@workos/openapi-spec 0.69.0 → 0.70.0

package/dist/open-api-spec.yaml

@@ -7024,131 +7024,1471 @@ paths:
       tags:
         - application.client-secrets
   /connections:
+    post:
+      description: >-
+        Creates a new connection for an organization. Provide `saml_options` or
+        `oidc_options` to configure the identity provider. When `external_id`
+        matches an existing connection in the organization, that connection is
+        returned instead of creating a duplicate.
+      operationId: ConnectionsController_create
+      parameters: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/CreateConnectionDto'
+      responses:
+        '201':
+          description: Created
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Connection'
+        '400':
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                oneOf:
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: external_id_already_in_use
+                        const: external_id_already_in_use
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: connection_type_not_supported
+                        const: connection_type_not_supported
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: connection_type_or_options_required
+                        const: connection_type_or_options_required
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: connection_type_conflicts_with_options
+                        const: connection_type_conflicts_with_options
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: both_saml_and_oidc_options_provided
+                        const: both_saml_and_oidc_options_provided
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: ambiguous_saml_options
+                        const: ambiguous_saml_options
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: incomplete_saml_options
+                        const: incomplete_saml_options
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: saml_options_required
+                        const: saml_options_required
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: oidc_options_required
+                        const: oidc_options_required
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: invalid_certificate
+                        const: invalid_certificate
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: client_secret_required
+                        const: client_secret_required
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: client_secret_not_accepted
+                        const: client_secret_not_accepted
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: key_pair_not_accepted
+                        const: key_pair_not_accepted
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: discovery_endpoint_must_use_https
+                        const: discovery_endpoint_must_use_https
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: token_authentication_method_not_supported
+                        const: token_authentication_method_not_supported
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+        '403':
+          description: Forbidden
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '404':
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '409':
+          description: ''
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code:
+                    type: string
+                    description: The error code identifying the type of error.
+                    example: connection_deletion_in_progress
+                    const: connection_deletion_in_progress
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: Request could not be processed.
+                required:
+                  - code
+                  - message
+        '422':
+          description: Unprocessable Entity
+          content:
+            application/json:
+              schema:
+                oneOf:
+                  - type: object
+                    properties:
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: >-
+                          Organization not found:
+                          'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                    required:
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: idp_metadata_fetch_failed
+                        const: idp_metadata_fetch_failed
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: connection_could_not_be_verified
+                        const: connection_could_not_be_verified
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: invalid_idp_sso_url
+                        const: invalid_idp_sso_url
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+      summary: Create a Connection
+      tags:
+        - connections
+      x-feature-flag: connections-api-migrations-capabilities-api
+      x-mutually-exclusive-body-groups: &ref_7
+        protocol_options:
+          optional: false
+          variants:
+            saml:
+              - saml_options
+            oidc:
+              - oidc_options
     get:
       description: >-
-        Get a list of all of your existing connections matching the criteria
-        specified.
-      operationId: ConnectionsController_list
+        Get a list of all of your existing connections matching the criteria
+        specified.
+      operationId: ConnectionsController_list
+      parameters:
+        - name: before
+          required: false
+          in: query
+          description: >-
+            An object ID that defines your place in the list. When the ID is not
+            present, you are at the end of the list.
+          schema:
+            example: obj_1234567890
+            type: string
+        - name: after
+          required: false
+          in: query
+          description: >-
+            An object ID that defines your place in the list. When the ID is not
+            present, you are at the end of the list.
+          schema:
+            example: obj_1234567890
+            type: string
+        - name: limit
+          required: false
+          in: query
+          description: >-
+            Upper limit on the number of objects to return, between `1` and
+            `100`.
+          schema:
+            minimum: 1
+            maximum: 100
+            default: 10
+            example: 10
+            type: integer
+        - name: order
+          required: false
+          in: query
+          description: Order the results by the creation time. Defaults to `normal`.
+          schema:
+            $ref: '#/components/schemas/PaginationOrder'
+        - name: connection_type
+          required: false
+          in: query
+          description: Filter Connections by their type.
+          schema:
+            example: GithubOAuth
+            enum:
+              - ADFSSAML
+              - AdpOidc
+              - AppleOAuth
+              - Auth0SAML
+              - AzureSAML
+              - BitbucketOAuth
+              - CasSAML
+              - CloudflareSAML
+              - ClassLinkSAML
+              - CleverOIDC
+              - CyberArkSAML
+              - DuoSAML
+              - EntraIdOIDC
+              - GenericOIDC
+              - GenericSAML
+              - GithubOAuth
+              - GitLabOAuth
+              - GoogleOAuth
+              - GoogleOIDC
+              - GoogleSAML
+              - IntuitOAuth
+              - JumpCloudSAML
+              - KeycloakSAML
+              - LastPassSAML
+              - LinkedInOAuth
+              - LoginGovOidc
+              - MagicLink
+              - MicrosoftOAuth
+              - MiniOrangeSAML
+              - NetIqSAML
+              - OktaOIDC
+              - OktaSAML
+              - OneLoginSAML
+              - OracleSAML
+              - PingFederateSAML
+              - PingOneSAML
+              - RipplingSAML
+              - SalesforceSAML
+              - ShibbolethGenericSAML
+              - ShibbolethSAML
+              - SimpleSamlPhpSAML
+              - SalesforceOAuth
+              - SlackOAuth
+              - VercelMarketplaceOAuth
+              - VercelOAuth
+              - VMwareSAML
+              - XeroOAuth
+            type: string
+        - name: domain
+          required: false
+          in: query
+          description: Filter Connections by their associated domain.
+          schema:
+            example: foo-corp.com
+            type: string
+        - name: organization_id
+          required: false
+          in: query
+          description: Filter Connections by their associated organization.
+          schema:
+            example: org_01EHWNCE74X7JSDV0X3SZ3KJNY
+            type: string
+        - name: search
+          required: false
+          in: query
+          description: Searchable text to match against Connection names.
+          schema:
+            example: Foo Corp
+            type: string
+      responses:
+        '200':
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ConnectionList'
+        '403':
+          description: Forbidden
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '422':
+          description: Unprocessable Entity
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+      summary: List Connections
+      tags:
+        - connections
+  /connections/{connectionId}/saml_idp_signing_certs:
+    get:
+      description: >-
+        Lists every Identity Provider signing certificate on the connection,
+        including expired ones, oldest first.
+      operationId: SamlIdpSigningCertificatesController_list
+      parameters:
+        - name: connectionId
+          required: true
+          in: path
+          description: Unique identifier for the Connection.
+          schema:
+            example: conn_01E4ZCR3C56J083X43JQXF3JK5
+            type: string
+      responses:
+        '200':
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/SamlIdpSigningCertificateList'
+        '400':
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code:
+                    type: string
+                    description: The error code identifying the type of error.
+                    example: connection_is_not_saml
+                    const: connection_is_not_saml
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: Request could not be processed.
+                required:
+                  - code
+                  - message
+        '403':
+          description: Forbidden
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '404':
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+      summary: List IdP signing certificates
+      tags:
+        - connections
+      x-feature-flag: connections-api-migrations-capabilities-api
+    post:
+      description: >-
+        Adds an Identity Provider signing certificate to the connection, so SAML
+        responses signed with its key can be verified. Use this to import a new
+        certificate ahead of an Identity Provider rotation — the existing
+        certificates keep working until they are deleted or expire.
+      operationId: SamlIdpSigningCertificatesController_create
+      parameters:
+        - name: connectionId
+          required: true
+          in: path
+          description: Unique identifier for the Connection.
+          schema:
+            example: conn_01E4ZCR3C56J083X43JQXF3JK5
+            type: string
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/CreateSamlIdpSigningCertificateDto'
+      responses:
+        '201':
+          description: Created
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/SamlIdpSigningCertificate'
+        '400':
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                oneOf:
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: connection_is_not_saml
+                        const: connection_is_not_saml
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: invalid_certificate
+                        const: invalid_certificate
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: certificate_expired
+                        const: certificate_expired
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+        '403':
+          description: Forbidden
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '404':
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '422':
+          description: Unprocessable Entity
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+      summary: Create an IdP signing certificate
+      tags:
+        - connections
+      x-feature-flag: connections-api-migrations-capabilities-api
+  /connections/{connectionId}/saml_idp_signing_certs/{certificateId}:
+    delete:
+      description: >-
+        Removes an Identity Provider signing certificate from the connection.
+        The last remaining certificate cannot be deleted. A certificate still
+        published in the Identity Provider metadata may be restored by a
+        metadata refresh.
+      operationId: SamlIdpSigningCertificatesController_delete
+      parameters:
+        - name: connectionId
+          required: true
+          in: path
+          description: Unique identifier for the Connection.
+          schema:
+            example: conn_01E4ZCR3C56J083X43JQXF3JK5
+            type: string
+        - name: certificateId
+          required: true
+          in: path
+          description: Unique identifier for the Identity Provider signing certificate.
+          schema:
+            example: saml_x509_cert_01E4ZCR3C56J083X43JQXF3JK5
+            type: string
+      responses:
+        '204':
+          description: No Content
+        '400':
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code:
+                    type: string
+                    description: The error code identifying the type of error.
+                    example: cannot_delete_last_certificate
+                    const: cannot_delete_last_certificate
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: Request could not be processed.
+                required:
+                  - code
+                  - message
+        '403':
+          description: Forbidden
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '404':
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+      summary: Delete an IdP signing certificate
+      tags:
+        - connections
+      x-feature-flag: connections-api-migrations-capabilities-api
+  /connections/{connectionId}/saml_sp_encryption_certs:
+    get:
+      description: >-
+        Lists the public certificates the Identity Provider can use to encrypt
+        SAML responses sent to WorkOS, including expired ones, oldest first.
+      operationId: SamlSpEncryptionCertificatesController_list
+      parameters:
+        - name: connectionId
+          required: true
+          in: path
+          description: Unique identifier for the Connection.
+          schema:
+            example: conn_01E4ZCR3C56J083X43JQXF3JK5
+            type: string
+      responses:
+        '200':
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/SamlSpEncryptionCertificateList'
+        '400':
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code:
+                    type: string
+                    description: The error code identifying the type of error.
+                    example: connection_is_not_saml
+                    const: connection_is_not_saml
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: Request could not be processed.
+                required:
+                  - code
+                  - message
+        '403':
+          description: Forbidden
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '404':
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+      summary: List SP encryption certificates
+      tags:
+        - connections
+      x-feature-flag: connections-api-migrations-capabilities-api
+    post:
+      description: >-
+        Generates a new encryption key pair for the connection and returns its
+        public certificate. WorkOS holds the private key, so the request takes
+        no body — to bring your own key pairs, provide
+        `saml_options.sp_encryption_key_pairs` when creating the connection
+        instead. Creating a certificate appends rather than replaces: every
+        active private key is tried when decrypting, which lets a rotation
+        overlap the old and new certificates.
+      operationId: SamlSpEncryptionCertificatesController_create
+      parameters:
+        - name: connectionId
+          required: true
+          in: path
+          description: Unique identifier for the Connection.
+          schema:
+            example: conn_01E4ZCR3C56J083X43JQXF3JK5
+            type: string
+      responses:
+        '201':
+          description: Created
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/SamlSpEncryptionCertificate'
+        '400':
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                oneOf:
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: connection_is_not_saml
+                        const: connection_is_not_saml
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: key_pair_not_accepted
+                        const: key_pair_not_accepted
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+        '403':
+          description: Forbidden
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '404':
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '409':
+          description: ''
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code:
+                    type: string
+                    description: The error code identifying the type of error.
+                    example: too_many_sp_encryption_certs
+                    const: too_many_sp_encryption_certs
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: Request could not be processed.
+                required:
+                  - code
+                  - message
+        '503':
+          description: ''
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code:
+                    type: string
+                    description: The error code identifying the type of error.
+                    example: concurrent_request
+                    const: concurrent_request
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: Request could not be processed.
+                required:
+                  - code
+                  - message
+      summary: Create an SP encryption certificate
+      tags:
+        - connections
+      x-feature-flag: connections-api-migrations-capabilities-api
+  /connections/{connectionId}/saml_sp_encryption_certs/{certificateId}:
+    delete:
+      description: >-
+        Removes an encryption key pair from the connection. SAML responses
+        encrypted with its certificate can no longer be decrypted, so remove the
+        certificate from the Identity Provider first when rotating.
+      operationId: SamlSpEncryptionCertificatesController_delete
+      parameters:
+        - name: connectionId
+          required: true
+          in: path
+          description: Unique identifier for the Connection.
+          schema:
+            example: conn_01E4ZCR3C56J083X43JQXF3JK5
+            type: string
+        - name: certificateId
+          required: true
+          in: path
+          description: >-
+            Unique identifier for the Service Provider encryption key pair.
+            WorkOS holds the corresponding private key, which is never exposed.
+          schema:
+            example: saml_enc_key_pair_01E4ZCR3C56J083X43JQXF3JK5
+            type: string
+      responses:
+        '204':
+          description: No Content
+        '403':
+          description: Forbidden
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '404':
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+      summary: Delete an SP encryption certificate
+      tags:
+        - connections
+      x-feature-flag: connections-api-migrations-capabilities-api
+  /connections/{connectionId}/saml_sp_signing_cert:
+    get:
+      description: >-
+        Returns the public certificate the Identity Provider can use to verify
+        the signature of SAML requests sent by WorkOS. Responds with `404` when
+        the connection has no request signing key pair.
+      operationId: SamlSpSigningCertificatesController_get
+      parameters:
+        - name: connectionId
+          required: true
+          in: path
+          description: Unique identifier for the Connection.
+          schema:
+            example: conn_01E4ZCR3C56J083X43JQXF3JK5
+            type: string
+      responses:
+        '200':
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/SamlSpSigningCertificate'
+        '400':
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code:
+                    type: string
+                    description: The error code identifying the type of error.
+                    example: connection_is_not_saml
+                    const: connection_is_not_saml
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: Request could not be processed.
+                required:
+                  - code
+                  - message
+        '403':
+          description: Forbidden
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '404':
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+      summary: Get the SP signing certificate
+      tags:
+        - connections
+      x-feature-flag: connections-api-migrations-capabilities-api
+    post:
+      description: >-
+        Generates a new request signing key pair for the connection and returns
+        its public certificate. WorkOS holds the private key, so the request
+        takes no body — to bring your own key pair, provide
+        `saml_options.sp_signing_key_pair` when creating the connection instead.
+        A connection signs with one key pair at a time: delete the existing
+        certificate before creating its replacement.
+      operationId: SamlSpSigningCertificatesController_create
       parameters:
-        - name: before
-          required: false
-          in: query
-          description: >-
-            An object ID that defines your place in the list. When the ID is not
-            present, you are at the end of the list.
+        - name: connectionId
+          required: true
+          in: path
+          description: Unique identifier for the Connection.
           schema:
-            example: obj_1234567890
+            example: conn_01E4ZCR3C56J083X43JQXF3JK5
             type: string
-        - name: after
-          required: false
-          in: query
-          description: >-
-            An object ID that defines your place in the list. When the ID is not
-            present, you are at the end of the list.
+      responses:
+        '201':
+          description: Created
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/SamlSpSigningCertificate'
+        '400':
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                oneOf:
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: connection_is_not_saml
+                        const: connection_is_not_saml
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: key_pair_not_accepted
+                        const: key_pair_not_accepted
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: connection_type_not_supported
+                        const: connection_type_not_supported
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+        '403':
+          description: Forbidden
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '404':
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '409':
+          description: ''
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code:
+                    type: string
+                    description: The error code identifying the type of error.
+                    example: sp_signing_cert_already_exists
+                    const: sp_signing_cert_already_exists
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: Request could not be processed.
+                required:
+                  - code
+                  - message
+        '503':
+          description: ''
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code:
+                    type: string
+                    description: The error code identifying the type of error.
+                    example: concurrent_request
+                    const: concurrent_request
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: Request could not be processed.
+                required:
+                  - code
+                  - message
+      summary: Create an SP signing certificate
+      tags:
+        - connections
+      x-feature-flag: connections-api-migrations-capabilities-api
+  /connections/{connectionId}/saml_sp_signing_cert/{certificateId}:
+    delete:
+      description: >-
+        Removes the request signing key pair from the connection, after which
+        SAML requests are sent unsigned. Delete the certificate before creating
+        its replacement when rotating.
+      operationId: SamlSpSigningCertificatesController_delete
+      parameters:
+        - name: connectionId
+          required: true
+          in: path
+          description: Unique identifier for the Connection.
           schema:
-            example: obj_1234567890
+            example: conn_01E4ZCR3C56J083X43JQXF3JK5
             type: string
-        - name: limit
-          required: false
-          in: query
+        - name: certificateId
+          required: true
+          in: path
           description: >-
-            Upper limit on the number of objects to return, between `1` and
-            `100`.
-          schema:
-            minimum: 1
-            maximum: 100
-            default: 10
-            example: 10
-            type: integer
-        - name: order
-          required: false
-          in: query
-          description: Order the results by the creation time. Defaults to `normal`.
-          schema:
-            $ref: '#/components/schemas/PaginationOrder'
-        - name: connection_type
-          required: false
-          in: query
-          description: Filter Connections by their type.
-          schema:
-            example: GithubOAuth
-            enum:
-              - ADFSSAML
-              - AdpOidc
-              - AppleOAuth
-              - Auth0SAML
-              - AzureSAML
-              - BitbucketOAuth
-              - CasSAML
-              - CloudflareSAML
-              - ClassLinkSAML
-              - CleverOIDC
-              - CyberArkSAML
-              - DuoSAML
-              - EntraIdOIDC
-              - GenericOIDC
-              - GenericSAML
-              - GithubOAuth
-              - GitLabOAuth
-              - GoogleOAuth
-              - GoogleOIDC
-              - GoogleSAML
-              - IntuitOAuth
-              - JumpCloudSAML
-              - KeycloakSAML
-              - LastPassSAML
-              - LinkedInOAuth
-              - LoginGovOidc
-              - MagicLink
-              - MicrosoftOAuth
-              - MiniOrangeSAML
-              - NetIqSAML
-              - OktaOIDC
-              - OktaSAML
-              - OneLoginSAML
-              - OracleSAML
-              - PingFederateSAML
-              - PingOneSAML
-              - RipplingSAML
-              - SalesforceSAML
-              - ShibbolethGenericSAML
-              - ShibbolethSAML
-              - SimpleSamlPhpSAML
-              - SalesforceOAuth
-              - SlackOAuth
-              - VercelMarketplaceOAuth
-              - VercelOAuth
-              - VMwareSAML
-              - XeroOAuth
-            type: string
-        - name: domain
-          required: false
-          in: query
-          description: Filter Connections by their associated domain.
-          schema:
-            example: foo-corp.com
-            type: string
-        - name: organization_id
-          required: false
-          in: query
-          description: Filter Connections by their associated organization.
+            Unique identifier for the Service Provider signing key pair. WorkOS
+            holds the corresponding private key, which is never exposed.
           schema:
-            example: org_01EHWNCE74X7JSDV0X3SZ3KJNY
+            example: saml_party_trust_01E4ZCR3C56J083X43JQXF3JK5
             type: string
-        - name: search
-          required: false
-          in: query
-          description: Searchable text to match against Connection names.
+      responses:
+        '204':
+          description: No Content
+        '403':
+          description: Forbidden
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '404':
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+      summary: Delete the SP signing certificate
+      tags:
+        - connections
+      x-feature-flag: connections-api-migrations-capabilities-api
+  /connections/{id}:
+    patch:
+      description: >-
+        Updates an existing connection. Only the provided fields are changed;
+        fields that accept `null` are reset to their default behavior.
