@workos/openapi-spec 0.69.0 → 0.70.0

package/dist/types.d.ts

@@ -1042,13 +1042,149 @@ export interface paths {
          */
         get: operations["ConnectionsController_list"];
         put?: never;
+        /**
+         * Create a Connection
+         * @description Creates a new connection for an organization. Provide `saml_options` or `oidc_options` to configure the identity provider. When `external_id` matches an existing connection in the organization, that connection is returned instead of creating a duplicate.
+         */
+        post: operations["ConnectionsController_create"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/connections/{connectionId}/saml_idp_signing_certs": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List IdP signing certificates
+         * @description Lists every Identity Provider signing certificate on the connection, including expired ones, oldest first.
+         */
+        get: operations["SamlIdpSigningCertificatesController_list"];
+        put?: never;
+        /**
+         * Create an IdP signing certificate
+         * @description Adds an Identity Provider signing certificate to the connection, so SAML responses signed with its key can be verified. Use this to import a new certificate ahead of an Identity Provider rotation — the existing certificates keep working until they are deleted or expire.
+         */
+        post: operations["SamlIdpSigningCertificatesController_create"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/connections/{connectionId}/saml_idp_signing_certs/{certificateId}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
         post?: never;
+        /**
+         * Delete an IdP signing certificate
+         * @description Removes an Identity Provider signing certificate from the connection. The last remaining certificate cannot be deleted. A certificate still published in the Identity Provider metadata may be restored by a metadata refresh.
+         */
+        delete: operations["SamlIdpSigningCertificatesController_delete"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/connections/{connectionId}/saml_sp_encryption_certs": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List SP encryption certificates
+         * @description Lists the public certificates the Identity Provider can use to encrypt SAML responses sent to WorkOS, including expired ones, oldest first.
+         */
+        get: operations["SamlSpEncryptionCertificatesController_list"];
+        put?: never;
+        /**
+         * Create an SP encryption certificate
+         * @description Generates a new encryption key pair for the connection and returns its public certificate. WorkOS holds the private key, so the request takes no body — to bring your own key pairs, provide `saml_options.sp_encryption_key_pairs` when creating the connection instead. Creating a certificate appends rather than replaces: every active private key is tried when decrypting, which lets a rotation overlap the old and new certificates.
+         */
+        post: operations["SamlSpEncryptionCertificatesController_create"];
         delete?: never;
         options?: never;
         head?: never;
         patch?: never;
         trace?: never;
     };
+    "/connections/{connectionId}/saml_sp_encryption_certs/{certificateId}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /**
+         * Delete an SP encryption certificate
+         * @description Removes an encryption key pair from the connection. SAML responses encrypted with its certificate can no longer be decrypted, so remove the certificate from the Identity Provider first when rotating.
+         */
+        delete: operations["SamlSpEncryptionCertificatesController_delete"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/connections/{connectionId}/saml_sp_signing_cert": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get the SP signing certificate
+         * @description Returns the public certificate the Identity Provider can use to verify the signature of SAML requests sent by WorkOS. Responds with `404` when the connection has no request signing key pair.
+         */
+        get: operations["SamlSpSigningCertificatesController_get"];
+        put?: never;
+        /**
+         * Create an SP signing certificate
+         * @description Generates a new request signing key pair for the connection and returns its public certificate. WorkOS holds the private key, so the request takes no body — to bring your own key pair, provide `saml_options.sp_signing_key_pair` when creating the connection instead. A connection signs with one key pair at a time: delete the existing certificate before creating its replacement.
+         */
+        post: operations["SamlSpSigningCertificatesController_create"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/connections/{connectionId}/saml_sp_signing_cert/{certificateId}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /**
+         * Delete the SP signing certificate
+         * @description Removes the request signing key pair from the connection, after which SAML requests are sent unsigned. Delete the certificate before creating its replacement when rotating.
+         */
+        delete: operations["SamlSpSigningCertificatesController_delete"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/connections/{id}": {
         parameters: {
             query?: never;
@@ -1070,7 +1206,11 @@ export interface paths {
         delete: operations["ConnectionsController_delete"];
         options?: never;
         head?: never;
-        patch?: never;
+        /**
+         * Update a Connection
+         * @description Updates an existing connection. Only the provided fields are changed; fields that accept `null` are reset to their default behavior.
+         */
+        patch: operations["ConnectionsController_patch"];
         trace?: never;
     };
     "/data-integrations": {
@@ -3147,7 +3287,7 @@ export interface paths {
         post?: never;
         /**
          * Delete a waitlist entry
-         * @description Removes the entry from the waitlist. An invitation created by approving the entry stays valid, so revoke that invitation to withdraw access.
+         * @description Remove the entry from the waitlist. Its email address can join again unless a user with that email now exists in the environment. Deleting the entry does not revoke an invitation created by approving it — [revoke that invitation](/reference/authkit/invitation/revoke) separately to withdraw access.
          */
         delete: operations["WaitlistEntriesController_delete"];
         options?: never;
@@ -3166,7 +3306,11 @@ export interface paths {
         put?: never;
         /**
          * Approve a waitlist entry
-         * @description Approve a waitlist entry and send the resulting user invitation email. Also reverses a denial: a denied entry can be approved.
+         * @description Approve a waitlist entry, create an invitation for its email address, and send the invitation email. Approving a denied entry reverses the denial. The approval is saved even when the invitation steps fail, so instead of retrying the approval, recover based on the outcome:
+         *
+         *     - `200` — the entry is approved. If invitation creation failed, no invitation exists yet; [send](/reference/authkit/invitation/send) one.
+         *     - `422` with code `invitation_email_not_sent` — the entry is approved and an invitation exists, but its email was not sent; [resend](/reference/authkit/invitation/resend) it.
+         *     - `422` with code `invalid_state` — the entry was already approved.
          */
         post: operations["WaitlistEntriesController_approve"];
         delete?: never;
@@ -3186,7 +3330,7 @@ export interface paths {
         put?: never;
         /**
          * Deny a waitlist entry
-         * @description Deny a pending waitlist entry. A denial can be reversed by approving the entry.
+         * @description Deny a pending waitlist entry. Denying an entry that is not pending fails with the code `invalid_state`. A denial can be reversed by approving the entry.
          */
         post: operations["WaitlistEntriesController_deny"];
         delete?: never;
@@ -3204,7 +3348,7 @@ export interface paths {
         };
         /**
          * List waitlists
-         * @description Get a list of the waitlists in the environment.
+         * @description Get a list of the waitlists in the environment. All waitlists are returned in a single response — this endpoint is not paginated, so the `list_metadata` cursors are always `null`.
          */
         get: operations["WaitlistsController_list"];
         put?: never;
@@ -3250,7 +3394,7 @@ export interface paths {
         put?: never;
         /**
          * Create a waitlist entry
-         * @description Add an email address to the waitlist. Creating an entry is idempotent per email address: a request for an email address already on the waitlist returns the existing entry.
+         * @description Add an email address to the waitlist. Email addresses are normalized and unique per environment: a request for an email address already on the waitlist returns the existing entry unchanged (still with status `201`) and does not send another confirmation email. If a user with the email address already exists in the environment, the request fails with the code `user_already_exists`.
          */
         post: operations["WaitlistsController_createEntry"];
         delete?: never;
@@ -4297,6 +4441,334 @@ export interface components {
              */
             parent_resource_type_slug: string;
         });
+        CreateConnectionKeyPairDto: {
+            /**
+             * @description The PEM-encoded private key.
+             * @example -----BEGIN PRIVATE KEY-----
+             *     MIIE...
+             *     -----END PRIVATE KEY-----
+             */
+            key: string;
+            /**
+             * @description The PEM-encoded X.509 certificate for the key.
+             * @example -----BEGIN CERTIFICATE-----
+             *     MIIC...
+             *     -----END CERTIFICATE-----
+             */
+            cert: string;
+        };
+        CreateConnectionSamlOptionsDto: {
+            /**
+             * Format: uri
+             * @description The Identity Provider metadata URL. When provided, the IdP fields and signing certificates are imported from the metadata document. Mutually exclusive with the manual IdP fields.
+             * @example https://idp.example.com/metadata.xml
+             */
+            idp_metadata_url?: string;
+            /**
+             * Format: uri
+             * @description A custom Assertion Consumer Service (ACS) URL override. When omitted, the standard WorkOS-generated ACS URL is used.
+             * @example https://example.auth0.com/login/callback?connection=123
+             */
+            acs_url?: string;
+            /**
+             * @description A custom Service Provider Entity ID (audience) override. When omitted, the connection external key is used.
+             * @example https://example.auth0.com/login/callback?connection=123
+             */
+            sp_entity_id?: string;
+            /**
+             * @description The Identity Provider Entity ID.
+             * @example https://idp.example.com/entity
+             */
+            idp_entity_id?: string;
+            /**
+             * Format: uri
+             * @description The Identity Provider SSO URL. Required when configuring the connection with manual IdP fields.
+             * @example https://idp.example.com/sso
+             */
+            idp_sso_url?: string;
+            /**
+             * @description The X.509 certificates used to verify signed SAML responses from the Identity Provider. Required when configuring the connection with manual IdP fields.
+             * @example [
+             *       "-----BEGIN CERTIFICATE-----\nMIIC...\n-----END CERTIFICATE-----"
+             *     ]
+             */
+            idp_signing_certs?: string[];
+            /** @description The customer-owned key pair used to sign SAML requests sent to the Identity Provider. When omitted, WorkOS generates and manages the signing key pair. */
+            sp_signing_key_pair?: components["schemas"]["CreateConnectionKeyPairDto"];
+            /** @description The customer-owned key pairs used to decrypt encrypted SAML responses from the Identity Provider. When omitted, WorkOS generates and manages the encryption key pair. */
+            sp_encryption_key_pairs?: components["schemas"]["CreateConnectionKeyPairDto"][];
+        };
+        CreateConnectionOidcOptionsDto: {
+            /**
+             * Format: uri
+             * @description The OIDC discovery endpoint.
+             * @example https://idp.example.com/.well-known/openid-configuration
+             */
+            discovery_endpoint: string;
+            /**
+             * @description The OIDC client ID.
+             * @example client_123
+             */
+            client_id: string;
+            /**
+             * @description The OIDC client secret. Required for `client_secret_basic` and `client_secret_post`, and rejected for `private_key_jwt`, which authenticates with a key pair instead. This value is write-only and is never returned.
+             * @example secret_xyz
+             */
+            client_secret?: string;
+            /**
+             * Format: uri
+             * @description A custom OAuth callback URL override. When omitted, the standard WorkOS-generated redirect URI is used.
+             * @example https://auth.workos.com/sso/oidc/conn_externalkey/callback
+             */
+            redirect_uri?: string;
+            /**
+             * @description Whether PKCE is enabled for the connection.
+             * @default true
+             * @example true
+             */
+            pkce: boolean;
+            /**
+             * @description The token-endpoint client authentication method.
+             * @default client_secret_basic
+             * @example client_secret_basic
+             * @enum {string}
+             */
+            token_authentication_method: "client_secret_post" | "client_secret_basic" | "private_key_jwt";
+            /** @description A key pair for WorkOS to sign `private_key_jwt` client assertions with. Only accepted when `token_authentication_method` is `private_key_jwt`; when omitted, WorkOS generates one and returns its certificate in `oidc_options.jwt_signing_certs`. */
+            jwt_signing_key_pair?: components["schemas"]["CreateConnectionKeyPairDto"];
+            /**
+             * @description The ID-token signing algorithm.
+             * @example RS256
+             * @enum {string}
+             */
+            id_token_signature_algorithm?: "ES256" | "ES384" | "ES512" | "EdDSA" | "HS256" | "HS384" | "HS512" | "PS256" | "PS384" | "PS512" | "RS256" | "RS384" | "RS512";
+            /**
+             * @description Whether to fetch additional profile attributes from the userinfo endpoint.
+             * @example false
+             */
+            fetch_user_info?: boolean;
+        };
+        CreateConnectionStandardAttributesDto: {
+            /**
+             * @description The IdP attribute or claim the profile's `idp_id` is mapped from. When omitted, the default for the connection type is used.
+             * @example sub
+             */
+            idp_id?: string;
+            /**
+             * @description The IdP attribute or claim the profile's `email` is mapped from. When omitted, the default for the connection type is used.
+             * @example email
+             */
+            email?: string;
+            /**
+             * @description The IdP attribute or claim the profile's `first_name` is mapped from. When omitted, the default for the connection type is used.
+             * @example given_name
+             */
+            first_name?: string;
+            /**
+             * @description The IdP attribute or claim the profile's `last_name` is mapped from. When omitted, the default for the connection type is used.
+             * @example family_name
+             */
+            last_name?: string;
+            /**
+             * @description The IdP attribute or claim the profile's `groups` are mapped from. `null` leaves the mapping unset.
+             * @example memberOf
+             */
+            groups?: string | null;
+            /**
+             * @description The IdP attribute or claim the profile's `name` is mapped from. `null` leaves the mapping unset.
+             * @example displayName
+             */
+            name?: string | null;
+        };
+        CreateConnectionAttributeMapsDto: {
+            /** @description How IdP attributes or claims map onto the standard WorkOS profile fields. Provided fields override the defaults for the connection type. */
+            standard_attributes?: components["schemas"]["CreateConnectionStandardAttributesDto"];
+            /**
+             * @description How IdP attributes or claims map onto custom attributes, keyed by custom attribute name. Custom attributes must already be defined in the WorkOS dashboard.
+             * @example {
+             *       "company": "company_claim"
+             *     }
+             */
+            custom_attributes?: {
+                [key: string]: string;
+            };
+        };
+        CreateConnectionDto: {
+            /**
+             * @description Unique identifier for the Organization in which the Connection resides.
+             * @example org_01EHWNCE74X7JSDV0X3SZ3KJNY
+             */
+            organization_id: string;
+            /**
+             * @description A human-readable name for the Connection. This will most commonly be the organization's name.
+             * @example Foo Corp
+             */
+            name?: string;
+            /**
+             * @description The customer-owned identifier for the Connection.
+             * @example acme-legacy-conn-42
+             */
+            external_id?: string;
+            /**
+             * @description The type of the Connection. Only SAML and OIDC connection types may be created. When omitted, the type is inferred from the provided options.
+             * @example OktaSAML
+             */
+            connection_type?: string;
+            /** @description How IdP attributes or claims map onto WorkOS profile fields. Provided fields override the defaults for the connection type. */
+            attribute_maps?: components["schemas"]["CreateConnectionAttributeMapsDto"];
+        } & ({
+            /** @description Protocol configuration for SAML connections. Mutually exclusive with `oidc_options`. */
+            saml_options: components["schemas"]["CreateConnectionSamlOptionsDto"];
+        } | {
+            /** @description Protocol configuration for OIDC connections. Mutually exclusive with `saml_options`. */
+            oidc_options: components["schemas"]["CreateConnectionOidcOptionsDto"];
+        });
+        PatchConnectionSamlOptionsDto: {
+            /**
+             * Format: uri
+             * @description The Identity Provider metadata URL. When provided, the IdP fields and signing certificates are re-imported from the metadata document, replacing the current set. Mutually exclusive with the manual IdP fields. Set to `null` to stop tracking a metadata URL.
+             * @example https://idp.example.com/metadata.xml
+             */
+            idp_metadata_url?: string | null;
+            /**
+             * Format: uri
+             * @description A custom Assertion Consumer Service (ACS) URL override. Set to `null` to revert to the standard WorkOS-generated ACS URL.
+             * @example https://example.auth0.com/login/callback?connection=123
+             */
+            acs_url?: string | null;
+            /**
+             * @description A custom Service Provider Entity ID (audience) override. Set to `null` to revert to the connection external key.
+             * @example https://example.auth0.com/login/callback?connection=123
+             */
+            sp_entity_id?: string | null;
+            /**
+             * @description The Identity Provider Entity ID.
+             * @example https://idp.example.com/entity
+             */
+            idp_entity_id?: string;
+            /**
+             * Format: uri
+             * @description The Identity Provider SSO URL.
+             * @example https://idp.example.com/sso
+             */
+            idp_sso_url?: string;
+        };
+        PatchConnectionOidcOptionsDto: {
+            /**
+             * Format: uri
+             * @description The OIDC discovery endpoint.
+             * @example https://idp.example.com/.well-known/openid-configuration
+             */
+            discovery_endpoint?: string;
+            /**
+             * @description The OIDC client ID.
+             * @example client_123
+             */
+            client_id?: string;
+            /**
+             * @description The OIDC client secret. Required when moving the connection to `client_secret_basic` or `client_secret_post`, and rejected for `private_key_jwt`, which authenticates with a key pair instead. This value is write-only and is never returned.
+             * @example secret_xyz
+             */
+            client_secret?: string;
+            /**
+             * Format: uri
+             * @description A custom OAuth callback URL override. Set to `null` to revert to the standard WorkOS-generated redirect URI.
+             * @example https://auth.workos.com/sso/oidc/conn_externalkey/callback
+             */
+            redirect_uri?: string | null;
+            /**
+             * @description Whether PKCE is enabled for the connection.
+             * @example true
+             */
+            pkce?: boolean;
+            /**
+             * @description The token-endpoint client authentication method. Moving to `private_key_jwt` generates a signing key pair if the connection has none; its certificate is returned in `oidc_options.jwt_signing_certs` and must be registered at the Identity Provider.
+             * @example client_secret_basic
+             * @enum {string}
+             */
+            token_authentication_method?: "client_secret_post" | "client_secret_basic" | "private_key_jwt";
+            /**
+             * @description The ID-token signing algorithm.
+             * @example RS256
+             * @enum {string}
+             */
+            id_token_signature_algorithm?: "ES256" | "ES384" | "ES512" | "EdDSA" | "HS256" | "HS384" | "HS512" | "PS256" | "PS384" | "PS512" | "RS256" | "RS384" | "RS512";
+            /**
+             * @description Whether to fetch additional profile attributes from the userinfo endpoint.
+             * @example false
+             */
+            fetch_user_info?: boolean;
+        };
+        PatchConnectionStandardAttributesDto: {
+            /**
+             * @description The IdP attribute or claim the profile's `idp_id` is mapped from.
+             * @example sub
+             */
+            idp_id?: string;
+            /**
+             * @description The IdP attribute or claim the profile's `email` is mapped from.
+             * @example email
+             */
+            email?: string;
+            /**
+             * @description The IdP attribute or claim the profile's `first_name` is mapped from.
+             * @example given_name
+             */
+            first_name?: string;
+            /**
+             * @description The IdP attribute or claim the profile's `last_name` is mapped from.
+             * @example family_name
+             */
+            last_name?: string;
+            /**
+             * @description The IdP attribute or claim the profile's `groups` are mapped from. Set to `null` to unset the mapping.
+             * @example memberOf
+             */
+            groups?: string | null;
+            /**
+             * @description The IdP attribute or claim the profile's `name` is mapped from. Set to `null` to unset the mapping.
+             * @example displayName
+             */
+            name?: string | null;
+        };
+        PatchConnectionAttributeMapsDto: {
+            /** @description How IdP attributes or claims map onto the standard WorkOS profile fields. Only the provided fields are updated. */
+            standard_attributes?: components["schemas"]["PatchConnectionStandardAttributesDto"];
+            /**
+             * @description How IdP attributes or claims map onto custom attributes, keyed by custom attribute name. Custom attributes must already be defined in the WorkOS dashboard. Only the provided keys are updated; a `null` value unsets that mapping.
+             * @example {
+             *       "company": "company_claim"
+             *     }
+             */
+            custom_attributes?: {
+                [key: string]: string | null;
+            };
+        };
+        PatchConnectionDto: {
+            /**
+             * @description A human-readable name for the Connection.
+             * @example Foo Corp
+             */
+            name?: string;
+            /**
+             * @description The customer-owned identifier for the Connection. Set to `null` to stop tracking one.
+             * @example acme-legacy-conn-42
+             */
+            external_id?: string | null;
+            /**
+             * @description The type of the Connection. Immutable after creation — it may be sent, but only with the Connection current type.
+             * @example OktaSAML
+             */
+            connection_type?: string;
+            /** @description How IdP attributes or claims map onto WorkOS profile fields. Only the provided fields are updated. */
+            attribute_maps?: components["schemas"]["PatchConnectionAttributeMapsDto"];
+        } & (Record<string, never> | {
+            /** @description Protocol configuration for SAML connections. Only the provided fields are updated. Mutually exclusive with `oidc_options`. */
+            saml_options: components["schemas"]["PatchConnectionSamlOptionsDto"];
+        } | {
+            /** @description Protocol configuration for OIDC connections. Only the provided fields are updated. Mutually exclusive with `saml_options`. */
+            oidc_options: components["schemas"]["PatchConnectionOidcOptionsDto"];
+        });
         CreateCorsOriginDto: {
             /**
              * @description The origin URL to allow for CORS requests.
