scalekit-sdk-python 2.6.0__tar.gz → 2.7.1__tar.gz

{scalekit_sdk_python-2.6.0 → scalekit_sdk_python-2.7.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: scalekit-sdk-python
-Version: 2.6.0
+Version: 2.7.1
 Summary: Scalekit official Python SDK
 Home-page: https://github.com/scalekit-inc/scalekit-sdk-python
 Author: Team Scalekit
@@ -15,9 +15,9 @@ Requires-Dist: grpcio>=1.64.1
 Requires-Dist: protobuf<7.0.0,>=5.29.5
 Requires-Dist: google>=3.0
 Requires-Dist: requests>=2.32.3
-Requires-Dist: PyJWT<2.11,>=2.8
+Requires-Dist: PyJWT>=2.12.0
 Requires-Dist: cffi>=1.15.1
-Requires-Dist: cryptography<47,==46.0.5
+Requires-Dist: cryptography<47,==46.0.6
 Requires-Dist: setuptools<81.0,>=78.1.1
 Requires-Dist: grpcio-status<1.67,>=1.64
 Requires-Dist: protoc-gen-openapiv2>=0.0.1

{scalekit_sdk_python-2.6.0 → scalekit_sdk_python-2.7.1}/scalekit/_version.py

@@ -1,3 +1,3 @@
 # Single source of truth for the SDK version.
 # Import this in setup.py and scalekit/core.py — never hardcode the version elsewhere.
-__version__ = "2.6.0"
+__version__ = "2.7.1"

{scalekit_sdk_python-2.6.0 → scalekit_sdk_python-2.7.1}/scalekit/actions/__init__.py

@@ -1,5 +1,4 @@
 from .actions import ActionClient
-from .models import *
 
 __all__ = [
     'ActionClient',

{scalekit_sdk_python-2.6.0 → scalekit_sdk_python-2.7.1}/scalekit/actions/actions.py

@@ -3,7 +3,7 @@ import requests
 from scalekit.actions.types import ToolRequest,ExecuteToolResponse,MagicLinkResponse,ListConnectedAccountsResponse,DeleteConnectedAccountResponse,GetConnectedAccountAuthResponse,ToolInput, \
     UpdateConnectedAccountResponse,CreateMcpConfigResponse,ListMcpConfigsResponse,UpdateMcpConfigResponse,DeleteMcpConfigResponse, \
     EnsureMcpInstanceResponse,UpdateMcpInstanceResponse,GetMcpInstanceResponse,ListMcpInstancesResponse,DeleteMcpInstanceResponse,GetMcpInstanceAuthStateResponse, \
-    McpConfig,McpConfigConnectionToolMapping
+    McpConfig,McpConfigConnectionToolMapping,VerifyConnectedAccountUserResponse
 from scalekit.actions.models.responses.create_connected_account_response import CreateConnectedAccountResponse
 from scalekit.actions.models.requests.create_connected_account_request import CreateConnectedAccountRequest
 from scalekit.actions.models.requests.update_connected_account_request import UpdateConnectedAccountRequest
@@ -143,18 +143,24 @@ class ActionClient:
             identifier: Optional[str] = None,
             connection_name: Optional[str] = None,
             connected_account_id: Optional[str] = None,
+            state: Optional[str] = None,
+            user_verify_url: Optional[str] = None,
             **kwargs
     ) -> MagicLinkResponse:
         """
         Get authorization magic link for a connected account
-        
+
         :param connection_name: Connector identifier
         :type: str
         :param identifier: Connected account identifier
         :type: str
         :param connected_account_id: Connected account ID (optional)
         :type: str
-        
+        :param state: Opaque state value passed through to the user verify redirect URL query params (optional)
+        :type: str
+        :param user_verify_url: B2B app's user verify redirect URL (optional)
+        :type: str
+
         :returns:
             MagicLinkResponse containing magic link and expiry
         """
@@ -162,14 +168,47 @@ class ActionClient:
         result_tuple = self.connected_accounts.get_magic_link_for_connected_account(
             connector=connection_name,
             identifier=identifier,
-            connected_account_id=connected_account_id
+            connected_account_id=connected_account_id,
+            state=state,
+            user_verify_url=user_verify_url
         )
-        
+
         # Extract the response[0] (the actual GetMagicLinkForConnectedAccountResponse proto object)
         proto_response = result_tuple[0]
-        
+
         # Convert proto to our MagicLinkResponse class
         return MagicLinkResponse.from_proto(proto_response)
+
+    def verify_connected_account_user(
+        self,
+        auth_request_id: str,
+        identifier: str,
+    ) -> VerifyConnectedAccountUserResponse:
+        """
+        Verify a connected account user after OAuth callback
+
+        :param auth_request_id: Auth request ID as base64url-encoded opaque token from the
+                                user verify redirect URL query params
+        :type: str
+        :param identifier: Current logged in user's connected account identifier
+        :type: str
+
+        :returns:
+            VerifyConnectedAccountUserResponse containing the post-verification redirect URL
+        """
+        if not auth_request_id:
+            raise ValueError("auth_request_id is required")
+        if not identifier:
+            raise ValueError("identifier is required")
+
+        result_tuple = self.connected_accounts.verify_connected_account_user(
+            auth_request_id=auth_request_id,
+            identifier=identifier
+        )
+
+        proto_response = result_tuple[0]
+
+        return VerifyConnectedAccountUserResponse.from_proto(proto_response)
     
     def list_connected_accounts(
         self, 
@@ -565,7 +604,7 @@ class ActionClient:
         self,
         connection_name: str,
         identifier: str,
-        authorization_details: Dict[str, Any],
+        authorization_details: Optional[Dict[str, Any]] = None,
         organization_id: Optional[str] = None,
         user_id: Optional[str] = None,
         api_config: Optional[Dict[str, Any]] = None,
@@ -578,8 +617,8 @@ class ActionClient:
         :type: str
         :param identifier: Connected account identifier (required)
         :type: str
-        :param authorization_details: Authorization details (OAuth token or static auth) (required)
-        :type: Dict[str, Any]
+        :param authorization_details: Authorization details (OAuth token or static auth) (optional)
+        :type: Optional[Dict[str, Any]]
         :param organization_id: Organization ID (optional)
         :type: str
         :param user_id: User ID (optional)
@@ -641,7 +680,7 @@ class ActionClient:
         :type: str
         :param identifier: Connected account identifier (required)
         :type: str
-        :param authorization_details: Authorization details (OAuth token or static auth) (optional, empty auth will be used if not provided)
+        :param authorization_details: Authorization details (OAuth token or static auth) (optional)
         :type: Optional[Dict[str, Any]]
         :param organization_id: Organization ID (optional)
         :type: str
@@ -672,13 +711,10 @@ class ActionClient:
             
         except ScalekitNotFoundException:
             # Connected account doesn't exist, create a new one
-            # Use empty authorization details if none provided
-            auth_details = authorization_details if authorization_details is not None else {}
-            
             return self.create_connected_account(
                 connection_name=connection_name,
                 identifier=identifier,
-                authorization_details=auth_details,
+                authorization_details=authorization_details,
                 organization_id=organization_id,
                 user_id=user_id,
                 api_config=api_config

{scalekit_sdk_python-2.6.0 → scalekit_sdk_python-2.7.1}/scalekit/actions/models/requests/create_connected_account_request.py

@@ -14,7 +14,7 @@ class CreateConnectedAccountRequest(BaseModel):
 
     connection_name: str = Field(..., description="Connector identifier")
     identifier: str = Field(..., description="Connected account identifier")
-    authorization_details: Dict[str, Any] = Field(default_factory=dict, description="Authorization details (OAuth token or static auth)")
+    authorization_details: Optional[Dict[str, Any]] = Field(None, description="Authorization details (OAuth token or static auth)")
     organization_id: Optional[str] = Field(None, description="Organization ID")
     user_id: Optional[str] = Field(None, description="User ID")
     api_config: Optional[Dict[str, Any]] = Field(None, description="Optional API configuration for the connected account")
@@ -45,15 +45,6 @@ class CreateConnectedAccountRequest(BaseModel):
             static_auth = StaticAuth(details=struct_details)
             auth_details = AuthorizationDetails(static_auth=static_auth)
         
-        elif not self.authorization_details:
-            # Create empty OAuth token for empty authorization details
-            oauth_token = OauthToken(
-                access_token="",
-                refresh_token="",
-                scopes=[]
-            )
-            auth_details = AuthorizationDetails(oauth_token=oauth_token)
-
         # Handle api_config if provided
         api_config_struct = None
         if self.api_config:

scalekit_sdk_python-2.7.1/scalekit/actions/models/responses/verify_connected_account_user_response.py

@@ -0,0 +1,41 @@
+from typing import Optional
+from pydantic import BaseModel, Field
+
+
+class VerifyConnectedAccountUserResponse(BaseModel):
+    """Verify connected account user response with one-to-one mapping to proto VerifyConnectedAccountUserResponse"""
+
+    post_user_verify_redirect_url: Optional[str] = Field(
+        None,
+        description="URL to redirect the user to after successful verification"
+    )
+
+    @classmethod
+    def from_proto(cls, proto_response) -> 'VerifyConnectedAccountUserResponse':
+        """
+        Create VerifyConnectedAccountUserResponse from protobuf VerifyConnectedAccountUserResponse
+
+        :param proto_response: The protobuf VerifyConnectedAccountUserResponse object
+        :type proto_response: VerifyConnectedAccountUserResponse (from connected_accounts_pb2)
+
+        :returns:
+            VerifyConnectedAccountUserResponse instance
+        """
+        return cls(
+            post_user_verify_redirect_url=proto_response.post_user_verify_redirect_url or None
+        )
+
+    def to_dict(self) -> dict:
+        """
+        Convert to dictionary representation
+
+        :returns:
+            Dictionary representation of the response
+        """
+        return {
+            "post_user_verify_redirect_url": self.post_user_verify_redirect_url
+        }
+
+    class Config:
+        """Pydantic configuration"""
+        validate_assignment = True

{scalekit_sdk_python-2.6.0 → scalekit_sdk_python-2.7.1}/scalekit/actions/types.py

@@ -21,6 +21,7 @@ from .models.responses.update_mcp_config_response import UpdateMcpConfigResponse
 from .models.responses.update_mcp_instance_response import UpdateMcpInstanceResponse
 from .models.responses.delete_mcp_config_response import DeleteMcpConfigResponse
 from .models.responses.delete_mcp_instance_response import DeleteMcpInstanceResponse
+from .models.responses.verify_connected_account_user_response import VerifyConnectedAccountUserResponse
 from .models.tool_input_output import ToolInput, ToolOutput
 from .models.tool_mapping import ToolMapping
 from .models.mcp_config import McpConfig, McpConfigConnectionToolMapping
@@ -58,4 +59,5 @@ __all__ = [
     'McpConfigConnectionToolMapping',
     'McpInstance',
     'McpInstanceConnectionAuthState',
+    'VerifyConnectedAccountUserResponse',
 ]

{scalekit_sdk_python-2.6.0 → scalekit_sdk_python-2.7.1}/scalekit/client.py

@@ -83,8 +83,8 @@ class ScalekitClient:
             self.auth = AuthClient(self.core_client)
             self.webauthn = WebAuthnClient(self.core_client)
             self.tokens = TokenClient(self.core_client)
-        except Exception as exp:
-            raise exp
+        except Exception:
+            raise
 
     def get_authorization_url(
         self, redirect_uri: str, options: AuthorizationUrlOptions | None
@@ -123,8 +123,8 @@ class ScalekitClient:
             query_string = urlencode(valid_auth_params)
 
             return f"{self.core_client.env_url}/{AUTHORIZE_ENDPOINT}?{query_string}"
-        except Exception as exp:
-            raise exp
+        except Exception:
+            raise
 
     def authenticate_with_code(
         self, code, redirect_uri, options: CodeAuthenticationOptions
@@ -181,8 +181,8 @@ class ScalekitClient:
 
         except jwt.exceptions.InvalidTokenError as exp:
             raise ScalekitValidateTokenFailureException(exp)
-        except Exception as exp:
-            raise exp
+        except Exception:
+            raise
 
     def validate_access_token(self, token: str, options: Optional[TokenValidationOptions] = None, audience = None) -> bool:
         """
@@ -217,20 +217,17 @@ class ScalekitClient:
         :returns:
             access token
         """
-        try:
-            payload = {
-                "grant_type": GrantType.ClientCredentials.value,
-                "client_id": client_id,
-                "client_secret": client_secret,
-                }
-            if scopes:
-                payload["scope"] = " ".join(scopes)
+        payload = {
+            "grant_type": GrantType.ClientCredentials.value,
+            "client_id": client_id,
+            "client_secret": client_secret,
+        }
+        if scopes:
+            payload["scope"] = " ".join(scopes)
 
-            response = self.core_client.authenticate(payload)
-            response = json.loads(response.content)
-            return response['access_token']
-        except Exception as exp:
-            raise exp
+        response = self.core_client.authenticate(payload)
+        response = json.loads(response.content)
+        return response['access_token']
 
     def get_client_access_token(self) -> str:
         """
@@ -266,8 +263,8 @@ class ScalekitClient:
             return claims
         except jwt.exceptions.InvalidTokenError as exp:
             raise ScalekitValidateTokenFailureException(exp)
-        except Exception as exp:
-            raise exp
+        except Exception:
+            raise
 
     def get_idp_initiated_login_claims(self, idp_initiated_login_token: str, options: Optional[TokenValidationOptions] = None, audience = None) -> IdpInitiatedLoginClaims:
         """
@@ -288,8 +285,8 @@ class ScalekitClient:
             return claims
         except jwt.exceptions.InvalidTokenError as exp:
             raise ScalekitValidateTokenFailureException(exp)
-        except Exception as exp:
-            raise exp
+        except Exception:
+            raise
 
     def validate_token(
         self, token: str, options: Optional[TokenValidationOptions] = None, audience: Optional[str] = None
@@ -411,13 +408,13 @@ class ScalekitClient:
 
         try:
             secret_bytes = base64.b64decode(secret_parts[1])
-        except Exception as exp:
-            raise exp
+        except Exception:
+            raise
 
         try:
             timestamp = self.__verify_timestamp(webhook_timestamp)
-        except Exception as exp:
-            raise exp
+        except Exception:
+            raise
 
         timestamp_str = str(floor(timestamp.replace(tzinfo=timezone.utc).timestamp()))
         data = f"{webhook_id}.{timestamp_str}.{payload}"
@@ -549,8 +546,8 @@ class ScalekitClient:
                 "refresh_token": response["refresh_token"]
             }
 
-        except Exception as exp:
-            raise exp
+        except Exception:
+            raise
 
     def get_logout_url(self, options: LogoutUrlOptions) -> str:
         """
@@ -573,5 +570,5 @@ class ScalekitClient:
             query_string = urlencode(valid_params)
 
             return f"{self.core_client.env_url}/{LOGOUT_ENDPOINT}?{query_string}"
-        except Exception as exp:
-            raise exp
+        except Exception:
+            raise

{scalekit_sdk_python-2.6.0 → scalekit_sdk_python-2.7.1}/scalekit/connected_accounts.py

@@ -1,7 +1,24 @@
 from typing import Optional
 
 from scalekit.core import CoreClient
-from scalekit.v1.connected_accounts.connected_accounts_pb2 import *
+from scalekit.v1.connected_accounts.connected_accounts_pb2 import (
+    CreateConnectedAccount,
+    CreateConnectedAccountRequest,
+    CreateConnectedAccountResponse,
+    DeleteConnectedAccountRequest,
+    DeleteConnectedAccountResponse,
+    GetConnectedAccountByIdentifierRequest,
+    GetConnectedAccountByIdentifierResponse,
+    GetMagicLinkForConnectedAccountRequest,
+    GetMagicLinkForConnectedAccountResponse,
+    ListConnectedAccountsRequest,
+    ListConnectedAccountsResponse,
+    UpdateConnectedAccount,
+    UpdateConnectedAccountRequest,
+    UpdateConnectedAccountResponse,
+    VerifyConnectedAccountUserRequest,
+    VerifyConnectedAccountUserResponse,
+)
 from scalekit.v1.connected_accounts.connected_accounts_pb2_grpc import ConnectedAccountServiceStub
 
 
@@ -184,7 +201,9 @@ class ConnectedAccountsClient:
         identifier: str,
         organization_id: Optional[str] = None,
         user_id: Optional[str] = None,
-        connected_account_id: Optional[str] = None
+        connected_account_id: Optional[str] = None,
+        state: Optional[str] = None,
+        user_verify_url: Optional[str] = None
     ) -> GetMagicLinkForConnectedAccountResponse:
         """
         Method to get magic link for a connected account
@@ -199,6 +218,10 @@ class ConnectedAccountsClient:
         :type                   : ``` str ```
         :param connected_account_id : ID of the connected account
         :type                   : ``` str ```
+        :param state            : Opaque state value passed through to the user verify redirect URL query params
+        :type                   : ``` str ```
+        :param user_verify_url  : B2B app's user verify redirect URL
+        :type                   : ``` str ```
 
         :returns:
             Get Magic Link For Connected Account Response
@@ -210,7 +233,9 @@ class ConnectedAccountsClient:
                 user_id=user_id,
                 connector=connector,
                 identifier=identifier,
-                id=connected_account_id
+                id=connected_account_id,
+                state=state,
+                user_verify_url=user_verify_url
             ),
         )
 
@@ -248,4 +273,29 @@ class ConnectedAccountsClient:
                 identifier=identifier,
                 id=connected_account_id
             ),
-        )
+        )
+
+    def verify_connected_account_user(
+        self,
+        auth_request_id: str,
+        identifier: str
+    ) -> VerifyConnectedAccountUserResponse:
+        """
+        Method to verify a connected account user after OAuth callback
+
+        :param auth_request_id  : Auth request ID as base64url-encoded opaque token from the
+                                  user verify redirect URL query params
+        :type                   : ``` str ```
+        :param identifier       : Current logged in user's connected account identifier
+        :type                   : ``` str ```
+
+        :returns:
+            Verify Connected Account User Response
+        """
+        return self.core_client.grpc_exec(
+            self.connected_accounts_service.VerifyConnectedAccountUser.with_call,
+            VerifyConnectedAccountUserRequest(
+                auth_request_id=auth_request_id,
+                identifier=identifier
+            ),
+        )

{scalekit_sdk_python-2.6.0 → scalekit_sdk_python-2.7.1}/scalekit/core.py

@@ -28,7 +28,8 @@ class CoreClient:
     """Class definition for Core Client"""
 
     sdk_version = f"Scalekit-Python/{_sdk_version}"
-    api_version = "20260310"
+    # YYYYMMDD
+    api_version = "20260403"
     user_agent = f"{sdk_version} Python/{platform.python_version()} ({platform.system()}; {platform.architecture()}"
 
     def __init__(self, env_url, client_id, client_secret):

{scalekit_sdk_python-2.6.0 → scalekit_sdk_python-2.7.1}/scalekit/directory.py

@@ -117,14 +117,11 @@ class DirectoryClient:
             dir_user.emails = user.emails
             dir_user.groups = user.groups
             dir_user.user_detail = MessageToJson(user.user_detail)
+            user_response[0].users.append(dir_user)
 
-            if not hasattr(user_response[0], 'users'):
-                user_response[0].users = [dir_user]
-            else:
-                user_response[0].users.append(dir_user)
-            user_response[0].total_size = response[0].total_size
-            user_response[0].next_page_token = response[0].next_page_token
-            user_response[0].prev_page_token = response[0].prev_page_token
+        user_response[0].total_size = response[0].total_size
+        user_response[0].next_page_token = response[0].next_page_token
+        user_response[0].prev_page_token = response[0].prev_page_token
 
         return user_response
 
@@ -177,14 +174,11 @@ class DirectoryClient:
             dir_group.updated_at = group.updated_at
             dir_group.group_detail = MessageToJson(group.group_detail)
 
-            if not hasattr(group_response, 'users'):
-                group_response[0].groups = [dir_group]
-            else:
-                group_response[0].groups.append(dir_group)
+            group_response[0].groups.append(dir_group)
 
-            group_response[0].total_size = response[0].total_size
-            group_response[0].next_page_token = response[0].next_page_token
-            group_response[0].prev_page_token = response[0].prev_page_token
+        group_response[0].total_size = response[0].total_size
+        group_response[0].next_page_token = response[0].next_page_token
+        group_response[0].prev_page_token = response[0].prev_page_token
 
         return group_response
 

{scalekit_sdk_python-2.6.0 → scalekit_sdk_python-2.7.1}/scalekit/organization.py

@@ -2,7 +2,25 @@ from typing import Optional, List, Dict
 
 from google.protobuf import wrappers_pb2
 from scalekit.core import CoreClient
-from scalekit.v1.organizations.organizations_pb2 import *
+from scalekit.v1.organizations.organizations_pb2 import (
+    ListOrganizationsRequest,
+    ListOrganizationsResponse,
+    CreateOrganization,
+    CreateOrganizationRequest,
+    CreateOrganizationResponse,
+    UpdateOrganization,
+    UpdateOrganizationRequest,
+    UpdateOrganizationResponse,
+    GetOrganizationRequest,
+    GetOrganizationResponse,
+    DeleteOrganizationRequest,
+    Feature,
+    GeneratePortalLinkRequest,
+    GeneratePortalLinkResponse,
+    UpdateOrganizationSettingsRequest,
+    OrganizationUserManagementSettings,
+    UpsertUserManagementSettingsRequest,
+)
 from scalekit.v1.organizations.organizations_pb2_grpc import OrganizationServiceStub
 
 

{scalekit_sdk_python-2.6.0 → scalekit_sdk_python-2.7.1}/scalekit/role.py

@@ -329,7 +329,7 @@ class RoleClient:
         )
 
     def delete_organization_role_base(
-        self, 
+        self,
         org_id: str,
         role_name: str
     ):
@@ -351,3 +351,48 @@ class RoleClient:
                 role_name=role_name
             ),
         )
+
+    def update_default_roles(
+        self,
+        default_creator_role: Optional[str] = None,
+        default_member_role: Optional[str] = None,
+    ) -> UpdateDefaultRolesResponse:
+        """
+        Method to update default environment-level roles
+
+        Both default_creator_role and default_member_role must be provided.
+
+        :param default_creator_role : Name of the role to set as default creator role
+        :type                       : ``` str ```
+        :param default_member_role  : Name of the role to set as default member role
+        :type                       : ``` str ```
+
+        :returns:
+            Update Default Roles Response
+        """
+        if not default_creator_role:
+            raise ValueError("default_creator_role is required")
+        if not default_member_role:
+            raise ValueError("default_member_role is required")
+        req = UpdateDefaultRolesRequest()
+        req.default_creator_role = default_creator_role
+        req.default_member_role = default_member_role
+        return self.core_client.grpc_exec(
+            self.role_service.UpdateDefaultRoles.with_call,
+            req,
+        )
+
+    def list_dependent_roles(self, role_name: str) -> ListDependentRolesResponse:
+        """
+        Method to list roles that directly extend (depend on) the specified base role
+
+        :param role_name : Name of the base role
+        :type            : ``` str ```
+
+        :returns:
+            List Dependent Roles Response
+        """
+        return self.core_client.grpc_exec(
+            self.role_service.ListDependentRoles.with_call,
+            ListDependentRolesRequest(role_name=role_name),
+        )

{scalekit_sdk_python-2.6.0 → scalekit_sdk_python-2.7.1}/scalekit/token.py

@@ -13,6 +13,8 @@ from scalekit.v1.tokens.tokens_pb2 import (
     InvalidateTokenRequest,
     ListTokensRequest,
     ListTokensResponse,
+    UpdateTokenRequest,
+    UpdateTokenResponse,
 )
 from scalekit.v1.tokens.tokens_pb2_grpc import ApiTokenServiceStub
 
@@ -121,6 +123,47 @@ class TokenClient:
             InvalidateTokenRequest(token=token),
         )
 
+    def update_token(
+        self,
+        token: str,
+        custom_claims: Optional[Dict[str, str]] = None,
+        description: Optional[str] = None,
+    ) -> UpdateTokenResponse:
+        """
+        Method to update the custom claims and/or description of an existing API token
+
+        Custom claims are merged into the existing set. To remove a claim, set its value to an empty string.
+
+        :param token       : Opaque token string or token_id (apit_xxxxx)
+        :type              : ``` str ```
+        :param custom_claims : Claims to merge; set value to "" to remove a claim
+        :type              : ``` dict[str, str] ```
+        :param description : Replacement description; empty string clears it
+        :type              : ``` str ```
+        :returns:
+            UpdateTokenResponse with updated token_info
+        """
+        if not token:
+            raise ValueError("Invalid token")
+        request = UpdateTokenRequest(token=token)
+        if custom_claims is not None:
+            # Fetch current token to get existing claims for merge
+            current = self.validate_token(token)
+            merged_claims = dict(current.token_info.custom_claims)
+            # Apply updates and removals (empty string means remove)
+            for key, value in custom_claims.items():
+                if value == "":
+                    merged_claims.pop(key, None)
+                else:
+                    merged_claims[key] = value
+            request.custom_claims.update(merged_claims)
+        if description is not None:
+            request.description = description
+        return self.core_client.grpc_exec(
+            self.token_service.UpdateToken,
+            request,
+        )
+
     def list_tokens(
         self,
         organization_id: str,