@workos/openapi-spec 0.89.0 → 0.91.0

package/dist/types.d.ts

@@ -1418,7 +1418,7 @@ export interface paths {
         };
         /**
          * List data integrations
-         * @description Lists the environment's data integrations configured with `custom` or `organization` credentials, including custom providers and API key integrations.
+         * @description Lists the environment's data integrations configured with `custom` or `organization` credentials, including custom providers and API key integrations. Both user-owned and organization-owned roots are returned, each as its own row with an `ownership`; filter with `ownership` to return only one kind.
          */
         get: operations["DataIntegrationsManagementController_listDataIntegrations"];
         put?: never;
@@ -1442,18 +1442,18 @@ export interface paths {
         };
         /**
          * Get a data integration
-         * @description Retrieves a data integration by its slug.
+         * @description Retrieves the user-owned data integration by its slug.
          */
         get: operations["DataIntegrationsManagementController_getDataIntegration"];
         /**
          * Update a data integration
-         * @description Updates the description, enabled state, or custom credentials of a data integration. For custom providers, `custom_provider` updates the OAuth definition.
+         * @description Updates the description, enabled state, or custom credentials of the user-owned data integration. For custom providers, `custom_provider` updates the OAuth definition.
          */
         put: operations["DataIntegrationsManagementController_updateDataIntegration"];
         post?: never;
         /**
          * Delete a data integration
-         * @description Deletes a data integration and all of its connected installations. For a custom provider, also deletes the custom provider definition.
+         * @description Deletes the user-owned data integration and all of its connected installations. For a custom provider, the provider definition is deleted once no organization-owned root references it either.
          */
         delete: operations["DataIntegrationsManagementController_deleteDataIntegration"];
         options?: never;
@@ -1541,6 +1541,34 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/data-integrations/{slug}/organization": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get an organization-owned data integration
+         * @description Retrieves the organization-owned data integration for a provider by its slug. The `/organization` suffix selects the environment-level organization-owned root for the provider; it does not name a particular organization.
+         */
+        get: operations["DataIntegrationsManagementController_getOrganizationDataIntegration"];
+        /**
+         * Update an organization-owned data integration
+         * @description Updates the description, enabled state, or custom credentials of the organization-owned data integration for a provider. For custom providers, `custom_provider` updates the OAuth definition, which is shared with the user-owned root. The `/organization` suffix selects the environment-level organization-owned root for the provider; it does not name a particular organization.
+         */
+        put: operations["DataIntegrationsManagementController_updateOrganizationDataIntegration"];
+        post?: never;
+        /**
+         * Delete an organization-owned data integration
+         * @description Deletes the organization-owned data integration for a provider and all of its connected installations. For a custom provider, the provider definition is deleted once no user-owned root references it either. The `/organization` suffix selects the environment-level organization-owned root for the provider; it does not name a particular organization.
+         */
+        delete: operations["DataIntegrationsManagementController_deleteOrganizationDataIntegration"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/data-integrations/{slug}/token": {
         parameters: {
             query?: never;
@@ -2539,6 +2567,50 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/user_management/authkit_oauth_resources": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List MCP resource indicators
+         * @description Lists the MCP resource indicators configured for an environment.
+         */
+        get: operations["AuthkitOauthResourcesController_list"];
+        put?: never;
+        /**
+         * Create an MCP resource indicator
+         * @description Adds an MCP resource indicator (RFC 8707) to an environment, leaving any others in place.
+         */
+        post: operations["AuthkitOauthResourcesController_create"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/user_management/authkit_oauth_resources/{id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /**
+         * Delete an MCP resource indicator
+         * @description Removes an MCP resource indicator from an environment. Any application consents granted against it are removed too.
+         */
+        delete: operations["AuthkitOauthResourcesController_delete"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/user_management/authorize": {
         parameters: {
             query?: never;
@@ -3419,7 +3491,7 @@ export interface paths {
         post: operations["DataIntegrationsUserManagementController_createUserDataInstallation"];
         /**
          * Delete a connected account
-         * @description Disconnects WorkOS's account for the user, including removing any stored access and refresh tokens. The user will need to reauthorize if they want to reconnect. This does not revoke access on the provider side.
+         * @description Disconnects WorkOS's account for the user, including removing any stored access and refresh tokens. The user will need to reauthorize if they want to reconnect. Access is not revoked on the provider side, except for the WorkOS OAuth provider, whose underlying AuthKit grant is revoked.
          */
         delete: operations["DataIntegrationsUserManagementController_deleteUserDataInstallation"];
         options?: never;
@@ -5268,11 +5340,11 @@ export interface components {
              */
             provider: string;
             /**
-             * @description Who owns the Data Integration. `userland_user` (the default) creates the integration users connect their own accounts to; `organization` creates the root organizations connect to. Ownership is fixed at creation, and one integration of each ownership may exist per provider. Independent of `credentials.type`.
-             * @example userland_user
+             * @description Who owns the Data Integration. `user` (the default) creates the integration users connect their own accounts to; `organization` creates the root organizations connect to. Ownership is fixed at creation, and one integration of each ownership may exist per provider. Independent of `credentials.type`.
+             * @example user
              * @enum {string}
              */
-            ownership?: "userland_user" | "organization";
+            ownership?: "user" | "organization";
             /**
              * @description An optional description of the Data Integration.
              * @example Production GitHub app
@@ -5501,6 +5573,18 @@ export interface components {
              */
             user_agent?: string;
         };
+        CreateAuthkitOauthResourceDto: {
+            /**
+             * @description The resource URI. May be a wildcard pattern with a single `*` in the leftmost hostname label, where enabled for the environment.
+             * @example https://api.example.com
+             */
+            uri: string;
+            /**
+             * @description Whether the resource being created becomes the environment default, clearing any previous default. Applies at creation only — this API has no update endpoint yet, so changing the default on an existing resource is done from the dashboard. A wildcard pattern cannot be the default.
+             * @example false
+             */
+            default?: boolean;
+        };
         CreateRedirectUriDto: {
             /**
              * @description The redirect URI to create.
@@ -17343,11 +17427,11 @@ export interface components {
              */
             integration_type: string;
             /**
-             * @description Who owns the Data Integration: `userland_user` when users connect their own accounts, `organization` when organizations connect. Fixed at creation.
-             * @example userland_user
+             * @description Who owns the Data Integration: `user` when users connect their own accounts, `organization` when organizations connect. Fixed at creation.
+             * @example user
              * @enum {string}
              */
-            ownership: "userland_user" | "organization";
+            ownership: "user" | "organization";
             /**
              * @description An optional description of the Data Integration.
              * @example Production GitHub app
@@ -17926,7 +18010,7 @@ export interface components {
                  * @description Use updated_at instead.
                  */
                 updatedAt: string;
-                /** @description The user's [connected account](/reference/pipes/connected-account) for this provider, or `null` if the user has not connected. */
+                /** @description The user's compatibility [connected account](/reference/pipes/connected-account) for this provider, or `null` when the compatibility slot is empty. This legacy field never selects a standard connection. */
                 connected_account: {
                     /**
                      * @description Distinguishes the connected account object.
@@ -18026,7 +18110,7 @@ export interface components {
                      */
                     updatedAt: string;
                 } | null;
-                /** @description The user's connected accounts for this provider in the requested ownership context. */
+                /** @description The user's connected accounts for this provider in the requested ownership context. This contains only the compatibility connection unless `supports_multiple_connections` is `true`. */
                 connected_accounts: {
                     /**
                      * @description Distinguishes the connected account object.
@@ -18237,6 +18321,38 @@ export interface components {
              */
             message: string;
         };
+        AuthkitOauthResource: {
+            /**
+             * @description The object type.
+             * @constant
+             */
+            object: "authkit_oauth_resource";
+            /**
+             * @description The ID of the MCP resource indicator.
+             * @example authkit_oauth_resource_01EHZNVPK3SFK441A1RGBFSHRT
+             */
+            id: string;
+            /**
+             * @description The resource URI.
+             * @example https://api.example.com
+             */
+            uri: string;
+            /**
+             * @description Whether this is the default MCP resource indicator for the environment.
+             * @example false
+             */
+            default: boolean;
+            /**
+             * @description The timestamp when the MCP resource indicator was created.
+             * @example 2026-01-15T12:00:00.000Z
+             */
+            created_at: string;
+            /**
+             * @description The timestamp when the MCP resource indicator was last updated.
+             * @example 2026-01-15T12:00:00.000Z
+             */
+            updated_at: string;
+        };
         RedirectUri: {
             /**
              * @description The object type.
@@ -19122,7 +19238,7 @@ export interface components {
              */
             verification_uri: string;
             /**
-             * Format: password
+             * Format: uri
              * @description Verification URI that includes the user code.
              * @example https://authkit_domain/device?user_code=BCDF-GHJK
              */
@@ -20920,6 +21036,8 @@ export interface operations {
                 limit?: number;
                 /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. */
                 order?: components["schemas"]["PaginationOrder"];
+                /** @description Only return sessions of instances acting within this organization. */
+                organization_id?: string;
                 /** @description Only return sessions of instances minted from this blueprint. */
                 agent_blueprint_id?: string;
                 /** @description Only return sessions belonging to this agent instance. */
@@ -28519,6 +28637,8 @@ export interface operations {
                 limit?: number;
                 /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. */
                 order?: components["schemas"]["PaginationOrder"];
+                /** @description Only return Data Integrations with this ownership: `user` for the integrations users connect their own accounts to, or `organization` for the roots organizations connect to. Omit to return both. */
+                ownership?: "user" | "organization";
             };
             header?: never;
             path?: never;
@@ -28542,6 +28662,36 @@ export interface operations {
                 };
                 content?: never;
             };
+            /** @description Organization-owned data integrations are not available for this environment. */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            /** @description Unprocessable Entity */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
         };
     };
     DataIntegrationsManagementController_createDataIntegration: {
@@ -29275,6 +29425,11 @@ export interface operations {
                      * @enum {string}
                      */
                     connection_owner?: "user" | "organization";
+                    /**
+                     * @description Set to `true` to use the plural connection contract. If no `connected_account_id` is supplied and several connections match, the request returns `account_selection_required`. When omitted or `false`, only the compatibility connection is considered.
+                     * @example true
+                     */
+                    supports_multiple_connections?: boolean;
                 };
             };
         };
@@ -29382,41 +29537,110 @@ export interface operations {
             };
         };
     };
-    DataIntegrationsController_getUserlandUserToken: {
+    DataIntegrationsManagementController_getOrganizationDataIntegration: {
         parameters: {
             query?: never;
             header?: never;
             path: {
-                /** @description The identifier of the integration. */
+                /** @description The slug identifier of the data integration. */
                 slug: string;
             };
             cookie?: never;
         };
-        requestBody: {
-            content: {
-                "application/json": {
-                    /**
-                     * @description A [User](/reference/authkit/user) identifier. When `connection_owner` is `organization`, this is the user the credentials are vended on behalf of; they must be an active member of the organization.
-                     * @example user_01EHZNVPK3SFK441A1RGBFSHRT
-                     */
-                    user_id: string;
-                    /**
-                     * @description An [Organization](/reference/organization) identifier. Optional parameter to scope the connection to a specific organization. Required when `connection_owner` is `organization`.
-                     * @example org_01EHZNVPK3SFK441A1RGBFSHRT
-                     */
-                    organization_id?: string;
-                    /**
-                     * @description A [connected account](/reference/pipes/connected-account) identifier. Use this to select a specific connection when the user has several for this provider.
-                     * @example data_installation_01EHZNVPK3SFK441A1RGBFSHRT
-                     */
-                    connected_account_id?: string;
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
                     /**
-                     * @description Which connection to vend from. `user` (the default) vends the user's own connection and requires `user_id`. `organization` vends the organization's shared connection and requires `organization_id`.
-                     * @example user
-                     * @enum {string}
+                     * @example {
+                     *       "object": "data_integration",
+                     *       "id": "data_integration_01EHZNVPK3SFK441A1RGBFSHRT",
+                     *       "slug": "github",
+                     *       "integration_type": "github",
+                     *       "ownership": "organization",
+                     *       "description": "Production GitHub app",
+                     *       "enabled": true,
+                     *       "state": "valid",
+                     *       "scopes": [
+                     *         "repo",
+                     *         "read:org"
+                     *       ],
+                     *       "redirect_uri": "https://api.workos.com/data-integrations/github/dik_01EHZNVPK3SFK441A1RGBFSHRT/callback",
+                     *       "auth_methods": [
+                     *         "oauth"
+                     *       ],
+                     *       "credentials": {
+                     *         "type": "custom",
+                     *         "client_id": "Iv1.abc123",
+                     *         "redacted_client_secret": "6789"
+                     *       },
+                     *       "installation": null,
+                     *       "config": {
+                     *         "account": "myorg-myaccount"
+                     *       },
+                     *       "custom_provider": {
+                     *         "name": "My OAuth App",
+                     *         "authorization_url": "https://provider.example.com/oauth/authorize",
+                     *         "token_url": "https://provider.example.com/oauth/token",
+                     *         "refresh_token_url": "https://provider.example.com/oauth/token",
+                     *         "pkce_enabled": true,
+                     *         "request_scope_separator": " ",
+                     *         "scopes_required": false,
+                     *         "client_secret_required": true,
+                     *         "additional_authorization_parameters": {
+                     *           "prompt": "consent"
+                     *         },
+                     *         "token_body_content_type": "application/x-www-form-urlencoded",
+                     *         "authenticate_via": "request_body"
+                     *       },
+                     *       "created_at": "2026-01-15T12:00:00.000Z",
+                     *       "updated_at": "2026-01-15T12:00:00.000Z"
+                     *     }
                      */
-                    connection_owner?: "user" | "organization";
+                    "application/json": components["schemas"]["DataIntegration"];
+                };
+            };
+            /** @description Unauthorized */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Not Found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
                 };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
+        };
+    };
+    DataIntegrationsManagementController_updateOrganizationDataIntegration: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The slug identifier of the data integration. */
+                slug: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["UpdateDataIntegrationDto"];
             };
         };
         responses: {
@@ -29426,7 +29650,53 @@ export interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["DataIntegrationAccessTokenResponse"];
+                    /**
+                     * @example {
+                     *       "object": "data_integration",
+                     *       "id": "data_integration_01EHZNVPK3SFK441A1RGBFSHRT",
+                     *       "slug": "github",
+                     *       "integration_type": "github",
+                     *       "ownership": "organization",
+                     *       "description": "Production GitHub app",
+                     *       "enabled": true,
+                     *       "state": "valid",
+                     *       "scopes": [
+                     *         "repo",
+                     *         "read:org"
+                     *       ],
+                     *       "redirect_uri": "https://api.workos.com/data-integrations/github/dik_01EHZNVPK3SFK441A1RGBFSHRT/callback",
+                     *       "auth_methods": [
+                     *         "oauth"
+                     *       ],
+                     *       "credentials": {
+                     *         "type": "custom",
+                     *         "client_id": "Iv1.abc123",
+                     *         "redacted_client_secret": "6789"
+                     *       },
+                     *       "installation": null,
+                     *       "config": {
+                     *         "account": "myorg-myaccount"
+                     *       },
+                     *       "custom_provider": {
+                     *         "name": "My OAuth App",
+                     *         "authorization_url": "https://provider.example.com/oauth/authorize",
+                     *         "token_url": "https://provider.example.com/oauth/token",
+                     *         "refresh_token_url": "https://provider.example.com/oauth/token",
+                     *         "pkce_enabled": true,
+                     *         "request_scope_separator": " ",
+                     *         "scopes_required": false,
+                     *         "client_secret_required": true,
+                     *         "additional_authorization_parameters": {
+                     *           "prompt": "consent"
+                     *         },
+                     *         "token_body_content_type": "application/x-www-form-urlencoded",
+                     *         "authenticate_via": "request_body"
+                     *       },
+                     *       "created_at": "2026-01-15T12:00:00.000Z",
+                     *       "updated_at": "2026-01-15T12:00:00.000Z"
+                     *     }
+                     */
+                    "application/json": components["schemas"]["DataIntegration"];
                 };
             };
             /** @description Bad Request */
@@ -29451,7 +29721,7 @@ export interface operations {
                 };
                 content?: never;
             };
-            /** @description The user is not an active member of the organization named for an organization connection. */
+            /** @description Forbidden */
             403: {
                 headers: {
                     [name: string]: unknown;
@@ -29466,7 +29736,7 @@ export interface operations {
                     };
                 };
             };
-            /** @description The data integration or selected connected account was not found. */
+            /** @description Not Found */
             404: {
                 headers: {
                     [name: string]: unknown;
@@ -29481,64 +29751,242 @@ export interface operations {
                     };
                 };
             };
-            /** @description Several connected accounts match this user for the provider; one must be named. */
             409: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["AccountSelectionRequiredError"];
-                };
-            };
-            /** @description The matched installation uses a different auth method than this endpoint expects. */
-            422: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["AuthMethodMismatchError"];
-                };
-            };
-        };
-    };
-    DirectoriesController_list: {
-        parameters: {
-            query?: {
-                /** @description An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. */
-                before?: string;
-                /** @description An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. */
-                after?: string;
-                /** @description Upper limit on the number of objects to return, between `1` and `100`. */
-                limit?: number;
-                /** @description Order the results by the creation time. Defaults to `normal`. */
-                order?: components["schemas"]["PaginationOrder"];
-                /** @description Filter Directories by their associated organization. */
-                organization_id?: string;
-                /** @description Searchable text to match against Directory names. */
-                search?: string;
-                /**
-                 * @deprecated
-                 * @description Filter Directories by their associated domain.
-                 */
-                domain?: string;
-            };
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        requestBody?: never;
-        responses: {
-            /** @description OK */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["DirectoryList"];
-                };
-            };
-            /** @description Forbidden */
-            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            /** @description Unprocessable Entity */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
+        };
+    };
+    DataIntegrationsManagementController_deleteOrganizationDataIntegration: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The slug identifier of the data integration. */
+                slug: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description No Content */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Unauthorized */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Not Found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
+        };
+    };
+    DataIntegrationsController_getUserlandUserToken: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The identifier of the integration. */
+                slug: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /**
+                     * @description A [User](/reference/authkit/user) identifier. When `connection_owner` is `organization`, this is the user the credentials are vended on behalf of; they must be an active member of the organization.
+                     * @example user_01EHZNVPK3SFK441A1RGBFSHRT
+                     */
+                    user_id: string;
+                    /**
+                     * @description An [Organization](/reference/organization) identifier. Optional parameter to scope the connection to a specific organization. Required when `connection_owner` is `organization`.
+                     * @example org_01EHZNVPK3SFK441A1RGBFSHRT
+                     */
+                    organization_id?: string;
+                    /**
+                     * @description A [connected account](/reference/pipes/connected-account) identifier. Use this to select a specific connection when the user has several for this provider.
+                     * @example data_installation_01EHZNVPK3SFK441A1RGBFSHRT
+                     */
+                    connected_account_id?: string;
+                    /**
+                     * @description Which connection to vend from. `user` (the default) vends the user's own connection and requires `user_id`. `organization` vends the organization's shared connection and requires `organization_id`.
+                     * @example user
+                     * @enum {string}
+                     */
+                    connection_owner?: "user" | "organization";
+                    /**
+                     * @description Set to `true` to use the plural connection contract. If no `connected_account_id` is supplied and several connections match, the request returns `account_selection_required`. When omitted or `false`, only the compatibility connection is considered.
+                     * @example true
+                     */
+                    supports_multiple_connections?: boolean;
+                };
+            };
+        };
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["DataIntegrationAccessTokenResponse"];
+                };
+            };
+            /** @description Bad Request */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            /** @description Unauthorized */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description The user is not an active member of the organization named for an organization connection. */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            /** @description The data integration or selected connected account was not found. */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            /** @description Several connected accounts match this user for the provider; one must be named. */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AccountSelectionRequiredError"];
+                };
+            };
+            /** @description The matched installation uses a different auth method than this endpoint expects. */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AuthMethodMismatchError"];
+                };
+            };
+        };
+    };
+    DirectoriesController_list: {
+        parameters: {
+            query?: {
+                /** @description An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. */
+                before?: string;
+                /** @description An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. */
+                after?: string;
+                /** @description Upper limit on the number of objects to return, between `1` and `100`. */
+                limit?: number;
+                /** @description Order the results by the creation time. Defaults to `normal`. */
+                order?: components["schemas"]["PaginationOrder"];
+                /** @description Filter Directories by their associated organization. */
+                organization_id?: string;
+                /** @description Searchable text to match against Directory names. */
+                search?: string;
+                /**
+                 * @deprecated
+                 * @description Filter Directories by their associated domain.
+                 */
+                domain?: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["DirectoryList"];
+                };
+            };
+            /** @description Forbidden */
+            403: {
                 headers: {
                     [name: string]: unknown;
                 };
@@ -34659,6 +35107,212 @@ export interface operations {
             };
         };
     };
+    AuthkitOauthResourcesController_list: {
+        parameters: {
+            query?: {
+                /** @description An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`. */
+                before?: string;
+                /** @description An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`. */
+                after?: string;
+                /** @description Upper limit on the number of objects to return, between `1` and `100`. */
+                limit?: number;
+                /** @description Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `normal`. */
+                order?: components["schemas"]["PaginationOrder"];
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description MCP resource indicators listed successfully. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description Indicates this is a list response.
+                         * @constant
+                         */
+                        object?: "list";
+                        /** @description Pagination cursors for navigating between pages of results. */
+                        list_metadata?: {
+                            /**
+                             * @description An object ID that defines your place in the list. When the ID is not present, you are at the start of the list.
+                             * @example authkit_oauth_resource_01HXYZ123456789ABCDEFGHIJ
+                             */
+                            before: string | null;
+                            /**
+                             * @description An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.
+                             * @example authkit_oauth_resource_01HXYZ987654321KJIHGFEDCBA
+                             */
+                            after: string | null;
+                        };
+                    } & {
+                        /** @description The list of records for the current page. */
+                        data?: components["schemas"]["AuthkitOauthResource"][];
+                    };
+                };
+            };
+            /** @description Unauthorized */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "message": "Unauthorized"
+                     *     }
+                     */
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
+        };
+    };
+    AuthkitOauthResourcesController_create: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["CreateAuthkitOauthResourceDto"];
+            };
+        };
+        responses: {
+            /** @description MCP resource indicator created successfully. */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "object": "authkit_oauth_resource",
+                     *       "id": "authkit_oauth_resource_01EHZNVPK3SFK441A1RGBFSHRT",
+                     *       "uri": "https://api.example.com",
+                     *       "default": false,
+                     *       "created_at": "2026-01-15T12:00:00.000Z",
+                     *       "updated_at": "2026-01-15T12:00:00.000Z"
+                     *     }
+                     */
+                    "application/json": components["schemas"]["AuthkitOauthResource"];
+                };
+            };
+            /** @description Unauthorized */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "message": "Unauthorized"
+                     *     }
+                     */
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            /** @description Validation failed. */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "message": "AuthKit OAuth resource 'https://api.example.com' already exists."
+                     *     }
+                     */
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
+        };
+    };
+    AuthkitOauthResourcesController_delete: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The ID of the MCP resource indicator to delete. */
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description MCP resource indicator deleted successfully. */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Unauthorized */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "message": "Unauthorized"
+                     *     }
+                     */
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
+            /** @description MCP resource indicator not found. */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "message": "AuthKit OAuth resource not found: 'authkit_oauth_resource_01EHZNVPK3SFK441A1RGBFSHRT'."
+                     *     }
+                     */
+                    "application/json": {
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         */
+                        message: string;
+                    };
+                };
+            };
+        };
+    };
     UserlandSsoController_authorize: {
         parameters: {
             query: {
@@ -38961,6 +39615,8 @@ export interface operations {
             query?: {
                 /** @description An [Organization](/reference/organization) identifier. Optional parameter if the connection is scoped to an organization. */
                 organization_id?: string;
+                /** @description Set to `true` to use the plural connection contract. When omitted or `false`, only the compatibility connection is considered. */
+                supports_multiple_connections?: boolean;
                 /** @description A [connected account](/reference/pipes/connected-account) identifier. Use this to select a specific connection when the user has several for this provider. */
                 connected_account_id?: string;
             };
@@ -39037,6 +39693,8 @@ export interface operations {
             query?: {
                 /** @description An [Organization](/reference/organization) identifier. Optional parameter if the connection is scoped to an organization. */
                 organization_id?: string;
+                /** @description Set to `true` to use the plural connection contract. When omitted or `false`, only the compatibility connection is considered. */
+                supports_multiple_connections?: boolean;
                 /** @description A [connected account](/reference/pipes/connected-account) identifier. Use this to select the connection to update. */
                 connected_account_id?: string;
             };
@@ -39110,6 +39768,73 @@ export interface operations {
                     "application/json": components["schemas"]["AccountSelectionRequiredError"];
                 };
             };
+            /** @description The request body is malformed (`invalid_request_parameters`), or `refresh_token` is not an active WorkOS OAuth grant of this user (`invalid_refresh_token`). */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example invalid_refresh_token
+                         * @constant
+                         */
+                        code: "invalid_refresh_token";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example invalid_request_parameters
+                         * @constant
+                         */
+                        code: "invalid_request_parameters";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Validation failed.
+                         */
+                        message: string;
+                        /** @description The list of validation errors. */
+                        errors: {
+                            /**
+                             * @description The validation error code.
+                             * @example unknown_event_type
+                             */
+                            code: string;
+                            /**
+                             * @description A human-readable description of the validation error.
+                             * @example Invalid enum value.
+                             */
+                            message: string;
+                        }[];
+                    };
+                };
+            };
+            /** @description The WorkOS OAuth grant behind `refresh_token` is being changed by another request. Retry the request. */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example concurrent_request
+                         * @constant
+                         */
+                        code: "concurrent_request";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    };
+                };
+            };
         };
     };
     DataIntegrationsUserManagementController_createUserDataInstallation: {
@@ -39179,16 +39904,68 @@ export interface operations {
                     };
                 };
             };
-            /** @description The data integration is not in a valid state or the token combination is invalid. */
+            /** @description The request body is malformed (`invalid_request_parameters`), the data integration is not in a valid state (`invalid_data_integration_state`), the token combination is invalid (`invalid_token_combination`), or `refresh_token` is not an active WorkOS OAuth grant of this user (`invalid_refresh_token`). */
             422: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example invalid_refresh_token
+                         * @enum {string}
+                         */
+                        code: "invalid_refresh_token" | "invalid_token_combination" | "invalid_data_integration_state";
                         /**
                          * @description A human-readable description of the error.
-                         * @example Organization not found: 'org_01EHQMYV6MBK39QC5PZXHY59C3'.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    } | {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example invalid_request_parameters
+                         * @constant
+                         */
+                        code: "invalid_request_parameters";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Validation failed.
+                         */
+                        message: string;
+                        /** @description The list of validation errors. */
+                        errors: {
+                            /**
+                             * @description The validation error code.
+                             * @example unknown_event_type
+                             */
+                            code: string;
+                            /**
+                             * @description A human-readable description of the validation error.
+                             * @example Invalid enum value.
+                             */
+                            message: string;
+                        }[];
+                    };
+                };
+            };
+            /** @description The WorkOS OAuth grant behind `refresh_token` is being changed by another request. Retry the request. */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example concurrent_request
+                         * @constant
+                         */
+                        code: "concurrent_request";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
                          */
                         message: string;
                     };
@@ -39201,6 +39978,8 @@ export interface operations {
             query?: {
                 /** @description An [Organization](/reference/organization) identifier. Optional parameter if the connection is scoped to an organization. */
                 organization_id?: string;
+                /** @description Set to `true` to use the plural connection contract. When omitted or `false`, only the compatibility connection is considered. */
+                supports_multiple_connections?: boolean;
                 /** @description A [connected account](/reference/pipes/connected-account) identifier. Use this to select the connection to delete. */
                 connected_account_id?: string;
             };
@@ -39268,6 +40047,27 @@ export interface operations {
                     "application/json": components["schemas"]["AccountSelectionRequiredError"];
                 };
             };
+            /** @description The connected account or its WorkOS OAuth grant is being changed by another request. Retry the request. */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description The error code identifying the type of error.
+                         * @example concurrent_request
+                         * @constant
+                         */
+                        code: "concurrent_request";
+                        /**
+                         * @description A human-readable description of the error.
+                         * @example Request could not be processed.
+                         */
+                        message: string;
+                    };
+                };
+            };
         };
     };
     DataIntegrationsUserManagementController_getUserDataIntegrations: {
@@ -39275,6 +40075,8 @@ export interface operations {
             query?: {
                 /** @description An [Organization](/reference/organization) identifier. Optional parameter to filter connections for a specific organization. */
                 organization_id?: string;
+                /** @description Set to `true` to use the plural connection contract. When omitted or `false`, only the compatibility connection is considered. */
+                supports_multiple_connections?: boolean;
             };
             header?: never;
             path: {