@@ -4824,6 +5296,13 @@ export interface components {
              */
             uri: string;
         };
+        CreateSamlIdpSigningCertificateDto: {
+            /**
+             * @description The PEM-encoded X.509 certificate.
+             * @example -----BEGIN CERTIFICATE-----MIIC...-----END CERTIFICATE-----
+             */
+            value: string;
+        };
         CreateTeamDto: {
             /**
              * Format: email
@@ -5210,7 +5689,7 @@ export interface components {
              */
             email: string;
             /**
-             * @description Object containing additional key/value pairs collected with the waitlist entry. Values are user-provided — treat them as untrusted input when rendering or exporting.
+             * @description Object containing additional key/value pairs collected with the waitlist entry. Supports up to 50 string pairs, with keys up to 40 characters and values up to 600 characters. Values are user-provided — treat them as untrusted input when rendering or exporting.
              * @example {
              *       "company": "Example Corp"
              *     }
@@ -5238,7 +5717,7 @@ export interface components {
              *       "dsync.user.created"
              *     ]
              */
-            events: ("agent.blueprint.created" | "agent.blueprint.deleted" | "agent.blueprint.updated" | "agent.registration.created" | "agent.registration.claim.attempt.created" | "agent.registration.claim.completed" | "agent.registration.credential.issued" | "agent.registration.deleted" | "agent.registration.refreshed" | "agent.registration.expired" | "agent.registration.organization.switched" | "agent.registration.revoked" | "authentication.email_verification_succeeded" | "authentication.magic_auth_failed" | "authentication.magic_auth_succeeded" | "authentication.mfa_succeeded" | "authentication.oauth_failed" | "authentication.oauth_succeeded" | "authentication.password_failed" | "authentication.password_succeeded" | "authentication.passkey_failed" | "authentication.passkey_succeeded" | "authentication.sso_failed" | "authentication.sso_started" | "authentication.sso_succeeded" | "authentication.sso_timed_out" | "radar.challenge_created" | "authentication.radar_risk_detected" | "authentication.reauthentication_succeeded" | "api_key.created" | "api_key.revoked" | "api_key.updated" | "connection.activated" | "connection.deactivated" | "connection.saml_certificate_renewal_required" | "connection.saml_certificate_renewed" | "connection.deleted" | "dsync.activated" | "dsync.deleted" | "dsync.group.created" | "dsync.group.deleted" | "dsync.group.updated" | "dsync.group.user_added" | "dsync.group.user_removed" | "dsync.user.created" | "dsync.user.deleted" | "dsync.user.updated" | "email_verification.created" | "group.created" | "group.deleted" | "group.member_added" | "group.member_removed" | "group.updated" | "flag.created" | "flag.deleted" | "flag.updated" | "flag.rule_updated" | "invitation.accepted" | "invitation.created" | "invitation.resent" | "invitation.revoked" | "magic_auth.created" | "organization.created" | "organization.deleted" | "organization.updated" | "organization_domain.created" | "organization_domain.deleted" | "organization_domain.updated" | "organization_domain.verified" | "organization_domain.verification_failed" | "password_reset.created" | "password_reset.succeeded" | "user.created" | "user.updated" | "user.deleted" | "organization_membership.created" | "organization_membership.deleted" | "organization_membership.updated" | "role.created" | "role.deleted" | "role.updated" | "organization_role.created" | "organization_role.deleted" | "organization_role.updated" | "permission.created" | "permission.deleted" | "permission.updated" | "pipes.connected_account.connected" | "pipes.connected_account.connection_failed" | "pipes.connected_account.disconnected" | "pipes.connected_account.reauthorization_needed" | "session.created" | "session.revoked" | "waitlist_user.approved" | "waitlist_user.created" | "waitlist_user.denied")[];
+            events: ("agent.blueprint.created" | "agent.blueprint.deleted" | "agent.blueprint.updated" | "agent.instance.created" | "agent.instance.deleted" | "agent.instance.session.created" | "agent.instance.session.revoked" | "agent.registration.created" | "agent.registration.claim.attempt.created" | "agent.registration.claim.completed" | "agent.registration.credential.issued" | "agent.registration.deleted" | "agent.registration.refreshed" | "agent.registration.expired" | "agent.registration.organization.switched" | "agent.registration.revoked" | "authentication.email_verification_succeeded" | "authentication.magic_auth_failed" | "authentication.magic_auth_succeeded" | "authentication.mfa_succeeded" | "authentication.oauth_failed" | "authentication.oauth_succeeded" | "authentication.password_failed" | "authentication.password_succeeded" | "authentication.passkey_failed" | "authentication.passkey_succeeded" | "authentication.sso_failed" | "authentication.sso_started" | "authentication.sso_succeeded" | "authentication.sso_timed_out" | "radar.challenge_created" | "authentication.radar_risk_detected" | "authentication.reauthentication_succeeded" | "api_key.created" | "api_key.revoked" | "api_key.updated" | "connection.activated" | "connection.deactivated" | "connection.saml_certificate_renewal_required" | "connection.saml_certificate_renewed" | "connection.deleted" | "dsync.activated" | "dsync.deleted" | "dsync.group.created" | "dsync.group.deleted" | "dsync.group.updated" | "dsync.group.user_added" | "dsync.group.user_removed" | "dsync.user.created" | "dsync.user.deleted" | "dsync.user.updated" | "email_verification.created" | "group.created" | "group.deleted" | "group.member_added" | "group.member_removed" | "group.updated" | "flag.created" | "flag.deleted" | "flag.updated" | "flag.rule_updated" | "invitation.accepted" | "invitation.created" | "invitation.resent" | "invitation.revoked" | "magic_auth.created" | "organization.created" | "organization.deleted" | "organization.updated" | "organization_domain.created" | "organization_domain.deleted" | "organization_domain.updated" | "organization_domain.verified" | "organization_domain.verification_failed" | "password_reset.created" | "password_reset.succeeded" | "user.created" | "user.updated" | "user.deleted" | "organization_membership.created" | "organization_membership.deleted" | "organization_membership.updated" | "role.created" | "role.deleted" | "role.updated" | "organization_role.created" | "organization_role.deleted" | "organization_role.updated" | "permission.created" | "permission.deleted" | "permission.updated" | "pipes.connected_account.connected" | "pipes.connected_account.connection_failed" | "pipes.connected_account.disconnected" | "pipes.connected_account.reauthorization_needed" | "session.created" | "session.revoked" | "waitlist_user.approved" | "waitlist_user.created" | "waitlist_user.denied")[];
         };
         UpdateWebhookEndpointDto: {
             /**
@@ -5259,7 +5738,7 @@ export interface components {
              *       "dsync.user.created"
              *     ]
              */
