@workos/openapi-spec 0.89.0 → 0.91.0

package/dist/open-api-spec.yaml

@@ -1783,6 +1783,13 @@ paths:
             `after` fetches newer records). Defaults to `normal`.
           schema:
             $ref: '#/components/schemas/PaginationOrder'
+        - name: organization_id
+          required: false
+          in: query
+          description: Only return sessions of instances acting within this organization.
+          schema:
+            type: string
+            example: org_01EHWNCE74X7JSDV0X3SZ3KJNY
         - name: agent_blueprint_id
           required: false
           in: query
@@ -10352,7 +10359,9 @@ paths:
       description: >-
         Lists the environment's data integrations configured with `custom` or
         `organization` credentials, including custom providers and API key
-        integrations.
+        integrations. Both user-owned and organization-owned roots are returned,
+        each as its own row with an `ownership`; filter with `ownership` to
+        return only one kind.
       operationId: DataIntegrationsManagementController_listDataIntegrations
       parameters:
         - name: before
@@ -10401,6 +10410,19 @@ paths:
             `after` fetches newer records). Defaults to `normal`.
           schema:
             $ref: '#/components/schemas/PaginationOrder'
+        - name: ownership
+          required: false
+          in: query
+          description: >-
+            Only return Data Integrations with this ownership: `user` for the
+            integrations users connect their own accounts to, or `organization`
+            for the roots organizations connect to. Omit to return both.
+          schema:
+            example: user
+            enum:
+              - user
+              - organization
+            type: string
       responses:
         '200':
           description: OK
@@ -10410,13 +10432,41 @@ paths:
                 $ref: '#/components/schemas/DataIntegrationList'
         '401':
           description: Unauthorized
+        '404':
+          description: >-
+            Organization-owned data integrations are not available for this
+            environment.
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '422':
+          description: Unprocessable Entity
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
       summary: List data integrations
       tags:
         - pipes
       x-feature-flag: pipes-management-api
   /data-integrations/{slug}:
     get:
-      description: Retrieves a data integration by its slug.
+      description: Retrieves the user-owned data integration by its slug.
       operationId: DataIntegrationsManagementController_getDataIntegration
       parameters:
         - name: slug
@@ -10454,9 +10504,9 @@ paths:
       x-feature-flag: pipes-management-api
     put:
       description: >-
-        Updates the description, enabled state, or custom credentials of a data
-        integration. For custom providers, `custom_provider` updates the OAuth
-        definition.
+        Updates the description, enabled state, or custom credentials of the
+        user-owned data integration. For custom providers, `custom_provider`
+        updates the OAuth definition.
       operationId: DataIntegrationsManagementController_updateDataIntegration
       parameters:
         - name: slug
@@ -10554,8 +10604,9 @@ paths:
       x-feature-flag: pipes-management-api
     delete:
       description: >-
-        Deletes a data integration and all of its connected installations. For a
-        custom provider, also deletes the custom provider definition.
+        Deletes the user-owned data integration and all of its connected
+        installations. For a custom provider, the provider definition is deleted
+        once no organization-owned root references it either.
       operationId: DataIntegrationsManagementController_deleteDataIntegration
       parameters:
         - name: slug
@@ -11047,6 +11098,15 @@ paths:
                     `organization` vends the organization's shared connection
                     and requires `organization_id`.
                   example: user
+                supports_multiple_connections:
+                  type: boolean
+                  description: >-
+                    Set to `true` to use the plural connection contract. If no
+                    `connected_account_id` is supplied and several connections
+                    match, the request returns `account_selection_required`.
+                    When omitted or `false`, only the compatibility connection
+                    is considered.
+                  example: true
               required:
                 - user_id
       responses:
@@ -11136,6 +11196,263 @@ paths:
       summary: Vend credentials for a connected account
       tags:
         - pipes
+  /data-integrations/{slug}/organization:
+    get:
+      description: >-
+        Retrieves the organization-owned data integration for a provider by its
+        slug. The `/organization` suffix selects the environment-level
+        organization-owned root for the provider; it does not name a particular
+        organization.
+      operationId: DataIntegrationsManagementController_getOrganizationDataIntegration
+      parameters:
+        - name: slug
+          required: true
+          in: path
+          description: The slug identifier of the data integration.
+          schema:
+            example: github
+            type: string
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/DataIntegration'
+              example:
+                object: data_integration
+                id: data_integration_01EHZNVPK3SFK441A1RGBFSHRT
+                slug: github
+                integration_type: github
+                ownership: organization
+                description: Production GitHub app
+                enabled: true
+                state: valid
+                scopes:
+                  - repo
+                  - read:org
+                redirect_uri: >-
+                  https://api.workos.com/data-integrations/github/dik_01EHZNVPK3SFK441A1RGBFSHRT/callback
+                auth_methods:
+                  - oauth
+                credentials:
+                  type: custom
+                  client_id: Iv1.abc123
+                  redacted_client_secret: '6789'
+                installation: null
+                config:
+                  account: myorg-myaccount
+                custom_provider:
+                  name: My OAuth App
+                  authorization_url: https://provider.example.com/oauth/authorize
+                  token_url: https://provider.example.com/oauth/token
+                  refresh_token_url: https://provider.example.com/oauth/token
+                  pkce_enabled: true
+                  request_scope_separator: ' '
+                  scopes_required: false
+                  client_secret_required: true
+                  additional_authorization_parameters:
+                    prompt: consent
+                  token_body_content_type: application/x-www-form-urlencoded
+                  authenticate_via: request_body
+                created_at: '2026-01-15T12:00:00.000Z'
+                updated_at: '2026-01-15T12:00:00.000Z'
+          description: OK
+        '401':
+          description: Unauthorized
+        '404':
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+      summary: Get an organization-owned data integration
+      tags:
+        - pipes
+      x-feature-flag: pipes-management-api
+    put:
+      description: >-
+        Updates the description, enabled state, or custom credentials of the
+        organization-owned data integration for a provider. For custom
+        providers, `custom_provider` updates the OAuth definition, which is
+        shared with the user-owned root. The `/organization` suffix selects the
+        environment-level organization-owned root for the provider; it does not
+        name a particular organization.
+      operationId: DataIntegrationsManagementController_updateOrganizationDataIntegration
+      parameters:
+        - name: slug
+          required: true
+          in: path
+          description: The slug identifier of the data integration.
+          schema:
+            example: github
+            type: string
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/UpdateDataIntegrationDto'
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/DataIntegration'
+              example:
+                object: data_integration
+                id: data_integration_01EHZNVPK3SFK441A1RGBFSHRT
+                slug: github
+                integration_type: github
+                ownership: organization
+                description: Production GitHub app
+                enabled: true
+                state: valid
+                scopes:
+                  - repo
+                  - read:org
+                redirect_uri: >-
+                  https://api.workos.com/data-integrations/github/dik_01EHZNVPK3SFK441A1RGBFSHRT/callback
+                auth_methods:
+                  - oauth
+                credentials:
+                  type: custom
+                  client_id: Iv1.abc123
+                  redacted_client_secret: '6789'
+                installation: null
+                config:
+                  account: myorg-myaccount
+                custom_provider:
+                  name: My OAuth App
+                  authorization_url: https://provider.example.com/oauth/authorize
+                  token_url: https://provider.example.com/oauth/token
+                  refresh_token_url: https://provider.example.com/oauth/token
+                  pkce_enabled: true
+                  request_scope_separator: ' '
+                  scopes_required: false
+                  client_secret_required: true
+                  additional_authorization_parameters:
+                    prompt: consent
+                  token_body_content_type: application/x-www-form-urlencoded
+                  authenticate_via: request_body
+                created_at: '2026-01-15T12:00:00.000Z'
+                updated_at: '2026-01-15T12:00:00.000Z'
+          description: OK
+        '400':
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '401':
+          description: Unauthorized
+        '403':
+          description: Forbidden
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '404':
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '409':
+          description: ''
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '422':
+          description: Unprocessable Entity
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+      summary: Update an organization-owned data integration
+      tags:
+        - pipes
+      x-feature-flag: pipes-management-api
+    delete:
+      description: >-
+        Deletes the organization-owned data integration for a provider and all
+        of its connected installations. For a custom provider, the provider
+        definition is deleted once no user-owned root references it either. The
+        `/organization` suffix selects the environment-level organization-owned
+        root for the provider; it does not name a particular organization.
+      operationId: DataIntegrationsManagementController_deleteOrganizationDataIntegration
+      parameters:
+        - name: slug
+          required: true
+          in: path
+          description: The slug identifier of the data integration.
+          schema:
+            example: github
+            type: string
+      responses:
+        '204':
+          description: No Content
+        '401':
+          description: Unauthorized
+        '404':
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+      summary: Delete an organization-owned data integration
+      tags:
+        - pipes
+      x-feature-flag: pipes-management-api
   /data-integrations/{slug}/token:
     post:
       description: >-
@@ -11193,6 +11510,15 @@ paths:
                     `organization` vends the organization's shared connection
                     and requires `organization_id`.
                   example: user
+                supports_multiple_connections:
+                  type: boolean
+                  description: >-
+                    Set to `true` to use the plural connection contract. If no
+                    `connected_account_id` is supplied and several connections
+                    match, the request returns `account_selection_required`.
+                    When omitted or `false`, only the compatibility connection
+                    is considered.
+                  example: true
               required:
                 - user_id
       responses:
@@ -17118,6 +17444,235 @@ paths:
       summary: Authenticate
       tags:
         - user-management.authentication
+  /user_management/authkit_oauth_resources:
+    post:
+      description: >-
+        Adds an MCP resource indicator (RFC 8707) to an environment, leaving any
+        others in place.
+      operationId: AuthkitOauthResourcesController_create
+      parameters: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/CreateAuthkitOauthResourceDto'
+      responses:
+        '201':
+          description: MCP resource indicator created successfully.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/AuthkitOauthResource'
+              example:
+                object: authkit_oauth_resource
+                id: authkit_oauth_resource_01EHZNVPK3SFK441A1RGBFSHRT
+                uri: https://api.example.com
+                default: false
+                created_at: '2026-01-15T12:00:00.000Z'
+                updated_at: '2026-01-15T12:00:00.000Z'
+        '401':
+          description: Unauthorized
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+              example:
+                message: Unauthorized
+        '422':
+          description: Validation failed.
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+              example:
+                message: >-
+                  AuthKit OAuth resource 'https://api.example.com' already
+                  exists.
+      summary: Create an MCP resource indicator
+      tags:
+        - user-management.authkit-oauth-resources
+    get:
+      description: Lists the MCP resource indicators configured for an environment.
+      operationId: AuthkitOauthResourcesController_list
+      parameters:
+        - name: before
+          required: false
+          in: query
+          description: >-
+            An object ID that defines your place in the list. When the ID is not
+            present, you are at the end of the list. For example, if you make a
+            list request and receive 100 objects, ending with `"obj_123"`, your
+            subsequent call can include `before="obj_123"` to fetch a new batch
+            of objects before `"obj_123"`.
+          schema:
+            example: xxx_01HXYZ123456789ABCDEFGHIJ
+            type: string
+        - name: after
+          required: false
+          in: query
+          description: >-
+            An object ID that defines your place in the list. When the ID is not
+            present, you are at the end of the list. For example, if you make a
+            list request and receive 100 objects, ending with `"obj_123"`, your
+            subsequent call can include `after="obj_123"` to fetch a new batch
+            of objects after `"obj_123"`.
+          schema:
+            example: xxx_01HXYZ987654321KJIHGFEDCBA
+            type: string
+        - name: limit
+          required: false
+          in: query
+          description: >-
+            Upper limit on the number of objects to return, between `1` and
+            `100`.
+          schema:
+            minimum: 1
+            maximum: 100
+            default: 10
+            example: 10
+            type: integer
+        - name: order
+          required: false
+          in: query
+          description: >-
+            Order the results by the creation time. Supported values are `"asc"`
+            (ascending), `"desc"` (descending), and `"normal"` (descending with
+            reversed cursor semantics where `before` fetches older records and
+            `after` fetches newer records). Defaults to `normal`.
+          schema:
+            $ref: '#/components/schemas/PaginationOrder'
+      responses:
+        '200':
+          description: MCP resource indicators listed successfully.
+          content:
+            application/json:
+              schema:
+                allOf:
+                  - type: object
+                    properties:
+                      object:
+                        type: string
+                        description: Indicates this is a list response.
+                        const: list
+                      list_metadata:
+                        type: object
+                        properties:
+                          before:
+                            type:
+                              - string
+                              - 'null'
+                            description: >-
+                              An object ID that defines your place in the list.
+                              When the ID is not present, you are at the start
+                              of the list.
+                            example: authkit_oauth_resource_01HXYZ123456789ABCDEFGHIJ
+                          after:
+                            type:
+                              - string
+                              - 'null'
+                            description: >-
+                              An object ID that defines your place in the list.
+                              When the ID is not present, you are at the end of
+                              the list.
+                            example: authkit_oauth_resource_01HXYZ987654321KJIHGFEDCBA
+                        required:
+                          - before
+                          - after
+                        description: >-
+                          Pagination cursors for navigating between pages of
+                          results.
+                  - type: object
+                    properties:
+                      data:
+                        type: array
+                        description: The list of records for the current page.
+                        items:
+                          $ref: '#/components/schemas/AuthkitOauthResource'
+        '401':
+          description: Unauthorized
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+              example:
+                message: Unauthorized
+      summary: List MCP resource indicators
+      tags:
+        - user-management.authkit-oauth-resources
+  /user_management/authkit_oauth_resources/{id}:
+    delete:
+      description: >-
+        Removes an MCP resource indicator from an environment. Any application
+        consents granted against it are removed too.
+      operationId: AuthkitOauthResourcesController_delete
+      parameters:
+        - name: id
+          required: true
+          in: path
+          description: The ID of the MCP resource indicator to delete.
+          schema:
+            type: string
+            example: authkit_oauth_resource_01EHZNVPK3SFK441A1RGBFSHRT
+      responses:
+        '204':
+          description: MCP resource indicator deleted successfully.
+        '401':
+          description: Unauthorized
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+              example:
+                message: Unauthorized
+        '404':
+          description: MCP resource indicator not found.
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+              example:
+                message: >-
+                  AuthKit OAuth resource not found:
+                  'authkit_oauth_resource_01EHZNVPK3SFK441A1RGBFSHRT'.
+      summary: Delete an MCP resource indicator
+      tags:
+        - user-management.authkit-oauth-resources
   /user_management/authorize:
     get:
       description: >-
@@ -22270,6 +22825,15 @@ paths:
           schema:
             example: org_01EHZNVPK3SFK441A1RGBFSHRT
             type: string
+        - name: supports_multiple_connections
+          required: false
+          in: query
+          description: >-
+            Set to `true` to use the plural connection contract. When omitted or
+            `false`, only the compatibility connection is considered.
+          schema:
+            example: true
+            type: boolean
         - name: connected_account_id
           required: false
           in: query
@@ -22324,90 +22888,122 @@ paths:
             application/json:
               schema:
                 $ref: '#/components/schemas/AccountSelectionRequiredError'
-      summary: Get a connected account
-      tags:
-        - user-management.data-providers
-    delete:
-      description: >-
-        Disconnects WorkOS's account for the user, including removing any stored
-        access and refresh tokens. The user will need to reauthorize if they
-        want to reconnect. This does not revoke access on the provider side.
-      operationId: DataIntegrationsUserManagementController_deleteUserDataInstallation
-      parameters:
-        - name: user_id
-          required: true
-          in: path
-          description: A [User](/reference/authkit/user) identifier.
-          schema:
-            example: user_01EHZNVPK3SFK441A1RGBFSHRT
-            type: string
-        - name: slug
-          required: true
-          in: path
-          description: >-
-            The slug identifier of the provider (e.g., `github`, `slack`,
-            `notion`).
-          schema:
-            example: github
-            type: string
-        - name: organization_id
-          required: false
-          in: query
-          description: >-
-            An [Organization](/reference/organization) identifier. Optional
-            parameter if the connection is scoped to an organization.
-          schema:
-            example: org_01EHZNVPK3SFK441A1RGBFSHRT
-            type: string
-        - name: connected_account_id
-          required: false
-          in: query
+      summary: Get a connected account
+      tags:
+        - user-management.data-providers
+    delete:
+      description: >-
+        Disconnects WorkOS's account for the user, including removing any stored
+        access and refresh tokens. The user will need to reauthorize if they
+        want to reconnect. Access is not revoked on the provider side, except
+        for the WorkOS OAuth provider, whose underlying AuthKit grant is
+        revoked.
+      operationId: DataIntegrationsUserManagementController_deleteUserDataInstallation
+      parameters:
+        - name: user_id
+          required: true
+          in: path
+          description: A [User](/reference/authkit/user) identifier.
+          schema:
+            example: user_01EHZNVPK3SFK441A1RGBFSHRT
+            type: string
+        - name: slug
+          required: true
+          in: path
+          description: >-
+            The slug identifier of the provider (e.g., `github`, `slack`,
+            `notion`).
+          schema:
+            example: github
+            type: string
+        - name: organization_id
+          required: false
+          in: query
+          description: >-
+            An [Organization](/reference/organization) identifier. Optional
+            parameter if the connection is scoped to an organization.
+          schema:
+            example: org_01EHZNVPK3SFK441A1RGBFSHRT
+            type: string
+        - name: supports_multiple_connections
+          required: false
+          in: query
+          description: >-
+            Set to `true` to use the plural connection contract. When omitted or
+            `false`, only the compatibility connection is considered.
+          schema:
+            example: true
+            type: boolean
+        - name: connected_account_id
+          required: false
+          in: query
+          description: >-
+            A [connected account](/reference/pipes/connected-account)
+            identifier. Use this to select the connection to delete.
+          schema:
+            minLength: 1
+            example: data_installation_01EHZNVPK3SFK441A1RGBFSHRT
+            type: string
+      responses:
+        '204':
+          description: The connected account was deleted successfully.
+        '400':
+          description: The connected account selector is malformed.
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '401':
+          description: The request is missing a valid API key.
+        '404':
+          description: The user, organization, or connected account was not found.
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '409':
+          description: >-
+            Several connected accounts match this user for the provider; one
+            must be named.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/AccountSelectionRequiredError'
+        '503':
           description: >-
-            A [connected account](/reference/pipes/connected-account)
-            identifier. Use this to select the connection to delete.
-          schema:
-            minLength: 1
-            example: data_installation_01EHZNVPK3SFK441A1RGBFSHRT
-            type: string
-      responses:
-        '204':
-          description: The connected account was deleted successfully.
-        '400':
-          description: The connected account selector is malformed.
+            The connected account or its WorkOS OAuth grant is being changed by
+            another request. Retry the request.
           content:
             application/json:
               schema:
                 type: object
                 properties:
-                  message:
+                  code:
                     type: string
-                    description: A human-readable description of the error.
-                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
-                required:
-                  - message
-        '401':
-          description: The request is missing a valid API key.
-        '404':
-          description: The user, organization, or connected account was not found.
-          content:
-            application/json:
-              schema:
-                type: object
-                properties:
+                    description: The error code identifying the type of error.
+                    example: concurrent_request
+                    const: concurrent_request
                   message:
                     type: string
                     description: A human-readable description of the error.
-                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                    example: Request could not be processed.
                 required:
+                  - code
                   - message
-        '409':
-          description: >-
-            Several connected accounts match this user for the provider; one
-            must be named.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/AccountSelectionRequiredError'
       summary: Delete a connected account
       tags:
         - user-management.data-providers
@@ -22488,18 +23084,86 @@ paths:
                   - message
         '422':
           description: >-
-            The data integration is not in a valid state or the token
-            combination is invalid.
+            The request body is malformed (`invalid_request_parameters`), the
+            data integration is not in a valid state
+            (`invalid_data_integration_state`), the token combination is invalid
+            (`invalid_token_combination`), or `refresh_token` is not an active
+            WorkOS OAuth grant of this user (`invalid_refresh_token`).
+          content:
+            application/json:
+              schema:
+                oneOf:
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        enum:
+                          - invalid_refresh_token
+                          - invalid_token_combination
+                          - invalid_data_integration_state
+                        description: The error code identifying the type of error.
+                        example: invalid_refresh_token
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: invalid_request_parameters
+                        const: invalid_request_parameters
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Validation failed.
+                      errors:
+                        type: array
+                        items:
+                          type: object
+                          properties:
+                            code:
+                              type: string
+                              description: The validation error code.
+                              example: unknown_event_type
+                            message:
+                              type: string
+                              description: >-
+                                A human-readable description of the validation
+                                error.
+                              example: Invalid enum value.
+                          required:
+                            - code
+                            - message
+                        description: The list of validation errors.
+                    required:
+                      - code
+                      - message
+                      - errors
+        '503':
+          description: >-
+            The WorkOS OAuth grant behind `refresh_token` is being changed by
+            another request. Retry the request.
           content:
             application/json:
               schema:
                 type: object
                 properties:
+                  code:
+                    type: string
+                    description: The error code identifying the type of error.
+                    example: concurrent_request
+                    const: concurrent_request
                   message:
                     type: string
                     description: A human-readable description of the error.
-                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                    example: Request could not be processed.
                 required:
+                  - code
                   - message
       summary: Import a connected account
       tags:
@@ -22536,6 +23200,15 @@ paths:
           schema:
             example: org_01EHZNVPK3SFK441A1RGBFSHRT
             type: string
+        - name: supports_multiple_connections
+          required: false
+          in: query
+          description: >-
+            Set to `true` to use the plural connection contract. When omitted or
+            `false`, only the compatibility connection is considered.
+          schema:
+            example: true
+            type: boolean
         - name: connected_account_id
           required: false
           in: query
@@ -22595,6 +23268,84 @@ paths:
             application/json:
               schema:
                 $ref: '#/components/schemas/AccountSelectionRequiredError'
+        '422':
+          description: >-
+            The request body is malformed (`invalid_request_parameters`), or
+            `refresh_token` is not an active WorkOS OAuth grant of this user
+            (`invalid_refresh_token`).
+          content:
+            application/json:
+              schema:
+                oneOf:
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: invalid_refresh_token
+                        const: invalid_refresh_token
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: invalid_request_parameters
+                        const: invalid_request_parameters
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Validation failed.
+                      errors:
+                        type: array
+                        items:
+                          type: object
+                          properties:
+                            code:
+                              type: string
+                              description: The validation error code.
+                              example: unknown_event_type
+                            message:
+                              type: string
+                              description: >-
+                                A human-readable description of the validation
+                                error.
+                              example: Invalid enum value.
+                          required:
+                            - code
+                            - message
+                        description: The list of validation errors.
+                    required:
+                      - code
+                      - message
+                      - errors
+        '503':
+          description: >-
+            The WorkOS OAuth grant behind `refresh_token` is being changed by
+            another request. Retry the request.
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code:
+                    type: string
+                    description: The error code identifying the type of error.
+                    example: concurrent_request
+                    const: concurrent_request
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: Request could not be processed.
+                required:
+                  - code
+                  - message
       summary: Update a connected account
       tags:
         - user-management.data-providers
@@ -22626,6 +23377,15 @@ paths:
           schema:
             example: org_01EHZNVPK3SFK441A1RGBFSHRT
             type: string
+        - name: supports_multiple_connections
+          required: false
+          in: query
+          description: >-
+            Set to `true` to use the plural connection contract. When omitted or
+            `false`, only the compatibility connection is considered.
+          schema:
+            example: true
+            type: boolean
       responses:
         '200':
           description: The list of data providers was retrieved successfully.
@@ -24319,6 +25079,8 @@ tags:
     description: Single Sign-On endpoints.
   - name: user-management.authentication
     description: User authentication endpoints.
+  - name: user-management.authkit-oauth-resources
+    description: Manage MCP resource indicators (RFC 8707).
   - name: user-management.cors-origins
     description: Manage CORS origins for user management.
   - name: user-management.data-providers
@@ -26490,15 +27252,15 @@ components:
         ownership:
           type: string
           enum:
-            - userland_user
+            - user
             - organization
           description: >-
-            Who owns the Data Integration. `userland_user` (the default) creates
-            the integration users connect their own accounts to; `organization`
+            Who owns the Data Integration. `user` (the default) creates the
+            integration users connect their own accounts to; `organization`
             creates the root organizations connect to. Ownership is fixed at
             creation, and one integration of each ownership may exist per
             provider. Independent of `credentials.type`.
-          example: userland_user
+          example: user
         description:
           type:
             - string
@@ -26801,6 +27563,26 @@ components:
         - user_id
         - pending_authentication_token
         - phone_number
+    CreateAuthkitOauthResourceDto:
+      type: object
+      properties:
+        uri:
+          type: string
+          description: >-
+            The resource URI. May be a wildcard pattern with a single `*` in the
+            leftmost hostname label, where enabled for the environment.
+          example: https://api.example.com
+        default:
+          type: boolean
+          description: >-
+            Whether the resource being created becomes the environment default,
+            clearing any previous default. Applies at creation only — this API
+            has no update endpoint yet, so changing the default on an existing
+            resource is done from the dashboard. A wildcard pattern cannot be
+            the default.
+          example: false
+      required:
+        - uri
     CreateRedirectUriDto:
       type: object
       properties:
@@ -42480,13 +43262,13 @@ components:
         ownership:
           type: string
           enum:
-            - userland_user
+            - user
             - organization
           description: >-
-            Who owns the Data Integration: `userland_user` when users connect
-            their own accounts, `organization` when organizations connect. Fixed
-            at creation.
-          example: userland_user
+            Who owns the Data Integration: `user` when users connect their own
+            accounts, `organization` when organizations connect. Fixed at
+            creation.
+          example: user
         description:
           type:
             - string
@@ -43339,9 +44121,10 @@ components:
                 description: Use updated_at instead.
               connected_account:
                 description: >-
-                  The user's [connected
+                  The user's compatibility [connected
                   account](/reference/pipes/connected-account) for this
-                  provider, or `null` if the user has not connected.
+                  provider, or `null` when the compatibility slot is empty. This
+                  legacy field never selects a standard connection.
                 oneOf:
                   - type: object
                     properties:
@@ -43632,7 +44415,9 @@ components:
                     - updatedAt
                 description: >-
                   The user's connected accounts for this provider in the
-                  requested ownership context.
+                  requested ownership context. This contains only the
+                  compatibility connection unless
+                  `supports_multiple_connections` is `true`.
             required:
               - object
               - id
@@ -43799,6 +44584,42 @@ components:
           example: Entry already present in list
       required:
         - message
+    AuthkitOauthResource:
+      type: object
+      properties:
+        object:
+          type: string
+          description: The object type.
+          const: authkit_oauth_resource
+        id:
+          type: string
+          description: The ID of the MCP resource indicator.
+          example: authkit_oauth_resource_01EHZNVPK3SFK441A1RGBFSHRT
+        uri:
+          type: string
+          description: The resource URI.
+          example: https://api.example.com
+        default:
+          type: boolean
+          description: >-
+            Whether this is the default MCP resource indicator for the
+            environment.
+          example: false
+        created_at:
+          type: string
+          description: The timestamp when the MCP resource indicator was created.
+          example: '2026-01-15T12:00:00.000Z'
+        updated_at:
+          type: string
+          description: The timestamp when the MCP resource indicator was last updated.
+          example: '2026-01-15T12:00:00.000Z'
+      required:
+        - object
+        - id
+        - uri
+        - default
+        - created_at
+        - updated_at
     RedirectUri:
       type: object
       properties:
@@ -44969,7 +45790,7 @@ components:
           example: https://authkit_domain/device
         verification_uri_complete:
           type: string
-          format: password
+          format: uri
           description: Verification URI that includes the user code.
           example: https://authkit_domain/device?user_code=BCDF-GHJK
         expires_in: