
+                      example: agent_session_01EHWNCE74X7JSDV0X3SZ3KJNY
+                    agent_instance_id:
+                      type: string
+                      description: The agent instance the session belongs to.
+                      example: agent_01EHWNCE74X7JSDV0X3SZ3KJNY
+                    organization_id:
+                      type: string
+                      description: The organization the owning agent instance belongs to.
+                      example: org_01EHWNCE74X7JSDV0X3SZ3KJNY
+                    expires_at:
+                      type: string
+                      description: Timestamp when the session expires.
+                      example: '2026-01-15T13:00:00.000Z'
+                    revoked_at:
                       type:
                         - string
                         - 'null'
-                      description: The user agent of the request.
-                      example: Mozilla/5.0
+                      description: >-
+                        Timestamp when the session was revoked; `null` if it has
+                        not been revoked.
+                      example: null
+                    created_at:
+                      type: string
+                      description: The timestamp when the session was created.
+                      example: '2026-01-15T12:00:00.000Z'
+                    updated_at:
+                      type: string
+                      description: The timestamp when the session was last updated.
+                      example: '2026-01-15T12:00:00.000Z'
                   required:
-                    - action_endpoint_id
-                    - action_execution_id
-                    - type
-                    - verdict
+                    - object
+                    - id
+                    - agent_instance_id
                     - organization_id
-                    - email
-                    - ip_address
-                    - user_agent
+                    - expires_at
+                    - revoked_at
+                    - created_at
+                    - updated_at
                   description: The event payload.
-                context:
-                  $ref: '#/components/schemas/EventContextDto'
                 created_at:
                   format: date-time
                   type: string
                   description: An ISO 8601 timestamp.
                   example: '2026-01-15T12:00:00.000Z'
+                context:
+                  $ref: '#/components/schemas/EventContextDto'
                 object:
                   type: string
                   description: Distinguishes the Event object.
@@ -28230,7 +30848,7 @@ components:
                       items:
                         type: string
                       description: The permissions granted to the API key.
-                      example: &ref_19
+                      example: &ref_26
                         - users:read
                         - users:write
                     created_at:
@@ -28356,7 +30974,7 @@ components:
                       items:
                         type: string
                       description: The permissions granted to the API key.
-                      example: *ref_19
+                      example: *ref_26
                     created_at:
                       type: string
                       description: The timestamp when the API key was created.
@@ -28480,7 +31098,7 @@ components:
                       items:
                         type: string
                       description: The permissions granted to the API key.
-                      example: *ref_19
+                      example: *ref_26
                     created_at:
                       type: string
                       description: The timestamp when the API key was created.
@@ -31347,7 +33965,7 @@ components:
                       description: >-
                         An object containing the custom attribute mapping for
                         the Directory Provider.
-                      example: *ref_20
+                      example: *ref_27
                     role:
                       $ref: '#/components/schemas/SlimRole'
                     roles:
@@ -31537,7 +34155,7 @@ components:
                       description: >-
                         Labels assigned to the Feature Flag for categorizing and
                         filtering.
-                      example: &ref_21
+                      example: &ref_28
                         - reports
                     enabled:
                       type: boolean
@@ -31698,7 +34316,7 @@ components:
                       description: >-
                         Labels assigned to the Feature Flag for categorizing and
                         filtering.
-                      example: *ref_21
+                      example: *ref_28
                     enabled:
                       type: boolean
                       description: >-
@@ -31858,7 +34476,7 @@ components:
                       description: >-
                         Labels assigned to the Feature Flag for categorizing and
                         filtering.
-                      example: *ref_21
+                      example: *ref_28
                     enabled:
                       type: boolean
                       description: >-
@@ -32138,7 +34756,7 @@ components:
                       description: >-
                         Labels assigned to the Feature Flag for categorizing and
                         filtering.
-                      example: *ref_21
+                      example: *ref_28
                     enabled:
                       type: boolean
                       description: >-
@@ -33126,7 +35744,7 @@ components:
                       description: >-
                         Object containing [metadata](/authkit/metadata)
                         key/value pairs associated with the Organization.
-                      example: &ref_22
+                      example: &ref_29
                         tier: diamond
                       propertyNames:
                         maxLength: 40
@@ -33276,7 +35894,7 @@ components:
                       description: >-
                         Object containing [metadata](/authkit/metadata)
                         key/value pairs associated with the Organization.
-                      example: *ref_22
+                      example: *ref_29
                       propertyNames:
                         maxLength: 40
                       maxProperties: 50
@@ -34103,7 +36721,7 @@ components:
                       items:
                         type: string
                       description: The permissions granted by the role.
-                      example: &ref_23
+                      example: &ref_30
                         - users:read
                         - users:write
                     created_at:
@@ -34187,7 +36805,7 @@ components:
                       items:
                         type: string
                       description: The permissions granted by the role.
-                      example: *ref_23
+                      example: *ref_30
                     created_at:
                       format: date-time
                       type: string
@@ -34269,7 +36887,7 @@ components:
                       items:
                         type: string
                       description: The permissions granted by the role.
-                      example: *ref_23
+                      example: *ref_30
                     created_at:
                       format: date-time
                       type: string
@@ -34406,7 +37024,7 @@ components:
                       description: >-
                         Object containing [metadata](/authkit/metadata)
                         key/value pairs associated with the Organization.
-                      example: *ref_22
+                      example: *ref_29
                       propertyNames:
                         maxLength: 40
                       maxProperties: 50
@@ -34831,9 +37449,217 @@ components:
                   example: event_01EHZNVPK3SFK441A1RGBFSHRT
                 event:
                   type: string
-                  const: pipes.connected_account.connected
+                  const: pipes.connected_account.connected
+                data:
+                  $ref: '#/components/schemas/PipesConnectedAccount'
+                  description: The event payload.
+                created_at:
+                  format: date-time
+                  type: string
+                  description: An ISO 8601 timestamp.
+                  example: '2026-01-15T12:00:00.000Z'
+                context:
+                  $ref: '#/components/schemas/EventContextDto'
+                object:
+                  type: string
+                  description: Distinguishes the Event object.
+                  const: event
+              required:
+                - id
+                - event
+                - data
+                - created_at
+                - object
+            - type: object
+              properties:
+                id:
+                  type: string
+                  description: Unique identifier for the event.
+                  example: event_01EHZNVPK3SFK441A1RGBFSHRT
+                event:
+                  type: string
+                  const: pipes.connected_account.connection_failed
+                data:
+                  type: object
+                  properties:
+                    object:
+                      type: string
+                      description: The object type.
+                      example: connection_failed
+                      const: connection_failed
+                    data_integration_id:
+                      type: string
+                      description: The unique ID of the data integration.
+                      example: data_integration_01EHZNVPK3SFK441A1RGBFSHRT
+                    provider_slug:
+                      type: string
+                      description: The provider slug for this connection attempt.
+                      example: github
+                    user_id:
+                      type:
+                        - string
+                        - 'null'
+                      description: The ID of the User the connection attempt belongs to.
+                      example: user_01EHZNVPK3SFK441A1RGBFSHRT
+                    organization_id:
+                      type:
+                        - string
+                        - 'null'
+                      description: >-
+                        The ID of the Organization the connection attempt
+                        belongs to.
+                      example: org_01EHWNCE74X7JSDV0X3SZ3KJNY
+                    error_code:
+                      type: string
+                      description: A machine-readable error code for the failure.
+                      example: authorization_code_exchange_error
+                    error_reason:
+                      type:
+                        - string
+                        - 'null'
+                      description: A human-readable explanation of the failure.
+                      example: The authorization code has expired.
+                    provider_error:
+                      type:
+                        - string
+                        - 'null'
+                      description: The raw error code returned by the OAuth provider.
+                      example: access_denied
+                    provider_error_description:
+                      type:
+                        - string
+                        - 'null'
+                      description: >-
+                        The raw error description returned by the OAuth
+                        provider.
+                      example: The user denied the authorization request.
+                    created_at:
+                      format: date-time
+                      type: string
+                      description: An ISO 8601 timestamp.
+                      example: '2026-01-15T12:00:00.000Z'
+                  required:
+                    - object
+                    - data_integration_id
+                    - provider_slug
+                    - user_id
+                    - organization_id
+                    - error_code
+                    - error_reason
+                    - provider_error
+                    - provider_error_description
+                    - created_at
+                  title: PipesConnectionFailed
+                  description: The event payload.
+                created_at:
+                  format: date-time
+                  type: string
+                  description: An ISO 8601 timestamp.
+                  example: '2026-01-15T12:00:00.000Z'
+                context:
+                  $ref: '#/components/schemas/EventContextDto'
+                object:
+                  type: string
+                  description: Distinguishes the Event object.
+                  const: event
+              required:
+                - id
+                - event
+                - data
+                - created_at
+                - object
+            - type: object
+              properties:
+                id:
+                  type: string
+                  description: Unique identifier for the event.
+                  example: event_01EHZNVPK3SFK441A1RGBFSHRT
+                event:
+                  type: string
+                  const: pipes.connected_account.disconnected
+                data:
+                  $ref: '#/components/schemas/PipesConnectedAccount'
+                  description: The event payload.
+                created_at:
+                  format: date-time
+                  type: string
+                  description: An ISO 8601 timestamp.
+                  example: '2026-01-15T12:00:00.000Z'
+                context:
+                  $ref: '#/components/schemas/EventContextDto'
+                object:
+                  type: string
+                  description: Distinguishes the Event object.
+                  const: event
+              required:
+                - id
+                - event
+                - data
+                - created_at
+                - object
+            - type: object
+              properties:
+                id:
+                  type: string
+                  description: Unique identifier for the event.
+                  example: event_01EHZNVPK3SFK441A1RGBFSHRT
+                event:
+                  type: string
+                  const: pipes.connected_account.reauthorization_needed
+                data:
+                  $ref: '#/components/schemas/PipesConnectedAccount'
+                  description: The event payload.
+                created_at:
+                  format: date-time
+                  type: string
+                  description: An ISO 8601 timestamp.
+                  example: '2026-01-15T12:00:00.000Z'
+                context:
+                  $ref: '#/components/schemas/EventContextDto'
+                object:
+                  type: string
+                  description: Distinguishes the Event object.
+                  const: event
+              required:
+                - id
+                - event
+                - data
+                - created_at
+                - object
+            - type: object
+              properties:
+                id:
+                  type: string
+                  description: Unique identifier for the event.
+                  example: event_01EHZNVPK3SFK441A1RGBFSHRT
+                event:
+                  type: string
+                  const: radar.challenge_created
                 data:
-                  $ref: '#/components/schemas/PipesConnectedAccount'
+                  type: object
+                  properties:
+                    type:
+                      type: string
+                      description: The type of the Radar challenge.
+                      example: email
+                      const: email
+                    radar_challenge_id:
+                      type: string
+                      description: The ID of the Radar challenge.
+                      example: radar_challenge_01HWZBQZY2M3AMQW166Q22K88F
+                    user_id:
+                      type: string
+                      description: The ID of the user.
+                      example: user_01E4ZCR3C56J083X43JQXF3JK5
+                    email:
+                      type: string
+                      description: The email address of the user.
+                      example: user@example.com
+                  required:
+                    - type
+                    - radar_challenge_id
+                    - user_id
+                    - email
                   description: The event payload.
                 created_at:
                   format: date-time
@@ -34860,78 +37686,26 @@ components:
                   example: event_01EHZNVPK3SFK441A1RGBFSHRT
                 event:
                   type: string
-                  const: pipes.connected_account.connection_failed
+                  const: resource_export.completed
                 data:
                   type: object
                   properties:
-                    object:
-                      type: string
-                      description: The object type.
-                      example: connection_failed
-                      const: connection_failed
-                    data_integration_id:
+                    id:
                       type: string
-                      description: The unique ID of the data integration.
-                      example: data_integration_01EHZNVPK3SFK441A1RGBFSHRT
-                    provider_slug:
+                      description: The ID of the resource export.
+                      example: resource_export_01HWZBQZY2M3AMQW166Q22K88F
+                    resource_type:
                       type: string
-                      description: The provider slug for this connection attempt.
-                      example: github
-                    user_id:
-                      type:
-                        - string
-                        - 'null'
-                      description: The ID of the User the connection attempt belongs to.
-                      example: user_01EHZNVPK3SFK441A1RGBFSHRT
-                    organization_id:
-                      type:
-                        - string
-                        - 'null'
-                      description: >-
-                        The ID of the Organization the connection attempt
-                        belongs to.
-                      example: org_01EHWNCE74X7JSDV0X3SZ3KJNY
-                    error_code:
-                      type: string
-                      description: A machine-readable error code for the failure.
-                      example: authorization_code_exchange_error
-                    error_reason:
-                      type:
-                        - string
-                        - 'null'
-                      description: A human-readable explanation of the failure.
-                      example: The authorization code has expired.
-                    provider_error:
-                      type:
-                        - string
-                        - 'null'
-                      description: The raw error code returned by the OAuth provider.
-                      example: access_denied
-                    provider_error_description:
-                      type:
-                        - string
-                        - 'null'
-                      description: >-
-                        The raw error description returned by the OAuth
-                        provider.
-                      example: The user denied the authorization request.
-                    created_at:
-                      format: date-time
-                      type: string
-                      description: An ISO 8601 timestamp.
-                      example: '2026-01-15T12:00:00.000Z'
+                      enum:
+                        - users
+                        - organizations
+                        - events
+                        - sessions
+                      description: The type of resource being exported.
+                      example: users
                   required:
-                    - object
-                    - data_integration_id
-                    - provider_slug
-                    - user_id
-                    - organization_id
-                    - error_code
-                    - error_reason
-                    - provider_error
-                    - provider_error_description
-                    - created_at
-                  title: PipesConnectionFailed
+                    - id
+                    - resource_type
                   description: The event payload.
                 created_at:
                   format: date-time
@@ -34958,9 +37732,26 @@ components:
                   example: event_01EHZNVPK3SFK441A1RGBFSHRT
                 event:
                   type: string
-                  const: pipes.connected_account.disconnected
+                  const: resource_export.created
                 data:
-                  $ref: '#/components/schemas/PipesConnectedAccount'
+                  type: object
+                  properties:
+                    id:
+                      type: string
+                      description: The ID of the resource export.
+                      example: resource_export_01HWZBQZY2M3AMQW166Q22K88F
+                    resource_type:
+                      type: string
+                      enum:
+                        - users
+                        - organizations
+                        - events
+                        - sessions
+                      description: The type of resource being exported.
+                      example: users
+                  required:
+                    - id
+                    - resource_type
                   description: The event payload.
                 created_at:
                   format: date-time
@@ -34987,9 +37778,26 @@ components:
                   example: event_01EHZNVPK3SFK441A1RGBFSHRT
                 event:
                   type: string
-                  const: pipes.connected_account.reauthorization_needed
+                  const: resource_export.downloaded
                 data:
-                  $ref: '#/components/schemas/PipesConnectedAccount'
+                  type: object
+                  properties:
+                    id:
+                      type: string
+                      description: The ID of the resource export.
+                      example: resource_export_01HWZBQZY2M3AMQW166Q22K88F
+                    resource_type:
+                      type: string
+                      enum:
+                        - users
+                        - organizations
+                        - events
+                        - sessions
+                      description: The type of resource being exported.
+                      example: users
+                  required:
+                    - id
+                    - resource_type
                   description: The event payload.
                 created_at:
                   format: date-time
@@ -35016,32 +37824,26 @@ components:
                   example: event_01EHZNVPK3SFK441A1RGBFSHRT
                 event:
                   type: string
-                  const: radar.challenge_created
+                  const: resource_export.failed
                 data:
                   type: object
                   properties:
-                    type:
-                      type: string
-                      description: The type of the Radar challenge.
-                      example: email
-                      const: email
-                    radar_challenge_id:
-                      type: string
-                      description: The ID of the Radar challenge.
-                      example: radar_challenge_01HWZBQZY2M3AMQW166Q22K88F
-                    user_id:
+                    id:
                       type: string
-                      description: The ID of the user.
-                      example: user_01E4ZCR3C56J083X43JQXF3JK5
-                    email:
+                      description: The ID of the resource export.
+                      example: resource_export_01HWZBQZY2M3AMQW166Q22K88F
+                    resource_type:
                       type: string
-                      description: The email address of the user.
-                      example: user@example.com
+                      enum:
+                        - users
+                        - organizations
+                        - events
+                        - sessions
+                      description: The type of resource being exported.
+                      example: users
                   required:
-                    - type
-                    - radar_challenge_id
-                    - user_id
-                    - email
+                    - id
+                    - resource_type
                   description: The event payload.
                 created_at:
                   format: date-time
@@ -35089,7 +37891,7 @@ components:
                       items:
                         type: string
                       description: The permissions granted by the role.
-                      example: &ref_24
+                      example: &ref_31
                         - users:read
                         - users:write
                     created_at:
@@ -35155,7 +37957,7 @@ components:
                       items:
                         type: string
                       description: The permissions granted by the role.
-                      example: *ref_24
+                      example: *ref_31
                     created_at:
                       format: date-time
                       type: string
@@ -35219,7 +38021,7 @@ components:
                       items:
                         type: string
                       description: The permissions granted by the role.
-                      example: *ref_24
+                      example: *ref_31
                     created_at:
                       format: date-time
                       type: string
@@ -36359,7 +39161,7 @@ components:
                 - data
                 - created_at
                 - object
-      example: *ref_25
+      example: *ref_32
       description: An event emitted by WorkOS.
     EventList:
       type: object
@@ -36394,7 +39196,7 @@ components:
       example:
         object: list
         data:
-          - *ref_25
+          - *ref_32
         list_metadata:
           after: event_01EHZNVPK3SFK441A1RGBFSHRT
     JwtTemplate:
@@ -37388,7 +40190,9 @@ components:
           type: string
           description: >-
             The OAuth redirect URI to register with the provider when
-            configuring the custom application.
+            configuring the custom application. Empty for `api_key` and
+            `client_credentials` integrations, which run no authorization
+            redirect.
           example: >-
             https://api.workos.com/data-integrations/github/dik_01EHZNVPK3SFK441A1RGBFSHRT/callback
         auth_methods:
@@ -37407,8 +40211,8 @@ components:
         credentials:
           description: >-
             The integration-level OAuth app credentials. `null` for `api_key`
-            integrations, which hold no OAuth credentials (keys are installed
-            per-tenant).
+            and `client_credentials` integrations, which hold no
+            integration-level credentials (secrets are installed per-tenant).
           oneOf:
             - type: object
               properties:
@@ -37903,7 +40707,11 @@ components:
                     type: string
                   description: >-
                     If the integration has requested scopes that aren't present
-                    on the access token, they're listed here.
+                    on the access token, they're listed here. The scopes granted
+                    to a client-credentials token are governed by the connected
+                    organization's client application, so the integration's
+                    configured scopes are requests or defaults rather than
+                    guarantees.
                   example: []
                 metadata:
                   type: object
@@ -38517,6 +41325,169 @@ components:
         - default
         - created_at
         - updated_at
+    SamlIdpSigningCertificate:
+      type: object
+      properties:
+        object:
+          type: string
+          description: Distinguishes the SAML Identity Provider signing certificate object.
+          const: saml_idp_signing_certificate
+        id:
+          type: string
+          description: Unique identifier for the Identity Provider signing certificate.
+          example: saml_x509_cert_01E4ZCR3C56J083X43JQXF3JK5
+        value:
+          type: string
+          description: The PEM-encoded public X.509 certificate.
+          example: '-----BEGIN CERTIFICATE-----MIIC...-----END CERTIFICATE-----'
+        not_before:
+          format: date-time
+          type:
+            - string
+            - 'null'
+          description: When the certificate becomes valid.
+          example: '2026-01-15T12:00:00.000Z'
+        not_after:
+          format: date-time
+          type:
+            - string
+            - 'null'
+          description: When the certificate expires.
+          example: '2026-01-15T12:00:00.000Z'
+        created_at:
+          format: date-time
+          type: string
+          description: An ISO 8601 timestamp.
+          example: '2026-01-15T12:00:00.000Z'
+      required:
+        - object
+        - id
+        - value
+        - not_before
+        - not_after
+        - created_at
+    SamlIdpSigningCertificateList:
+      type: object
+      properties:
+        object:
+          type: string
+          example: list
+          const: list
+        data:
+          type: array
+          items:
+            $ref: '#/components/schemas/SamlIdpSigningCertificate'
+          description: >-
+            Every Identity Provider signing certificate on the Connection,
+            including expired ones, oldest first.
+      required:
+        - object
+        - data
+    SamlSpEncryptionCertificate:
+      type: object
+      properties:
+        object:
+          type: string
+          description: >-
+            Distinguishes the SAML Service Provider encryption certificate
+            object.
+          const: saml_sp_encryption_certificate
+        id:
+          type: string
+          description: >-
+            Unique identifier for the Service Provider encryption key pair.
+            WorkOS holds the corresponding private key, which is never exposed.
+          example: saml_enc_key_pair_01E4ZCR3C56J083X43JQXF3JK5
+        value:
+          type: string
+          description: The PEM-encoded public X.509 certificate.
+          example: '-----BEGIN CERTIFICATE-----MIIC...-----END CERTIFICATE-----'
+        not_before:
+          format: date-time
+          type:
+            - string
+            - 'null'
+          description: When the certificate becomes valid.
+          example: '2026-01-15T12:00:00.000Z'
+        not_after:
+          format: date-time
+          type:
+            - string
+            - 'null'
+          description: When the certificate expires.
+          example: '2026-01-15T12:00:00.000Z'
+        created_at:
+          format: date-time
+          type: string
+          description: An ISO 8601 timestamp.
+          example: '2026-01-15T12:00:00.000Z'
+      required:
+        - object
+        - id
+        - value
+        - not_before
+        - not_after
+        - created_at
+    SamlSpEncryptionCertificateList:
+      type: object
+      properties:
+        object:
+          type: string
+          example: list
+          const: list
+        data:
+          type: array
+          items:
+            $ref: '#/components/schemas/SamlSpEncryptionCertificate'
+          description: >-
+            Every Service Provider encryption certificate on the Connection,
+            including expired ones.
+      required:
+        - object
+        - data
+    SamlSpSigningCertificate:
+      type: object
+      properties:
+        object:
+          type: string
+          description: Distinguishes the SAML Service Provider signing certificate object.
+          const: saml_sp_signing_certificate
+        id:
+          type: string
+          description: >-
+            Unique identifier for the Service Provider signing key pair. WorkOS
+            holds the corresponding private key, which is never exposed.
+          example: saml_party_trust_01E4ZCR3C56J083X43JQXF3JK5
+        value:
+          type: string
+          description: The PEM-encoded public X.509 certificate.
+          example: '-----BEGIN CERTIFICATE-----MIIC...-----END CERTIFICATE-----'
+        not_before:
+          format: date-time
+          type:
+            - string
+            - 'null'
+          description: When the certificate becomes valid.
+          example: '2026-01-15T12:00:00.000Z'
+        not_after:
+          format: date-time
+          type:
+            - string
+            - 'null'
+          description: When the certificate expires.
+          example: '2026-01-15T12:00:00.000Z'
+        created_at:
+          format: date-time
+          type: string
+          description: An ISO 8601 timestamp.
+          example: '2026-01-15T12:00:00.000Z'
+      required:
+        - object
+        - id
+        - value
+        - not_before
+        - not_after
+        - created_at
     Team:
       type: object
       properties: