@workos/openapi-spec 0.84.0 → 0.86.0

package/dist/open-api-spec.yaml

@@ -10252,9 +10252,13 @@ paths:
         create an API key integration; you may optionally supply an `api_key`
         block to install a first tenant in the same call. Set `auth_methods` to
         `["client_credentials"]` to create a client-credentials integration;
-        client credentials are installed per-tenant afterwards. For a built-in
-        provider, pass its slug as `provider`. For a custom provider, pass a new
-        slug plus a `custom_provider` definition.
+        client credentials are installed per-tenant afterwards. Set `ownership`
+        to `organization` to create the integration organizations connect to
+        instead of the default user-owned one; a provider may have one of each.
+        For a built-in provider, pass its slug as `provider`. For a custom
+        provider, pass a new slug plus a `custom_provider` definition, or the
+        slug of an existing custom provider (without `custom_provider`) to add
+        the other ownership.
       operationId: DataIntegrationsManagementController_createDataIntegration
       parameters: []
       requestBody:
@@ -10613,6 +10617,14 @@ paths:
                     Optional parameter to scope the connection to a specific
                     organization.
                   example: org_01EHZNVPK3SFK441A1RGBFSHRT
+                connected_account_id:
+                  type: string
+                  pattern: ^data_installation_.+$
+                  description: >-
+                    A [connected account](/reference/pipes/connected-account)
+                    identifier. Use this to rotate a specific existing
+                    connection.
+                  example: data_installation_01EHZNVPK3SFK441A1RGBFSHRT
                 secret:
                   type: string
                   minLength: 1
@@ -10668,7 +10680,7 @@ paths:
                 required:
                   - message
         '404':
-          description: Data integration not found for the given provider slug.
+          description: The data integration or selected connected account was not found.
           content:
             application/json:
               schema:
@@ -10687,14 +10699,7 @@ paths:
           content:
             application/json:
               schema:
-                type: object
-                properties:
-                  message:
-                    type: string
-                    description: A human-readable description of the error.
-                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
-                required:
-                  - message
+                $ref: '#/components/schemas/AccountSelectionRequiredError'
         '422':
           description: >-
             The matched installation uses a different auth method than this
@@ -10843,6 +10848,14 @@ paths:
                     Optional parameter to scope the connection to a specific
                     organization.
                   example: org_01EHZNVPK3SFK441A1RGBFSHRT
+                connected_account_id:
+                  type: string
+                  pattern: ^data_installation_.+$
+                  description: >-
+                    A [connected account](/reference/pipes/connected-account)
+                    identifier. Use this to rotate a specific existing
+                    connection.
+                  example: data_installation_01EHZNVPK3SFK441A1RGBFSHRT
                 client_id:
                   type: string
                   minLength: 1
@@ -10913,7 +10926,7 @@ paths:
                 required:
                   - message
         '404':
-          description: Data integration not found for the given provider slug.
+          description: The data integration or selected connected account was not found.
           content:
             application/json:
               schema:
@@ -10932,14 +10945,7 @@ paths:
           content:
             application/json:
               schema:
-                type: object
-                properties:
-                  message:
-                    type: string
-                    description: A human-readable description of the error.
-                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
-                required:
-                  - message
+                $ref: '#/components/schemas/AccountSelectionRequiredError'
         '422':
           description: >-
             The matched installation uses a different auth method than this
@@ -10975,14 +10981,19 @@ paths:
               properties:
                 user_id:
                   type: string
-                  description: A [User](/reference/authkit/user) identifier.
+                  description: >-
+                    A [User](/reference/authkit/user) identifier. When
+                    `connection_owner` is `organization`, this is the user the
+                    credentials are vended on behalf of; they must be an active
+                    member of the organization.
                   example: user_01EHZNVPK3SFK441A1RGBFSHRT
                 organization_id:
                   type: string
                   description: >-
                     An [Organization](/reference/organization) identifier.
                     Optional parameter to scope the connection to a specific
-                    organization.
+                    organization. Required when `connection_owner` is
+                    `organization`.
                   example: org_01EHZNVPK3SFK441A1RGBFSHRT
                 connected_account_id:
                   type: string
@@ -10992,6 +11003,17 @@ paths:
                     identifier. Use this to select a specific connection when
                     the user has several for this provider.
                   example: data_installation_01EHZNVPK3SFK441A1RGBFSHRT
+                connection_owner:
+                  type: string
+                  enum:
+                    - user
+                    - organization
+                  description: >-
+                    Which connection to vend from. `user` (the default) vends
+                    the user's own connection and requires `user_id`.
+                    `organization` vends the organization's shared connection
+                    and requires `organization_id`.
+                  example: user
               required:
                 - user_id
       responses:
@@ -11027,8 +11049,10 @@ paths:
                   - message
         '401':
           description: Unauthorized
-        '404':
-          description: The data integration or selected connected account was not found.
+        '403':
+          description: >-
+            The user is not an active member of the organization named for an
+            organization connection.
           content:
             application/json:
               schema:
@@ -11040,10 +11064,8 @@ paths:
                     example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
                 required:
                   - message
-        '409':
-          description: >-
-            Several connected accounts match this user for the provider; one
-            must be named.
+        '404':
+          description: The data integration or selected connected account was not found.
           content:
             application/json:
               schema:
@@ -11055,6 +11077,14 @@ paths:
                     example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
                 required:
                   - message
+        '409':
+          description: >-
+            Several connected accounts match this user for the provider; one
+            must be named.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/AccountSelectionRequiredError'
         '422':
           description: >-
             The installation uses an auth method that is not yet supported by
@@ -11097,14 +11127,19 @@ paths:
               properties:
                 user_id:
                   type: string
-                  description: A [User](/reference/authkit/user) identifier.
+                  description: >-
+                    A [User](/reference/authkit/user) identifier. When
+                    `connection_owner` is `organization`, this is the user the
+                    credentials are vended on behalf of; they must be an active
+                    member of the organization.
                   example: user_01EHZNVPK3SFK441A1RGBFSHRT
                 organization_id:
                   type: string
                   description: >-
                     An [Organization](/reference/organization) identifier.
                     Optional parameter to scope the connection to a specific
-                    organization.
+                    organization. Required when `connection_owner` is
+                    `organization`.
                   example: org_01EHZNVPK3SFK441A1RGBFSHRT
                 connected_account_id:
                   type: string
@@ -11114,6 +11149,17 @@ paths:
                     identifier. Use this to select a specific connection when
                     the user has several for this provider.
                   example: data_installation_01EHZNVPK3SFK441A1RGBFSHRT
+                connection_owner:
+                  type: string
+                  enum:
+                    - user
+                    - organization
+                  description: >-
+                    Which connection to vend from. `user` (the default) vends
+                    the user's own connection and requires `user_id`.
+                    `organization` vends the organization's shared connection
+                    and requires `organization_id`.
+                  example: user
               required:
                 - user_id
       responses:
@@ -11138,8 +11184,10 @@ paths:
                   - message
         '401':
           description: Unauthorized
-        '404':
-          description: The data integration or selected connected account was not found.
+        '403':
+          description: >-
+            The user is not an active member of the organization named for an
+            organization connection.
           content:
             application/json:
               schema:
@@ -11151,10 +11199,8 @@ paths:
                     example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
                 required:
                   - message
-        '409':
-          description: >-
-            Several connected accounts match this user for the provider; one
-            must be named.
+        '404':
+          description: The data integration or selected connected account was not found.
           content:
             application/json:
               schema:
@@ -11166,6 +11212,14 @@ paths:
                     example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
                 required:
                   - message
+        '409':
+          description: >-
+            Several connected accounts match this user for the provider; one
+            must be named.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/AccountSelectionRequiredError'
         '422':
           description: >-
             The matched installation uses a different auth method than this
@@ -22225,14 +22279,7 @@ paths:
           content:
             application/json:
               schema:
-                type: object
-                properties:
-                  message:
-                    type: string
-                    description: A human-readable description of the error.
-                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
-                required:
-                  - message
+                $ref: '#/components/schemas/AccountSelectionRequiredError'
       summary: Get a connected account
       tags:
         - user-management.data-providers
@@ -22316,14 +22363,7 @@ paths:
           content:
             application/json:
               schema:
-                type: object
-                properties:
-                  message:
-                    type: string
-                    description: A human-readable description of the error.
-                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
-                required:
-                  - message
+                $ref: '#/components/schemas/AccountSelectionRequiredError'
       summary: Delete a connected account
       tags:
         - user-management.data-providers
@@ -22510,14 +22550,7 @@ paths:
           content:
             application/json:
               schema:
-                type: object
-                properties:
-                  message:
-                    type: string
-                    description: A human-readable description of the error.
-                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
-                required:
-                  - message
+                $ref: '#/components/schemas/AccountSelectionRequiredError'
       summary: Update a connected account
       tags:
         - user-management.data-providers
@@ -26408,6 +26441,18 @@ components:
             be supplied. A custom provider slug cannot shadow an existing global
             provider slug.
           example: github
+        ownership:
+          type: string
+          enum:
+            - userland_user
+            - organization
+          description: >-
+            Who owns the Data Integration. `userland_user` (the default) creates
+            the integration users connect their own accounts to; `organization`
+            creates the root organizations connect to. Ownership is fixed at
+            creation, and one integration of each ownership may exist per
+            provider. Independent of `credentials.type`.
+          example: userland_user
         description:
           type:
             - string
@@ -42370,6 +42415,16 @@ components:
           type: string
           description: The integration type derived from the provider.
           example: github
+        ownership:
+          type: string
+          enum:
+            - userland_user
+            - organization
+          description: >-
+            Who owns the Data Integration: `userland_user` when users connect
+            their own accounts, `organization` when organizations connect. Fixed
+            at creation.
+          example: userland_user
         description:
           type:
             - string
@@ -42477,15 +42532,21 @@ components:
                   description: Unique identifier of the installation.
                   example: data_installation_01EHZNVPK3SFK441A1RGBFSHRT
                 user_id:
-                  type: string
-                  description: The User the API key was installed for.
+                  type:
+                    - string
+                    - 'null'
+                  description: >-
+                    The User the API key was installed for. Null on an
+                    `organization`-owned integration, whose installations belong
+                    to the organization.
                   example: user_01EHZNVPK3SFK441A1RGBFSHRT
                 organization_id:
                   type:
                     - string
                     - 'null'
                   description: >-
-                    The Organization the installation is scoped to, or null when
+                    The Organization the installation is scoped to (or owned by,
+                    on an `organization`-owned integration), or null when
                     unscoped.
                   example: null
                 api_key_last_4:
@@ -42611,6 +42672,7 @@ components:
         - id
         - slug
         - integration_type
+        - ownership
         - description
         - enabled
         - state
@@ -42752,6 +42814,25 @@ components:
           required:
             - active
             - error
+    AccountSelectionRequiredError:
+      type: object
+      properties:
+        code:
+          type: string
+          description: >-
+            Indicates that several connected accounts match and the request must
+            name one.
+          example: account_selection_required
+          const: account_selection_required
+        message:
+          type: string
+          description: A human-readable explanation of the ambiguity.
+          example: >-
+            Several connected accounts match this user for this provider. Name
+            one with a connected account id.
+      required:
+        - code
+        - message
     AuthMethodMismatchError:
       type: object
       properties:

package/dist/policy.d.mts

@@ -49,7 +49,7 @@ interface OperationHint {
  * Per-operation overrides for the operation resolver. Keyed by `"METHOD /path"`.
  * Only operations that need overrides are listed; the algorithm handles the rest.
  */
-declare const operationHints: Record<string, OperationHint>;
+export declare const operationHints: Record<string, OperationHint>;
 //#endregion
 //#region src/policy/mount-rules.d.ts
 /**
@@ -65,7 +65,7 @@ declare const operationHints: Record<string, OperationHint>;
  * does not belong to its prefix family (cf. UserManagementDataProviders →
  * Pipes) needs its own exact entry here.
  */
-declare const mountRules: Record<string, string>;
+export declare const mountRules: Record<string, string>;
 //#endregion
 //#region src/policy/model-hints.d.ts
 /**
@@ -73,21 +73,21 @@ declare const mountRules: Record<string, string>;
  * `assignModelsToServices` so hinted models land in the configured service
  * instead of the default first-reference winner.
  */
-declare const modelHints: Record<string, string>;
+export declare const modelHints: Record<string, string>;
 //#endregion
 //#region src/policy/transforms.d.ts
 /**
  * NestJS-style operationId transform. Strips "Controller" and extracts the
  * action after the first underscore: `FooController_bar` -> `bar`.
  */
-declare function nestjsOperationIdTransform(id: string): string;
-declare function schemaNameTransform(name: string): string;
+export declare function nestjsOperationIdTransform(id: string): string;
+export declare function schemaNameTransform(name: string): string;
 /**
  * Pre-IR spec overlay — patch around upstream spec quirks that would otherwise
  * emit breaking SDK changes. See docs/breaking-change-playbook.md and the
  * oagen `transformSpec` docs for usage. Reach for this only when the upstream
  * fix can't land in time AND the change is genuinely additive.
  */
-declare function transformSpec(spec: OpenApiDocument): OpenApiDocument;
+export declare function transformSpec(spec: OpenApiDocument): OpenApiDocument;
 //#endregion
-export { type OpenApiDocument, type OperationHint, type SplitHint, modelHints, mountRules, nestjsOperationIdTransform, operationHints, schemaNameTransform, transformSpec };
+export type { OpenApiDocument, OperationHint, SplitHint };

package/dist/services.d.mts

@@ -1,12 +1,11 @@
 //#region src/policy/services.generated.d.ts
-declare const services: readonly ["AdminPortal", "Agents", "ApiKeys", "AuditLogs", "Authorization", "ClientApi", "Connect", "DirectorySync", "Events", "FeatureFlags", "Groups", "MultiFactorAuth", "OrganizationDomains", "OrganizationMembership", "Organizations", "Pipes", "PipesProvider", "PlatformTeams", "Radar", "SSO", "UserManagement", "Vault", "Webhooks", "Widgets"];
-type ServiceName = (typeof services)[number];
-interface ServiceEndpoint {
+export declare const services: readonly ["AdminPortal", "Agents", "ApiKeys", "AuditLogs", "Authorization", "ClientApi", "Connect", "DirectorySync", "Events", "FeatureFlags", "Groups", "MultiFactorAuth", "OrganizationDomains", "OrganizationMembership", "Organizations", "Pipes", "PipesProvider", "PlatformTeams", "Radar", "SSO", "UserManagement", "Vault", "Webhooks", "Widgets"];
+export type ServiceName = (typeof services)[number];
+export interface ServiceEndpoint {
   method: string;
   path: string;
   name?: string;
 }
-declare const serviceEndpoints: Record<string, ServiceEndpoint[]>;
-declare const serviceAliases: Record<string, ServiceName>;
-//#endregion
-export { ServiceEndpoint, ServiceName, serviceAliases, serviceEndpoints, services };
+export declare const serviceEndpoints: Record<string, ServiceEndpoint[]>;
+export declare const serviceAliases: Record<string, ServiceName>;
+//#endregion

package/dist/types.d.ts

@@ -1424,7 +1424,7 @@ export interface paths {
         put?: never;
         /**
          * Create a data integration
-         * @description Creates a data integration for a provider. Set `credentials.type` to `custom` to use your own OAuth app credentials or `organization` to have each organization supply its own. Set `auth_methods` to `["api_key"]` to create an API key integration; you may optionally supply an `api_key` block to install a first tenant in the same call. Set `auth_methods` to `["client_credentials"]` to create a client-credentials integration; client credentials are installed per-tenant afterwards. For a built-in provider, pass its slug as `provider`. For a custom provider, pass a new slug plus a `custom_provider` definition.
+         * @description Creates a data integration for a provider. Set `credentials.type` to `custom` to use your own OAuth app credentials or `organization` to have each organization supply its own. Set `auth_methods` to `["api_key"]` to create an API key integration; you may optionally supply an `api_key` block to install a first tenant in the same call. Set `auth_methods` to `["client_credentials"]` to create a client-credentials integration; client credentials are installed per-tenant afterwards. Set `ownership` to `organization` to create the integration organizations connect to instead of the default user-owned one; a provider may have one of each. For a built-in provider, pass its slug as `provider`. For a custom provider, pass a new slug plus a `custom_provider` definition, or the slug of an existing custom provider (without `custom_provider`) to add the other ownership.
          */
         post: operations["DataIntegrationsManagementController_createDataIntegration"];
         delete?: never;
@@ -5265,6 +5265,12 @@ export interface components {
              * @example github
              */
             provider: string;
+            /**
+             * @description Who owns the Data Integration. `userland_user` (the default) creates the integration users connect their own accounts to; `organization` creates the root organizations connect to. Ownership is fixed at creation, and one integration of each ownership may exist per provider. Independent of `credentials.type`.
+             * @example userland_user
+             * @enum {string}
+             */
+            ownership?: "userland_user" | "organization";
             /**
              * @description An optional description of the Data Integration.
              * @example Production GitHub app
@@ -17322,6 +17328,12 @@ export interface components {
              * @example github
              */
             integration_type: string;
+            /**
+             * @description Who owns the Data Integration: `userland_user` when users connect their own accounts, `organization` when organizations connect. Fixed at creation.
+             * @example userland_user
+             * @enum {string}
+             */
+            ownership: "userland_user" | "organization";
             /**
              * @description An optional description of the Data Integration.
              * @example Production GitHub app
@@ -17388,12 +17400,12 @@ export interface components {
                  */
                 id: string;
                 /**
-                 * @description The User the API key was installed for.
+                 * @description The User the API key was installed for. Null on an `organization`-owned integration, whose installations belong to the organization.
                  * @example user_01EHZNVPK3SFK441A1RGBFSHRT
                  */
-                user_id: string;
+                user_id: string | null;
                 /**
-                 * @description The Organization the installation is scoped to, or null when unscoped.
+                 * @description The Organization the installation is scoped to (or owned by, on an `organization`-owned integration), or null when unscoped.
                  * @example null
                  */
                 organization_id: string | null;
@@ -17568,6 +17580,19 @@ export interface components {
              */
             error: "needs_reauthorization" | "not_installed";
         };
+        AccountSelectionRequiredError: {
+            /**
+             * @description Indicates that several connected accounts match and the request must name one.
+             * @example account_selection_required
+             * @constant
+             */
+            code: "account_selection_required";
+            /**
+             * @description A human-readable explanation of the ambiguity.
+             * @example Several connected accounts match this user for this provider. Name one with a connected account id.
+             */
+            message: string;
+        };
         AuthMethodMismatchError: {
             /**
              * @description Error code indicating the endpoint does not match the installation auth method.
@@ -28814,6 +28839,11 @@ export interface operations {
                      * @example org_01EHZNVPK3SFK441A1RGBFSHRT
                      */
                     organization_id?: string;
+                    /**
+                     * @description A [connected account](/reference/pipes/connected-account) identifier. Use this to rotate a specific existing connection.
+                     * @example data_installation_01EHZNVPK3SFK441A1RGBFSHRT
+                     */
+                    connected_account_id?: string;
                     /**
                      * @description The API key secret to store for this integration.
                      * @example sk-1234567890abcdef
@@ -28883,7 +28913,7 @@ export interface operations {
                     };
                 };
             };
-            /** @description Data integration not found for the given provider slug. */
+            /** @description The data integration or selected connected account was not found. */
             404: {
                 headers: {
                     [name: string]: unknown;
@@ -28904,13 +28934,7 @@ export interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": {
-                        /**
-                         * @description A human-readable description of the error.
-                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
-                         */
-                        message: string;
-                    };
+                    "application/json": components["schemas"]["AccountSelectionRequiredError"];
                 };
             };
             /** @description The matched installation uses a different auth method than this endpoint expects. */
@@ -29052,6 +29076,11 @@ export interface operations {
                      * @example org_01EHZNVPK3SFK441A1RGBFSHRT
                      */
                     organization_id?: string;
+                    /**
+                     * @description A [connected account](/reference/pipes/connected-account) identifier. Use this to rotate a specific existing connection.
+                     * @example data_installation_01EHZNVPK3SFK441A1RGBFSHRT
+                     */
+                    connected_account_id?: string;
                     /**
                      * @description The OAuth client ID to store for this integration.
                      * @example 3MVG9...
@@ -29134,7 +29163,7 @@ export interface operations {
                     };
                 };
             };
-            /** @description Data integration not found for the given provider slug. */
+            /** @description The data integration or selected connected account was not found. */
             404: {
                 headers: {
                     [name: string]: unknown;
@@ -29155,13 +29184,7 @@ export interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": {
-                        /**
-                         * @description A human-readable description of the error.
-                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
-                         */
-                        message: string;
-                    };
+                    "application/json": components["schemas"]["AccountSelectionRequiredError"];
                 };
             };
             /** @description The matched installation uses a different auth method than this endpoint expects. */
@@ -29189,12 +29212,12 @@ export interface operations {
             content: {
                 "application/json": {
                     /**
-                     * @description A [User](/reference/authkit/user) identifier.
+                     * @description A [User](/reference/authkit/user) identifier. When `connection_owner` is `organization`, this is the user the credentials are vended on behalf of; they must be an active member of the organization.
                      * @example user_01EHZNVPK3SFK441A1RGBFSHRT
                      */
                     user_id: string;
                     /**
-                     * @description An [Organization](/reference/organization) identifier. Optional parameter to scope the connection to a specific organization.
+                     * @description An [Organization](/reference/organization) identifier. Optional parameter to scope the connection to a specific organization. Required when `connection_owner` is `organization`.
                      * @example org_01EHZNVPK3SFK441A1RGBFSHRT
                      */
                     organization_id?: string;
@@ -29203,6 +29226,12 @@ export interface operations {
                      * @example data_installation_01EHZNVPK3SFK441A1RGBFSHRT
                      */
                     connected_account_id?: string;
+                    /**
+                     * @description Which connection to vend from. `user` (the default) vends the user's own connection and requires `user_id`. `organization` vends the organization's shared connection and requires `organization_id`.
+                     * @example user
+                     * @enum {string}
+                     */
+                    connection_owner?: "user" | "organization";
                 };
             };
         };
@@ -29254,8 +29283,8 @@ export interface operations {
                 };
                 content?: never;
             };
-            /** @description The data integration or selected connected account was not found. */
-            404: {
+            /** @description The user is not an active member of the organization named for an organization connection. */
+            403: {
                 headers: {
                     [name: string]: unknown;
                 };
@@ -29269,8 +29298,8 @@ export interface operations {
                     };
                 };
             };
-            /** @description Several connected accounts match this user for the provider; one must be named. */
-            409: {
+            /** @description The data integration or selected connected account was not found. */
+            404: {
                 headers: {
                     [name: string]: unknown;
                 };
@@ -29284,6 +29313,15 @@ export interface operations {
                     };
                 };
             };
+            /** @description Several connected accounts match this user for the provider; one must be named. */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AccountSelectionRequiredError"];
+                };
+            };
             /** @description The installation uses an auth method that is not yet supported by this endpoint. */
             422: {
                 headers: {
@@ -29315,12 +29353,12 @@ export interface operations {
             content: {
                 "application/json": {
                     /**
-                     * @description A [User](/reference/authkit/user) identifier.
+                     * @description A [User](/reference/authkit/user) identifier. When `connection_owner` is `organization`, this is the user the credentials are vended on behalf of; they must be an active member of the organization.
                      * @example user_01EHZNVPK3SFK441A1RGBFSHRT
                      */
                     user_id: string;
                     /**
-                     * @description An [Organization](/reference/organization) identifier. Optional parameter to scope the connection to a specific organization.
+                     * @description An [Organization](/reference/organization) identifier. Optional parameter to scope the connection to a specific organization. Required when `connection_owner` is `organization`.
                      * @example org_01EHZNVPK3SFK441A1RGBFSHRT
                      */
                     organization_id?: string;
@@ -29329,6 +29367,12 @@ export interface operations {
                      * @example data_installation_01EHZNVPK3SFK441A1RGBFSHRT
                      */
                     connected_account_id?: string;
+                    /**
+                     * @description Which connection to vend from. `user` (the default) vends the user's own connection and requires `user_id`. `organization` vends the organization's shared connection and requires `organization_id`.
+                     * @example user
+                     * @enum {string}
+                     */
+                    connection_owner?: "user" | "organization";
                 };
             };
         };
@@ -29364,8 +29408,8 @@ export interface operations {
                 };
                 content?: never;
             };
-            /** @description The data integration or selected connected account was not found. */
-            404: {
+            /** @description The user is not an active member of the organization named for an organization connection. */
+            403: {
                 headers: {
                     [name: string]: unknown;
                 };
@@ -29379,8 +29423,8 @@ export interface operations {
                     };
                 };
             };
-            /** @description Several connected accounts match this user for the provider; one must be named. */
-            409: {
+            /** @description The data integration or selected connected account was not found. */
+            404: {
                 headers: {
                     [name: string]: unknown;
                 };
@@ -29394,6 +29438,15 @@ export interface operations {
                     };
                 };
             };
+            /** @description Several connected accounts match this user for the provider; one must be named. */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AccountSelectionRequiredError"];
+                };
+            };
             /** @description The matched installation uses a different auth method than this endpoint expects. */
             422: {
                 headers: {
@@ -38921,13 +38974,7 @@ export interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": {
-                        /**
-                         * @description A human-readable description of the error.
-                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
-                         */
-                        message: string;
-                    };
+                    "application/json": components["schemas"]["AccountSelectionRequiredError"];
                 };
             };
         };
@@ -39007,13 +39054,7 @@ export interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": {
-                        /**
-                         * @description A human-readable description of the error.
-                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
-                         */
-                        message: string;
-                    };
+                    "application/json": components["schemas"]["AccountSelectionRequiredError"];
                 };
             };
         };
@@ -39171,13 +39212,7 @@ export interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": {
-                        /**
-                         * @description A human-readable description of the error.
-                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
-                         */
-                        message: string;
-                    };
+                    "application/json": components["schemas"]["AccountSelectionRequiredError"];
                 };
             };
         };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@workos/openapi-spec",
-  "version": "0.84.0",
+  "version": "0.86.0",
   "type": "module",
   "description": "WorkOS OpenAPI specification, TypeScript types, and SDK resolution policy",
   "license": "MIT",
@@ -56,14 +56,14 @@
     "lodash": "^4.17.23"
   },
   "devDependencies": {
-    "@types/node": "^26.4.1",
-    "@workos/oagen": "^0.30.0",
+    "@types/node": "^26.5.0",
+    "@workos/oagen": "^0.30.1",
     "@workos/oagen-emitters": "^0.24.11",
     "diff2html": "^3.4.56",
     "husky": "^9.1.7",
     "js-yaml": "^5.4.1",
     "openapi-to-postmanv2": "^6.3.3",
-    "tsdown": "^0.22.14",
+    "tsdown": "^0.23.0",
     "tsx": "^4.23.13",
     "typescript": "^7.0.2"
   }