ordercloud-python 2026.10.1__tar.gz → 2026.10.2__tar.gz

{ordercloud_python-2026.10.1 → ordercloud_python-2026.10.2}/.github/workflows/ci.yml

@@ -14,7 +14,7 @@ jobs:
     name: Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: "3.13"
@@ -29,7 +29,7 @@ jobs:
     name: Type check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: "3.13"
@@ -46,7 +46,7 @@ jobs:
       matrix:
         python-version: ["3.10", "3.11", "3.12", "3.13"]
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: ${{ matrix.python-version }}
@@ -56,7 +56,7 @@ jobs:
         run: pytest --cov=ordercloud --cov-report=xml --cov-report=term-missing --cov-fail-under=90
       - name: Upload coverage to Codecov
         if: matrix.python-version == '3.13'
-        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
         with:
           files: ./coverage.xml
           fail_ci_if_error: false

{ordercloud_python-2026.10.1 → ordercloud_python-2026.10.2}/.github/workflows/codeql.yml

@@ -18,7 +18,7 @@ jobs:
     name: Analyze (Python)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2

{ordercloud_python-2026.10.1 → ordercloud_python-2026.10.2}/.github/workflows/dependency-review.yml

@@ -12,7 +12,7 @@ jobs:
     name: Review dependencies
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Dependency Review
         uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
         with:

{ordercloud_python-2026.10.1 → ordercloud_python-2026.10.2}/.github/workflows/release.yml

@@ -14,7 +14,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: "3.13"
@@ -71,7 +71,7 @@ jobs:
           path: dist/
       - name: Attest build provenance
         id: attest
-        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-path: dist/*
       - name: Name provenance file
@@ -98,7 +98,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Download distributions
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:

{ordercloud_python-2026.10.1 → ordercloud_python-2026.10.2}/.github/workflows/sbom.yml

@@ -16,10 +16,10 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Generate SBOM
-        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0
+        uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
         with:
           format: spdx-json
           output-file: sbom.spdx.json

{ordercloud_python-2026.10.1 → ordercloud_python-2026.10.2}/.github/workflows/scorecard.yml

@@ -19,12 +19,12 @@ jobs:
       contents: read
       actions: read
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Run Scorecard
-        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
         with:
           results_file: results.sarif
           results_format: sarif

{ordercloud_python-2026.10.1 → ordercloud_python-2026.10.2}/CHANGELOG.md

@@ -4,6 +4,27 @@ All notable changes to this project will be documented in this file.
 
 This project uses [Calendar Versioning](https://calver.org/) — `YYYY.MM.N` where `N` is the release number within that month.
 
+## 2026.10.2 — 2026-10-05
+
+### Security
+
+- **Credential-bearing path values are no longer written to the SDK's log lines.** The SDK logs requests on the `ordercloud` logger: a `Request:` and a `Response:` line at `DEBUG` for every request, and a `Retry` line at `WARNING` before each retry (retries are off unless `max_retries` is set). In 2026.4.1, 2026.6.1 and 2026.10.1 each of these lines contained the full request path. Two path parameters in the OrderCloud spec carry values that work as credentials, so those values reached the log:
+  - `verificationCode`, in `forgotten_credentials.reset_password_by_verification_code` (`PUT /password/reset/{verificationCode}`).
+  - `invitationID`, in `group_orders.get_token` (`POST /grouporders/{invitationID}/token`, which returns an `AccessToken`). The spec says of group-order invitations: "Contributors may request an access token with the invitation ID".
+
+  The SDK classifies path parameters by name, so every operation that takes an `invitationID` is covered: `group_orders.get_token`, and on `me` the three group-order invitation operations (`get_` / `delete_` / `patch_group_order_invitation`) and the five product-collection invitation operations (`get_` / `delete_` / `patch_` / `accept_` / `decline_product_collection_invitation`). On these ten operations the SDK's log lines now show `***` in place of the value, for example `Request: PUT /password/reset/***` and `Request: POST /me/productcollections/col-1/invitations/accept/***`. Other path values, and the log lines of every other operation, are unchanged.
+- **What this release does not change:**
+  - `httpx` writes its own `HTTP Request: <METHOD> <URL> ...` line at `INFO` on the `httpx` logger, with the full URL including the query string. The SDK does not control that logger. If your application logs at `INFO` or below, set `logging.getLogger("httpx").setLevel(logging.WARNING)`. See [SECURITY.md](SECURITY.md#logging).
+  - Middleware hooks receive the concrete values: `RequestContext.path`, `url` and `params` are what is sent to the API.
+  - Exceptions that `httpx` raises for transport failures (timeouts, connection errors) carry the request, and with it the full URL, as their `request` attribute.
+- The code generator now refuses to generate while any path-parameter name in the spec is unclassified. Every name is listed in `tools/codegen/sensitivity.py` as sensitive or not sensitive, and a name missing from the not-sensitive list is redacted. See [CONTRIBUTING.md](CONTRIBUTING.md#path-parameter-classification).
+
+### Changed
+
+- Bumped package version to `2026.10.2` (CalVer).
+- `HttpClient.request()` and its `get` / `post` / `put` / `patch` / `delete` helpers accept a `SensitivePath` (new, in `ordercloud.http`) as well as a plain string path. Generated resource method signatures are unchanged.
+- Removed an unused module-level `TypeVar` from `ordercloud.sync_client`.
+
 ## 2026.10.1 — 2026-10-05
 