-            events?: ("agent.blueprint.created" | "agent.blueprint.deleted" | "agent.blueprint.updated" | "agent.registration.created" | "agent.registration.claim.attempt.created" | "agent.registration.claim.completed" | "agent.registration.credential.issued" | "agent.registration.deleted" | "agent.registration.refreshed" | "agent.registration.expired" | "agent.registration.organization.switched" | "agent.registration.revoked" | "authentication.email_verification_succeeded" | "authentication.magic_auth_failed" | "authentication.magic_auth_succeeded" | "authentication.mfa_succeeded" | "authentication.oauth_failed" | "authentication.oauth_succeeded" | "authentication.password_failed" | "authentication.password_succeeded" | "authentication.passkey_failed" | "authentication.passkey_succeeded" | "authentication.sso_failed" | "authentication.sso_started" | "authentication.sso_succeeded" | "authentication.sso_timed_out" | "radar.challenge_created" | "authentication.radar_risk_detected" | "authentication.reauthentication_succeeded" | "api_key.created" | "api_key.revoked" | "api_key.updated" | "connection.activated" | "connection.deactivated" | "connection.saml_certificate_renewal_required" | "connection.saml_certificate_renewed" | "connection.deleted" | "dsync.activated" | "dsync.deleted" | "dsync.group.created" | "dsync.group.deleted" | "dsync.group.updated" | "dsync.group.user_added" | "dsync.group.user_removed" | "dsync.user.created" | "dsync.user.deleted" | "dsync.user.updated" | "email_verification.created" | "group.created" | "group.deleted" | "group.member_added" | "group.member_removed" | "group.updated" | "flag.created" | "flag.deleted" | "flag.updated" | "flag.rule_updated" | "invitation.accepted" | "invitation.created" | "invitation.resent" | "invitation.revoked" | "magic_auth.created" | "organization.created" | "organization.deleted" | "organization.updated" | "organization_domain.created" | "organization_domain.deleted" | "organization_domain.updated" | "organization_domain.verified" | "organization_domain.verification_failed" | "password_reset.created" | "password_reset.succeeded" | "user.created" | "user.updated" | "user.deleted" | "organization_membership.created" | "organization_membership.deleted" | "organization_membership.updated" | "role.created" | "role.deleted" | "role.updated" | "organization_role.created" | "organization_role.deleted" | "organization_role.updated" | "permission.created" | "permission.deleted" | "permission.updated" | "pipes.connected_account.connected" | "pipes.connected_account.connection_failed" | "pipes.connected_account.disconnected" | "pipes.connected_account.reauthorization_needed" | "session.created" | "session.revoked" | "waitlist_user.approved" | "waitlist_user.created" | "waitlist_user.denied")[];
+            events?: ("agent.blueprint.created" | "agent.blueprint.deleted" | "agent.blueprint.updated" | "agent.instance.created" | "agent.instance.deleted" | "agent.instance.session.created" | "agent.instance.session.revoked" | "agent.registration.created" | "agent.registration.claim.attempt.created" | "agent.registration.claim.completed" | "agent.registration.credential.issued" | "agent.registration.deleted" | "agent.registration.refreshed" | "agent.registration.expired" | "agent.registration.organization.switched" | "agent.registration.revoked" | "authentication.email_verification_succeeded" | "authentication.magic_auth_failed" | "authentication.magic_auth_succeeded" | "authentication.mfa_succeeded" | "authentication.oauth_failed" | "authentication.oauth_succeeded" | "authentication.password_failed" | "authentication.password_succeeded" | "authentication.passkey_failed" | "authentication.passkey_succeeded" | "authentication.sso_failed" | "authentication.sso_started" | "authentication.sso_succeeded" | "authentication.sso_timed_out" | "radar.challenge_created" | "authentication.radar_risk_detected" | "authentication.reauthentication_succeeded" | "api_key.created" | "api_key.revoked" | "api_key.updated" | "connection.activated" | "connection.deactivated" | "connection.saml_certificate_renewal_required" | "connection.saml_certificate_renewed" | "connection.deleted" | "dsync.activated" | "dsync.deleted" | "dsync.group.created" | "dsync.group.deleted" | "dsync.group.updated" | "dsync.group.user_added" | "dsync.group.user_removed" | "dsync.user.created" | "dsync.user.deleted" | "dsync.user.updated" | "email_verification.created" | "group.created" | "group.deleted" | "group.member_added" | "group.member_removed" | "group.updated" | "flag.created" | "flag.deleted" | "flag.updated" | "flag.rule_updated" | "invitation.accepted" | "invitation.created" | "invitation.resent" | "invitation.revoked" | "magic_auth.created" | "organization.created" | "organization.deleted" | "organization.updated" | "organization_domain.created" | "organization_domain.deleted" | "organization_domain.updated" | "organization_domain.verified" | "organization_domain.verification_failed" | "password_reset.created" | "password_reset.succeeded" | "user.created" | "user.updated" | "user.deleted" | "organization_membership.created" | "organization_membership.deleted" | "organization_membership.updated" | "role.created" | "role.deleted" | "role.updated" | "organization_role.created" | "organization_role.deleted" | "organization_role.updated" | "permission.created" | "permission.deleted" | "permission.updated" | "pipes.connected_account.connected" | "pipes.connected_account.connection_failed" | "pipes.connected_account.disconnected" | "pipes.connected_account.reauthorization_needed" | "session.created" | "session.revoked" | "waitlist_user.approved" | "waitlist_user.created" | "waitlist_user.denied")[];
         };
         WidgetSessionTokenDto: {
             /**
@@ -8434,6 +8913,265 @@ export interface components {
              * @constant
              */
             object: "event";
+        } | {
+            /**
+             * @description Unique identifier for the event.
+             * @example event_01EHZNVPK3SFK441A1RGBFSHRT
+             */
+            id: string;
+            /** @constant */
+            event: "agent.instance.created";
+            /** @description The event payload. */
+            data: {
+                /**
+                 * @description Distinguishes the agent instance object.
+                 * @constant
+                 */
+                object: "agent_instance";
+                /**
+                 * @description Unique identifier of the agent instance.
+                 * @example agent_01EHWNCE74X7JSDV0X3SZ3KJNY
+                 */
+                id: string;
+                /**
+                 * @description The agent blueprint this instance was minted from.
+                 * @example agent_blueprint_01EHWNCE74X7JSDV0X3SZ3KJNY
+                 */
+                agent_blueprint_id: string;
+                /**
+                 * @description The organization the instance acts within.
+                 * @example org_01EHWNCE74X7JSDV0X3SZ3KJNY
+                 */
+                organization_id: string;
+                /**
+                 * @description The organization membership the instance acts on behalf of; `null` for an autonomous instance.
+                 * @example om_01EHWNCE74X7JSDV0X3SZ3KJNY
+                 */
+                organization_membership_id: string | null;
+                /**
+                 * @description Whether the instance acts on behalf of a user (`delegated`) or as itself within an organization (`autonomous`).
+                 * @enum {string}
+                 */
+                type: "delegated" | "autonomous";
+                /**
+                 * @description The timestamp when the agent instance was created.
+                 * @example 2026-01-15T12:00:00.000Z
+                 */
+                created_at: string;
+                /**
+                 * @description The timestamp when the agent instance was last updated.
+                 * @example 2026-01-15T12:00:00.000Z
+                 */
+                updated_at: string;
+            };
+            /**
+             * Format: date-time
+             * @description An ISO 8601 timestamp.
+             * @example 2026-01-15T12:00:00.000Z
+             */
+            created_at: string;
+            context?: components["schemas"]["EventContextDto"];
+            /**
+             * @description Distinguishes the Event object.
+             * @constant
+             */
+            object: "event";
+        } | {
+            /**
+             * @description Unique identifier for the event.
+             * @example event_01EHZNVPK3SFK441A1RGBFSHRT
+             */
+            id: string;
+            /** @constant */
+            event: "agent.instance.deleted";
+            /** @description The event payload. */
+            data: {
+                /**
+                 * @description Distinguishes the agent instance object.
+                 * @constant
+                 */
+                object: "agent_instance";
+                /**
+                 * @description Unique identifier of the agent instance.
+                 * @example agent_01EHWNCE74X7JSDV0X3SZ3KJNY
+                 */
+                id: string;
+                /**
+                 * @description The agent blueprint this instance was minted from.
+                 * @example agent_blueprint_01EHWNCE74X7JSDV0X3SZ3KJNY
+                 */
+                agent_blueprint_id: string;
+                /**
+                 * @description The organization the instance acts within.
+                 * @example org_01EHWNCE74X7JSDV0X3SZ3KJNY
+                 */
+                organization_id: string;
+                /**
+                 * @description The organization membership the instance acts on behalf of; `null` for an autonomous instance.
+                 * @example om_01EHWNCE74X7JSDV0X3SZ3KJNY
+                 */
+                organization_membership_id: string | null;
+                /**
+                 * @description Whether the instance acts on behalf of a user (`delegated`) or as itself within an organization (`autonomous`).
+                 * @enum {string}
+                 */
+                type: "delegated" | "autonomous";
+                /**
+                 * @description The timestamp when the agent instance was created.
+                 * @example 2026-01-15T12:00:00.000Z
+                 */
+                created_at: string;
+                /**
+                 * @description The timestamp when the agent instance was last updated.
+                 * @example 2026-01-15T12:00:00.000Z
+                 */
+                updated_at: string;
+            };
+            /**
+             * Format: date-time
+             * @description An ISO 8601 timestamp.
+             * @example 2026-01-15T12:00:00.000Z
+             */
+            created_at: string;
+            context?: components["schemas"]["EventContextDto"];
+            /**
+             * @description Distinguishes the Event object.
+             * @constant
+             */
+            object: "event";
+        } | {
+            /**
+             * @description Unique identifier for the event.
+             * @example event_01EHZNVPK3SFK441A1RGBFSHRT
+             */
+            id: string;
+            /** @constant */
+            event: "agent.instance.session.created";
+            /** @description The event payload. */
+            data: {
+                /**
+                 * @description Distinguishes the agent instance session object.
+                 * @constant
+                 */
+                object: "agent_instance_session";
+                /**
+                 * @description Unique identifier of the agent instance session.
+                 * @example agent_session_01EHWNCE74X7JSDV0X3SZ3KJNY
+                 */
+                id: string;
+                /**
+                 * @description The agent instance the session belongs to.
+                 * @example agent_01EHWNCE74X7JSDV0X3SZ3KJNY
+                 */
+                agent_instance_id: string;
+                /**
+                 * @description The organization the owning agent instance belongs to.
+                 * @example org_01EHWNCE74X7JSDV0X3SZ3KJNY
+                 */
+                organization_id: string;
+                /**
+                 * @description Timestamp when the session expires.
+                 * @example 2026-01-15T13:00:00.000Z
+                 */
+                expires_at: string;
+                /**
+                 * @description Timestamp when the session was revoked; `null` if it has not been revoked.
+                 * @example null
+                 */
+                revoked_at: string | null;
+                /**
+                 * @description The timestamp when the session was created.
+                 * @example 2026-01-15T12:00:00.000Z
+                 */
+                created_at: string;
+                /**
+                 * @description The timestamp when the session was last updated.
+                 * @example 2026-01-15T12:00:00.000Z
+                 */
+                updated_at: string;
+                /**
+                 * @description The permissions granted to the session at mint time.
+                 * @example [
+                 *       "crm:read"
+                 *     ]
+                 */
+                permission_slugs: string[];
+            };
+            /**
+             * Format: date-time
+             * @description An ISO 8601 timestamp.
+             * @example 2026-01-15T12:00:00.000Z
+             */
+            created_at: string;
+            context?: components["schemas"]["EventContextDto"];
+            /**
+             * @description Distinguishes the Event object.
+             * @constant
+             */
+            object: "event";
+        } | {
+            /**
+             * @description Unique identifier for the event.
+             * @example event_01EHZNVPK3SFK441A1RGBFSHRT
+             */
+            id: string;
+            /** @constant */
+            event: "agent.instance.session.revoked";
+            /** @description The event payload. */
+            data: {
+                /**
+                 * @description Distinguishes the agent instance session object.
+                 * @constant
+                 */
+                object: "agent_instance_session";
+                /**
+                 * @description Unique identifier of the agent instance session.
+                 * @example agent_session_01EHWNCE74X7JSDV0X3SZ3KJNY
+                 */
+                id: string;
+                /**
+                 * @description The agent instance the session belongs to.
+                 * @example agent_01EHWNCE74X7JSDV0X3SZ3KJNY
+                 */
+                agent_instance_id: string;
+                /**
+                 * @description The organization the owning agent instance belongs to.
+                 * @example org_01EHWNCE74X7JSDV0X3SZ3KJNY
+                 */
+                organization_id: string;
+                /**
+                 * @description Timestamp when the session expires.
+                 * @example 2026-01-15T13:00:00.000Z
+                 */
+                expires_at: string;
+                /**
+                 * @description Timestamp when the session was revoked; `null` if it has not been revoked.
+                 * @example null
+                 */
+                revoked_at: string | null;
+                /**
+                 * @description The timestamp when the session was created.
+                 * @example 2026-01-15T12:00:00.000Z
+                 */
+                created_at: string;
+                /**
+                 * @description The timestamp when the session was last updated.
+                 * @example 2026-01-15T12:00:00.000Z
+                 */
+                updated_at: string;
+            };
+            /**
+             * Format: date-time
+             * @description An ISO 8601 timestamp.
+             * @example 2026-01-15T12:00:00.000Z
+             */
+            created_at: string;
+            context?: components["schemas"]["EventContextDto"];
+            /**
+             * @description Distinguishes the Event object.
+             * @constant
+             */
+            object: "event";
         } | {
             /**
              * @description Unique identifier for the event.
@@ -16928,6 +17666,129 @@ export interface components {
              */
             updated_at: string;
         };
+        SamlIdpSigningCertificate: {
+            /**
+             * @description Distinguishes the SAML Identity Provider signing certificate object.
+             * @constant
+             */
+            object: "saml_idp_signing_certificate";
+            /**
+             * @description Unique identifier for the Identity Provider signing certificate.
+             * @example saml_x509_cert_01E4ZCR3C56J083X43JQXF3JK5
+             */
+            id: string;
+            /**
+             * @description The PEM-encoded public X.509 certificate.
