@workos/openapi-spec 0.83.0 → 0.85.0

package/dist/open-api-spec.yaml

@@ -10252,9 +10252,13 @@ paths:
         create an API key integration; you may optionally supply an `api_key`
         block to install a first tenant in the same call. Set `auth_methods` to
         `["client_credentials"]` to create a client-credentials integration;
-        client credentials are installed per-tenant afterwards. For a built-in
-        provider, pass its slug as `provider`. For a custom provider, pass a new
-        slug plus a `custom_provider` definition.
+        client credentials are installed per-tenant afterwards. Set `ownership`
+        to `organization` to create the integration organizations connect to
+        instead of the default user-owned one; a provider may have one of each.
+        For a built-in provider, pass its slug as `provider`. For a custom
+        provider, pass a new slug plus a `custom_provider` definition, or the
+        slug of an existing custom provider (without `custom_provider`) to add
+        the other ownership.
       operationId: DataIntegrationsManagementController_createDataIntegration
       parameters: []
       requestBody:
@@ -10975,14 +10979,19 @@ paths:
               properties:
                 user_id:
                   type: string
-                  description: A [User](/reference/authkit/user) identifier.
+                  description: >-
+                    A [User](/reference/authkit/user) identifier. When
+                    `connection_owner` is `organization`, this is the user the
+                    credentials are vended on behalf of; they must be an active
+                    member of the organization.
                   example: user_01EHZNVPK3SFK441A1RGBFSHRT
                 organization_id:
                   type: string
                   description: >-
                     An [Organization](/reference/organization) identifier.
                     Optional parameter to scope the connection to a specific
-                    organization.
+                    organization. Required when `connection_owner` is
+                    `organization`.
                   example: org_01EHZNVPK3SFK441A1RGBFSHRT
                 connected_account_id:
                   type: string
@@ -10992,6 +11001,17 @@ paths:
                     identifier. Use this to select a specific connection when
                     the user has several for this provider.
                   example: data_installation_01EHZNVPK3SFK441A1RGBFSHRT
+                connection_owner:
+                  type: string
+                  enum:
+                    - user
+                    - organization
+                  description: >-
+                    Which connection to vend from. `user` (the default) vends
+                    the user's own connection and requires `user_id`.
+                    `organization` vends the organization's shared connection
+                    and requires `organization_id`.
+                  example: user
               required:
                 - user_id
       responses:
@@ -11027,6 +11047,21 @@ paths:
                   - message
         '401':
           description: Unauthorized
+        '403':
+          description: >-
+            The user is not an active member of the organization named for an
+            organization connection.
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
         '404':
           description: The data integration or selected connected account was not found.
           content:
@@ -11097,14 +11132,19 @@ paths:
               properties:
                 user_id:
                   type: string
-                  description: A [User](/reference/authkit/user) identifier.
+                  description: >-
+                    A [User](/reference/authkit/user) identifier. When
+                    `connection_owner` is `organization`, this is the user the
+                    credentials are vended on behalf of; they must be an active
+                    member of the organization.
                   example: user_01EHZNVPK3SFK441A1RGBFSHRT
                 organization_id:
                   type: string
                   description: >-
                     An [Organization](/reference/organization) identifier.
                     Optional parameter to scope the connection to a specific
-                    organization.
+                    organization. Required when `connection_owner` is
+                    `organization`.
                   example: org_01EHZNVPK3SFK441A1RGBFSHRT
                 connected_account_id:
                   type: string
@@ -11114,6 +11154,17 @@ paths:
                     identifier. Use this to select a specific connection when
                     the user has several for this provider.
                   example: data_installation_01EHZNVPK3SFK441A1RGBFSHRT
+                connection_owner:
+                  type: string
+                  enum:
+                    - user
+                    - organization
+                  description: >-
+                    Which connection to vend from. `user` (the default) vends
+                    the user's own connection and requires `user_id`.
+                    `organization` vends the organization's shared connection
+                    and requires `organization_id`.
+                  example: user
               required:
                 - user_id
       responses:
@@ -11138,6 +11189,21 @@ paths:
                   - message
         '401':
           description: Unauthorized
+        '403':
+          description: >-
+            The user is not an active member of the organization named for an
+            organization connection.
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
         '404':
           description: The data integration or selected connected account was not found.
           content:
@@ -26408,6 +26474,18 @@ components:
             be supplied. A custom provider slug cannot shadow an existing global
             provider slug.
           example: github
+        ownership:
+          type: string
+          enum:
+            - userland_user
+            - organization
+          description: >-
+            Who owns the Data Integration. `userland_user` (the default) creates
+            the integration users connect their own accounts to; `organization`
+            creates the root organizations connect to. Ownership is fixed at
+            creation, and one integration of each ownership may exist per
+            provider. Independent of `credentials.type`.
+          example: userland_user
         description:
           type:
             - string
@@ -26631,16 +26709,16 @@ components:
           type: string
           description: >-
             The URL to go to when an admin clicks on your logo in the Admin
-            Portal. If not specified, the return URL configured on the
-            [Redirects](https://dashboard.workos.com/redirects) page will be
+            Portal. If not specified, the return URL configured on the [Admin
+            Portal](https://dashboard.workos.com/admin-portal) page will be
             used.
           example: https://example.com/admin-portal/return
         success_url:
           type: string
           description: >-
             The URL to redirect the admin to when they finish setup. If not
-            specified, the success URL configured on the
-            [Redirects](https://dashboard.workos.com/redirects) page will be
+            specified, the success URL configured on the [Admin
+            Portal](https://dashboard.workos.com/admin-portal) page will be
             used.
           example: https://example.com/admin-portal/success
         organization:
@@ -42370,6 +42448,16 @@ components:
           type: string
           description: The integration type derived from the provider.
           example: github
+        ownership:
+          type: string
+          enum:
+            - userland_user
+            - organization
+          description: >-
+            Who owns the Data Integration: `userland_user` when users connect
+            their own accounts, `organization` when organizations connect. Fixed
+            at creation.
+          example: userland_user
         description:
           type:
             - string
@@ -42477,15 +42565,21 @@ components:
                   description: Unique identifier of the installation.
                   example: data_installation_01EHZNVPK3SFK441A1RGBFSHRT
                 user_id:
-                  type: string
-                  description: The User the API key was installed for.
+                  type:
+                    - string
+                    - 'null'
+                  description: >-
+                    The User the API key was installed for. Null on an
+                    `organization`-owned integration, whose installations belong
+                    to the organization.
                   example: user_01EHZNVPK3SFK441A1RGBFSHRT
                 organization_id:
                   type:
                     - string
                     - 'null'
                   description: >-
-                    The Organization the installation is scoped to, or null when
+                    The Organization the installation is scoped to (or owned by,
+                    on an `organization`-owned integration), or null when
                     unscoped.
                   example: null
                 api_key_last_4:
@@ -42611,6 +42705,7 @@ components:
         - id
         - slug
         - integration_type
+        - ownership
         - description
         - enabled
         - state

package/dist/policy.d.mts

@@ -49,7 +49,7 @@ interface OperationHint {
  * Per-operation overrides for the operation resolver. Keyed by `"METHOD /path"`.
  * Only operations that need overrides are listed; the algorithm handles the rest.
  */
-declare const operationHints: Record<string, OperationHint>;
+export declare const operationHints: Record<string, OperationHint>;
 //#endregion
 //#region src/policy/mount-rules.d.ts
 /**
@@ -65,7 +65,7 @@ declare const operationHints: Record<string, OperationHint>;
  * does not belong to its prefix family (cf. UserManagementDataProviders →
  * Pipes) needs its own exact entry here.
  */
-declare const mountRules: Record<string, string>;
+export declare const mountRules: Record<string, string>;
 //#endregion
 //#region src/policy/model-hints.d.ts
 /**
@@ -73,21 +73,21 @@ declare const mountRules: Record<string, string>;
  * `assignModelsToServices` so hinted models land in the configured service
  * instead of the default first-reference winner.
  */
-declare const modelHints: Record<string, string>;
+export declare const modelHints: Record<string, string>;
 //#endregion
 //#region src/policy/transforms.d.ts
 /**
  * NestJS-style operationId transform. Strips "Controller" and extracts the
  * action after the first underscore: `FooController_bar` -> `bar`.
  */
-declare function nestjsOperationIdTransform(id: string): string;
-declare function schemaNameTransform(name: string): string;
+export declare function nestjsOperationIdTransform(id: string): string;
+export declare function schemaNameTransform(name: string): string;
 /**
  * Pre-IR spec overlay — patch around upstream spec quirks that would otherwise
  * emit breaking SDK changes. See docs/breaking-change-playbook.md and the
  * oagen `transformSpec` docs for usage. Reach for this only when the upstream
  * fix can't land in time AND the change is genuinely additive.
  */
-declare function transformSpec(spec: OpenApiDocument): OpenApiDocument;
+export declare function transformSpec(spec: OpenApiDocument): OpenApiDocument;
 //#endregion
-export { type OpenApiDocument, type OperationHint, type SplitHint, modelHints, mountRules, nestjsOperationIdTransform, operationHints, schemaNameTransform, transformSpec };
+export type { OpenApiDocument, OperationHint, SplitHint };

package/dist/services.d.mts

@@ -1,12 +1,11 @@
 //#region src/policy/services.generated.d.ts
-declare const services: readonly ["AdminPortal", "Agents", "ApiKeys", "AuditLogs", "Authorization", "ClientApi", "Connect", "DirectorySync", "Events", "FeatureFlags", "Groups", "MultiFactorAuth", "OrganizationDomains", "OrganizationMembership", "Organizations", "Pipes", "PipesProvider", "PlatformTeams", "Radar", "SSO", "UserManagement", "Vault", "Webhooks", "Widgets"];
-type ServiceName = (typeof services)[number];
-interface ServiceEndpoint {
+export declare const services: readonly ["AdminPortal", "Agents", "ApiKeys", "AuditLogs", "Authorization", "ClientApi", "Connect", "DirectorySync", "Events", "FeatureFlags", "Groups", "MultiFactorAuth", "OrganizationDomains", "OrganizationMembership", "Organizations", "Pipes", "PipesProvider", "PlatformTeams", "Radar", "SSO", "UserManagement", "Vault", "Webhooks", "Widgets"];
+export type ServiceName = (typeof services)[number];
+export interface ServiceEndpoint {
   method: string;
   path: string;
   name?: string;
 }
-declare const serviceEndpoints: Record<string, ServiceEndpoint[]>;
-declare const serviceAliases: Record<string, ServiceName>;
-//#endregion
-export { ServiceEndpoint, ServiceName, serviceAliases, serviceEndpoints, services };
+export declare const serviceEndpoints: Record<string, ServiceEndpoint[]>;
+export declare const serviceAliases: Record<string, ServiceName>;
+//#endregion

package/dist/types.d.ts

@@ -1424,7 +1424,7 @@ export interface paths {
         put?: never;
         /**
          * Create a data integration
-         * @description Creates a data integration for a provider. Set `credentials.type` to `custom` to use your own OAuth app credentials or `organization` to have each organization supply its own. Set `auth_methods` to `["api_key"]` to create an API key integration; you may optionally supply an `api_key` block to install a first tenant in the same call. Set `auth_methods` to `["client_credentials"]` to create a client-credentials integration; client credentials are installed per-tenant afterwards. For a built-in provider, pass its slug as `provider`. For a custom provider, pass a new slug plus a `custom_provider` definition.
+         * @description Creates a data integration for a provider. Set `credentials.type` to `custom` to use your own OAuth app credentials or `organization` to have each organization supply its own. Set `auth_methods` to `["api_key"]` to create an API key integration; you may optionally supply an `api_key` block to install a first tenant in the same call. Set `auth_methods` to `["client_credentials"]` to create a client-credentials integration; client credentials are installed per-tenant afterwards. Set `ownership` to `organization` to create the integration organizations connect to instead of the default user-owned one; a provider may have one of each. For a built-in provider, pass its slug as `provider`. For a custom provider, pass a new slug plus a `custom_provider` definition, or the slug of an existing custom provider (without `custom_provider`) to add the other ownership.
          */
         post: operations["DataIntegrationsManagementController_createDataIntegration"];
         delete?: never;
@@ -5265,6 +5265,12 @@ export interface components {
              * @example github
              */
             provider: string;
+            /**
+             * @description Who owns the Data Integration. `userland_user` (the default) creates the integration users connect their own accounts to; `organization` creates the root organizations connect to. Ownership is fixed at creation, and one integration of each ownership may exist per provider. Independent of `credentials.type`.
+             * @example userland_user
+             * @enum {string}
+             */
+            ownership?: "userland_user" | "organization";
             /**
              * @description An optional description of the Data Integration.
              * @example Production GitHub app
@@ -5431,12 +5437,12 @@ export interface components {
         };
         GenerateLinkDto: {
             /**
-             * @description The URL to go to when an admin clicks on your logo in the Admin Portal. If not specified, the return URL configured on the [Redirects](https://dashboard.workos.com/redirects) page will be used.
+             * @description The URL to go to when an admin clicks on your logo in the Admin Portal. If not specified, the return URL configured on the [Admin Portal](https://dashboard.workos.com/admin-portal) page will be used.
              * @example https://example.com/admin-portal/return
              */
             return_url?: string;
             /**
-             * @description The URL to redirect the admin to when they finish setup. If not specified, the success URL configured on the [Redirects](https://dashboard.workos.com/redirects) page will be used.
+             * @description The URL to redirect the admin to when they finish setup. If not specified, the success URL configured on the [Admin Portal](https://dashboard.workos.com/admin-portal) page will be used.
              * @example https://example.com/admin-portal/success
              */
             success_url?: string;
@@ -17322,6 +17328,12 @@ export interface components {
              * @example github
              */
             integration_type: string;
+            /**
+             * @description Who owns the Data Integration: `userland_user` when users connect their own accounts, `organization` when organizations connect. Fixed at creation.
+             * @example userland_user
+             * @enum {string}
+             */
+            ownership: "userland_user" | "organization";
             /**
              * @description An optional description of the Data Integration.
              * @example Production GitHub app
@@ -17388,12 +17400,12 @@ export interface components {
                  */
                 id: string;
                 /**
-                 * @description The User the API key was installed for.
+                 * @description The User the API key was installed for. Null on an `organization`-owned integration, whose installations belong to the organization.
                  * @example user_01EHZNVPK3SFK441A1RGBFSHRT
                  */
-                user_id: string;
+                user_id: string | null;
                 /**
-                 * @description The Organization the installation is scoped to, or null when unscoped.
+                 * @description The Organization the installation is scoped to (or owned by, on an `organization`-owned integration), or null when unscoped.
                  * @example null
                  */
                 organization_id: string | null;
@@ -29189,12 +29201,12 @@ export interface operations {
             content: {
                 "application/json": {
                     /**
-                     * @description A [User](/reference/authkit/user) identifier.
+                     * @description A [User](/reference/authkit/user) identifier. When `connection_owner` is `organization`, this is the user the credentials are vended on behalf of; they must be an active member of the organization.
                      * @example user_01EHZNVPK3SFK441A1RGBFSHRT
                      */
                     user_id: string;
                     /**
-                     * @description An [Organization](/reference/organization) identifier. Optional parameter to scope the connection to a specific organization.
+                     * @description An [Organization](/reference/organization) identifier. Optional parameter to scope the connection to a specific organization. Required when `connection_owner` is `organization`.
                      * @example org_01EHZNVPK3SFK441A1RGBFSHRT
                      */
                     organization_id?: string;
@@ -29203,6 +29215,12 @@ export interface operations {
                      * @example data_installation_01EHZNVPK3SFK441A1RGBFSHRT
                      */
                     connected_account_id?: string;
+                    /**
+                     * @description Which connection to vend from. `user` (the default) vends the user's own connection and requires `user_id`. `organization` vends the organization's shared connection and requires `organization_id`.
+                     * @example user
+                     * @enum {string}
+                     */
+                    connection_owner?: "user" | "organization";
                 };
             };
         };
@@ -29254,6 +29272,21 @@ export interface operations {
                 };
                 content?: never;
             };
+            /** @description The user is not an active member of the organization named for an organization connection. */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
             /** @description The data integration or selected connected account was not found. */
             404: {
                 headers: {
@@ -29315,12 +29348,12 @@ export interface operations {
             content: {
                 "application/json": {
                     /**
-                     * @description A [User](/reference/authkit/user) identifier.
+                     * @description A [User](/reference/authkit/user) identifier. When `connection_owner` is `organization`, this is the user the credentials are vended on behalf of; they must be an active member of the organization.
                      * @example user_01EHZNVPK3SFK441A1RGBFSHRT
                      */
                     user_id: string;
                     /**
-                     * @description An [Organization](/reference/organization) identifier. Optional parameter to scope the connection to a specific organization.
+                     * @description An [Organization](/reference/organization) identifier. Optional parameter to scope the connection to a specific organization. Required when `connection_owner` is `organization`.
                      * @example org_01EHZNVPK3SFK441A1RGBFSHRT
                      */
                     organization_id?: string;
@@ -29329,6 +29362,12 @@ export interface operations {
                      * @example data_installation_01EHZNVPK3SFK441A1RGBFSHRT
                      */
                     connected_account_id?: string;
+                    /**
+                     * @description Which connection to vend from. `user` (the default) vends the user's own connection and requires `user_id`. `organization` vends the organization's shared connection and requires `organization_id`.
+                     * @example user
+                     * @enum {string}
+                     */
+                    connection_owner?: "user" | "organization";
                 };
             };
         };
@@ -29364,6 +29403,21 @@ export interface operations {
                 };
                 content?: never;
             };
+            /** @description The user is not an active member of the organization named for an organization connection. */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
             /** @description The data integration or selected connected account was not found. */
             404: {
                 headers: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@workos/openapi-spec",
-  "version": "0.83.0",
+  "version": "0.85.0",
   "type": "module",
   "description": "WorkOS OpenAPI specification, TypeScript types, and SDK resolution policy",
   "license": "MIT",
@@ -56,14 +56,14 @@
     "lodash": "^4.17.23"
   },
   "devDependencies": {
-    "@types/node": "^26.4.1",
-    "@workos/oagen": "^0.30.0",
+    "@types/node": "^26.5.0",
+    "@workos/oagen": "^0.30.1",
     "@workos/oagen-emitters": "^0.24.11",
     "diff2html": "^3.4.56",
     "husky": "^9.1.7",
     "js-yaml": "^5.4.1",
     "openapi-to-postmanv2": "^6.3.3",
-    "tsdown": "^0.22.14",
+    "tsdown": "^0.23.0",
     "tsx": "^4.23.13",
     "typescript": "^7.0.2"
   }