ordercloud-python 2026.6.1__tar.gz → 2026.10.1__tar.gz

{ordercloud_python-2026.6.1 → ordercloud_python-2026.10.1}/.github/dependabot.yml

@@ -24,3 +24,9 @@ updates:
     labels:
       - "ci"
     open-pull-requests-limit: 5
+    groups:
+      # The init / autobuild / analyze / upload-sarif steps must share one
+      # version, so they are bumped together in a single PR.
+      codeql-action:
+        patterns:
+          - "github/codeql-action*"

{ordercloud_python-2026.6.1 → ordercloud_python-2026.10.1}/.github/workflows/ci.yml

@@ -14,8 +14,8 @@ jobs:
     name: Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: "3.13"
       - name: Install ruff
@@ -29,8 +29,8 @@ jobs:
     name: Type check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: "3.13"
       - name: Install dependencies
@@ -46,8 +46,8 @@ jobs:
       matrix:
         python-version: ["3.10", "3.11", "3.12", "3.13"]
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install dependencies

{ordercloud_python-2026.6.1 → ordercloud_python-2026.10.1}/.github/workflows/codeql.yml

@@ -18,18 +18,18 @@ jobs:
     name: Analyze (Python)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
         with:
           languages: python
           queries: security-and-quality
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/autobuild@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
         with:
           category: "/language:python"

{ordercloud_python-2026.6.1 → ordercloud_python-2026.10.1}/.github/workflows/dependency-review.yml

@@ -12,7 +12,7 @@ jobs:
     name: Review dependencies
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Dependency Review
         uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
         with:

{ordercloud_python-2026.6.1 → ordercloud_python-2026.10.1}/.github/workflows/release.yml

@@ -14,8 +14,8 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: "3.13"
       - name: Install build
@@ -38,7 +38,8 @@ jobs:
 
   publish:
     name: Publish to PyPI
-    needs: build
+    # The PyPI upload cannot be undone, so it runs only after attestation.
+    needs: attestation
     runs-on: ubuntu-latest
     permissions:
       id-token: write
@@ -52,7 +53,7 @@ jobs:
           name: dist
           path: dist/
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
 
   attestation:
     name: Attest build provenance
@@ -69,9 +70,26 @@ jobs:
           name: dist
           path: dist/
       - name: Attest build provenance
-        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
+        id: attest
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
         with:
           subject-path: dist/*
+      - name: Name provenance file
+        env:
+          BUNDLE_PATH: ${{ steps.attest.outputs.bundle-path }}
+        run: |
+          if [ ! -s "$BUNDLE_PATH" ]; then
+            echo "::error::Attestation bundle is missing or empty: $BUNDLE_PATH"
+            exit 1
+          fi
+          mkdir provenance
+          cp "$BUNDLE_PATH" "provenance/ordercloud_python-${GITHUB_REF_NAME#v}.intoto.jsonl"
+      - name: Upload provenance
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: provenance
+          path: provenance/
+          if-no-files-found: error
 
   github-release:
     name: Create GitHub Release
@@ -80,16 +98,26 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Download distributions
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: dist
           path: dist/
+      - name: Download provenance
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: provenance
+          path: provenance/
       - name: Create GitHub Release
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
-          gh release create "$GITHUB_REF_NAME" dist/* \
+          PROVENANCE="provenance/ordercloud_python-${GITHUB_REF_NAME#v}.intoto.jsonl"
+          if [ ! -s "$PROVENANCE" ]; then
+            echo "::error::Provenance file is missing or empty: $PROVENANCE"
+            exit 1
+          fi
+          gh release create "$GITHUB_REF_NAME" dist/* "$PROVENANCE" \
             --title "$GITHUB_REF_NAME" \
             --generate-notes

{ordercloud_python-2026.6.1 → ordercloud_python-2026.10.1}/.github/workflows/sbom.yml

@@ -16,7 +16,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Generate SBOM
         uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0

{ordercloud_python-2026.6.1 → ordercloud_python-2026.10.1}/.github/workflows/scorecard.yml

@@ -19,7 +19,7 @@ jobs:
       contents: read
       actions: read
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
@@ -31,6 +31,6 @@ jobs:
           publish_results: true
 
       - name: Upload SARIF results
-        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
         with:
           sarif_file: results.sarif

{ordercloud_python-2026.6.1 → ordercloud_python-2026.10.1}/CHANGELOG.md

@@ -4,6 +4,41 @@ All notable changes to this project will be documented in this file.
 
 This project uses [Calendar Versioning](https://calver.org/) — `YYYY.MM.N` where `N` is the release number within that month.
 
+## 2026.10.1 — 2026-10-05
+
+Regenerated from the OrderCloud OpenAPI v3 spec, **version 1.0.454 → 1.0.470**. This release contains **one breaking change** — `ApiClient.client_secret` is removed — which the CalVer version number does not signal. Coverage is unchanged: **639 operations** across 60 resources, with 173 models and 17 enums.
+
+### Breaking
+
+- **`ApiClient.client_secret` (`ClientSecret`) removed**, following its removal from the `ApiClient` schema in the spec. `ApiClient` keeps the models' `extra="allow"` configuration, so code that still uses the field now behaves as follows:
+  - Reading `.client_secret` on an `ApiClient` that was not given one raises `AttributeError` (it previously returned `None`).
+  - mypy reports any `.client_secret` access as an `attr-defined` error.
+  - A `ClientSecret` value in an API response is no longer available as `.client_secret`; it is kept as an undeclared extra under its API name, in `model_extra["ClientSecret"]`.
+  - `ApiClient(ClientSecret="...")` is accepted, and the value is still sent to the API under the key `ClientSecret`.
+  - `ApiClient(client_secret="...")` is accepted, but the value is now sent to the API under the snake_case key `client_secret` instead of `ClientSecret`.
+  - Request bodies passed as plain dicts are sent unchanged.
+
+  The five API-client secret operations (`ApiClients.ListSecrets` / `CreateSecret` / `GetSecret` / `PatchSecret` / `DeleteSecret`) and the `ApiClientSecret` / `ApiClientSecretCreateResponse` models are unchanged in this release.
+
+### Added
+
+- **`Discount.priority`** (`Priority`, integer). The spec describes it as: "Controls precedence when multiple discounts apply to the same user and product. Lower number = higher precedence (1 beats 2). Null is applied last."
+- **`OrderEditAfterSubmit`** added to the `ApiRole` enum. Role lists that contain it (for example `SecurityProfile.roles` or `ApiClient.maximum_granted_roles`) now validate; on 2026.6.1 they raise a pydantic `ValidationError`.
+
+### Spec changes with no SDK code change
+
+- The `x-lifecycle: Beta` marker is removed from the Discounts tag and its nine operations. The code generator does not read this marker.
+- `GET /discounts` now lists `Priority` and `!Priority` as `sortBy` values. `Discounts.list` takes `sort_by` as a plain string and passes it through unvalidated, so no SDK change was needed.
+- `OrderEditAfterSubmit` is also added to the spec's OAuth2 scopes. The SDK's `scopes` setting takes plain strings.
+
+### Release artefacts
+
+- GitHub releases now also attach the build provenance attestation for the sdist and wheel, as `ordercloud_python-<version>.intoto.jsonl`, alongside the distributions themselves.
+
+### Changed
+
+- Bumped package version to `2026.10.1` (CalVer).
+
 ## 2026.6.1 — 2026-06-14
 
 Regenerated from the OrderCloud OpenAPI v3 spec, **version 1.0.445 → 1.0.454**. All changes are additive — no breaking changes to existing models or operations. Coverage now spans **639 operations** (was 632) across the same 60 resources, with **173 models** and 17 enums.

{ordercloud_python-2026.6.1 → ordercloud_python-2026.10.1}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: ordercloud-python
-Version: 2026.6.1
+Version: 2026.10.1
 Summary: Idiomatic Python SDK for Sitecore OrderCloud
 Project-URL: Homepage, https://github.com/markcassidyconsulting/ordercloud-python
 Project-URL: Repository, https://github.com/markcassidyconsulting/ordercloud-python
@@ -60,7 +60,7 @@ A fully typed, async-first Python SDK for [Sitecore OrderCloud](https://orderclo
 - **Middleware hooks** — intercept requests and responses for logging, metrics, or header injection.
 - **Structured logging** — standard Python `logging` module, DEBUG/WARNING levels.
 - **Full type annotations** — `py.typed` marker for downstream type checking with mypy, pyright, etc.
-- **791 tests, 97% coverage** — 766 unit tests (mocked HTTP) + 25 integration tests (live sandbox).
+- **803 tests, 97% coverage** — 778 unit tests (mocked HTTP) + 25 integration tests (live sandbox).
 
 ## Installation
 
@@ -244,7 +244,7 @@ Before-request hooks receive a mutable `RequestContext` — modify `headers`, `p
 
 ## API Coverage
 
-The SDK covers **all 60 resources** and **639 operations** in the OrderCloud API. Models and resource clients are generated from the official OpenAPI v3 spec (version 1.0.454).
+The SDK covers **all 60 resources** and **639 operations** in the OrderCloud API. Models and resource clients are generated from the official OpenAPI v3 spec (version 1.0.470).
 
 ### Core Commerce
 
@@ -504,18 +504,18 @@ The test suite is self-bootstrapping — it uses the SDK itself to create all te
 
 ### Test Suite
 
-791 tests across 12 modules.
+803 tests across 12 modules.
 
-**Unit tests (766)** — mocked HTTP via [respx](https://lundberg.github.io/respx/), no network calls:
+**Unit tests (778)** — mocked HTTP via [respx](https://lundberg.github.io/respx/), no network calls:
 
 | Module | Tests | Purpose |
 |--------|-------|---------|
 | `test_auth.py` | 13 | OAuth2 token management |
-| `test_http.py` | 16 | HTTP client, error parsing, retries |
-| `test_models.py` | 28 | Model round-trips, enums, xp, ListPage |
-| `test_resources.py` | 22 | Representative resource operations |
+| `test_http.py` | 37 | HTTP client, error parsing, retries |
+| `test_models.py` | 44 | Model round-trips, enums, xp, ListPage |
+| `test_resources.py` | 33 | Representative resource operations |
 | `test_resource_coverage.py` | 639 | All 60 resources, all 639 operations |
-| `test_sync_client.py` | 48 | Sync wrapper, pagination |
+| `test_sync_client.py` | 12 | Sync wrapper, pagination |
 
 **Integration tests (25)** — live sandbox, skipped when credentials are absent:
 
@@ -532,11 +532,11 @@ The test suite is self-bootstrapping — it uses the SDK itself to create all te
 
 | Module | Coverage |
 |--------|----------|
-| `auth.py` | 100% |
+| `auth.py` | 93% |
 | `client.py` | 100% |
-| `config.py` | 100% |
+| `config.py` | 94% |
 | `errors.py` | 100% |
-| `http.py` | 97% |
+| `http.py` | 98% |
 | `middleware.py` | 100% |
 | `sync_client.py` | 100% |
 | `resources/base.py` | 100% |

{ordercloud_python-2026.6.1 → ordercloud_python-2026.10.1}/README.md

@@ -20,7 +20,7 @@ A fully typed, async-first Python SDK for [Sitecore OrderCloud](https://orderclo
 - **Middleware hooks** — intercept requests and responses for logging, metrics, or header injection.
 - **Structured logging** — standard Python `logging` module, DEBUG/WARNING levels.
 - **Full type annotations** — `py.typed` marker for downstream type checking with mypy, pyright, etc.
-- **791 tests, 97% coverage** — 766 unit tests (mocked HTTP) + 25 integration tests (live sandbox).
+- **803 tests, 97% coverage** — 778 unit tests (mocked HTTP) + 25 integration tests (live sandbox).
 
 ## Installation
 
@@ -204,7 +204,7 @@ Before-request hooks receive a mutable `RequestContext` — modify `headers`, `p
 
 ## API Coverage
 
-The SDK covers **all 60 resources** and **639 operations** in the OrderCloud API. Models and resource clients are generated from the official OpenAPI v3 spec (version 1.0.454).
+The SDK covers **all 60 resources** and **639 operations** in the OrderCloud API. Models and resource clients are generated from the official OpenAPI v3 spec (version 1.0.470).
 
 ### Core Commerce
 
@@ -464,18 +464,18 @@ The test suite is self-bootstrapping — it uses the SDK itself to create all te
 
 ### Test Suite
 
-791 tests across 12 modules.
+803 tests across 12 modules.
 
-**Unit tests (766)** — mocked HTTP via [respx](https://lundberg.github.io/respx/), no network calls:
+**Unit tests (778)** — mocked HTTP via [respx](https://lundberg.github.io/respx/), no network calls:
 
 | Module | Tests | Purpose |
 |--------|-------|---------|
 | `test_auth.py` | 13 | OAuth2 token management |
-| `test_http.py` | 16 | HTTP client, error parsing, retries |
-| `test_models.py` | 28 | Model round-trips, enums, xp, ListPage |
-| `test_resources.py` | 22 | Representative resource operations |
+| `test_http.py` | 37 | HTTP client, error parsing, retries |
+| `test_models.py` | 44 | Model round-trips, enums, xp, ListPage |
+| `test_resources.py` | 33 | Representative resource operations |
 | `test_resource_coverage.py` | 639 | All 60 resources, all 639 operations |
-| `test_sync_client.py` | 48 | Sync wrapper, pagination |
+| `test_sync_client.py` | 12 | Sync wrapper, pagination |
 
 **Integration tests (25)** — live sandbox, skipped when credentials are absent:
 
@@ -492,11 +492,11 @@ The test suite is self-bootstrapping — it uses the SDK itself to create all te
 
 | Module | Coverage |
 |--------|----------|
-| `auth.py` | 100% |
+| `auth.py` | 93% |
 | `client.py` | 100% |
-| `config.py` | 100% |
+| `config.py` | 94% |
 | `errors.py` | 100% |
-| `http.py` | 97% |
+| `http.py` | 98% |
 | `middleware.py` | 100% |
 | `sync_client.py` | 100% |
 | `resources/base.py` | 100% |

{ordercloud_python-2026.6.1 → ordercloud_python-2026.10.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "ordercloud-python"
-version = "2026.6.1"
+version = "2026.10.1"
 description = "Idiomatic Python SDK for Sitecore OrderCloud"
 readme = "README.md"
 license = "MIT"
@@ -70,6 +70,11 @@ packages = ["src/ordercloud"]
 target-version = "py310"
 line-length = 100
 
+[tool.ruff.lint]
+# Explicit rule selection: the set this codebase is linted against. Stated
+# here so the gate does not change when Ruff changes its default rules.
+select = ["E4", "E7", "E9", "F"]
+
 [tool.pytest.ini_options]
 testpaths = ["tests"]
 asyncio_mode = "auto"

{ordercloud_python-2026.6.1 → ordercloud_python-2026.10.1}/src/ordercloud/models/api_client.py

@@ -47,7 +47,6 @@ class ApiClient(OrderCloudModel, Generic[XP]):
 
     Attributes:
         id: Used for OAuth 2.0 workflows and impersonation. (read-only)
-        client_secret: Enables the OAuth 2.0 client credentials grant type. Required on all OAuth workflows when present.
         access_token_duration:
         active: All user authentication is prohibited if false.
         app_name:
@@ -74,7 +73,6 @@ class ApiClient(OrderCloudModel, Generic[XP]):
     """
 
     id: Optional[str] = Field(None, alias="ID")
-    client_secret: Optional[str] = Field(None, alias="ClientSecret")
     access_token_duration: Optional[int] = Field(None, alias="AccessTokenDuration")
     active: Optional[bool] = Field(None, alias="Active")
     app_name: Optional[str] = Field(None, alias="AppName")

{ordercloud_python-2026.6.1 → ordercloud_python-2026.10.1}/src/ordercloud/models/discount.py

@@ -52,6 +52,7 @@ class Discount(OrderCloudModel, Generic[XP]):
         catalog_id:
         category_id:
         product_id:
+        priority: Controls precedence when multiple discounts apply to the same user and product. Lower number = higher precedence (1 beats 2). Null is applied last.
         xp:
     """
 
@@ -62,4 +63,5 @@ class Discount(OrderCloudModel, Generic[XP]):
     catalog_id: Optional[str] = Field(None, alias="CatalogID")
     category_id: Optional[str] = Field(None, alias="CategoryID")
     product_id: Optional[str] = Field(None, alias="ProductID")
+    priority: Optional[int] = Field(None, alias="Priority")
     xp: Optional[XP] = Field(None, alias="xp")

{ordercloud_python-2026.6.1 → ordercloud_python-2026.10.1}/src/ordercloud/models/misc.py

@@ -78,6 +78,7 @@ class ApiRole(OrderCloudEnum):
     MeSubscriptionAdmin = "MeSubscriptionAdmin"
     MeXpAdmin = "MeXpAdmin"
     OrderAdmin = "OrderAdmin"
+    OrderEditAfterSubmit = "OrderEditAfterSubmit"
     OrderReader = "OrderReader"
     OverrideShipping = "OverrideShipping"
     OverrideTax = "OverrideTax"

{ordercloud_python-2026.6.1 → ordercloud_python-2026.10.1}/tests/test_models.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import pytest
 
 from ordercloud.models import (
     Address,
@@ -12,6 +13,9 @@ from ordercloud.models import (
     MetaWithFacets,
     Product,
 )
+from ordercloud.models.api_client import ApiClient
+from ordercloud.models.discount import Discount
+from ordercloud.models.misc import ApiRole
 from ordercloud.models.order import Order, OrderDirection, OrderStatus
 from ordercloud.models.line_item import LineItem
 from ordercloud.models.payment import Payment, PaymentType
@@ -241,6 +245,46 @@ class TestPhase2Models:
         assert "BuyerAdmin" in sp.roles
 
 
+class TestDiscountModel:
+    def test_priority_round_trip(self):
+        d = Discount.model_validate({"ID": "disc-1", "Priority": 1})
+        assert d.priority == 1
+        assert d.model_dump(by_alias=True, exclude_none=True)["Priority"] == 1
+
+    def test_priority_defaults_to_none(self):
+        assert Discount().priority is None
+
+
+class TestApiClientModel:
+    """``ClientSecret`` is not a declared ``ApiClient`` field (the spec dropped it in
+    1.0.470), so ``extra="allow"`` decides where a supplied value lands."""
+
+    def test_client_secret_not_a_declared_field(self):
+        assert "client_secret" not in ApiClient.model_fields
+
+    def test_client_secret_attribute_absent_when_not_supplied(self):
+        c = ApiClient(AppName="app")
+        with pytest.raises(AttributeError):
+            c.client_secret
+
+    def test_client_secret_in_response_kept_as_extra_under_api_name(self):
+        c = ApiClient.model_validate({"ID": "c1", "ClientSecret": "s"})
+        assert c.model_extra == {"ClientSecret": "s"}
+        with pytest.raises(AttributeError):
+            c.client_secret
+
+    def test_snake_case_client_secret_kwarg_kept_as_extra(self):
+        c = ApiClient(client_secret="s")
+        assert c.model_extra == {"client_secret": "s"}
+        assert c.client_secret == "s"
+
+    def test_pascal_case_client_secret_kwarg_kept_as_extra(self):
+        c = ApiClient(ClientSecret="s")
+        assert c.model_extra == {"ClientSecret": "s"}
+        with pytest.raises(AttributeError):
+            c.client_secret
+
+
 # ---------------------------------------------------------------------------
 # Enum serialisation
 # ---------------------------------------------------------------------------
@@ -266,6 +310,13 @@ class TestEnums:
         assert PaymentType.CreditCard.value == "CreditCard"
         assert PaymentType.PurchaseOrder.value == "PurchaseOrder"
 
+    def test_api_role_order_edit_after_submit(self):
+        assert ApiRole.OrderEditAfterSubmit.value == "OrderEditAfterSubmit"
+
+    def test_role_list_accepts_order_edit_after_submit(self):
+        sp = SecurityProfile.model_validate({"ID": "sp-1", "Roles": ["OrderEditAfterSubmit"]})
+        assert sp.roles == [ApiRole.OrderEditAfterSubmit]
+
 
 # ---------------------------------------------------------------------------
 # Typed xp generics

{ordercloud_python-2026.6.1 → ordercloud_python-2026.10.1}/tests/test_resources.py

@@ -2,15 +2,20 @@
 
 from __future__ import annotations
 
+import json
+
 import respx
 from httpx import Response
 
 from ordercloud.http import HttpClient
 from ordercloud.models import Product, ListPage
+from ordercloud.models.api_client import ApiClient
 from ordercloud.models.order import Order, OrderDirection, OrderStatus
 from ordercloud.models.line_item import LineItem
 from ordercloud.models.promotion import Promotion
+from ordercloud.resources.api_clients import ApiClientsResource
 from ordercloud.resources.base import paginate
+from ordercloud.resources.discounts import DiscountsResource
 from ordercloud.resources.products import ProductsResource
 from ordercloud.resources.orders import OrdersResource
 from ordercloud.resources.line_items import LineItemsResource
@@ -293,6 +298,43 @@ class TestPhase2Resources:
         shipment = await resource.get("ship-1")
         assert shipment.buyer_id == "b1"
 
+    @respx.mock
+    async def test_api_clients_create_sends_client_secret_under_the_key_given(
+        self, http_client: HttpClient
+    ):
+        """With no declared field, an extra is serialised under the exact name supplied."""
+        route = respx.post(f"{TEST_BASE_URL}/apiclients").mock(
+            return_value=Response(201, json={"ID": "c1", "AppName": "app"})
+        )
+        resource = ApiClientsResource(http_client)
+        await resource.create(ApiClient(AppName="app", client_secret="s"))
+        await resource.create(ApiClient(AppName="app", ClientSecret="s"))
+        snake_body = json.loads(route.calls[0].request.content)
+        pascal_body = json.loads(route.calls[1].request.content)
+        assert snake_body["client_secret"] == "s"
+        assert "ClientSecret" not in snake_body
+        assert pascal_body["ClientSecret"] == "s"
+        assert "client_secret" not in pascal_body
+
+    @respx.mock
+    async def test_api_clients_get_keeps_client_secret_as_extra(self, http_client: HttpClient):
+        respx.get(f"{TEST_BASE_URL}/apiclients/c1").mock(
+            return_value=Response(200, json={"ID": "c1", "ClientSecret": "s"})
+        )
+        resource = ApiClientsResource(http_client)
+        api_client = await resource.get("c1")
+        assert api_client.model_extra == {"ClientSecret": "s"}
+
+    @respx.mock
+    async def test_discounts_list_passes_sort_by_through(self, http_client: HttpClient):
+        route = respx.get(f"{TEST_BASE_URL}/discounts").mock(
+            return_value=Response(200, json=list_response([{"ID": "d1", "Priority": 1}]))
+        )
+        resource = DiscountsResource(http_client)
+        page = await resource.list(sort_by="!Priority")
+        assert route.calls[0].request.url.params["sortBy"] == "!Priority"
+        assert page.items[0].priority == 1
+
 
 # ---------------------------------------------------------------------------
 # Auto-pagination