+             * @example -----BEGIN CERTIFICATE-----MIIC...-----END CERTIFICATE-----
+             */
+            value: string;
+            /**
+             * Format: date-time
+             * @description When the certificate becomes valid.
+             * @example 2026-01-15T12:00:00.000Z
+             */
+            not_before: string | null;
+            /**
+             * Format: date-time
+             * @description When the certificate expires.
+             * @example 2026-01-15T12:00:00.000Z
+             */
+            not_after: string | null;
+            /**
+             * Format: date-time
+             * @description An ISO 8601 timestamp.
+             * @example 2026-01-15T12:00:00.000Z
+             */
+            created_at: string;
+        };
+        SamlIdpSigningCertificateList: {
+            /**
+             * @example list
+             * @constant
+             */
+            object: "list";
+            /** @description Every Identity Provider signing certificate on the Connection, including expired ones, oldest first. */
+            data: components["schemas"]["SamlIdpSigningCertificate"][];
+        };
+        SamlSpEncryptionCertificate: {
+            /**
+             * @description Distinguishes the SAML Service Provider encryption certificate object.
+             * @constant
+             */
+            object: "saml_sp_encryption_certificate";
+            /**
+             * @description Unique identifier for the Service Provider encryption key pair. WorkOS holds the corresponding private key, which is never exposed.
+             * @example saml_enc_key_pair_01E4ZCR3C56J083X43JQXF3JK5
+             */
+            id: string;
+            /**
+             * @description The PEM-encoded public X.509 certificate.
+             * @example -----BEGIN CERTIFICATE-----MIIC...-----END CERTIFICATE-----
+             */
+            value: string;
+            /**
+             * Format: date-time
+             * @description When the certificate becomes valid.
+             * @example 2026-01-15T12:00:00.000Z
+             */
+            not_before: string | null;
+            /**
+             * Format: date-time
+             * @description When the certificate expires.
+             * @example 2026-01-15T12:00:00.000Z
+             */
+            not_after: string | null;
+            /**
+             * Format: date-time
+             * @description An ISO 8601 timestamp.
+             * @example 2026-01-15T12:00:00.000Z
+             */
+            created_at: string;
+        };
+        SamlSpEncryptionCertificateList: {
+            /**
+             * @example list
+             * @constant
+             */
+            object: "list";
+            /** @description Every Service Provider encryption certificate on the Connection, including expired ones. */
+            data: components["schemas"]["SamlSpEncryptionCertificate"][];
+        };
+        SamlSpSigningCertificate: {
+            /**
+             * @description Distinguishes the SAML Service Provider signing certificate object.
+             * @constant
+             */
+            object: "saml_sp_signing_certificate";
+            /**
+             * @description Unique identifier for the Service Provider signing key pair. WorkOS holds the corresponding private key, which is never exposed.
+             * @example saml_party_trust_01E4ZCR3C56J083X43JQXF3JK5
+             */
+            id: string;
+            /**
+             * @description The PEM-encoded public X.509 certificate.
+             * @example -----BEGIN CERTIFICATE-----MIIC...-----END CERTIFICATE-----
+             */
+            value: string;
+            /**
+             * Format: date-time
+             * @description When the certificate becomes valid.
+             * @example 2026-01-15T12:00:00.000Z
+             */
+            not_before: string | null;
+            /**
+             * Format: date-time
+             * @description When the certificate expires.
+             * @example 2026-01-15T12:00:00.000Z
+             */
+            not_after: string | null;
+            /**
+             * Format: date-time
+             * @description An ISO 8601 timestamp.
+             * @example 2026-01-15T12:00:00.000Z
+             */
+            created_at: string;
+        };
         Team: {
             /**
              * @description Distinguishes the team object.
@@ -24353,6 +25214,1103 @@ export interface operations {
             };
         };
     };
+    ConnectionsController_create: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["CreateConnectionDto"];
+            };
+        };
+        responses: {
+            /** @description Created */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Connection"];
+                };
+            };
+            /** @description Bad Request */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example external_id_already_in_use
+                         * @constant
+                         */
+                        code: "external_id_already_in_use";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example connection_type_not_supported
+                         * @constant
+                         */
+                        code: "connection_type_not_supported";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example connection_type_or_options_required
+                         * @constant
+                         */
+                        code: "connection_type_or_options_required";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example connection_type_conflicts_with_options
+                         * @constant
+                         */
+                        code: "connection_type_conflicts_with_options";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example both_saml_and_oidc_options_provided
+                         * @constant
+                         */
+                        code: "both_saml_and_oidc_options_provided";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example ambiguous_saml_options
+                         * @constant
+                         */
+                        code: "ambiguous_saml_options";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example incomplete_saml_options
+                         * @constant
+                         */
+                        code: "incomplete_saml_options";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example saml_options_required
+                         * @constant
+                         */
+                        code: "saml_options_required";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example oidc_options_required
+                         * @constant
+                         */
+                        code: "oidc_options_required";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example invalid_certificate
+                         * @constant
+                         */
+                        code: "invalid_certificate";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example client_secret_required
+                         * @constant
+                         */
+                        code: "client_secret_required";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example client_secret_not_accepted
+                         * @constant
+                         */
+                        code: "client_secret_not_accepted";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example key_pair_not_accepted
+                         * @constant
+                         */
+                        code: "key_pair_not_accepted";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example discovery_endpoint_must_use_https
+                         * @constant
+                         */
+                        code: "discovery_endpoint_must_use_https";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example token_authentication_method_not_supported
+                         * @constant
+                         */
+                        code: "token_authentication_method_not_supported";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            /** @description Forbidden */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            /** @description Not Found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example connection_deletion_in_progress
+                         * @constant
+                         */
+                        code: "connection_deletion_in_progress";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            /** @description Unprocessable Entity */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example idp_metadata_fetch_failed
+                         * @constant
+                         */
+                        code: "idp_metadata_fetch_failed";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example connection_could_not_be_verified
+                         * @constant
+                         */
+                        code: "connection_could_not_be_verified";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example invalid_idp_sso_url
+                         * @constant
+                         */
+                        code: "invalid_idp_sso_url";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    };
+                };
+            };
+        };
+    };
+    SamlIdpSigningCertificatesController_list: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Unique identifier for the Connection. */
+                connectionId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["SamlIdpSigningCertificateList"];
+                };
+            };
+            /** @description Bad Request */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example connection_is_not_saml
+                         * @constant
+                         */
+                        code: "connection_is_not_saml";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            /** @description Forbidden */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            /** @description Not Found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
+        };
+    };
+    SamlIdpSigningCertificatesController_create: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Unique identifier for the Connection. */
+                connectionId: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["CreateSamlIdpSigningCertificateDto"];
+            };
+        };
+        responses: {
+            /** @description Created */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["SamlIdpSigningCertificate"];
+                };
+            };
+            /** @description Bad Request */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example connection_is_not_saml
+                         * @constant
+                         */
+                        code: "connection_is_not_saml";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example invalid_certificate
+                         * @constant
+                         */
+                        code: "invalid_certificate";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example certificate_expired
+                         * @constant
+                         */
+                        code: "certificate_expired";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            /** @description Forbidden */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            /** @description Not Found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            /** @description Unprocessable Entity */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
+        };
+    };
+    SamlIdpSigningCertificatesController_delete: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Unique identifier for the Connection. */
+                connectionId: string;
+                /** @description Unique identifier for the Identity Provider signing certificate. */
+                certificateId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description No Content */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Bad Request */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example cannot_delete_last_certificate
+                         * @constant
+                         */
+                        code: "cannot_delete_last_certificate";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            /** @description Forbidden */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            /** @description Not Found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
+        };
+    };
+    SamlSpEncryptionCertificatesController_list: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Unique identifier for the Connection. */
+                connectionId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["SamlSpEncryptionCertificateList"];
+                };
+            };
+            /** @description Bad Request */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example connection_is_not_saml
+                         * @constant
+                         */
+                        code: "connection_is_not_saml";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            /** @description Forbidden */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            /** @description Not Found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
+        };
+    };
+    SamlSpEncryptionCertificatesController_create: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Unique identifier for the Connection. */
+                connectionId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Created */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["SamlSpEncryptionCertificate"];
+                };
+            };
+            /** @description Bad Request */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example connection_is_not_saml
+                         * @constant
+                         */
+                        code: "connection_is_not_saml";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example key_pair_not_accepted
+                         * @constant
+                         */
+                        code: "key_pair_not_accepted";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            /** @description Forbidden */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            /** @description Not Found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example too_many_sp_encryption_certs
+                         * @constant
+                         */
+                        code: "too_many_sp_encryption_certs";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example concurrent_request
+                         * @constant
+                         */
+                        code: "concurrent_request";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    };
+                };
+            };
+        };
+    };
+    SamlSpEncryptionCertificatesController_delete: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Unique identifier for the Connection. */
+                connectionId: string;
+                /** @description Unique identifier for the Service Provider encryption key pair. WorkOS holds the corresponding private key, which is never exposed. */
+                certificateId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description No Content */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Forbidden */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            /** @description Not Found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
+        };
+    };
+    SamlSpSigningCertificatesController_get: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Unique identifier for the Connection. */
+                connectionId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["SamlSpSigningCertificate"];
+                };
+            };
+            /** @description Bad Request */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example connection_is_not_saml
+                         * @constant
+                         */
+                        code: "connection_is_not_saml";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            /** @description Forbidden */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            /** @description Not Found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
+        };
+    };
+    SamlSpSigningCertificatesController_create: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Unique identifier for the Connection. */
+                connectionId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Created */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["SamlSpSigningCertificate"];
+                };
+            };
+            /** @description Bad Request */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example connection_is_not_saml
+                         * @constant
+                         */
+                        code: "connection_is_not_saml";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example key_pair_not_accepted
+                         * @constant
+                         */
+                        code: "key_pair_not_accepted";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example connection_type_not_supported
+                         * @constant
+                         */
+                        code: "connection_type_not_supported";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            /** @description Forbidden */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            /** @description Not Found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example sp_signing_cert_already_exists
+                         * @constant
+                         */
+                        code: "sp_signing_cert_already_exists";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example concurrent_request
+                         * @constant
+                         */
+                        code: "concurrent_request";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    };
+                };
+            };
+        };
+    };
+    SamlSpSigningCertificatesController_delete: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Unique identifier for the Connection. */
+                connectionId: string;
+                /** @description Unique identifier for the Service Provider signing key pair. WorkOS holds the corresponding private key, which is never exposed. */
+                certificateId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description No Content */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Forbidden */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            /** @description Not Found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
+        };
+    };
     ConnectionsController_find: {
         parameters: {
             query?: never;
@@ -24464,6 +26422,263 @@ export interface operations {
             };
         };
     };
+    ConnectionsController_patch: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Unique identifier for the Connection. */
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["PatchConnectionDto"];
+            };
+        };
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Connection"];
+                };
+            };
+            /** @description Bad Request */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example external_id_already_in_use
+                         * @constant
+                         */
+                        code: "external_id_already_in_use";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example connection_type_not_supported
+                         * @constant
+                         */
+                        code: "connection_type_not_supported";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example connection_type_conflicts_with_options
+                         * @constant
+                         */
+                        code: "connection_type_conflicts_with_options";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example both_saml_and_oidc_options_provided
+                         * @constant
+                         */
+                        code: "both_saml_and_oidc_options_provided";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example ambiguous_saml_options
+                         * @constant
+                         */
+                        code: "ambiguous_saml_options";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example token_authentication_method_not_supported
+                         * @constant
+                         */
+                        code: "token_authentication_method_not_supported";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example id_token_signature_algorithm_not_supported
+                         * @constant
+                         */
+                        code: "id_token_signature_algorithm_not_supported";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example client_secret_required
+                         * @constant
+                         */
+                        code: "client_secret_required";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example client_secret_not_accepted
+                         * @constant
+                         */
+                        code: "client_secret_not_accepted";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example discovery_endpoint_must_use_https
+                         * @constant
+                         */
+                        code: "discovery_endpoint_must_use_https";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            /** @description Forbidden */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            /** @description Not Found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example connection_deletion_in_progress
+                         * @constant
+                         */
+                        code: "connection_deletion_in_progress";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            /** @description Unprocessable Entity */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example connection_type_not_updatable
+                         * @constant
+                         */
+                        code: "connection_type_not_updatable";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example idp_metadata_fetch_failed
+                         * @constant
+                         */
+                        code: "idp_metadata_fetch_failed";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example connection_could_not_be_verified
+                         * @constant
+                         */
+                        code: "connection_could_not_be_verified";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    };
+                };
+            };
+        };
+    };
     DataIntegrationsManagementController_listDataIntegrations: {
         parameters: {
             query?: {
@@ -35410,7 +37625,7 @@ export interface operations {
             query?: never;
             header?: never;
             path: {
-                /** @description The unique ID of the waitlist, or the literal `default` for the environment's default waitlist. */
+                /** @description The unique ID of the waitlist, or the literal `default` for the environment's default waitlist. The default waitlist is created when its first entry is added, so read requests for `default` return a `404` until then. */
                 id: string;
             };
             cookie?: never;
@@ -35461,7 +37676,7 @@ export interface operations {
             };
             header?: never;
             path: {
-                /** @description The unique ID of the waitlist, or the literal `default` for the environment's default waitlist. */
+                /** @description The unique ID of the waitlist, or the literal `default` for the environment's default waitlist. The default waitlist is created when its first entry is added, so read requests for `default` return a `404` until then. */
                 id: string;
             };
             cookie?: never;
@@ -35542,7 +37757,7 @@ export interface operations {
             query?: never;
             header?: never;
             path: {
-                /** @description The unique ID of the waitlist, or the literal `default` for the environment's default waitlist. */
+                /** @description The unique ID of the waitlist, or the literal `default` for the environment's default waitlist. Use `default` when adding the first entry — the default waitlist is created automatically. */
                 id: string;
             };
             cookie?: never;