 Regenerated from the OrderCloud OpenAPI v3 spec, **version 1.0.454 → 1.0.470**. This release contains **one breaking change** — `ApiClient.client_secret` is removed — which the CalVer version number does not signal. Coverage is unchanged: **639 operations** across 60 resources, with 173 models and 17 enums.

{ordercloud_python-2026.10.1 → ordercloud_python-2026.10.2}/CONTRIBUTING.md

@@ -99,8 +99,32 @@ If you need to change how models or resources are structured, the relevant files
 - `tools/codegen/ir.py` — intermediate representation dataclasses
 - `tools/codegen/parser.py` — OpenAPI spec to IR
 - `tools/codegen/transformer.py` — IR enrichment (imports, grouping)
+- `tools/codegen/sensitivity.py` — path-parameter sensitivity registry (see below)
 - `tools/codegen/templates/*.j2` — Jinja2 templates for output files
 
+### Path-parameter classification
+
+The SDK logs the path of every request, and some path parameters carry values that work as credentials. Every path-parameter name in the spec is therefore classified in `tools/codegen/sensitivity.py`, in exactly one of two sets:
+
+- `SENSITIVE_PATH_PARAMS` — anyone who reads the value from a log could use it to authenticate, obtain a token, or perform an account action without the account owner's own credentials.
+- `NOT_SENSITIVE_PATH_PARAMS` — record identifiers that grant nothing without the caller's own authorisation.
+
+When uncertain, choose sensitive. `NOT_SENSITIVE_PATH_PARAMS` is an allowlist: a parameter whose name is not on it is generated as a `SensitivePath`, and the SDK logs `***` in its place.
+
+Generation stops with exit code 1, before any file is written, if a path-parameter name in the spec is unclassified, is in both sets, or is classified but no longer in the spec. A new, unclassified name fails like this (`shareToken` is an example, not a real parameter):
+
+```
+Error: Path parameter 'shareToken' is not classified (used by Products.GetShareLink); add it to SENSITIVE_PATH_PARAMS or NOT_SENSITIVE_PATH_PARAMS in tools/codegen/sensitivity.py
+```
+
+To resolve it:
+
+1. Read what the value is in the spec: the operations named in the error, their descriptions, and what they return.
+2. Apply the rule above and add the name to one of the two sets, with a comment giving the reason.
+3. Regenerate and run the tests. `tests/test_log_redaction.py` scans every generated request path and fails if one could log an unclassified or sensitive value.
+
+The classification is by name, so the gate cannot tell when a new spec reuses an already-cleared name for a credential-bearing value. Review the spec diff at each spec bump for that.
+
 ## Conventions
 
 - **snake_case** for all Python identifiers. Model fields use snake_case with PascalCase aliases matching the API.

{ordercloud_python-2026.10.1 → ordercloud_python-2026.10.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: ordercloud-python
-Version: 2026.10.1
+Version: 2026.10.2
 Summary: Idiomatic Python SDK for Sitecore OrderCloud
 Project-URL: Homepage, https://github.com/markcassidyconsulting/ordercloud-python
 Project-URL: Repository, https://github.com/markcassidyconsulting/ordercloud-python
@@ -212,9 +212,8 @@ The SDK logs via Python's standard `logging` module under the `ordercloud` logge
 
 ```python
 import logging
-logging.basicConfig(level=logging.DEBUG)
 
-# Or configure just the SDK logger
+logging.basicConfig()  # adds a handler; the root logger stays at WARNING
 logging.getLogger("ordercloud").setLevel(logging.DEBUG)
 ```
 
@@ -223,6 +222,10 @@ logging.getLogger("ordercloud").setLevel(logging.DEBUG)
 | `DEBUG` | Every request (`Request: GET /products`) and response (`Response: GET /products 200`) |
 | `WARNING` | Retry attempts with status code and backoff delay |
 
+Path values that work as credentials, a password-reset verification code and an invitation ID, are logged as `***`, for example `Request: PUT /password/reset/***`. Query parameters and request bodies are not logged.
+
+Setting the root logger to `INFO` or `DEBUG` (for example `logging.basicConfig(level=logging.DEBUG)`) also turns on `httpx`'s own `HTTP Request:` line, which contains the full URL, unredacted, including the query string. The SDK does not control that logger. To keep it quiet, add `logging.getLogger("httpx").setLevel(logging.WARNING)`. See [SECURITY.md](SECURITY.md#logging).
+
 ## Middleware Hooks
 
 Register hooks to intercept requests and responses:
@@ -242,6 +245,8 @@ client.add_after_response(log_timing)
 
 Before-request hooks receive a mutable `RequestContext` — modify `headers`, `params`, or `json` before the request is sent. After-response hooks receive a `ResponseContext` with the request details and response. Hooks are called on every attempt, including retries.
 
+Hooks see the concrete values sent to the API, including credential-bearing path values and the `Authorization` header; the redaction above applies only to the SDK's own log lines.
+
 ## API Coverage
 
 The SDK covers **all 60 resources** and **639 operations** in the OrderCloud API. Models and resource clients are generated from the official OpenAPI v3 spec (version 1.0.470).

{ordercloud_python-2026.10.1 → ordercloud_python-2026.10.2}/README.md

@@ -172,9 +172,8 @@ The SDK logs via Python's standard `logging` module under the `ordercloud` logge
 
 ```python
 import logging
-logging.basicConfig(level=logging.DEBUG)
 
-# Or configure just the SDK logger
+logging.basicConfig()  # adds a handler; the root logger stays at WARNING
 logging.getLogger("ordercloud").setLevel(logging.DEBUG)
 ```
 
@@ -183,6 +182,10 @@ logging.getLogger("ordercloud").setLevel(logging.DEBUG)
 | `DEBUG` | Every request (`Request: GET /products`) and response (`Response: GET /products 200`) |
 | `WARNING` | Retry attempts with status code and backoff delay |
 
+Path values that work as credentials, a password-reset verification code and an invitation ID, are logged as `***`, for example `Request: PUT /password/reset/***`. Query parameters and request bodies are not logged.
+
+Setting the root logger to `INFO` or `DEBUG` (for example `logging.basicConfig(level=logging.DEBUG)`) also turns on `httpx`'s own `HTTP Request:` line, which contains the full URL, unredacted, including the query string. The SDK does not control that logger. To keep it quiet, add `logging.getLogger("httpx").setLevel(logging.WARNING)`. See [SECURITY.md](SECURITY.md#logging).
+
 ## Middleware Hooks
 
 Register hooks to intercept requests and responses:
@@ -202,6 +205,8 @@ client.add_after_response(log_timing)
 
 Before-request hooks receive a mutable `RequestContext` — modify `headers`, `params`, or `json` before the request is sent. After-response hooks receive a `ResponseContext` with the request details and response. Hooks are called on every attempt, including retries.
 
+Hooks see the concrete values sent to the API, including credential-bearing path values and the `Authorization` header; the redaction above applies only to the SDK's own log lines.
+
 ## API Coverage
 
 The SDK covers **all 60 resources** and **639 operations** in the OrderCloud API. Models and resource clients are generated from the official OpenAPI v3 spec (version 1.0.470).

ordercloud_python-2026.10.2/SECURITY.md

@@ -0,0 +1,70 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported          |
+|---------|--------------------|
+| Latest  | :white_check_mark: |
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability in this project, please report it responsibly.
+
+**Do not open a public GitHub issue for security vulnerabilities.**
+
+Instead, email **mark.cassidy@markcassidyconsulting.com** with:
+
+- A description of the vulnerability
+- Steps to reproduce or a proof of concept
+- The potential impact
+
+You will receive an acknowledgement within 48 hours and a detailed response within 5 business days, including next steps and any planned fixes.
+
+If the vulnerability is confirmed, a fix will be developed and released as a patch version. A security advisory will be published via [GitHub Security Advisories](https://github.com/markcassidyconsulting/ordercloud-python/security/advisories) once a fix is available.
+
+## Scope
+
+This SDK is an HTTP client library. It does not run a server, store credentials persistently, or process untrusted input beyond what the OrderCloud API returns. Security concerns most likely relate to:
+
+- Credential handling (OAuth tokens in memory)
+- Dependency vulnerabilities (tracked via Dependabot and `dependency-review`)
+- Injection via API response data (mitigated by Pydantic model validation)
+
+## Logging
+
+The SDK writes request log lines to the `ordercloud` logger (see [Structured Logging](README.md#structured-logging)). Path values that work as credentials, a password-reset `verificationCode` and an `invitationID`, appear in those lines as `***`. Every path-parameter name in the OrderCloud spec is classified as sensitive or not sensitive when the SDK is generated, and an unclassified name stops generation. Query parameters and request bodies are not written to these lines.
+
+The SDK does not control what other code logs:
+
+- **`httpx` logs the full URL.** For every request, `httpx` writes `HTTP Request: <METHOD> <URL> "<HTTP version> <status> <reason>"` at `INFO` on the `httpx` logger, with the full URL including the path and the query string (checked against the httpx 0.28.1 source). The line appears whenever that logger is enabled for `INFO`, for example after `logging.basicConfig(level=logging.INFO)` or `level=logging.DEBUG`. To keep it out of your logs:
+
+  ```python
+  import logging
+
+  logging.getLogger("httpx").setLevel(logging.WARNING)
+  ```
+
+- **`httpx` exceptions carry the request.** Exceptions that `httpx` raises for transport failures (timeouts, connection errors) carry the request as their `request` attribute, and `exc.request.url` is the full URL.
+- **Middleware hooks receive the concrete values.** `RequestContext.path`, `url` and `params` are the values sent to the API, and `headers` holds the `Authorization` bearer token. A hook that logs them must redact them itself.
+
+## Security Measures
+
+This project employs the following security practices:
+
+- **Static analysis:** [CodeQL](https://github.com/markcassidyconsulting/ordercloud-python/actions/workflows/codeql.yml) runs on every push and weekly
+- **Dependency scanning:** [Dependabot](https://github.com/markcassidyconsulting/ordercloud-python/security/dependabot) monitors for known vulnerabilities in dependencies
+- **Dependency review:** Pull requests are checked for newly introduced vulnerable dependencies
+- **Supply chain security:** All GitHub Actions are pinned to commit SHAs
+- **Build provenance:** Every [GitHub release](https://github.com/markcassidyconsulting/ordercloud-python/releases) carries the build provenance attestation for its sdist and wheel as `ordercloud_python-<version>.intoto.jsonl`
+- **Branch protection:** The `main` branch requires status checks to pass before merge
+
+### Verifying a release
+
+With the [GitHub CLI](https://cli.github.com/), download a release's files and check a distribution against its provenance file:
+
+```bash
+gh release download v<version> --repo markcassidyconsulting/ordercloud-python
+gh attestation verify ordercloud_python-<version>-py3-none-any.whl --bundle ordercloud_python-<version>.intoto.jsonl --repo markcassidyconsulting/ordercloud-python
+```
+
+The provenance file covers both the wheel and the sdist (`ordercloud_python-<version>.tar.gz`), and the same command checks a wheel fetched from PyPI with `pip download ordercloud-python==<version> --no-deps`. Exit code 0 means the file matches build provenance signed by a GitHub Actions workflow in this repository; a modified file fails verification.

{ordercloud_python-2026.10.1 → ordercloud_python-2026.10.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "ordercloud-python"
-version = "2026.10.1"
+version = "2026.10.2"
 description = "Idiomatic Python SDK for Sitecore OrderCloud"
 readme = "README.md"
 license = "MIT"

{ordercloud_python-2026.10.1 → ordercloud_python-2026.10.2}/src/ordercloud/http.py

@@ -2,7 +2,8 @@
 
 import asyncio
 import logging
-from typing import Any, Optional
+from dataclasses import dataclass
+from typing import Any, Optional, Union
 
 import httpx
 
@@ -11,13 +12,28 @@ from .config import OrderCloudConfig
 from .errors import ApiError, AuthenticationError, OrderCloudError
 from .middleware import AfterResponse, BeforeRequest, RequestContext, ResponseContext
 
-__all__ = ["HttpClient"]
+__all__ = ["HttpClient", "SensitivePath"]
 
 logger = logging.getLogger("ordercloud")
 
 _RETRYABLE_STATUSES = frozenset({429, 500, 502, 503, 504})
 
 
+@dataclass(frozen=True)
+class SensitivePath:
+    """A request path that carries a sensitive value.
+
+    ``wire`` is sent to the API; ``log_form`` is the only form the SDK may log.
+    """
+
+    wire: str
+    log_form: str
+
+    def __repr__(self) -> str:
+        # str() falls back to this, so neither ever renders the wire form.
+        return f"SensitivePath({self.log_form!r})"
+
+
 class HttpClient:
     """Async HTTP client with automatic authentication and error handling.
 
@@ -60,7 +76,7 @@ class HttpClient:
     async def request(
         self,
         method: str,
-        path: str,
+        path: Union[str, SensitivePath],
         *,
         params: Optional[dict[str, Any]] = None,
         json: Optional[dict[str, Any]] = None,
@@ -69,7 +85,9 @@ class HttpClient:
 
         Args:
             method: HTTP method (e.g. ``"GET"``, ``"POST"``).
-            path: API path relative to the base URL (e.g. ``"/products"``).
+            path: API path relative to the base URL (e.g. ``"/products"``),
+                or a ``SensitivePath`` whose ``log_form`` is logged in place
+                of the path that is sent. A plain string is logged as given.
             params: Query parameters (``None`` values are stripped).
             json: JSON request body.
 
@@ -80,7 +98,8 @@ class HttpClient:
             AuthenticationError: On 401 or 403 responses.
             OrderCloudError: On any other 4xx/5xx response.
         """
-        url = f"{self._config.base_url}{path}"
+        wire_path, log_path = self._split_path(path)
+        url = f"{self._config.base_url}{wire_path}"
 
         if params:
             params = {k: v for k, v in params.items() if v is not None}
@@ -93,7 +112,7 @@ class HttpClient:
 
             ctx = RequestContext(
                 method=method,
-                path=path,
+                path=wire_path,
                 url=url,
                 headers=dict(headers),
                 params=dict(params) if params else None,
@@ -103,7 +122,7 @@ class HttpClient:
             for hook in self._before_request:
                 await hook(ctx)
 
-            logger.debug("Request: %s %s", method, path)
+            logger.debug("Request: %s %s", method, log_path)
 
             resp = await self._client.request(
                 ctx.method,
@@ -113,7 +132,7 @@ class HttpClient:
                 json=ctx.json,
             )
 
-            logger.debug("Response: %s %s %d", method, path, resp.status_code)
+            logger.debug("Response: %s %s %d", method, log_path, resp.status_code)
 
             resp_ctx = ResponseContext(request=ctx, response=resp, attempt=attempt)
             for after_hook in self._after_response:
@@ -129,7 +148,7 @@ class HttpClient:
                     attempt + 1,
                     self._config.max_retries,
                     method,
-                    path,
+                    log_path,
                     resp.status_code,
                     delay,
                 )
@@ -141,6 +160,13 @@ class HttpClient:
         # Unreachable — loop always returns or raises
         raise AssertionError("unreachable")  # pragma: no cover
 
+    @staticmethod
+    def _split_path(path: Union[str, SensitivePath]) -> tuple[str, str]:
+        """Return ``(wire path, log path)``; a plain ``str`` is its own log form."""
+        if isinstance(path, SensitivePath):
+            return path.wire, path.log_form
+        return path, path
+
     def _retry_delay(self, resp: httpx.Response, attempt: int) -> float:
         """Calculate the delay before the next retry attempt.
 
@@ -157,13 +183,13 @@ class HttpClient:
         delay: float = self._config.retry_backoff * (2**attempt)
         return min(delay, max_delay)
 
-    async def get(self, path: str, **params: Any) -> httpx.Response:
+    async def get(self, path: Union[str, SensitivePath], **params: Any) -> httpx.Response:
         """Send a GET request."""
         return await self.request("GET", path, params=params or None)
 
     async def post(
         self,
-        path: str,
+        path: Union[str, SensitivePath],
         json: Optional[dict[str, Any]] = None,
         params: Optional[dict[str, Any]] = None,
     ) -> httpx.Response:
@@ -172,7 +198,7 @@ class HttpClient:
 
     async def put(
         self,
-        path: str,
+        path: Union[str, SensitivePath],
         json: Optional[dict[str, Any]] = None,
         params: Optional[dict[str, Any]] = None,
     ) -> httpx.Response:
@@ -181,14 +207,14 @@ class HttpClient:
 
     async def patch(
         self,
-        path: str,
+        path: Union[str, SensitivePath],
         json: Optional[dict[str, Any]] = None,
         params: Optional[dict[str, Any]] = None,
     ) -> httpx.Response:
         """Send a PATCH request."""
         return await self.request("PATCH", path, json=json, params=params)
 
-    async def delete(self, path: str, **params: Any) -> httpx.Response:
+    async def delete(self, path: Union[str, SensitivePath], **params: Any) -> httpx.Response:
         """Send a DELETE request."""
         return await self.request("DELETE", path, params=params or None)
 

{ordercloud_python-2026.10.1 → ordercloud_python-2026.10.2}/src/ordercloud/middleware.py

@@ -20,6 +20,13 @@ class RequestContext:
     Hooks can modify ``headers``, ``params``, or ``json`` in place
     before the request is sent.
 
+    ``path``, ``url`` and ``params`` are the concrete values sent on the
+    wire, and ``headers`` holds the ``Authorization`` bearer token. Any of
+    them may carry credentials — a password-reset verification code or a
+    group-order invitation ID in the path, for example — so redact them
+    before logging them from a hook. The SDK's own log lines redact such
+    path values; the context passed to hooks does not.
+
     Attributes:
         method: HTTP method (e.g. ``"GET"``).
         path: API path relative to the base URL.

{ordercloud_python-2026.10.1 → ordercloud_python-2026.10.2}/src/ordercloud/resources/forgotten_credentials.py

@@ -5,6 +5,7 @@
 from __future__ import annotations
 from typing import Any, Optional, Union
 
+from ..http import SensitivePath
 from ..models.auth_models import OneTimePasswordRequest, PasswordReset, PasswordResetRequest
 from .base import BaseResource
 
@@ -50,7 +51,9 @@ class ForgottenCredentialsResource(BaseResource):
             password_reset: A ``PasswordReset`` model or dict. Required fields: ClientID, Username.
         """
         await self._http.put(
-            f"/password/reset/{verification_code}",
+            SensitivePath(
+                wire=f"/password/reset/{verification_code}", log_form="/password/reset/***"
+            ),
             json=self._serialize(password_reset),
         )
 

{ordercloud_python-2026.10.1 → ordercloud_python-2026.10.2}/src/ordercloud/resources/group_orders.py

@@ -3,6 +3,7 @@
 """OrderCloud GroupOrders API resource."""
 
 from __future__ import annotations
+from ..http import SensitivePath
 from ..models.auth_models import AccessToken
 from .base import BaseResource
 
@@ -24,5 +25,9 @@ class GroupOrdersResource(BaseResource):
         Returns:
             The AccessToken object.
         """
-        resp = await self._http.post(f"/grouporders/{invitation_id}/token")
+        resp = await self._http.post(
+            SensitivePath(
+                wire=f"/grouporders/{invitation_id}/token", log_form="/grouporders/***/token"
+            )
+        )
         return AccessToken(**resp.json())

{ordercloud_python-2026.10.1 → ordercloud_python-2026.10.2}/src/ordercloud/resources/me.py

@@ -5,6 +5,7 @@
 from __future__ import annotations
 from typing import Any, Optional, Union
 
+from ..http import SensitivePath
 from ..models.auth_models import AccessTokenBasic, TokenPasswordReset
 from ..models.buyer import BuyerAddress, BuyerCreditCard, BuyerProduct, BuyerSupplier, ProductSeller
 from ..models.catalog import Catalog
@@ -513,7 +514,11 @@ class MeResource(BaseResource):
         Returns:
             The GroupOrderInvitation object.
         """
-        resp = await self._http.get(f"/me/orderinvitations/{invitation_id}")
+        resp = await self._http.get(
+            SensitivePath(
+                wire=f"/me/orderinvitations/{invitation_id}", log_form="/me/orderinvitations/***"
+            )
+        )
         return GroupOrderInvitation(**resp.json())
 
     async def delete_group_order_invitation(
@@ -525,7 +530,11 @@ class MeResource(BaseResource):
         Args:
             invitation_id: ID of the invitation.
         """
-        await self._http.delete(f"/me/orderinvitations/{invitation_id}")
+        await self._http.delete(
+            SensitivePath(
+                wire=f"/me/orderinvitations/{invitation_id}", log_form="/me/orderinvitations/***"
+            )
+        )
 
     async def patch_group_order_invitation(
         self,
@@ -541,7 +550,12 @@ class MeResource(BaseResource):
         Returns:
             The GroupOrderInvitation object.
         """
-        resp = await self._http.patch(f"/me/orderinvitations/{invitation_id}", json=partial)
+        resp = await self._http.patch(
+            SensitivePath(
+                wire=f"/me/orderinvitations/{invitation_id}", log_form="/me/orderinvitations/***"
+            ),
+            json=partial,
+        )
         return GroupOrderInvitation(**resp.json())
 
     async def list_orders(
@@ -877,7 +891,10 @@ class MeResource(BaseResource):
             The ProductCollectionInvitation object.
         """
         resp = await self._http.get(
-            f"/me/productcollections/{product_collection_id}/invitations/{invitation_id}"
+            SensitivePath(
+                wire=f"/me/productcollections/{product_collection_id}/invitations/{invitation_id}",
+                log_form=f"/me/productcollections/{product_collection_id}/invitations/***",
+            )
         )
         return ProductCollectionInvitation(**resp.json())
 
@@ -893,7 +910,10 @@ class MeResource(BaseResource):
             invitation_id: ID of the invitation.
         """
         await self._http.delete(
-            f"/me/productcollections/{product_collection_id}/invitations/{invitation_id}"
+            SensitivePath(
+                wire=f"/me/productcollections/{product_collection_id}/invitations/{invitation_id}",
+                log_form=f"/me/productcollections/{product_collection_id}/invitations/***",
+            )
         )
 
     async def patch_product_collection_invitation(
@@ -913,7 +933,10 @@ class MeResource(BaseResource):
             The ProductCollectionInvitation object.
         """
         resp = await self._http.patch(
-            f"/me/productcollections/{product_collection_id}/invitations/{invitation_id}",
+            SensitivePath(
+                wire=f"/me/productcollections/{product_collection_id}/invitations/{invitation_id}",
+                log_form=f"/me/productcollections/{product_collection_id}/invitations/***",
+            ),
             json=partial,
         )
         return ProductCollectionInvitation(**resp.json())
@@ -930,7 +953,10 @@ class MeResource(BaseResource):
             invitation_id: ID of the invitation.
         """
         await self._http.post(
-            f"/me/productcollections/{product_collection_id}/invitations/accept/{invitation_id}"
+            SensitivePath(
+                wire=f"/me/productcollections/{product_collection_id}/invitations/accept/{invitation_id}",
+                log_form=f"/me/productcollections/{product_collection_id}/invitations/accept/***",
+            )
         )
 
     async def decline_product_collection_invitation(
@@ -945,7 +971,10 @@ class MeResource(BaseResource):
             invitation_id: ID of the invitation.
         """
         await self._http.post(
-            f"/me/productcollections/{product_collection_id}/invitations/decline/{invitation_id}"
+            SensitivePath(
+                wire=f"/me/productcollections/{product_collection_id}/invitations/decline/{invitation_id}",
+                log_form=f"/me/productcollections/{product_collection_id}/invitations/decline/***",
+            )
         )
 
     async def list_product_collection_entries(