+      operationId: ConnectionsController_patch
+      parameters:
+        - name: id
+          required: true
+          in: path
+          description: Unique identifier for the Connection.
           schema:
-            example: Foo Corp
+            example: conn_01E4ZCR3C56J083X43JQXF3JK5
             type: string
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/PatchConnectionDto'
       responses:
         '200':
           description: OK
           content:
             application/json:
               schema:
-                $ref: '#/components/schemas/ConnectionList'
+                $ref: '#/components/schemas/Connection'
+        '400':
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                oneOf:
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: external_id_already_in_use
+                        const: external_id_already_in_use
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: connection_type_not_supported
+                        const: connection_type_not_supported
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: connection_type_conflicts_with_options
+                        const: connection_type_conflicts_with_options
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: both_saml_and_oidc_options_provided
+                        const: both_saml_and_oidc_options_provided
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: ambiguous_saml_options
+                        const: ambiguous_saml_options
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: token_authentication_method_not_supported
+                        const: token_authentication_method_not_supported
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: id_token_signature_algorithm_not_supported
+                        const: id_token_signature_algorithm_not_supported
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: client_secret_required
+                        const: client_secret_required
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: client_secret_not_accepted
+                        const: client_secret_not_accepted
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: discovery_endpoint_must_use_https
+                        const: discovery_endpoint_must_use_https
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
         '403':
           description: Forbidden
           content:
@@ -7162,8 +8502,8 @@ paths:
                     example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
                 required:
                   - message
-        '422':
-          description: Unprocessable Entity
+        '404':
+          description: Not Found
           content:
             application/json:
               schema:
@@ -7175,10 +8515,95 @@ paths:
                     example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
                 required:
                   - message
-      summary: List Connections
+        '409':
+          description: ''
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code:
+                    type: string
+                    description: The error code identifying the type of error.
+                    example: connection_deletion_in_progress
+                    const: connection_deletion_in_progress
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: Request could not be processed.
+                required:
+                  - code
+                  - message
+        '422':
+          description: Unprocessable Entity
+          content:
+            application/json:
+              schema:
+                oneOf:
+                  - type: object
+                    properties:
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: >-
+                          Organization not found:
+                          'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                    required:
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: connection_type_not_updatable
+                        const: connection_type_not_updatable
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: idp_metadata_fetch_failed
+                        const: idp_metadata_fetch_failed
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: connection_could_not_be_verified
+                        const: connection_could_not_be_verified
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+      summary: Update a Connection
       tags:
         - connections
-  /connections/{id}:
+      x-feature-flag: connections-api-migrations-capabilities-api
+      x-mutually-exclusive-body-groups: &ref_10
+        protocol_options:
+          optional: true
+          variants:
+            saml:
+              - saml_options
+            oidc:
+              - oidc_options
     get:
       description: Get the details of an existing connection.
       operationId: ConnectionsController_find
@@ -15777,7 +17202,7 @@ paths:
       summary: Create an organization membership
       tags:
         - user-management.organization-membership
-      x-mutually-exclusive-body-groups: &ref_10
+      x-mutually-exclusive-body-groups: &ref_14
         role:
           optional: true
           variants:
@@ -15961,7 +17386,7 @@ paths:
       summary: Update an organization membership
       tags:
         - user-management.organization-membership
-      x-mutually-exclusive-body-groups: &ref_11
+      x-mutually-exclusive-body-groups: &ref_15
         role:
           optional: true
           variants:
@@ -17281,7 +18706,7 @@ paths:
       summary: Create a user
       tags:
         - user-management.users
-      x-mutually-exclusive-body-groups: &ref_12
+      x-mutually-exclusive-body-groups: &ref_16
         password:
           optional: true
           variants:
@@ -17574,7 +18999,7 @@ paths:
       summary: Update a user
       tags:
         - user-management.users
-      x-mutually-exclusive-body-groups: &ref_16
+      x-mutually-exclusive-body-groups: &ref_20
         password:
           optional: true
           variants:
@@ -19440,8 +20865,11 @@ paths:
   /user_management/waitlist_entries/{id}:
     delete:
       description: >-
-        Removes the entry from the waitlist. An invitation created by approving
-        the entry stays valid, so revoke that invitation to withdraw access.
+        Remove the entry from the waitlist. Its email address can join again
+        unless a user with that email now exists in the environment. Deleting
+        the entry does not revoke an invitation created by approving it —
+        [revoke that invitation](/reference/authkit/invitation/revoke)
+        separately to withdraw access.
       operationId: WaitlistEntriesController_delete
       parameters:
         - name: id
@@ -19473,8 +20901,20 @@ paths:
   /user_management/waitlist_entries/{id}/approve:
     post:
       description: >-
-        Approve a waitlist entry and send the resulting user invitation email.
-        Also reverses a denial: a denied entry can be approved.
+        Approve a waitlist entry, create an invitation for its email address,
+        and send the invitation email. Approving a denied entry reverses the
+        denial. The approval is saved even when the invitation steps fail, so
+        instead of retrying the approval, recover based on the outcome:
+
+
+        - `200` — the entry is approved. If invitation creation failed, no
+        invitation exists yet; [send](/reference/authkit/invitation/send) one.
+
+        - `422` with code `invitation_email_not_sent` — the entry is approved
+        and an invitation exists, but its email was not sent;
+        [resend](/reference/authkit/invitation/resend) it.
+
+        - `422` with code `invalid_state` — the entry was already approved.
       operationId: WaitlistEntriesController_approve
       parameters:
         - name: id
@@ -19610,8 +21050,9 @@ paths:
   /user_management/waitlist_entries/{id}/deny:
     post:
       description: >-
-        Deny a pending waitlist entry. A denial can be reversed by approving the
-        entry.
+        Deny a pending waitlist entry. Denying an entry that is not pending
+        fails with the code `invalid_state`. A denial can be reversed by
+        approving the entry.
       operationId: WaitlistEntriesController_deny
       parameters:
         - name: id
@@ -19730,7 +21171,10 @@ paths:
         - user-management.waitlists
   /user_management/waitlists:
     get:
-      description: Get a list of the waitlists in the environment.
+      description: >-
+        Get a list of the waitlists in the environment. All waitlists are
+        returned in a single response — this endpoint is not paginated, so the
+        `list_metadata` cursors are always `null`.
       operationId: WaitlistsController_list
       parameters: []
       responses:
@@ -19794,7 +21238,9 @@ paths:
           in: path
           description: >-
             The unique ID of the waitlist, or the literal `default` for the
-            environment's default waitlist.
+            environment's default waitlist. The default waitlist is created when
+            its first entry is added, so read requests for `default` return a
+            `404` until then.
           schema:
             type: string
             example: waitlist_01E4ZCR3C56J083X43JQXF3JK5
@@ -19831,7 +21277,9 @@ paths:
           in: path
           description: >-
             The unique ID of the waitlist, or the literal `default` for the
-            environment's default waitlist.
+            environment's default waitlist. The default waitlist is created when
+            its first entry is added, so read requests for `default` return a
+            `404` until then.
           schema:
             type: string
             example: waitlist_01E4ZCR3C56J083X43JQXF3JK5
@@ -19983,9 +21431,12 @@ paths:
         - user-management.waitlists
     post:
       description: >-
-        Add an email address to the waitlist. Creating an entry is idempotent
-        per email address: a request for an email address already on the
-        waitlist returns the existing entry.
+        Add an email address to the waitlist. Email addresses are normalized and
+        unique per environment: a request for an email address already on the
+        waitlist returns the existing entry unchanged (still with status `201`)
+        and does not send another confirmation email. If a user with the email
+        address already exists in the environment, the request fails with the
+        code `user_already_exists`.
       operationId: WaitlistsController_createEntry
       parameters:
         - name: id
@@ -19993,10 +21444,11 @@ paths:
           in: path
           description: >-
             The unique ID of the waitlist, or the literal `default` for the
-            environment's default waitlist.
+            environment's default waitlist. Use `default` when adding the first
+            entry — the default waitlist is created automatically.
           schema:
             type: string
-            example: waitlist_01E4ZCR3C56J083X43JQXF3JK5
+            example: default
       requestBody:
         required: true
         content:
@@ -22150,6 +23602,525 @@ components:
                     required:
                       - parent_resource_id
       x-mutually-exclusive-body-groups: *ref_6
+    CreateConnectionKeyPairDto:
+      type: object
+      properties:
+        key:
+          type: string
+          description: The PEM-encoded private key.
+          example: |-
+            -----BEGIN PRIVATE KEY-----
+            MIIE...
+            -----END PRIVATE KEY-----
+        cert:
+          type: string
+          description: The PEM-encoded X.509 certificate for the key.
+          example: |-
+            -----BEGIN CERTIFICATE-----
+            MIIC...
+            -----END CERTIFICATE-----
+      required:
+        - key
+        - cert
+    CreateConnectionSamlOptionsDto:
+      type: object
+      properties:
+        idp_metadata_url:
+          type: string
+          format: uri
+          description: >-
+            The Identity Provider metadata URL. When provided, the IdP fields
+            and signing certificates are imported from the metadata document.
+            Mutually exclusive with the manual IdP fields.
+          example: https://idp.example.com/metadata.xml
+        acs_url:
+          type: string
+          format: uri
+          description: >-
+            A custom Assertion Consumer Service (ACS) URL override. When
+            omitted, the standard WorkOS-generated ACS URL is used.
+          example: https://example.auth0.com/login/callback?connection=123
+        sp_entity_id:
+          type: string
+          description: >-
+            A custom Service Provider Entity ID (audience) override. When
+            omitted, the connection external key is used.
+          example: https://example.auth0.com/login/callback?connection=123
+        idp_entity_id:
+          type: string
+          description: The Identity Provider Entity ID.
+          example: https://idp.example.com/entity
+        idp_sso_url:
+          type: string
+          format: uri
+          description: >-
+            The Identity Provider SSO URL. Required when configuring the
+            connection with manual IdP fields.
+          example: https://idp.example.com/sso
+        idp_signing_certs:
+          description: >-
+            The X.509 certificates used to verify signed SAML responses from the
+            Identity Provider. Required when configuring the connection with
+            manual IdP fields.
+          example:
+            - |-
+              -----BEGIN CERTIFICATE-----
+              MIIC...
+              -----END CERTIFICATE-----
+          type: array
+          items:
+            type: string
+        sp_signing_key_pair:
+          description: >-
+            The customer-owned key pair used to sign SAML requests sent to the
+            Identity Provider. When omitted, WorkOS generates and manages the
+            signing key pair.
+          $ref: '#/components/schemas/CreateConnectionKeyPairDto'
+        sp_encryption_key_pairs:
+          description: >-
+            The customer-owned key pairs used to decrypt encrypted SAML
+            responses from the Identity Provider. When omitted, WorkOS generates
+            and manages the encryption key pair.
+          type: array
+          items:
+            $ref: '#/components/schemas/CreateConnectionKeyPairDto'
+    CreateConnectionOidcOptionsDto:
+      type: object
+      properties:
+        discovery_endpoint:
+          type: string
+          format: uri
+          description: The OIDC discovery endpoint.
+          example: https://idp.example.com/.well-known/openid-configuration
+        client_id:
+          type: string
+          description: The OIDC client ID.
+          example: client_123
+        client_secret:
+          type: string
+          description: >-
+            The OIDC client secret. Required for `client_secret_basic` and
+            `client_secret_post`, and rejected for `private_key_jwt`, which
+            authenticates with a key pair instead. This value is write-only and
+            is never returned.
+          example: secret_xyz
+        redirect_uri:
+          type: string
+          format: uri
+          description: >-
+            A custom OAuth callback URL override. When omitted, the standard
+            WorkOS-generated redirect URI is used.
+          example: https://auth.workos.com/sso/oidc/conn_externalkey/callback
+        pkce:
+          type: boolean
+          description: Whether PKCE is enabled for the connection.
+          example: true
+          default: true
+        token_authentication_method:
+          type: string
+          enum: &ref_8
+            - client_secret_post
+            - client_secret_basic
+            - private_key_jwt
+          description: The token-endpoint client authentication method.
+          example: client_secret_basic
+          default: client_secret_basic
+        jwt_signing_key_pair:
+          description: >-
+            A key pair for WorkOS to sign `private_key_jwt` client assertions
+            with. Only accepted when `token_authentication_method` is
+            `private_key_jwt`; when omitted, WorkOS generates one and returns
+            its certificate in `oidc_options.jwt_signing_certs`.
+          $ref: '#/components/schemas/CreateConnectionKeyPairDto'
+        id_token_signature_algorithm:
+          type: string
+          enum: &ref_9
+            - ES256
+            - ES384
+            - ES512
+            - EdDSA
+            - HS256
+            - HS384
+            - HS512
+            - PS256
+            - PS384
+            - PS512
+            - RS256
+            - RS384
+            - RS512
+          description: The ID-token signing algorithm.
+          example: RS256
+        fetch_user_info:
+          type: boolean
+          description: >-
+            Whether to fetch additional profile attributes from the userinfo
+            endpoint.
+          example: false
+      required:
+        - discovery_endpoint
+        - client_id
+    CreateConnectionStandardAttributesDto:
+      type: object
+      properties:
+        idp_id:
+          type: string
+          description: >-
+            The IdP attribute or claim the profile's `idp_id` is mapped from.
+            When omitted, the default for the connection type is used.
+          example: sub
+        email:
+          type: string
+          description: >-
+            The IdP attribute or claim the profile's `email` is mapped from.
+            When omitted, the default for the connection type is used.
+          example: email
+        first_name:
+          type: string
+          description: >-
+            The IdP attribute or claim the profile's `first_name` is mapped
+            from. When omitted, the default for the connection type is used.
+          example: given_name
+        last_name:
+          type: string
+          description: >-
+            The IdP attribute or claim the profile's `last_name` is mapped from.
+            When omitted, the default for the connection type is used.
+          example: family_name
+        groups:
+          type:
+            - string
+            - 'null'
+          description: >-
+            The IdP attribute or claim the profile's `groups` are mapped from.
+            `null` leaves the mapping unset.
+          example: memberOf
+        name:
+          type:
+            - string
+            - 'null'
+          description: >-
+            The IdP attribute or claim the profile's `name` is mapped from.
+            `null` leaves the mapping unset.
+          example: displayName
+    CreateConnectionAttributeMapsDto:
+      type: object
+      properties:
+        standard_attributes:
+          description: >-
+            How IdP attributes or claims map onto the standard WorkOS profile
+            fields. Provided fields override the defaults for the connection
+            type.
+          $ref: '#/components/schemas/CreateConnectionStandardAttributesDto'
+        custom_attributes:
+          type: object
+          description: >-
+            How IdP attributes or claims map onto custom attributes, keyed by
+            custom attribute name. Custom attributes must already be defined in
+            the WorkOS dashboard.
+          additionalProperties:
+            type: string
+          example:
+            company: company_claim
+    CreateConnectionDto:
+      allOf:
+        - type: object
+          properties:
+            organization_id:
+              type: string
+              description: >-
+                Unique identifier for the Organization in which the Connection
+                resides.
+              example: org_01EHWNCE74X7JSDV0X3SZ3KJNY
+            name:
+              type: string
+              description: >-
+                A human-readable name for the Connection. This will most
+                commonly be the organization's name.
+              example: Foo Corp
+            external_id:
+              type: string
+              maxLength: 128
+              pattern: ^[\x00-\x7F]+$
+              description: The customer-owned identifier for the Connection.
+              example: acme-legacy-conn-42
+            connection_type:
+              type: string
+              description: >-
+                The type of the Connection. Only SAML and OIDC connection types
+                may be created. When omitted, the type is inferred from the
+                provided options.
+              example: OktaSAML
+            attribute_maps:
+              description: >-
+                How IdP attributes or claims map onto WorkOS profile fields.
+                Provided fields override the defaults for the connection type.
+              $ref: '#/components/schemas/CreateConnectionAttributeMapsDto'
+          required:
+            - organization_id
+        - oneOf:
+            - type: object
+              properties:
+                saml_options:
+                  description: >-
+                    Protocol configuration for SAML connections. Mutually
+                    exclusive with `oidc_options`.
+                  $ref: '#/components/schemas/CreateConnectionSamlOptionsDto'
+              required:
+                - saml_options
+              not:
+                anyOf:
+                  - properties:
+                      oidc_options:
+                        x-exclude-from-lint: true
+                    required:
+                      - oidc_options
+            - type: object
+              properties:
+                oidc_options:
+                  description: >-
+                    Protocol configuration for OIDC connections. Mutually
+                    exclusive with `saml_options`.
+                  $ref: '#/components/schemas/CreateConnectionOidcOptionsDto'
+              required:
+                - oidc_options
+              not:
+                anyOf:
+                  - properties:
+                      saml_options:
+                        x-exclude-from-lint: true
+                    required:
+                      - saml_options
+      x-mutually-exclusive-body-groups: *ref_7
+    PatchConnectionSamlOptionsDto:
+      type: object
+      properties:
+        idp_metadata_url:
+          type:
+            - string
+            - 'null'
+          format: uri
+          description: >-
+            The Identity Provider metadata URL. When provided, the IdP fields
+            and signing certificates are re-imported from the metadata document,
+            replacing the current set. Mutually exclusive with the manual IdP
+            fields. Set to `null` to stop tracking a metadata URL.
+          example: https://idp.example.com/metadata.xml
+        acs_url:
+          type:
+            - string
+            - 'null'
+          format: uri
+          description: >-
+            A custom Assertion Consumer Service (ACS) URL override. Set to
+            `null` to revert to the standard WorkOS-generated ACS URL.
+          example: https://example.auth0.com/login/callback?connection=123
+        sp_entity_id:
+          type:
+            - string
+            - 'null'
+          description: >-
+            A custom Service Provider Entity ID (audience) override. Set to
+            `null` to revert to the connection external key.
+          example: https://example.auth0.com/login/callback?connection=123
+        idp_entity_id:
+          type: string
+          description: The Identity Provider Entity ID.
+          example: https://idp.example.com/entity
+        idp_sso_url:
+          type: string
+          format: uri
+          description: The Identity Provider SSO URL.
+          example: https://idp.example.com/sso
+    PatchConnectionOidcOptionsDto:
+      type: object
+      properties:
+        discovery_endpoint:
+          type: string
+          format: uri
+          description: The OIDC discovery endpoint.
+          example: https://idp.example.com/.well-known/openid-configuration
+        client_id:
+          type: string
+          description: The OIDC client ID.
+          example: client_123
+        client_secret:
+          type: string
+          description: >-
+            The OIDC client secret. Required when moving the connection to
+            `client_secret_basic` or `client_secret_post`, and rejected for
+            `private_key_jwt`, which authenticates with a key pair instead. This
+            value is write-only and is never returned.
+          example: secret_xyz
+        redirect_uri:
+          type:
+            - string
+            - 'null'
+          format: uri
+          description: >-
+            A custom OAuth callback URL override. Set to `null` to revert to the
+            standard WorkOS-generated redirect URI.
+          example: https://auth.workos.com/sso/oidc/conn_externalkey/callback
+        pkce:
+          type: boolean
+          description: Whether PKCE is enabled for the connection.
+          example: true
+        token_authentication_method:
+          type: string
+          enum: *ref_8
+          description: >-
+            The token-endpoint client authentication method. Moving to
+            `private_key_jwt` generates a signing key pair if the connection has
+            none; its certificate is returned in
+            `oidc_options.jwt_signing_certs` and must be registered at the
+            Identity Provider.
+          example: client_secret_basic
+        id_token_signature_algorithm:
+          type: string
+          enum: *ref_9
+          description: The ID-token signing algorithm.
+          example: RS256
+        fetch_user_info:
+          type: boolean
+          description: >-
+            Whether to fetch additional profile attributes from the userinfo
+            endpoint.
+          example: false
+    PatchConnectionStandardAttributesDto:
+      type: object
+      properties:
+        idp_id:
+          type: string
+          description: The IdP attribute or claim the profile's `idp_id` is mapped from.
+          example: sub
+        email:
+          type: string
+          description: The IdP attribute or claim the profile's `email` is mapped from.
+          example: email
+        first_name:
+          type: string
+          description: >-
+            The IdP attribute or claim the profile's `first_name` is mapped
+            from.
+          example: given_name
+        last_name:
+          type: string
+          description: The IdP attribute or claim the profile's `last_name` is mapped from.
+          example: family_name
+        groups:
+          type:
+            - string
+            - 'null'
+          description: >-
+            The IdP attribute or claim the profile's `groups` are mapped from.
+            Set to `null` to unset the mapping.
+          example: memberOf
+        name:
+          type:
+            - string
+            - 'null'
+          description: >-
+            The IdP attribute or claim the profile's `name` is mapped from. Set
+            to `null` to unset the mapping.
+          example: displayName
+    PatchConnectionAttributeMapsDto:
+      type: object
+      properties:
+        standard_attributes:
+          description: >-
+            How IdP attributes or claims map onto the standard WorkOS profile
+            fields. Only the provided fields are updated.
+          $ref: '#/components/schemas/PatchConnectionStandardAttributesDto'
+        custom_attributes:
+          type: object
+          description: >-
+            How IdP attributes or claims map onto custom attributes, keyed by
+            custom attribute name. Custom attributes must already be defined in
+            the WorkOS dashboard. Only the provided keys are updated; a `null`
+            value unsets that mapping.
+          additionalProperties:
+            oneOf:
+              - type: string
+              - type: 'null'
+          example:
+            company: company_claim
+    PatchConnectionDto:
+      allOf:
+        - type: object
+          properties:
+            name:
+              type: string
+              description: A human-readable name for the Connection.
+              example: Foo Corp
+            external_id:
+              type:
+                - string
+                - 'null'
+              maxLength: 128
+              pattern: ^[\x00-\x7F]+$
+              description: >-
+                The customer-owned identifier for the Connection. Set to `null`
+                to stop tracking one.
+              example: acme-legacy-conn-42
+            connection_type:
+              type: string
+              description: >-
+                The type of the Connection. Immutable after creation — it may be
+                sent, but only with the Connection current type.
+              example: OktaSAML
+            attribute_maps:
+              description: >-
+                How IdP attributes or claims map onto WorkOS profile fields.
+                Only the provided fields are updated.
+              $ref: '#/components/schemas/PatchConnectionAttributeMapsDto'
+        - oneOf:
+            - type: object
+              not:
+                anyOf:
+                  - properties:
+                      saml_options:
+                        x-exclude-from-lint: true
+                    required:
+                      - saml_options
+                  - properties:
+                      oidc_options:
+                        x-exclude-from-lint: true
+                    required:
+                      - oidc_options
+            - type: object
+              properties:
+                saml_options:
+                  description: >-
+                    Protocol configuration for SAML connections. Only the
+                    provided fields are updated. Mutually exclusive with
+                    `oidc_options`.
+                  $ref: '#/components/schemas/PatchConnectionSamlOptionsDto'
+              required:
+                - saml_options
+              not:
+                anyOf:
+                  - properties:
+                      oidc_options:
+                        x-exclude-from-lint: true
+                    required:
+                      - oidc_options
+            - type: object
+              properties:
+                oidc_options:
+                  description: >-
+                    Protocol configuration for OIDC connections. Only the
+                    provided fields are updated. Mutually exclusive with
+                    `saml_options`.
+                  $ref: '#/components/schemas/PatchConnectionOidcOptionsDto'
+              required:
+                - oidc_options
+              not:
+                anyOf:
+                  - properties:
+                      saml_options:
+                        x-exclude-from-lint: true
+                    required:
+                      - saml_options
+      x-mutually-exclusive-body-groups: *ref_10
     CreateCorsOriginDto:
       type: object
       properties:
@@ -22331,11 +24302,11 @@ components:
           type:
             - object
             - 'null'
-          additionalProperties: &ref_7
+          additionalProperties: &ref_11
             type: string
             maxLength: 600
           maxProperties: 50
-          example: &ref_8
+          example: &ref_12
             tier: diamond
           description: >-
             Object containing [metadata](/authkit/metadata) key/value pairs
@@ -22390,9 +24361,9 @@ components:
           type:
             - object
             - 'null'
-          additionalProperties: *ref_7
+          additionalProperties: *ref_11
           maxProperties: 50
-          example: *ref_8
+          example: *ref_12
           description: >-
             Object containing [metadata](/authkit/metadata) key/value pairs
             associated with the Organization.
@@ -22526,7 +24497,7 @@ components:
           example: application/x-www-form-urlencoded
         authenticate_via:
           type: string
-          enum: &ref_9
+          enum: &ref_13
             - request_body
             - basic_auth_header
           description: >-
@@ -22682,7 +24653,7 @@ components:
           example: application/x-www-form-urlencoded
         authenticate_via:
           type: string
-          enum: *ref_9
+          enum: *ref_13
           description: >-
             How client credentials are sent when exchanging authorization codes
             and refreshing tokens.
@@ -22858,6 +24829,15 @@ components:
           example: https://example.com/callback
       required:
         - uri
+    CreateSamlIdpSigningCertificateDto:
+      type: object
+      properties:
+        value:
+          type: string
+          description: The PEM-encoded X.509 certificate.
+          example: '-----BEGIN CERTIFICATE-----MIIC...-----END CERTIFICATE-----'
+      required:
+        - value
     CreateTeamDto:
       type: object
       properties:
@@ -23238,9 +25218,9 @@ components:
                         x-exclude-from-lint: true
                     required:
                       - role_slug
-      x-mutually-exclusive-body-groups: *ref_10
+      x-mutually-exclusive-body-groups: *ref_14
     UpdateUserlandUserOrganizationMembershipDto:
-      x-mutually-exclusive-body-groups: *ref_11
+      x-mutually-exclusive-body-groups: *ref_15
       oneOf:
         - type: object
           not:
@@ -23362,9 +25342,9 @@ components:
               type:
                 - object
                 - 'null'
-              additionalProperties: *ref_7
+              additionalProperties: *ref_11
               maxProperties: 50
-              example: &ref_13
+              example: &ref_17
                 timezone: America/New_York
               description: >-
                 Object containing metadata key/value pairs associated with the
@@ -23463,157 +25443,14 @@ components:
                   example: $2a$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy
                 password_hash_type:
                   type: string
-                  enum: &ref_14
-                    - bcrypt
-                    - firebase-scrypt
-                    - ssha
-                    - ssha256
-                    - scrypt
-                    - pbkdf2
-                    - argon2
-                  description: >-
-                    The algorithm originally used to hash the password, used
-                    when providing a `password_hash`. Required with
-                    `password_hash`. Mutually exclusive with `password`.
-                  example: bcrypt
-                password_salt_position:
-                  type: string
-                  enum: &ref_15
-                    - prefix
-                    - suffix
-                  description: >-
-                    The position of the salt relative to the password when the
-                    `password_hash` digest was computed: `prefix` for `hash(salt
-                    + password)` or `suffix` for `hash(password + salt)`. Only
-                    supported with the `ssha256` hash type and only valid when a
-                    `password_hash` is provided. Defaults to `suffix`. Mutually
-                    exclusive with `password`.
-                  example: prefix
-              required:
-                - password_hash
-                - password_hash_type
-              not:
-                anyOf:
-                  - properties:
-                      password:
-                        x-exclude-from-lint: true
-                    required:
-                      - password
-      x-mutually-exclusive-body-groups: *ref_12
-    UpdateUserlandUserDto:
-      allOf:
-        - type: object
-          properties:
-            email:
-              type: string
-              format: email
-              description: The email address of the user.
-              example: marcelina.davis@example.com
-            first_name:
-              type: string
-              description: The first name of the user.
-              example: Marcelina
-            last_name:
-              type: string
-              description: The last name of the user.
-              example: Davis
-            name:
-              type: string
-              description: The user's full name.
-              example: Marcelina Davis
-            email_verified:
-              type: boolean
-              description: Whether the user's email has been verified.
-              example: true
-            metadata:
-              type:
-                - object
-                - 'null'
-              additionalProperties: *ref_7
-              maxProperties: 50
-              example: *ref_13
-              description: >-
-                Object containing metadata key/value pairs associated with the
-                user.
-              propertyNames:
-                maxLength: 40
-            external_id:
-              type:
-                - string
-                - 'null'
-              maxLength: 128
-              pattern: ^[\x00-\x7F]+$
-              description: The external ID of the user.
-              example: f1ffa2b2-c20b-4d39-be5c-212726e11222
-            locale:
-              type:
-                - string
-                - 'null'
-              description: The user's preferred locale.
-              example: en-US
-        - oneOf:
-            - type: object
-              not:
-                anyOf:
-                  - properties:
-                      password:
-                        x-exclude-from-lint: true
-                    required:
-                      - password
-                  - properties:
-                      password_hash:
-                        x-exclude-from-lint: true
-                    required:
-                      - password_hash
-                  - properties:
-                      password_hash_type:
-                        x-exclude-from-lint: true
-                    required:
-                      - password_hash_type
-                  - properties:
-                      password_salt_position:
-                        x-exclude-from-lint: true
-                    required:
-                      - password_salt_position
-            - type: object
-              properties:
-                password:
-                  type: string
-                  description: >-
-                    The password to set for the user. Mutually exclusive with
-                    `password_hash`, `password_hash_type`, and
-                    `password_salt_position`.
-                  example: strong_password_123!
-              required:
-                - password
-              not:
-                anyOf:
-                  - properties:
-                      password_hash:
-                        x-exclude-from-lint: true
-                    required:
-                      - password_hash
-                  - properties:
-                      password_hash_type:
-                        x-exclude-from-lint: true
-                    required:
-                      - password_hash_type
-                  - properties:
-                      password_salt_position:
-                        x-exclude-from-lint: true
-                    required:
-                      - password_salt_position
-            - type: object
-              properties:
-                password_hash:
-                  type: string
-                  description: >-
-                    The hashed password to set for the user. Required with
-                    `password_hash_type`. Mutually exclusive with `password`.
-                  example: $2a$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy
-                password_hash_type:
-                  type: string
-                  enum: *ref_14
+                  enum: &ref_18
+                    - bcrypt
+                    - firebase-scrypt
+                    - ssha
+                    - ssha256
+                    - scrypt
+                    - pbkdf2
+                    - argon2
                   description: >-
                     The algorithm originally used to hash the password, used
                     when providing a `password_hash`. Required with
@@ -23621,7 +25458,9 @@ components:
                   example: bcrypt
                 password_salt_position:
                   type: string
-                  enum: *ref_15
+                  enum: &ref_19
+                    - prefix
+                    - suffix
                   description: >-
                     The position of the salt relative to the password when the
                     `password_hash` digest was computed: `prefix` for `hash(salt
@@ -23641,6 +25480,147 @@ components:
                     required:
                       - password
       x-mutually-exclusive-body-groups: *ref_16
+    UpdateUserlandUserDto:
+      allOf:
+        - type: object
+          properties:
+            email:
+              type: string
+              format: email
+              description: The email address of the user.
+              example: marcelina.davis@example.com
+            first_name:
+              type: string
+              description: The first name of the user.
+              example: Marcelina
+            last_name:
+              type: string
+              description: The last name of the user.
+              example: Davis
+            name:
+              type: string
+              description: The user's full name.
+              example: Marcelina Davis
+            email_verified:
+              type: boolean
+              description: Whether the user's email has been verified.
+              example: true
+            metadata:
+              type:
+                - object
+                - 'null'
+              additionalProperties: *ref_11
+              maxProperties: 50
+              example: *ref_17
+              description: >-
+                Object containing metadata key/value pairs associated with the
+                user.
+              propertyNames:
+                maxLength: 40
+            external_id:
+              type:
+                - string
+                - 'null'
+              maxLength: 128
+              pattern: ^[\x00-\x7F]+$
+              description: The external ID of the user.
+              example: f1ffa2b2-c20b-4d39-be5c-212726e11222
+            locale:
+              type:
+                - string
+                - 'null'
+              description: The user's preferred locale.
+              example: en-US
+        - oneOf:
+            - type: object
+              not:
+                anyOf:
+                  - properties:
+                      password:
+                        x-exclude-from-lint: true
+                    required:
+                      - password
+                  - properties:
+                      password_hash:
+                        x-exclude-from-lint: true
+                    required:
+                      - password_hash
+                  - properties:
+                      password_hash_type:
+                        x-exclude-from-lint: true
+                    required:
+                      - password_hash_type
+                  - properties:
+                      password_salt_position:
+                        x-exclude-from-lint: true
+                    required:
+                      - password_salt_position
+            - type: object
+              properties:
+                password:
+                  type: string
+                  description: >-
+                    The password to set for the user. Mutually exclusive with
+                    `password_hash`, `password_hash_type`, and
+                    `password_salt_position`.
+                  example: strong_password_123!
+              required:
+                - password
+              not:
+                anyOf:
+                  - properties:
+                      password_hash:
+                        x-exclude-from-lint: true
+                    required:
+                      - password_hash
+                  - properties:
+                      password_hash_type:
+                        x-exclude-from-lint: true
+                    required:
+                      - password_hash_type
+                  - properties:
+                      password_salt_position:
+                        x-exclude-from-lint: true
+                    required:
+                      - password_salt_position
+            - type: object
+              properties:
+                password_hash:
+                  type: string
+                  description: >-
+                    The hashed password to set for the user. Required with
+                    `password_hash_type`. Mutually exclusive with `password`.
+                  example: $2a$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy
+                password_hash_type:
+                  type: string
+                  enum: *ref_18
+                  description: >-
+                    The algorithm originally used to hash the password, used
+                    when providing a `password_hash`. Required with
+                    `password_hash`. Mutually exclusive with `password`.
+                  example: bcrypt
+                password_salt_position:
+                  type: string
+                  enum: *ref_19
+                  description: >-
+                    The position of the salt relative to the password when the
+                    `password_hash` digest was computed: `prefix` for `hash(salt
+                    + password)` or `suffix` for `hash(password + salt)`. Only
+                    supported with the `ssha256` hash type and only valid when a
+                    `password_hash` is provided. Defaults to `suffix`. Mutually
+                    exclusive with `password`.
+                  example: prefix
+              required:
+                - password_hash
+                - password_hash_type
+              not:
+                anyOf:
+                  - properties:
+                      password:
+                        x-exclude-from-lint: true
+                    required:
+                      - password
+      x-mutually-exclusive-body-groups: *ref_20
     VerifyEmailAddressDto:
       type: object
       properties:
@@ -23715,8 +25695,9 @@ components:
           type: object
           description: >-
             Object containing additional key/value pairs collected with the
-            waitlist entry. Values are user-provided — treat them as untrusted
-            input when rendering or exporting.
+            waitlist entry. Supports up to 50 string pairs, with keys up to 40
+            characters and values up to 600 characters. Values are user-provided
+            — treat them as untrusted input when rendering or exporting.
           additionalProperties:
             type: string
             maxLength: 600
@@ -23746,10 +25727,14 @@ components:
           description: The events that the Webhook Endpoint is subscribed to.
           items:
             type: string
-            enum: &ref_17
+            enum: &ref_21
               - agent.blueprint.created
               - agent.blueprint.deleted
               - agent.blueprint.updated
+              - agent.instance.created
+              - agent.instance.deleted
+              - agent.instance.session.created
+              - agent.instance.session.revoked
               - agent.registration.created
               - agent.registration.claim.attempt.created
               - agent.registration.claim.completed
@@ -23868,7 +25853,7 @@ components:
           description: The events that the Webhook Endpoint is subscribed to.
           items:
             type: string
-            enum: *ref_17
+            enum: *ref_21
           example:
             - user.created
             - dsync.user.created
@@ -27194,7 +29179,7 @@ components:
           description: >-
             An object containing the custom attribute mapping for the Directory
             Provider.
-          example: &ref_23
+          example: &ref_27
             department: Engineering
             job_title: Software Engineer
         role:
@@ -27388,7 +29373,7 @@ components:
               type: object
               additionalProperties: {}
               description: The event payload.
-              example: &ref_18
+              example: &ref_22
                 id: directory_user_01E1JG7J09H96KYP8HM9B0G5SJ
                 directory_id: directory_01ECAZ4NV9QMV47GW873HDCX74
                 organization_id: org_01EZTR6WYX1A0DSE2CYMGXQ24Y
@@ -27423,11 +29408,11 @@ components:
             - data
             - created_at
           description: An event emitted by WorkOS.
-          example: &ref_28
+          example: &ref_32
             object: event
             id: event_01EHZNVPK3SFK441A1RGBFSHRT
             event: dsync.user.created
-            data: *ref_18
+            data: *ref_22
             created_at: '2021-06-25T19:07:33.155Z'
             context: {}
         - oneOf:
@@ -27627,7 +29612,7 @@ components:
                       description: >-
                         Permission slugs forming the ceiling on what sessions
                         minted from this blueprint may do.
-                      example: &ref_19
+                      example: &ref_23
                         - crm:read
                         - email:send
                     invocable_by:
@@ -27640,7 +29625,7 @@ components:
                           description: >-
                             Role slugs whose members may mint user-delegated
                             sessions from this blueprint.
-                          example: &ref_20
+                          example: &ref_24
                             - manager
                         organization_ids:
                           type: array
@@ -27649,7 +29634,7 @@ components:
                           description: >-
                             Organizations in which autonomous sessions may be
                             minted from this blueprint.
-                          example: &ref_21
+                          example: &ref_25
                             - org_01EHWNCE74X7JSDV0X3SZ3KJNY
                       required:
                         - role_slugs
@@ -27779,99 +29764,417 @@ components:
                   example: event_01EHZNVPK3SFK441A1RGBFSHRT
                 event:
                   type: string
-                  const: agent.blueprint.updated
+                  const: agent.blueprint.updated
+                data:
+                  type: object
+                  properties:
+                    object:
+                      type: string
+                      description: Distinguishes the agent blueprint object.
+                      const: agent_blueprint
+                    id:
+                      type: string
+                      description: Unique identifier of the agent blueprint.
+                      example: agent_blueprint_01EHWNCE74X7JSDV0X3SZ3KJNY
+                    name:
+                      type: string
+                      description: Human-readable name of the agent blueprint.
+                      example: Prospecting Agent
+                    description:
+                      type:
+                        - string
+                        - 'null'
+                      description: Human-readable description of the agent blueprint.
+                      example: Finds and qualifies sales prospects.
+                    permissions:
+                      type: array
+                      items:
+                        type: string
+                      description: >-
+                        Permission slugs forming the ceiling on what sessions
+                        minted from this blueprint may do.
+                      example: *ref_23
+                    invocable_by:
+                      type: object
+                      properties:
+                        role_slugs:
+                          type: array
+                          items:
+                            type: string
+                          description: >-
+                            Role slugs whose members may mint user-delegated
+                            sessions from this blueprint.
+                          example: *ref_24
+                        organization_ids:
+                          type: array
+                          items:
+                            type: string
+                          description: >-
+                            Organizations in which autonomous sessions may be
+                            minted from this blueprint.
+                          example: *ref_25
+                      required:
+                        - role_slugs
+                        - organization_ids
+                      description: Who may mint sessions from this blueprint.
+                    session_settings:
+                      type: object
+                      properties:
+                        max_age_seconds:
+                          type: number
+                          description: >-
+                            Maximum lifetime of a session in seconds; refreshes
+                            never extend a session past this.
+                          example: 3600
+                        access_token_ttl_seconds:
+                          type: number
+                          description: Lifetime of each minted access token in seconds.
+                          example: 300
+                        refresh_token_ttl_seconds:
+                          type: number
+                          description: Lifetime of each rotated refresh token in seconds.
+                          example: 3600
+                      required:
+                        - max_age_seconds
+                        - access_token_ttl_seconds
+                        - refresh_token_ttl_seconds
+                      description: >-
+                        Token and session lifetimes for sessions minted from
+                        this blueprint.
+                    created_at:
+                      type: string
+                      description: The timestamp when the agent blueprint was created.
+                      example: '2026-01-15T12:00:00.000Z'
+                    updated_at:
+                      type: string
+                      description: The timestamp when the agent blueprint was last updated.
+                      example: '2026-01-15T12:00:00.000Z'
+                  required:
+                    - object
+                    - id
+                    - name
+                    - description
+                    - permissions
+                    - invocable_by
+                    - session_settings
+                    - created_at
+                    - updated_at
+                  description: The event payload.
+                created_at:
+                  format: date-time
+                  type: string
+                  description: An ISO 8601 timestamp.
+                  example: '2026-01-15T12:00:00.000Z'
+                context:
+                  $ref: '#/components/schemas/EventContextDto'
+                object:
+                  type: string
+                  description: Distinguishes the Event object.
+                  const: event
+              required:
+                - id
+                - event
+                - data
+                - created_at
+                - object
+            - type: object
+              properties:
+                id:
+                  type: string
+                  description: Unique identifier for the event.
+                  example: event_01EHZNVPK3SFK441A1RGBFSHRT
+                event:
+                  type: string
+                  const: agent.instance.created
+                data:
+                  type: object
+                  properties:
+                    object:
+                      type: string
+                      description: Distinguishes the agent instance object.
+                      const: agent_instance
+                    id:
+                      type: string
+                      description: Unique identifier of the agent instance.
+                      example: agent_01EHWNCE74X7JSDV0X3SZ3KJNY
+                    agent_blueprint_id:
+                      type: string
+                      description: The agent blueprint this instance was minted from.
+                      example: agent_blueprint_01EHWNCE74X7JSDV0X3SZ3KJNY
+                    organization_id:
+                      type: string
+                      description: The organization the instance acts within.
+                      example: org_01EHWNCE74X7JSDV0X3SZ3KJNY
+                    organization_membership_id:
+                      type:
+                        - string
+                        - 'null'
+                      description: >-
+                        The organization membership the instance acts on behalf
+                        of; `null` for an autonomous instance.
+                      example: om_01EHWNCE74X7JSDV0X3SZ3KJNY
+                    type:
+                      type: string
+                      enum:
+                        - delegated
+                        - autonomous
+                      description: >-
+                        Whether the instance acts on behalf of a user
+                        (`delegated`) or as itself within an organization
+                        (`autonomous`).
+                    created_at:
+                      type: string
+                      description: The timestamp when the agent instance was created.
+                      example: '2026-01-15T12:00:00.000Z'
+                    updated_at:
+                      type: string
+                      description: The timestamp when the agent instance was last updated.
+                      example: '2026-01-15T12:00:00.000Z'
+                  required:
+                    - object
+                    - id
+                    - agent_blueprint_id
+                    - organization_id
+                    - organization_membership_id
+                    - type
+                    - created_at
+                    - updated_at
+                  description: The event payload.
+                created_at:
+                  format: date-time
+                  type: string
+                  description: An ISO 8601 timestamp.
+                  example: '2026-01-15T12:00:00.000Z'
+                context:
+                  $ref: '#/components/schemas/EventContextDto'
+                object:
+                  type: string
+                  description: Distinguishes the Event object.
+                  const: event
+              required:
+                - id
+                - event
+                - data
+                - created_at
+                - object
+            - type: object
+              properties:
+                id:
+                  type: string
+                  description: Unique identifier for the event.
+                  example: event_01EHZNVPK3SFK441A1RGBFSHRT
+                event:
+                  type: string
+                  const: agent.instance.deleted
+                data:
+                  type: object
+                  properties:
+                    object:
+                      type: string
+                      description: Distinguishes the agent instance object.
+                      const: agent_instance
+                    id:
+                      type: string
+                      description: Unique identifier of the agent instance.
+                      example: agent_01EHWNCE74X7JSDV0X3SZ3KJNY
+                    agent_blueprint_id:
+                      type: string
+                      description: The agent blueprint this instance was minted from.
+                      example: agent_blueprint_01EHWNCE74X7JSDV0X3SZ3KJNY
+                    organization_id:
+                      type: string
+                      description: The organization the instance acts within.
+                      example: org_01EHWNCE74X7JSDV0X3SZ3KJNY
+                    organization_membership_id:
+                      type:
+                        - string
+                        - 'null'
+                      description: >-
+                        The organization membership the instance acts on behalf
+                        of; `null` for an autonomous instance.
+                      example: om_01EHWNCE74X7JSDV0X3SZ3KJNY
+                    type:
+                      type: string
+                      enum:
+                        - delegated
+                        - autonomous
+                      description: >-
+                        Whether the instance acts on behalf of a user
+                        (`delegated`) or as itself within an organization
+                        (`autonomous`).
+                    created_at:
+                      type: string
+                      description: The timestamp when the agent instance was created.
+                      example: '2026-01-15T12:00:00.000Z'
+                    updated_at:
+                      type: string
+                      description: The timestamp when the agent instance was last updated.
+                      example: '2026-01-15T12:00:00.000Z'
+                  required:
+                    - object
+                    - id
+                    - agent_blueprint_id
+                    - organization_id
+                    - organization_membership_id
+                    - type
+                    - created_at
+                    - updated_at
+                  description: The event payload.
+                created_at:
+                  format: date-time
+                  type: string
+                  description: An ISO 8601 timestamp.
+                  example: '2026-01-15T12:00:00.000Z'
+                context:
+                  $ref: '#/components/schemas/EventContextDto'
+                object:
+                  type: string
+                  description: Distinguishes the Event object.
+                  const: event
+              required:
+                - id
+                - event
+                - data
+                - created_at
+                - object
+            - type: object
+              properties:
+                id:
+                  type: string
+                  description: Unique identifier for the event.
+                  example: event_01EHZNVPK3SFK441A1RGBFSHRT
+                event:
+                  type: string
+                  const: agent.instance.session.created
                 data:
                   type: object
                   properties:
                     object:
                       type: string
-                      description: Distinguishes the agent blueprint object.
-                      const: agent_blueprint
+                      description: Distinguishes the agent instance session object.
+                      const: agent_instance_session
                     id:
                       type: string
-                      description: Unique identifier of the agent blueprint.
-                      example: agent_blueprint_01EHWNCE74X7JSDV0X3SZ3KJNY
-                    name:
+                      description: Unique identifier of the agent instance session.
+                      example: agent_session_01EHWNCE74X7JSDV0X3SZ3KJNY
+                    agent_instance_id:
                       type: string
-                      description: Human-readable name of the agent blueprint.
-                      example: Prospecting Agent
-                    description:
+                      description: The agent instance the session belongs to.
+                      example: agent_01EHWNCE74X7JSDV0X3SZ3KJNY
+                    organization_id:
+                      type: string
+                      description: The organization the owning agent instance belongs to.
+                      example: org_01EHWNCE74X7JSDV0X3SZ3KJNY
+                    expires_at:
+                      type: string
+                      description: Timestamp when the session expires.
+                      example: '2026-01-15T13:00:00.000Z'
+                    revoked_at:
                       type:
                         - string
                         - 'null'
-                      description: Human-readable description of the agent blueprint.
-                      example: Finds and qualifies sales prospects.
-                    permissions:
+                      description: >-
+                        Timestamp when the session was revoked; `null` if it has
+                        not been revoked.
+                      example: null
+                    created_at:
+                      type: string
+                      description: The timestamp when the session was created.
+                      example: '2026-01-15T12:00:00.000Z'
+                    updated_at:
+                      type: string
+                      description: The timestamp when the session was last updated.
+                      example: '2026-01-15T12:00:00.000Z'
+                    permission_slugs:
                       type: array
                       items:
                         type: string
+                      description: The permissions granted to the session at mint time.
+                      example:
+                        - crm:read
+                  required:
+                    - object
+                    - id
+                    - agent_instance_id
+                    - organization_id
+                    - expires_at
+                    - revoked_at
+                    - created_at
+                    - updated_at
+                    - permission_slugs
+                  description: The event payload.
+                created_at:
+                  format: date-time
+                  type: string
+                  description: An ISO 8601 timestamp.
+                  example: '2026-01-15T12:00:00.000Z'
+                context:
+                  $ref: '#/components/schemas/EventContextDto'
+                object:
+                  type: string
+                  description: Distinguishes the Event object.
+                  const: event
+              required:
+                - id
+                - event
+                - data
+                - created_at
+                - object
+            - type: object
+              properties:
+                id:
+                  type: string
+                  description: Unique identifier for the event.
+                  example: event_01EHZNVPK3SFK441A1RGBFSHRT
+                event:
+                  type: string
+                  const: agent.instance.session.revoked
+                data:
+                  type: object
+                  properties:
+                    object:
+                      type: string
+                      description: Distinguishes the agent instance session object.
+                      const: agent_instance_session
+                    id:
+                      type: string
+                      description: Unique identifier of the agent instance session.
+                      example: agent_session_01EHWNCE74X7JSDV0X3SZ3KJNY
+                    agent_instance_id:
+                      type: string
+                      description: The agent instance the session belongs to.
+                      example: agent_01EHWNCE74X7JSDV0X3SZ3KJNY
+                    organization_id:
+                      type: string
+                      description: The organization the owning agent instance belongs to.
+                      example: org_01EHWNCE74X7JSDV0X3SZ3KJNY
+                    expires_at:
+                      type: string
+                      description: Timestamp when the session expires.
+                      example: '2026-01-15T13:00:00.000Z'
+                    revoked_at:
+                      type:
+                        - string
+                        - 'null'
                       description: >-
-                        Permission slugs forming the ceiling on what sessions
-                        minted from this blueprint may do.
-                      example: *ref_19
-                    invocable_by:
-                      type: object
-                      properties:
-                        role_slugs:
-                          type: array
-                          items:
-                            type: string
-                          description: >-
-                            Role slugs whose members may mint user-delegated
-                            sessions from this blueprint.
-                          example: *ref_20
-                        organization_ids:
-                          type: array
-                          items:
-                            type: string
-                          description: >-
-                            Organizations in which autonomous sessions may be
-                            minted from this blueprint.
-                          example: *ref_21
-                      required:
-                        - role_slugs
-                        - organization_ids
-                      description: Who may mint sessions from this blueprint.
-                    session_settings:
-                      type: object
-                      properties:
-                        max_age_seconds:
-                          type: number
-                          description: >-
-                            Maximum lifetime of a session in seconds; refreshes
-                            never extend a session past this.
-                          example: 3600
-                        access_token_ttl_seconds:
-                          type: number
-                          description: Lifetime of each minted access token in seconds.
-                          example: 300
-                        refresh_token_ttl_seconds:
-                          type: number
-                          description: Lifetime of each rotated refresh token in seconds.
-                          example: 3600
-                      required:
-                        - max_age_seconds
-                        - access_token_ttl_seconds
-                        - refresh_token_ttl_seconds
-                      description: >-
-                        Token and session lifetimes for sessions minted from
-                        this blueprint.
+                        Timestamp when the session was revoked; `null` if it has
+                        not been revoked.
+                      example: null
                     created_at:
                       type: string
-                      description: The timestamp when the agent blueprint was created.
+                      description: The timestamp when the session was created.
                       example: '2026-01-15T12:00:00.000Z'
                     updated_at:
                       type: string
-                      description: The timestamp when the agent blueprint was last updated.
+                      description: The timestamp when the session was last updated.
                       example: '2026-01-15T12:00:00.000Z'
                   required:
                     - object
                     - id
-                    - name
-                    - description
-                    - permissions
-                    - invocable_by
-                    - session_settings
+                    - agent_instance_id
+                    - organization_id
+                    - expires_at
+                    - revoked_at
                     - created_at
                     - updated_at
                   description: The event payload.
@@ -28545,7 +30848,7 @@ components:
                       items:
                         type: string
                       description: The permissions granted to the API key.
-                      example: &ref_22
+                      example: &ref_26
                         - users:read
                         - users:write
                     created_at:
@@ -28671,7 +30974,7 @@ components:
                       items:
                         type: string
                       description: The permissions granted to the API key.
-                      example: *ref_22
+                      example: *ref_26
                     created_at:
                       type: string
                       description: The timestamp when the API key was created.
@@ -28795,7 +31098,7 @@ components:
                       items:
                         type: string
                       description: The permissions granted to the API key.
-                      example: *ref_22
+                      example: *ref_26
                     created_at:
                       type: string
                       description: The timestamp when the API key was created.
@@ -31662,7 +33965,7 @@ components:
                       description: >-
                         An object containing the custom attribute mapping for
                         the Directory Provider.
-                      example: *ref_23
+                      example: *ref_27
                     role:
                       $ref: '#/components/schemas/SlimRole'
                     roles:
@@ -31852,7 +34155,7 @@ components:
                       description: >-
                         Labels assigned to the Feature Flag for categorizing and
                         filtering.
-                      example: &ref_24
+                      example: &ref_28
                         - reports
                     enabled:
                       type: boolean
@@ -32013,7 +34316,7 @@ components:
                       description: >-
                         Labels assigned to the Feature Flag for categorizing and
                         filtering.
-                      example: *ref_24
+                      example: *ref_28
                     enabled:
                       type: boolean
                       description: >-
@@ -32173,7 +34476,7 @@ components:
                       description: >-
                         Labels assigned to the Feature Flag for categorizing and
                         filtering.
-                      example: *ref_24
+                      example: *ref_28
                     enabled:
                       type: boolean
                       description: >-
@@ -32453,7 +34756,7 @@ components:
                       description: >-
                         Labels assigned to the Feature Flag for categorizing and
                         filtering.
-                      example: *ref_24
+                      example: *ref_28
                     enabled:
                       type: boolean
                       description: >-
@@ -33441,7 +35744,7 @@ components:
                       description: >-
                         Object containing [metadata](/authkit/metadata)
                         key/value pairs associated with the Organization.
-                      example: &ref_25
+                      example: &ref_29
                         tier: diamond
                       propertyNames:
                         maxLength: 40
@@ -33591,7 +35894,7 @@ components:
                       description: >-
                         Object containing [metadata](/authkit/metadata)
                         key/value pairs associated with the Organization.
-                      example: *ref_25
+                      example: *ref_29
                       propertyNames:
                         maxLength: 40
                       maxProperties: 50
@@ -34418,7 +36721,7 @@ components:
                       items:
                         type: string
                       description: The permissions granted by the role.
-                      example: &ref_26
+                      example: &ref_30
                         - users:read
                         - users:write
                     created_at:
@@ -34502,7 +36805,7 @@ components:
                       items:
                         type: string
                       description: The permissions granted by the role.
-                      example: *ref_26
+                      example: *ref_30
                     created_at:
                       format: date-time
                       type: string
@@ -34584,7 +36887,7 @@ components:
                       items:
                         type: string
                       description: The permissions granted by the role.
-                      example: *ref_26
+                      example: *ref_30
                     created_at:
                       format: date-time
                       type: string
@@ -34721,7 +37024,7 @@ components:
                       description: >-
                         Object containing [metadata](/authkit/metadata)
                         key/value pairs associated with the Organization.
-                      example: *ref_25
+                      example: *ref_29
                       propertyNames:
                         maxLength: 40
                       maxProperties: 50
@@ -35588,7 +37891,7 @@ components:
                       items:
                         type: string
                       description: The permissions granted by the role.
-                      example: &ref_27
+                      example: &ref_31
                         - users:read
                         - users:write
                     created_at:
@@ -35654,7 +37957,7 @@ components:
                       items:
                         type: string
                       description: The permissions granted by the role.
-                      example: *ref_27
+                      example: *ref_31
                     created_at:
                       format: date-time
                       type: string
@@ -35718,7 +38021,7 @@ components:
                       items:
                         type: string
                       description: The permissions granted by the role.
-                      example: *ref_27
+                      example: *ref_31
                     created_at:
                       format: date-time
                       type: string
@@ -36858,7 +39161,7 @@ components:
                 - data
                 - created_at
                 - object
-      example: *ref_28
+      example: *ref_32
       description: An event emitted by WorkOS.
     EventList:
       type: object
@@ -36893,7 +39196,7 @@ components:
       example:
         object: list
         data:
-          - *ref_28
+          - *ref_32
         list_metadata:
           after: event_01EHZNVPK3SFK441A1RGBFSHRT
     JwtTemplate:
@@ -39022,6 +41325,169 @@ components:
         - default
         - created_at
         - updated_at
+    SamlIdpSigningCertificate:
+      type: object
+      properties:
+        object:
+          type: string
+          description: Distinguishes the SAML Identity Provider signing certificate object.
+          const: saml_idp_signing_certificate
+        id:
+          type: string
+          description: Unique identifier for the Identity Provider signing certificate.
+          example: saml_x509_cert_01E4ZCR3C56J083X43JQXF3JK5
+        value:
+          type: string
+          description: The PEM-encoded public X.509 certificate.
+          example: '-----BEGIN CERTIFICATE-----MIIC...-----END CERTIFICATE-----'
+        not_before:
+          format: date-time
+          type:
+            - string
+            - 'null'
+          description: When the certificate becomes valid.
+          example: '2026-01-15T12:00:00.000Z'
+        not_after:
+          format: date-time
+          type:
+            - string
+            - 'null'
+          description: When the certificate expires.
+          example: '2026-01-15T12:00:00.000Z'
+        created_at:
+          format: date-time
+          type: string
+          description: An ISO 8601 timestamp.
+          example: '2026-01-15T12:00:00.000Z'
+      required:
+        - object
+        - id
+        - value
+        - not_before
+        - not_after
+        - created_at
+    SamlIdpSigningCertificateList:
+      type: object
+      properties:
+        object:
+          type: string
+          example: list
+          const: list
+        data:
+          type: array
+          items:
+            $ref: '#/components/schemas/SamlIdpSigningCertificate'
+          description: >-
+            Every Identity Provider signing certificate on the Connection,
+            including expired ones, oldest first.
+      required:
+        - object
+        - data
+    SamlSpEncryptionCertificate:
+      type: object
+      properties:
+        object:
+          type: string
+          description: >-
+            Distinguishes the SAML Service Provider encryption certificate
+            object.
+          const: saml_sp_encryption_certificate
+        id:
+          type: string
+          description: >-
+            Unique identifier for the Service Provider encryption key pair.
+            WorkOS holds the corresponding private key, which is never exposed.
+          example: saml_enc_key_pair_01E4ZCR3C56J083X43JQXF3JK5
+        value:
+          type: string
+          description: The PEM-encoded public X.509 certificate.
+          example: '-----BEGIN CERTIFICATE-----MIIC...-----END CERTIFICATE-----'
+        not_before:
+          format: date-time
+          type:
+            - string
+            - 'null'
+          description: When the certificate becomes valid.
+          example: '2026-01-15T12:00:00.000Z'
+        not_after:
+          format: date-time
+          type:
+            - string
+            - 'null'
+          description: When the certificate expires.
+          example: '2026-01-15T12:00:00.000Z'
+        created_at:
+          format: date-time
+          type: string
+          description: An ISO 8601 timestamp.
+          example: '2026-01-15T12:00:00.000Z'
+      required:
+        - object
+        - id
+        - value
+        - not_before
+        - not_after
+        - created_at
+    SamlSpEncryptionCertificateList:
+      type: object
+      properties:
+        object:
+          type: string
+          example: list
+          const: list
+        data:
+          type: array
+          items:
+            $ref: '#/components/schemas/SamlSpEncryptionCertificate'
+          description: >-
+            Every Service Provider encryption certificate on the Connection,
+            including expired ones.
+      required:
+        - object
+        - data
+    SamlSpSigningCertificate:
+      type: object
+      properties:
+        object:
+          type: string
+          description: Distinguishes the SAML Service Provider signing certificate object.
+          const: saml_sp_signing_certificate
+        id:
+          type: string
+          description: >-
+            Unique identifier for the Service Provider signing key pair. WorkOS
+            holds the corresponding private key, which is never exposed.
+          example: saml_party_trust_01E4ZCR3C56J083X43JQXF3JK5
+        value:
+          type: string
+          description: The PEM-encoded public X.509 certificate.
+          example: '-----BEGIN CERTIFICATE-----MIIC...-----END CERTIFICATE-----'
+        not_before:
+          format: date-time
+          type:
+            - string
+            - 'null'
+          description: When the certificate becomes valid.
+          example: '2026-01-15T12:00:00.000Z'
+        not_after:
+          format: date-time
+          type:
+            - string
+            - 'null'
+          description: When the certificate expires.
+          example: '2026-01-15T12:00:00.000Z'
+        created_at:
+          format: date-time
+          type: string
+          description: An ISO 8601 timestamp.
+          example: '2026-01-15T12:00:00.000Z'
+      required:
+        - object
+        - id
+        - value
+        - not_before
+        - not_after
+        - created_at
     Team:
       type: object
       properties: