@workos/openapi-spec 0.90.0 → 0.92.0

package/dist/open-api-spec.yaml

@@ -1783,6 +1783,13 @@ paths:
             `after` fetches newer records). Defaults to `normal`.
           schema:
             $ref: '#/components/schemas/PaginationOrder'
+        - name: organization_id
+          required: false
+          in: query
+          description: Only return sessions of instances acting within this organization.
+          schema:
+            type: string
+            example: org_01EHWNCE74X7JSDV0X3SZ3KJNY
         - name: agent_blueprint_id
           required: false
           in: query
@@ -10352,7 +10359,9 @@ paths:
       description: >-
         Lists the environment's data integrations configured with `custom` or
         `organization` credentials, including custom providers and API key
-        integrations.
+        integrations. Both user-owned and organization-owned roots are returned,
+        each as its own row with an `ownership`; filter with `ownership` to
+        return only one kind.
       operationId: DataIntegrationsManagementController_listDataIntegrations
       parameters:
         - name: before
@@ -10401,6 +10410,19 @@ paths:
             `after` fetches newer records). Defaults to `normal`.
           schema:
             $ref: '#/components/schemas/PaginationOrder'
+        - name: ownership
+          required: false
+          in: query
+          description: >-
+            Only return Data Integrations with this ownership: `user` for the
+            integrations users connect their own accounts to, or `organization`
+            for the roots organizations connect to. Omit to return both.
+          schema:
+            example: user
+            enum:
+              - user
+              - organization
+            type: string
       responses:
         '200':
           description: OK
@@ -10410,13 +10432,41 @@ paths:
                 $ref: '#/components/schemas/DataIntegrationList'
         '401':
           description: Unauthorized
+        '404':
+          description: >-
+            Organization-owned data integrations are not available for this
+            environment.
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '422':
+          description: Unprocessable Entity
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
       summary: List data integrations
       tags:
         - pipes
       x-feature-flag: pipes-management-api
   /data-integrations/{slug}:
     get:
-      description: Retrieves a data integration by its slug.
+      description: Retrieves the user-owned data integration by its slug.
       operationId: DataIntegrationsManagementController_getDataIntegration
       parameters:
         - name: slug
@@ -10454,9 +10504,9 @@ paths:
       x-feature-flag: pipes-management-api
     put:
       description: >-
-        Updates the description, enabled state, or custom credentials of a data
-        integration. For custom providers, `custom_provider` updates the OAuth
-        definition.
+        Updates the description, enabled state, or custom credentials of the
+        user-owned data integration. For custom providers, `custom_provider`
+        updates the OAuth definition.
       operationId: DataIntegrationsManagementController_updateDataIntegration
       parameters:
         - name: slug
@@ -10554,8 +10604,9 @@ paths:
       x-feature-flag: pipes-management-api
     delete:
       description: >-
-        Deletes a data integration and all of its connected installations. For a
-        custom provider, also deletes the custom provider definition.
+        Deletes the user-owned data integration and all of its connected
+        installations. For a custom provider, the provider definition is deleted
+        once no organization-owned root references it either.
       operationId: DataIntegrationsManagementController_deleteDataIntegration
       parameters:
         - name: slug
@@ -11047,6 +11098,15 @@ paths:
                     `organization` vends the organization's shared connection
                     and requires `organization_id`.
                   example: user
+                supports_multiple_connections:
+                  type: boolean
+                  description: >-
+                    Set to `true` to use the plural connection contract. If no
+                    `connected_account_id` is supplied and several connections
+                    match, the request returns `account_selection_required`.
+                    When omitted or `false`, only the compatibility connection
+                    is considered.
+                  example: true
               required:
                 - user_id
       responses:
@@ -11136,104 +11196,71 @@ paths:
       summary: Vend credentials for a connected account
       tags:
         - pipes
-  /data-integrations/{slug}/token:
-    post:
+  /data-integrations/{slug}/organization:
+    get:
       description: >-
-        Fetches a valid OAuth access token for a user's connected account.
-        WorkOS automatically handles token refresh, ensuring you always receive
-        a valid, non-expired token.
-      operationId: DataIntegrationsController_getUserlandUserToken
+        Retrieves the organization-owned data integration for a provider by its
+        slug. The `/organization` suffix selects the environment-level
+        organization-owned root for the provider; it does not name a particular
+        organization.
+      operationId: DataIntegrationsManagementController_getOrganizationDataIntegration
       parameters:
         - name: slug
           required: true
           in: path
-          description: The identifier of the integration.
+          description: The slug identifier of the data integration.
           schema:
             example: github
             type: string
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              type: object
-              properties:
-                user_id:
-                  type: string
-                  description: >-
-                    A [User](/reference/authkit/user) identifier. When
-                    `connection_owner` is `organization`, this is the user the
-                    credentials are vended on behalf of; they must be an active
-                    member of the organization.
-                  example: user_01EHZNVPK3SFK441A1RGBFSHRT
-                organization_id:
-                  type: string
-                  description: >-
-                    An [Organization](/reference/organization) identifier.
-                    Optional parameter to scope the connection to a specific
-                    organization. Required when `connection_owner` is
-                    `organization`.
-                  example: org_01EHZNVPK3SFK441A1RGBFSHRT
-                connected_account_id:
-                  type: string
-                  minLength: 1
-                  description: >-
-                    A [connected account](/reference/pipes/connected-account)
-                    identifier. Use this to select a specific connection when
-                    the user has several for this provider.
-                  example: data_installation_01EHZNVPK3SFK441A1RGBFSHRT
-                connection_owner:
-                  type: string
-                  enum:
-                    - user
-                    - organization
-                  description: >-
-                    Which connection to vend from. `user` (the default) vends
-                    the user's own connection and requires `user_id`.
-                    `organization` vends the organization's shared connection
-                    and requires `organization_id`.
-                  example: user
-              required:
-                - user_id
       responses:
         '200':
-          description: OK
           content:
             application/json:
               schema:
-                $ref: '#/components/schemas/DataIntegrationAccessTokenResponse'
-        '400':
-          description: Bad Request
-          content:
-            application/json:
-              schema:
-                type: object
-                properties:
-                  message:
-                    type: string
-                    description: A human-readable description of the error.
-                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
-                required:
-                  - message
+                $ref: '#/components/schemas/DataIntegration'
+              example:
+                object: data_integration
+                id: data_integration_01EHZNVPK3SFK441A1RGBFSHRT
+                slug: github
+                integration_type: github
+                ownership: organization
+                description: Production GitHub app
+                enabled: true
+                state: valid
+                scopes:
+                  - repo
+                  - read:org
+                redirect_uri: >-
+                  https://api.workos.com/data-integrations/github/dik_01EHZNVPK3SFK441A1RGBFSHRT/callback
+                auth_methods:
+                  - oauth
+                credentials:
+                  type: custom
+                  client_id: Iv1.abc123
+                  redacted_client_secret: '6789'
+                installation: null
+                config:
+                  account: myorg-myaccount
+                custom_provider:
+                  name: My OAuth App
+                  authorization_url: https://provider.example.com/oauth/authorize
+                  token_url: https://provider.example.com/oauth/token
+                  refresh_token_url: https://provider.example.com/oauth/token
+                  pkce_enabled: true
+                  request_scope_separator: ' '
+                  scopes_required: false
+                  client_secret_required: true
+                  additional_authorization_parameters:
+                    prompt: consent
+                  token_body_content_type: application/x-www-form-urlencoded
+                  authenticate_via: request_body
+                created_at: '2026-01-15T12:00:00.000Z'
+                updated_at: '2026-01-15T12:00:00.000Z'
+          description: OK
         '401':
           description: Unauthorized
-        '403':
-          description: >-
-            The user is not an active member of the organization named for an
-            organization connection.
-          content:
-            application/json:
-              schema:
-                type: object
-                properties:
-                  message:
-                    type: string
-                    description: A human-readable description of the error.
-                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
-                required:
-                  - message
         '404':
-          description: The data integration or selected connected account was not found.
+          description: Not Found
           content:
             application/json:
               schema:
@@ -11245,112 +11272,80 @@ paths:
                     example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
                 required:
                   - message
-        '409':
-          description: >-
-            Several connected accounts match this user for the provider; one
-            must be named.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/AccountSelectionRequiredError'
-        '422':
-          description: >-
-            The matched installation uses a different auth method than this
-            endpoint expects.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/AuthMethodMismatchError'
-      summary: Get an access token for a connected account
+      summary: Get an organization-owned data integration
       tags:
         - pipes
-  /directories:
-    get:
+      x-feature-flag: pipes-management-api
+    put:
       description: >-
-        Get a list of all of your existing directories matching the criteria
-        specified.
-      operationId: DirectoriesController_list
+        Updates the description, enabled state, or custom credentials of the
+        organization-owned data integration for a provider. For custom
+        providers, `custom_provider` updates the OAuth definition, which is
+        shared with the user-owned root. The `/organization` suffix selects the
+        environment-level organization-owned root for the provider; it does not
+        name a particular organization.
+      operationId: DataIntegrationsManagementController_updateOrganizationDataIntegration
       parameters:
-        - name: before
-          required: false
-          in: query
-          description: >-
-            An object ID that defines your place in the list. When the ID is not
-            present, you are at the end of the list.
-          schema:
-            example: obj_1234567890
-            type: string
-        - name: after
-          required: false
-          in: query
-          description: >-
-            An object ID that defines your place in the list. When the ID is not
-            present, you are at the end of the list.
-          schema:
-            example: obj_1234567890
-            type: string
-        - name: limit
-          required: false
-          in: query
-          description: >-
-            Upper limit on the number of objects to return, between `1` and
-            `100`.
-          schema:
-            minimum: 1
-            maximum: 100
-            default: 10
-            example: 10
-            type: integer
-        - name: order
-          required: false
-          in: query
-          description: Order the results by the creation time. Defaults to `normal`.
-          schema:
-            $ref: '#/components/schemas/PaginationOrder'
-        - name: organization_id
-          required: false
-          in: query
-          description: Filter Directories by their associated organization.
-          schema:
-            example: org_01EHZNVPK3SFK441A1RGBFSHRT
-            type: string
-        - name: search
-          required: false
-          in: query
-          description: Searchable text to match against Directory names.
-          schema:
-            example: Foo Corp
-            type: string
-        - name: domain
-          required: false
-          in: query
-          description: Filter Directories by their associated domain.
-          deprecated: true
+        - name: slug
+          required: true
+          in: path
+          description: The slug identifier of the data integration.
           schema:
-            example: foo-corp.com
+            example: github
             type: string
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/UpdateDataIntegrationDto'
       responses:
         '200':
-          description: OK
           content:
             application/json:
               schema:
-                $ref: '#/components/schemas/DirectoryList'
-        '403':
-          description: Forbidden
-          content:
-            application/json:
-              schema:
-                type: object
-                properties:
-                  message:
-                    type: string
-                    description: A human-readable description of the error.
-                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
-                required:
-                  - message
-        '422':
-          description: Unprocessable Entity
+                $ref: '#/components/schemas/DataIntegration'
+              example:
+                object: data_integration
+                id: data_integration_01EHZNVPK3SFK441A1RGBFSHRT
+                slug: github
+                integration_type: github
+                ownership: organization
+                description: Production GitHub app
+                enabled: true
+                state: valid
+                scopes:
+                  - repo
+                  - read:org
+                redirect_uri: >-
+                  https://api.workos.com/data-integrations/github/dik_01EHZNVPK3SFK441A1RGBFSHRT/callback
+                auth_methods:
+                  - oauth
+                credentials:
+                  type: custom
+                  client_id: Iv1.abc123
+                  redacted_client_secret: '6789'
+                installation: null
+                config:
+                  account: myorg-myaccount
+                custom_provider:
+                  name: My OAuth App
+                  authorization_url: https://provider.example.com/oauth/authorize
+                  token_url: https://provider.example.com/oauth/token
+                  refresh_token_url: https://provider.example.com/oauth/token
+                  pkce_enabled: true
+                  request_scope_separator: ' '
+                  scopes_required: false
+                  client_secret_required: true
+                  additional_authorization_parameters:
+                    prompt: consent
+                  token_body_content_type: application/x-www-form-urlencoded
+                  authenticate_via: request_body
+                created_at: '2026-01-15T12:00:00.000Z'
+                updated_at: '2026-01-15T12:00:00.000Z'
+          description: OK
+        '400':
+          description: Bad Request
           content:
             application/json:
               schema:
@@ -11362,28 +11357,359 @@ paths:
                     example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
                 required:
                   - message
-      summary: List Directories
-      tags:
-        - directories
-  /directories/{id}:
-    get:
-      description: Get the details of an existing directory.
-      operationId: DirectoriesController_find
-      parameters:
-        - name: id
-          required: true
-          in: path
-          description: Unique identifier for the Directory.
-          schema:
-            example: directory_01ECAZ4NV9QMV47GW873HDCX74
-            type: string
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/Directory'
+        '401':
+          description: Unauthorized
+        '403':
+          description: Forbidden
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '404':
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '409':
+          description: ''
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '422':
+          description: Unprocessable Entity
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+      summary: Update an organization-owned data integration
+      tags:
+        - pipes
+      x-feature-flag: pipes-management-api
+    delete:
+      description: >-
+        Deletes the organization-owned data integration for a provider and all
+        of its connected installations. For a custom provider, the provider
+        definition is deleted once no user-owned root references it either. The
+        `/organization` suffix selects the environment-level organization-owned
+        root for the provider; it does not name a particular organization.
+      operationId: DataIntegrationsManagementController_deleteOrganizationDataIntegration
+      parameters:
+        - name: slug
+          required: true
+          in: path
+          description: The slug identifier of the data integration.
+          schema:
+            example: github
+            type: string
+      responses:
+        '204':
+          description: No Content
+        '401':
+          description: Unauthorized
+        '404':
+          description: Not Found
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+      summary: Delete an organization-owned data integration
+      tags:
+        - pipes
+      x-feature-flag: pipes-management-api
+  /data-integrations/{slug}/token:
+    post:
+      description: >-
+        Fetches a valid OAuth access token for a user's connected account.
+        WorkOS automatically handles token refresh, ensuring you always receive
+        a valid, non-expired token.
+      operationId: DataIntegrationsController_getUserlandUserToken
+      parameters:
+        - name: slug
+          required: true
+          in: path
+          description: The identifier of the integration.
+          schema:
+            example: github
+            type: string
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                user_id:
+                  type: string
+                  description: >-
+                    A [User](/reference/authkit/user) identifier. When
+                    `connection_owner` is `organization`, this is the user the
+                    credentials are vended on behalf of; they must be an active
+                    member of the organization.
+                  example: user_01EHZNVPK3SFK441A1RGBFSHRT
+                organization_id:
+                  type: string
+                  description: >-
+                    An [Organization](/reference/organization) identifier.
+                    Optional parameter to scope the connection to a specific
+                    organization. Required when `connection_owner` is
+                    `organization`.
+                  example: org_01EHZNVPK3SFK441A1RGBFSHRT
+                connected_account_id:
+                  type: string
+                  minLength: 1
+                  description: >-
+                    A [connected account](/reference/pipes/connected-account)
+                    identifier. Use this to select a specific connection when
+                    the user has several for this provider.
+                  example: data_installation_01EHZNVPK3SFK441A1RGBFSHRT
+                connection_owner:
+                  type: string
+                  enum:
+                    - user
+                    - organization
+                  description: >-
+                    Which connection to vend from. `user` (the default) vends
+                    the user's own connection and requires `user_id`.
+                    `organization` vends the organization's shared connection
+                    and requires `organization_id`.
+                  example: user
+                supports_multiple_connections:
+                  type: boolean
+                  description: >-
+                    Set to `true` to use the plural connection contract. If no
+                    `connected_account_id` is supplied and several connections
+                    match, the request returns `account_selection_required`.
+                    When omitted or `false`, only the compatibility connection
+                    is considered.
+                  example: true
+              required:
+                - user_id
+      responses:
+        '200':
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/DataIntegrationAccessTokenResponse'
+        '400':
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '401':
+          description: Unauthorized
+        '403':
+          description: >-
+            The user is not an active member of the organization named for an
+            organization connection.
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '404':
+          description: The data integration or selected connected account was not found.
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '409':
+          description: >-
+            Several connected accounts match this user for the provider; one
+            must be named.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/AccountSelectionRequiredError'
+        '422':
+          description: >-
+            The matched installation uses a different auth method than this
+            endpoint expects.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/AuthMethodMismatchError'
+      summary: Get an access token for a connected account
+      tags:
+        - pipes
+  /directories:
+    get:
+      description: >-
+        Get a list of all of your existing directories matching the criteria
+        specified.
+      operationId: DirectoriesController_list
+      parameters:
+        - name: before
+          required: false
+          in: query
+          description: >-
+            An object ID that defines your place in the list. When the ID is not
+            present, you are at the end of the list.
+          schema:
+            example: obj_1234567890
+            type: string
+        - name: after
+          required: false
+          in: query
+          description: >-
+            An object ID that defines your place in the list. When the ID is not
+            present, you are at the end of the list.
+          schema:
+            example: obj_1234567890
+            type: string
+        - name: limit
+          required: false
+          in: query
+          description: >-
+            Upper limit on the number of objects to return, between `1` and
+            `100`.
+          schema:
+            minimum: 1
+            maximum: 100
+            default: 10
+            example: 10
+            type: integer
+        - name: order
+          required: false
+          in: query
+          description: Order the results by the creation time. Defaults to `normal`.
+          schema:
+            $ref: '#/components/schemas/PaginationOrder'
+        - name: organization_id
+          required: false
+          in: query
+          description: Filter Directories by their associated organization.
+          schema:
+            example: org_01EHZNVPK3SFK441A1RGBFSHRT
+            type: string
+        - name: search
+          required: false
+          in: query
+          description: Searchable text to match against Directory names.
+          schema:
+            example: Foo Corp
+            type: string
+        - name: domain
+          required: false
+          in: query
+          description: Filter Directories by their associated domain.
+          deprecated: true
+          schema:
+            example: foo-corp.com
+            type: string
+      responses:
+        '200':
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/DirectoryList'
+        '403':
+          description: Forbidden
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+        '422':
+          description: Unprocessable Entity
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+      summary: List Directories
+      tags:
+        - directories
+  /directories/{id}:
+    get:
+      description: Get the details of an existing directory.
+      operationId: DirectoriesController_find
+      parameters:
+        - name: id
+          required: true
+          in: path
+          description: Unique identifier for the Directory.
+          schema:
+            example: directory_01ECAZ4NV9QMV47GW873HDCX74
+            type: string
+      responses:
+        '200':
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Directory'
         '403':
           description: Forbidden
           content:
@@ -17118,6 +17444,235 @@ paths:
       summary: Authenticate
       tags:
         - user-management.authentication
+  /user_management/authkit_oauth_resources:
+    post:
+      description: >-
+        Adds an MCP resource indicator (RFC 8707) to an environment, leaving any
+        others in place.
+      operationId: AuthkitOauthResourcesController_create
+      parameters: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/CreateAuthkitOauthResourceDto'
+      responses:
+        '201':
+          description: MCP resource indicator created successfully.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/AuthkitOauthResource'
+              example:
+                object: authkit_oauth_resource
+                id: authkit_oauth_resource_01EHZNVPK3SFK441A1RGBFSHRT
+                uri: https://api.example.com
+                default: false
+                created_at: '2026-01-15T12:00:00.000Z'
+                updated_at: '2026-01-15T12:00:00.000Z'
+        '401':
+          description: Unauthorized
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+              example:
+                message: Unauthorized
+        '422':
+          description: Validation failed.
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+              example:
+                message: >-
+                  AuthKit OAuth resource 'https://api.example.com' already
+                  exists.
+      summary: Create an MCP resource indicator
+      tags:
+        - user-management.authkit-oauth-resources
+    get:
+      description: Lists the MCP resource indicators configured for an environment.
+      operationId: AuthkitOauthResourcesController_list
+      parameters:
+        - name: before
+          required: false
+          in: query
+          description: >-
+            An object ID that defines your place in the list. When the ID is not
+            present, you are at the end of the list. For example, if you make a
+            list request and receive 100 objects, ending with `"obj_123"`, your
+            subsequent call can include `before="obj_123"` to fetch a new batch
+            of objects before `"obj_123"`.
+          schema:
+            example: xxx_01HXYZ123456789ABCDEFGHIJ
+            type: string
+        - name: after
+          required: false
+          in: query
+          description: >-
+            An object ID that defines your place in the list. When the ID is not
+            present, you are at the end of the list. For example, if you make a
+            list request and receive 100 objects, ending with `"obj_123"`, your
+            subsequent call can include `after="obj_123"` to fetch a new batch
+            of objects after `"obj_123"`.
+          schema:
+            example: xxx_01HXYZ987654321KJIHGFEDCBA
+            type: string
+        - name: limit
+          required: false
+          in: query
+          description: >-
+            Upper limit on the number of objects to return, between `1` and
+            `100`.
+          schema:
+            minimum: 1
+            maximum: 100
+            default: 10
+            example: 10
+            type: integer
+        - name: order
+          required: false
+          in: query
+          description: >-
+            Order the results by the creation time. Supported values are `"asc"`
+            (ascending), `"desc"` (descending), and `"normal"` (descending with
+            reversed cursor semantics where `before` fetches older records and
+            `after` fetches newer records). Defaults to `normal`.
+          schema:
+            $ref: '#/components/schemas/PaginationOrder'
+      responses:
+        '200':
+          description: MCP resource indicators listed successfully.
+          content:
+            application/json:
+              schema:
+                allOf:
+                  - type: object
+                    properties:
+                      object:
+                        type: string
+                        description: Indicates this is a list response.
+                        const: list
+                      list_metadata:
+                        type: object
+                        properties:
+                          before:
+                            type:
+                              - string
+                              - 'null'
+                            description: >-
+                              An object ID that defines your place in the list.
+                              When the ID is not present, you are at the start
+                              of the list.
+                            example: authkit_oauth_resource_01HXYZ123456789ABCDEFGHIJ
+                          after:
+                            type:
+                              - string
+                              - 'null'
+                            description: >-
+                              An object ID that defines your place in the list.
+                              When the ID is not present, you are at the end of
+                              the list.
+                            example: authkit_oauth_resource_01HXYZ987654321KJIHGFEDCBA
+                        required:
+                          - before
+                          - after
+                        description: >-
+                          Pagination cursors for navigating between pages of
+                          results.
+                  - type: object
+                    properties:
+                      data:
+                        type: array
+                        description: The list of records for the current page.
+                        items:
+                          $ref: '#/components/schemas/AuthkitOauthResource'
+        '401':
+          description: Unauthorized
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+              example:
+                message: Unauthorized
+      summary: List MCP resource indicators
+      tags:
+        - user-management.authkit-oauth-resources
+  /user_management/authkit_oauth_resources/{id}:
+    delete:
+      description: >-
+        Removes an MCP resource indicator from an environment. Any application
+        consents granted against it are removed too.
+      operationId: AuthkitOauthResourcesController_delete
+      parameters:
+        - name: id
+          required: true
+          in: path
+          description: The ID of the MCP resource indicator to delete.
+          schema:
+            type: string
+            example: authkit_oauth_resource_01EHZNVPK3SFK441A1RGBFSHRT
+      responses:
+        '204':
+          description: MCP resource indicator deleted successfully.
+        '401':
+          description: Unauthorized
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+              example:
+                message: Unauthorized
+        '404':
+          description: MCP resource indicator not found.
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                required:
+                  - message
+              example:
+                message: >-
+                  AuthKit OAuth resource not found:
+                  'authkit_oauth_resource_01EHZNVPK3SFK441A1RGBFSHRT'.
+      summary: Delete an MCP resource indicator
+      tags:
+        - user-management.authkit-oauth-resources
   /user_management/authorize:
     get:
       description: >-
@@ -22270,6 +22825,15 @@ paths:
           schema:
             example: org_01EHZNVPK3SFK441A1RGBFSHRT
             type: string
+        - name: supports_multiple_connections
+          required: false
+          in: query
+          description: >-
+            Set to `true` to use the plural connection contract. When omitted or
+            `false`, only the compatibility connection is considered.
+          schema:
+            example: true
+            type: boolean
         - name: connected_account_id
           required: false
           in: query
@@ -22331,7 +22895,9 @@ paths:
       description: >-
         Disconnects WorkOS's account for the user, including removing any stored
         access and refresh tokens. The user will need to reauthorize if they
-        want to reconnect. This does not revoke access on the provider side.
+        want to reconnect. Access is not revoked on the provider side, except
+        for the WorkOS OAuth provider, whose underlying AuthKit grant is
+        revoked.
       operationId: DataIntegrationsUserManagementController_deleteUserDataInstallation
       parameters:
         - name: user_id
@@ -22359,6 +22925,15 @@ paths:
           schema:
             example: org_01EHZNVPK3SFK441A1RGBFSHRT
             type: string
+        - name: supports_multiple_connections
+          required: false
+          in: query
+          description: >-
+            Set to `true` to use the plural connection contract. When omitted or
+            `false`, only the compatibility connection is considered.
+          schema:
+            example: true
+            type: boolean
         - name: connected_account_id
           required: false
           in: query
@@ -22408,6 +22983,27 @@ paths:
             application/json:
               schema:
                 $ref: '#/components/schemas/AccountSelectionRequiredError'
+        '503':
+          description: >-
+            The connected account or its WorkOS OAuth grant is being changed by
+            another request. Retry the request.
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code:
+                    type: string
+                    description: The error code identifying the type of error.
+                    example: concurrent_request
+                    const: concurrent_request
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: Request could not be processed.
+                required:
+                  - code
+                  - message
       summary: Delete a connected account
       tags:
         - user-management.data-providers
@@ -22488,18 +23084,86 @@ paths:
                   - message
         '422':
           description: >-
-            The data integration is not in a valid state or the token
-            combination is invalid.
+            The request body is malformed (`invalid_request_parameters`), the
+            data integration is not in a valid state
+            (`invalid_data_integration_state`), the token combination is invalid
+            (`invalid_token_combination`), or `refresh_token` is not an active
+            WorkOS OAuth grant of this user (`invalid_refresh_token`).
+          content:
+            application/json:
+              schema:
+                oneOf:
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        enum:
+                          - invalid_refresh_token
+                          - invalid_token_combination
+                          - invalid_data_integration_state
+                        description: The error code identifying the type of error.
+                        example: invalid_refresh_token
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: invalid_request_parameters
+                        const: invalid_request_parameters
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Validation failed.
+                      errors:
+                        type: array
+                        items:
+                          type: object
+                          properties:
+                            code:
+                              type: string
+                              description: The validation error code.
+                              example: unknown_event_type
+                            message:
+                              type: string
+                              description: >-
+                                A human-readable description of the validation
+                                error.
+                              example: Invalid enum value.
+                          required:
+                            - code
+                            - message
+                        description: The list of validation errors.
+                    required:
+                      - code
+                      - message
+                      - errors
+        '503':
+          description: >-
+            The WorkOS OAuth grant behind `refresh_token` is being changed by
+            another request. Retry the request.
           content:
             application/json:
               schema:
                 type: object
                 properties:
+                  code:
+                    type: string
+                    description: The error code identifying the type of error.
+                    example: concurrent_request
+                    const: concurrent_request
                   message:
                     type: string
                     description: A human-readable description of the error.
-                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
+                    example: Request could not be processed.
                 required:
+                  - code
                   - message
       summary: Import a connected account
       tags:
@@ -22536,6 +23200,15 @@ paths:
           schema:
             example: org_01EHZNVPK3SFK441A1RGBFSHRT
             type: string
+        - name: supports_multiple_connections
+          required: false
+          in: query
+          description: >-
+            Set to `true` to use the plural connection contract. When omitted or
+            `false`, only the compatibility connection is considered.
+          schema:
+            example: true
+            type: boolean
         - name: connected_account_id
           required: false
           in: query
@@ -22595,6 +23268,84 @@ paths:
             application/json:
               schema:
                 $ref: '#/components/schemas/AccountSelectionRequiredError'
+        '422':
+          description: >-
+            The request body is malformed (`invalid_request_parameters`), or
+            `refresh_token` is not an active WorkOS OAuth grant of this user
+            (`invalid_refresh_token`).
+          content:
+            application/json:
+              schema:
+                oneOf:
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: invalid_refresh_token
+                        const: invalid_refresh_token
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Request could not be processed.
+                    required:
+                      - code
+                      - message
+                  - type: object
+                    properties:
+                      code:
+                        type: string
+                        description: The error code identifying the type of error.
+                        example: invalid_request_parameters
+                        const: invalid_request_parameters
+                      message:
+                        type: string
+                        description: A human-readable description of the error.
+                        example: Validation failed.
+                      errors:
+                        type: array
+                        items:
+                          type: object
+                          properties:
+                            code:
+                              type: string
+                              description: The validation error code.
+                              example: unknown_event_type
+                            message:
+                              type: string
+                              description: >-
+                                A human-readable description of the validation
+                                error.
+                              example: Invalid enum value.
+                          required:
+                            - code
+                            - message
+                        description: The list of validation errors.
+                    required:
+                      - code
+                      - message
+                      - errors
+        '503':
+          description: >-
+            The WorkOS OAuth grant behind `refresh_token` is being changed by
+            another request. Retry the request.
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code:
+                    type: string
+                    description: The error code identifying the type of error.
+                    example: concurrent_request
+                    const: concurrent_request
+                  message:
+                    type: string
+                    description: A human-readable description of the error.
+                    example: Request could not be processed.
+                required:
+                  - code
+                  - message
       summary: Update a connected account
       tags:
         - user-management.data-providers
@@ -22626,6 +23377,15 @@ paths:
           schema:
             example: org_01EHZNVPK3SFK441A1RGBFSHRT
             type: string
+        - name: supports_multiple_connections
+          required: false
+          in: query
+          description: >-
+            Set to `true` to use the plural connection contract. When omitted or
+            `false`, only the compatibility connection is considered.
+          schema:
+            example: true
+            type: boolean
       responses:
         '200':
           description: The list of data providers was retrieved successfully.
@@ -24319,6 +25079,8 @@ tags:
     description: Single Sign-On endpoints.
   - name: user-management.authentication
     description: User authentication endpoints.
+  - name: user-management.authkit-oauth-resources
+    description: Manage MCP resource indicators (RFC 8707).
   - name: user-management.cors-origins
     description: Manage CORS origins for user management.
   - name: user-management.data-providers
@@ -26490,15 +27252,15 @@ components:
         ownership:
           type: string
           enum:
-            - userland_user
+            - user
             - organization
           description: >-
-            Who owns the Data Integration. `userland_user` (the default) creates
-            the integration users connect their own accounts to; `organization`
+            Who owns the Data Integration. `user` (the default) creates the
+            integration users connect their own accounts to; `organization`
             creates the root organizations connect to. Ownership is fixed at
             creation, and one integration of each ownership may exist per
             provider. Independent of `credentials.type`.
-          example: userland_user
+          example: user
         description:
           type:
             - string
@@ -26801,6 +27563,26 @@ components:
         - user_id
         - pending_authentication_token
         - phone_number
+    CreateAuthkitOauthResourceDto:
+      type: object
+      properties:
+        uri:
+          type: string
+          description: >-
+            The resource URI. May be a wildcard pattern with a single `*` in the
+            leftmost hostname label, where enabled for the environment.
+          example: https://api.example.com
+        default:
+          type: boolean
+          description: >-
+            Whether the resource being created becomes the environment default,
+            clearing any previous default. Applies at creation only — this API
+            has no update endpoint yet, so changing the default on an existing
+            resource is done from the dashboard. A wildcard pattern cannot be
+            the default.
+          example: false
+      required:
+        - uri
     CreateRedirectUriDto:
       type: object
       properties:
@@ -27802,6 +28584,11 @@ components:
               - permission.created
               - permission.deleted
               - permission.updated
+              - pipes.account_connection.add_failed
+              - pipes.account_connection.connected
+              - pipes.account_connection.connection_failed
+              - pipes.account_connection.disconnected
+              - pipes.account_connection.reauthorization_needed
               - pipes.connected_account.connected
               - pipes.connected_account.connection_failed
               - pipes.connected_account.disconnected
@@ -39458,43 +40245,410 @@ components:
                   example: event_01EHZNVPK3SFK441A1RGBFSHRT
                 event:
                   type: string
-                  const: password_reset.succeeded
+                  const: password_reset.succeeded
+                data:
+                  type: object
+                  properties:
+                    object:
+                      type: string
+                      description: Distinguishes the password reset object.
+                      const: password_reset
+                    id:
+                      type: string
+                      description: The unique ID of the password reset object.
+                      example: password_reset_01E4ZCR3C56J083X43JQXF3JK5
+                    user_id:
+                      type: string
+                      description: The unique ID of the user.
+                      example: user_01E4ZCR3C56J083X43JQXF3JK5
+                    email:
+                      type: string
+                      description: The email address of the user.
+                      example: marcelina.davis@example.com
+                    expires_at:
+                      format: date-time
+                      type: string
+                      description: The timestamp when the password reset token expires.
+                      example: '2026-01-15T12:00:00.000Z'
+                    created_at:
+                      format: date-time
+                      type: string
+                      description: The timestamp when the password reset token was created.
+                      example: '2026-01-15T12:00:00.000Z'
+                  required:
+                    - object
+                    - id
+                    - user_id
+                    - email
+                    - expires_at
+                    - created_at
+                  description: The event payload.
+                created_at:
+                  format: date-time
+                  type: string
+                  description: An ISO 8601 timestamp.
+                  example: '2026-01-15T12:00:00.000Z'
+                context:
+                  $ref: '#/components/schemas/EventContextDto'
+                object:
+                  type: string
+                  description: Distinguishes the Event object.
+                  const: event
+              required:
+                - id
+                - event
+                - data
+                - created_at
+                - object
+            - type: object
+              properties:
+                id:
+                  type: string
+                  description: Unique identifier for the event.
+                  example: event_01EHZNVPK3SFK441A1RGBFSHRT
+                event:
+                  type: string
+                  const: permission.created
+                data:
+                  type: object
+                  properties:
+                    object:
+                      type: string
+                      description: Distinguishes the permission object.
+                      const: permission
+                    id:
+                      type: string
+                      description: Unique identifier of the permission.
+                      example: perm_01EHWNCE74X7JSDV0X3SZ3KJNY
+                    slug:
+                      type: string
+                      description: The slug identifier of the permission.
+                      example: billing:manage
+                    name:
+                      type: string
+                      description: The name of the permission.
+                      example: Manage Billing
+                    description:
+                      type:
+                        - string
+                        - 'null'
+                      description: A description of the permission.
+                      example: Allows managing billing settings.
+                    system:
+                      type: boolean
+                      description: Whether the permission is a system permission.
+                      example: false
+                    resource_type_slug:
+                      type: string
+                      description: The slug of the resource type the permission applies to.
+                      example: organization
+                    created_at:
+                      format: date-time
+                      type: string
+                      description: An ISO 8601 timestamp.
+                      example: '2026-01-15T12:00:00.000Z'
+                    updated_at:
+                      format: date-time
+                      type: string
+                      description: An ISO 8601 timestamp.
+                      example: '2026-01-15T12:00:00.000Z'
+                  required:
+                    - object
+                    - id
+                    - slug
+                    - name
+                    - description
+                    - system
+                    - resource_type_slug
+                    - created_at
+                    - updated_at
+                  description: The event payload.
+                created_at:
+                  format: date-time
+                  type: string
+                  description: An ISO 8601 timestamp.
+                  example: '2026-01-15T12:00:00.000Z'
+                context:
+                  $ref: '#/components/schemas/EventContextDto'
+                object:
+                  type: string
+                  description: Distinguishes the Event object.
+                  const: event
+              required:
+                - id
+                - event
+                - data
+                - created_at
+                - object
+            - type: object
+              properties:
+                id:
+                  type: string
+                  description: Unique identifier for the event.
+                  example: event_01EHZNVPK3SFK441A1RGBFSHRT
+                event:
+                  type: string
+                  const: permission.deleted
+                data:
+                  type: object
+                  properties:
+                    object:
+                      type: string
+                      description: Distinguishes the permission object.
+                      const: permission
+                    id:
+                      type: string
+                      description: Unique identifier of the permission.
+                      example: perm_01EHWNCE74X7JSDV0X3SZ3KJNY
+                    slug:
+                      type: string
+                      description: The slug identifier of the permission.
+                      example: billing:manage
+                    name:
+                      type: string
+                      description: The name of the permission.
+                      example: Manage Billing
+                    description:
+                      type:
+                        - string
+                        - 'null'
+                      description: A description of the permission.
+                      example: Allows managing billing settings.
+                    system:
+                      type: boolean
+                      description: Whether the permission is a system permission.
+                      example: false
+                    resource_type_slug:
+                      type: string
+                      description: The slug of the resource type the permission applies to.
+                      example: organization
+                    created_at:
+                      format: date-time
+                      type: string
+                      description: An ISO 8601 timestamp.
+                      example: '2026-01-15T12:00:00.000Z'
+                    updated_at:
+                      format: date-time
+                      type: string
+                      description: An ISO 8601 timestamp.
+                      example: '2026-01-15T12:00:00.000Z'
+                  required:
+                    - object
+                    - id
+                    - slug
+                    - name
+                    - description
+                    - system
+                    - resource_type_slug
+                    - created_at
+                    - updated_at
+                  description: The event payload.
+                created_at:
+                  format: date-time
+                  type: string
+                  description: An ISO 8601 timestamp.
+                  example: '2026-01-15T12:00:00.000Z'
+                context:
+                  $ref: '#/components/schemas/EventContextDto'
+                object:
+                  type: string
+                  description: Distinguishes the Event object.
+                  const: event
+              required:
+                - id
+                - event
+                - data
+                - created_at
+                - object
+            - type: object
+              properties:
+                id:
+                  type: string
+                  description: Unique identifier for the event.
+                  example: event_01EHZNVPK3SFK441A1RGBFSHRT
+                event:
+                  type: string
+                  const: permission.updated
+                data:
+                  type: object
+                  properties:
+                    object:
+                      type: string
+                      description: Distinguishes the permission object.
+                      const: permission
+                    id:
+                      type: string
+                      description: Unique identifier of the permission.
+                      example: perm_01EHWNCE74X7JSDV0X3SZ3KJNY
+                    slug:
+                      type: string
+                      description: The slug identifier of the permission.
+                      example: billing:manage
+                    name:
+                      type: string
+                      description: The name of the permission.
+                      example: Manage Billing
+                    description:
+                      type:
+                        - string
+                        - 'null'
+                      description: A description of the permission.
+                      example: Allows managing billing settings.
+                    system:
+                      type: boolean
+                      description: Whether the permission is a system permission.
+                      example: false
+                    resource_type_slug:
+                      type: string
+                      description: The slug of the resource type the permission applies to.
+                      example: organization
+                    created_at:
+                      format: date-time
+                      type: string
+                      description: An ISO 8601 timestamp.
+                      example: '2026-01-15T12:00:00.000Z'
+                    updated_at:
+                      format: date-time
+                      type: string
+                      description: An ISO 8601 timestamp.
+                      example: '2026-01-15T12:00:00.000Z'
+                  required:
+                    - object
+                    - id
+                    - slug
+                    - name
+                    - description
+                    - system
+                    - resource_type_slug
+                    - created_at
+                    - updated_at
+                  description: The event payload.
+                created_at:
+                  format: date-time
+                  type: string
+                  description: An ISO 8601 timestamp.
+                  example: '2026-01-15T12:00:00.000Z'
+                context:
+                  $ref: '#/components/schemas/EventContextDto'
+                object:
+                  type: string
+                  description: Distinguishes the Event object.
+                  const: event
+              required:
+                - id
+                - event
+                - data
+                - created_at
+                - object
+            - type: object
+              properties:
+                id:
+                  type: string
+                  description: Unique identifier for the event.
+                  example: event_01EHZNVPK3SFK441A1RGBFSHRT
+                event:
+                  type: string
+                  const: pipes.account_connection.add_failed
+                data:
+                  type: object
+                  properties:
+                    object:
+                      type: string
+                      description: The object type.
+                      example: connection_failed
+                      const: connection_failed
+                    data_integration_id:
+                      type: string
+                      description: The unique ID of the data integration.
+                      example: data_integration_01EHZNVPK3SFK441A1RGBFSHRT
+                    provider_slug:
+                      type: string
+                      description: The provider slug for this connection attempt.
+                      example: github
+                    user_id:
+                      type:
+                        - string
+                        - 'null'
+                      description: The ID of the User the connection attempt belongs to.
+                      example: user_01EHZNVPK3SFK441A1RGBFSHRT
+                    organization_id:
+                      type:
+                        - string
+                        - 'null'
+                      description: >-
+                        The ID of the Organization the connection attempt
+                        belongs to.
+                      example: org_01EHWNCE74X7JSDV0X3SZ3KJNY
+                    error_code:
+                      type: string
+                      description: A machine-readable error code for the failure.
+                      example: authorization_code_exchange_error
+                    error_reason:
+                      type:
+                        - string
+                        - 'null'
+                      description: A human-readable explanation of the failure.
+                      example: The authorization code has expired.
+                    provider_error:
+                      type:
+                        - string
+                        - 'null'
+                      description: The raw error code returned by the OAuth provider.
+                      example: access_denied
+                    provider_error_description:
+                      type:
+                        - string
+                        - 'null'
+                      description: >-
+                        The raw error description returned by the OAuth
+                        provider.
+                      example: The user denied the authorization request.
+                    created_at:
+                      format: date-time
+                      type: string
+                      description: An ISO 8601 timestamp.
+                      example: '2026-01-15T12:00:00.000Z'
+                  required:
+                    - object
+                    - data_integration_id
+                    - provider_slug
+                    - user_id
+                    - organization_id
+                    - error_code
+                    - error_reason
+                    - provider_error
+                    - provider_error_description
+                    - created_at
+                  title: PipesConnectionFailed
+                  description: The event payload.
+                created_at:
+                  format: date-time
+                  type: string
+                  description: An ISO 8601 timestamp.
+                  example: '2026-01-15T12:00:00.000Z'
+                context:
+                  $ref: '#/components/schemas/EventContextDto'
+                object:
+                  type: string
+                  description: Distinguishes the Event object.
+                  const: event
+              required:
+                - id
+                - event
+                - data
+                - created_at
+                - object
+            - type: object
+              properties:
+                id:
+                  type: string
+                  description: Unique identifier for the event.
+                  example: event_01EHZNVPK3SFK441A1RGBFSHRT
+                event:
+                  type: string
+                  const: pipes.account_connection.connected
                 data:
-                  type: object
-                  properties:
-                    object:
-                      type: string
-                      description: Distinguishes the password reset object.
-                      const: password_reset
-                    id:
-                      type: string
-                      description: The unique ID of the password reset object.
-                      example: password_reset_01E4ZCR3C56J083X43JQXF3JK5
-                    user_id:
-                      type: string
-                      description: The unique ID of the user.
-                      example: user_01E4ZCR3C56J083X43JQXF3JK5
-                    email:
-                      type: string
-                      description: The email address of the user.
-                      example: marcelina.davis@example.com
-                    expires_at:
-                      format: date-time
-                      type: string
-                      description: The timestamp when the password reset token expires.
-                      example: '2026-01-15T12:00:00.000Z'
-                    created_at:
-                      format: date-time
-                      type: string
-                      description: The timestamp when the password reset token was created.
-                      example: '2026-01-15T12:00:00.000Z'
-                  required:
-                    - object
-                    - id
-                    - user_id
-                    - email
-                    - expires_at
-                    - created_at
+                  $ref: '#/components/schemas/PipesConnectedAccount'
                   description: The event payload.
                 created_at:
                   format: date-time
@@ -39521,60 +40675,78 @@ components:
                   example: event_01EHZNVPK3SFK441A1RGBFSHRT
                 event:
                   type: string
-                  const: permission.created
+                  const: pipes.account_connection.connection_failed
                 data:
                   type: object
                   properties:
                     object:
                       type: string
-                      description: Distinguishes the permission object.
-                      const: permission
-                    id:
-                      type: string
-                      description: Unique identifier of the permission.
-                      example: perm_01EHWNCE74X7JSDV0X3SZ3KJNY
-                    slug:
+                      description: The object type.
+                      example: connection_failed
+                      const: connection_failed
+                    data_integration_id:
                       type: string
-                      description: The slug identifier of the permission.
-                      example: billing:manage
-                    name:
+                      description: The unique ID of the data integration.
+                      example: data_integration_01EHZNVPK3SFK441A1RGBFSHRT
+                    provider_slug:
                       type: string
-                      description: The name of the permission.
-                      example: Manage Billing
-                    description:
+                      description: The provider slug for this connection attempt.
+                      example: github
+                    user_id:
                       type:
                         - string
                         - 'null'
-                      description: A description of the permission.
-                      example: Allows managing billing settings.
-                    system:
-                      type: boolean
-                      description: Whether the permission is a system permission.
-                      example: false
-                    resource_type_slug:
+                      description: The ID of the User the connection attempt belongs to.
+                      example: user_01EHZNVPK3SFK441A1RGBFSHRT
+                    organization_id:
+                      type:
+                        - string
+                        - 'null'
+                      description: >-
+                        The ID of the Organization the connection attempt
+                        belongs to.
+                      example: org_01EHWNCE74X7JSDV0X3SZ3KJNY
+                    error_code:
                       type: string
-                      description: The slug of the resource type the permission applies to.
-                      example: organization
+                      description: A machine-readable error code for the failure.
+                      example: authorization_code_exchange_error
+                    error_reason:
+                      type:
+                        - string
+                        - 'null'
+                      description: A human-readable explanation of the failure.
+                      example: The authorization code has expired.
+                    provider_error:
+                      type:
+                        - string
+                        - 'null'
+                      description: The raw error code returned by the OAuth provider.
+                      example: access_denied
+                    provider_error_description:
+                      type:
+                        - string
+                        - 'null'
+                      description: >-
+                        The raw error description returned by the OAuth
+                        provider.
+                      example: The user denied the authorization request.
                     created_at:
                       format: date-time
                       type: string
                       description: An ISO 8601 timestamp.
                       example: '2026-01-15T12:00:00.000Z'
-                    updated_at:
-                      format: date-time
-                      type: string
-                      description: An ISO 8601 timestamp.
-                      example: '2026-01-15T12:00:00.000Z'
                   required:
                     - object
-                    - id
-                    - slug
-                    - name
-                    - description
-                    - system
-                    - resource_type_slug
+                    - data_integration_id
+                    - provider_slug
+                    - user_id
+                    - organization_id
+                    - error_code
+                    - error_reason
+                    - provider_error
+                    - provider_error_description
                     - created_at
-                    - updated_at
+                  title: PipesConnectionFailed
                   description: The event payload.
                 created_at:
                   format: date-time
@@ -39601,60 +40773,9 @@ components:
                   example: event_01EHZNVPK3SFK441A1RGBFSHRT
                 event:
                   type: string
-                  const: permission.deleted
+                  const: pipes.account_connection.disconnected
                 data:
-                  type: object
-                  properties:
-                    object:
-                      type: string
-                      description: Distinguishes the permission object.
-                      const: permission
-                    id:
-                      type: string
-                      description: Unique identifier of the permission.
-                      example: perm_01EHWNCE74X7JSDV0X3SZ3KJNY
-                    slug:
-                      type: string
-                      description: The slug identifier of the permission.
-                      example: billing:manage
-                    name:
-                      type: string
-                      description: The name of the permission.
-                      example: Manage Billing
-                    description:
-                      type:
-                        - string
-                        - 'null'
-                      description: A description of the permission.
-                      example: Allows managing billing settings.
-                    system:
-                      type: boolean
-                      description: Whether the permission is a system permission.
-                      example: false
-                    resource_type_slug:
-                      type: string
-                      description: The slug of the resource type the permission applies to.
-                      example: organization
-                    created_at:
-                      format: date-time
-                      type: string
-                      description: An ISO 8601 timestamp.
-                      example: '2026-01-15T12:00:00.000Z'
-                    updated_at:
-                      format: date-time
-                      type: string
-                      description: An ISO 8601 timestamp.
-                      example: '2026-01-15T12:00:00.000Z'
-                  required:
-                    - object
-                    - id
-                    - slug
-                    - name
-                    - description
-                    - system
-                    - resource_type_slug
-                    - created_at
-                    - updated_at
+                  $ref: '#/components/schemas/PipesConnectedAccount'
                   description: The event payload.
                 created_at:
                   format: date-time
@@ -39681,60 +40802,9 @@ components:
                   example: event_01EHZNVPK3SFK441A1RGBFSHRT
                 event:
                   type: string
-                  const: permission.updated
+                  const: pipes.account_connection.reauthorization_needed
                 data:
-                  type: object
-                  properties:
-                    object:
-                      type: string
-                      description: Distinguishes the permission object.
-                      const: permission
-                    id:
-                      type: string
-                      description: Unique identifier of the permission.
-                      example: perm_01EHWNCE74X7JSDV0X3SZ3KJNY
-                    slug:
-                      type: string
-                      description: The slug identifier of the permission.
-                      example: billing:manage
-                    name:
-                      type: string
-                      description: The name of the permission.
-                      example: Manage Billing
-                    description:
-                      type:
-                        - string
-                        - 'null'
-                      description: A description of the permission.
-                      example: Allows managing billing settings.
-                    system:
-                      type: boolean
-                      description: Whether the permission is a system permission.
-                      example: false
-                    resource_type_slug:
-                      type: string
-                      description: The slug of the resource type the permission applies to.
-                      example: organization
-                    created_at:
-                      format: date-time
-                      type: string
-                      description: An ISO 8601 timestamp.
-                      example: '2026-01-15T12:00:00.000Z'
-                    updated_at:
-                      format: date-time
-                      type: string
-                      description: An ISO 8601 timestamp.
-                      example: '2026-01-15T12:00:00.000Z'
-                  required:
-                    - object
-                    - id
-                    - slug
-                    - name
-                    - description
-                    - system
-                    - resource_type_slug
-                    - created_at
-                    - updated_at
+                  $ref: '#/components/schemas/PipesConnectedAccount'
                   description: The event payload.
                 created_at:
                   format: date-time
@@ -42480,13 +43550,13 @@ components:
         ownership:
           type: string
           enum:
-            - userland_user
+            - user
             - organization
           description: >-
-            Who owns the Data Integration: `userland_user` when users connect
-            their own accounts, `organization` when organizations connect. Fixed
-            at creation.
-          example: userland_user
+            Who owns the Data Integration: `user` when users connect their own
+            accounts, `organization` when organizations connect. Fixed at
+            creation.
+          example: user
         description:
           type:
             - string
@@ -43339,9 +44409,10 @@ components:
                 description: Use updated_at instead.
               connected_account:
                 description: >-
-                  The user's [connected
+                  The user's compatibility [connected
                   account](/reference/pipes/connected-account) for this
-                  provider, or `null` if the user has not connected.
+                  provider, or `null` when the compatibility slot is empty. This
+                  legacy field never selects a standard connection.
                 oneOf:
                   - type: object
                     properties:
@@ -43632,7 +44703,9 @@ components:
                     - updatedAt
                 description: >-
                   The user's connected accounts for this provider in the
-                  requested ownership context.
+                  requested ownership context. This contains only the
+                  compatibility connection unless
+                  `supports_multiple_connections` is `true`.
             required:
               - object
               - id
@@ -43799,6 +44872,42 @@ components:
           example: Entry already present in list
       required:
         - message
+    AuthkitOauthResource:
+      type: object
+      properties:
+        object:
+          type: string
+          description: The object type.
+          const: authkit_oauth_resource
+        id:
+          type: string
+          description: The ID of the MCP resource indicator.
+          example: authkit_oauth_resource_01EHZNVPK3SFK441A1RGBFSHRT
+        uri:
+          type: string
+          description: The resource URI.
+          example: https://api.example.com
+        default:
+          type: boolean
+          description: >-
+            Whether this is the default MCP resource indicator for the
+            environment.
+          example: false
+        created_at:
+          type: string
+          description: The timestamp when the MCP resource indicator was created.
+          example: '2026-01-15T12:00:00.000Z'
+        updated_at:
+          type: string
+          description: The timestamp when the MCP resource indicator was last updated.
+          example: '2026-01-15T12:00:00.000Z'
+      required:
+        - object
+        - id
+        - uri
+        - default
+        - created_at
+        - updated_at
     RedirectUri:
       type: object
       properties: