Bug Fixes

• bump cryptography to ~=50.0 for CVE-2026-69247 (#707) (d82226c)

Miscellaneous Chores

• release 10.1.0 (1889026)

• #702 feat(generated)!: regenerate from spec (2 changes)

  Features

  • pipes:
    • Added config to DataIntegrationsGetDataIntegrationAuthorizeUrlRequest
    • Added client_credentials to DataIntegrationAuthMethods
    • Added client_credentials to DataIntegrationsListResponseDataAuthMethods
    • Added client_credentials to DataIntegrationsListResponseDataConnectedAccountAuthMethod
    • Added config to Pipes models
  • connect:
    • Added client_credentials to ConnectedAccountAuthMethod

  Fixes

  • user_management:
    • Changed errors for endpoint POST /user_management/invitations
    • Changed errors for endpoint POST /user_management/invitations/{id}/resend
    • Changed errors for endpoint POST /user_management/magic_auth
    • Changed errors for endpoint POST /user_management/authenticate

• #704 feat(generated)!: regenerate from spec (1 change)

  Fixes

  • sso:
    • Removed callback_endpoint from Connection

Bug Fixes

• user_management: honor client_id in PKCE authorization URL (#701) (93c4fa4)

Documentation

• add agent context for oagen-generated code (d94f9f8)

Features

• Add NOT_GIVEN sentinel for nullable optional params (#694) (3b9a2cb)

Documentation

• clarify Idempotency-Key is only honored on audit log event creation (#692) (15003c0)

• #690 fix(generated): regenerate from spec

  Features

  • audit_logs:
    • Added expired to AuditLogExportState

• #695 feat(generated)!: regenerate from spec (9 changes)

  Features

  • agents:
    • Added model ClaimViewResponse
    • Added model ClaimViewResponseOrganization
    • Added model AgentAdminLinkClaimAttemptToExternalUserRequest
    • Added model AgentAdminLinkClaimAttemptToExternalUserRequestUser
    • Added enum ClaimViewResponseStatus
    • Added endpoint PATCH /agents/claims/attempts
    • Added model AgentRegistration
    • Added model AgentCredentialValidation
    • Added model AgentRegistrationAgentIdentity
    • Added model AgentRegistrationClaim
    • Added model AgentAdminValidateCredentialRequest
    • Added model AgentRegistrationClaimClaimCompletion
    • Added enum AgentRegistrationStatus
    • Added enum AgentRegistrationKind
    • Added enum AgentAdminValidateCredentialRequestType
    • Added service Agents
  • api_keys:
    • Added agent_registration_id to ApiKeyValidationResponse
  • connect:
    • Added enum ApplicationsRegistrationTypes
    • Added parameter Applications.list.registration_types
  • directory_sync:
    • Added parameter DirectoryUsers.list.idp_id
    • Added parameter DirectoryUsers.list.email
  • organizations:
    • Added model OrganizationAuthorizedConnectApplicationList
    • Added model OrganizationAuthorizedConnectApplicationListData
    • Added model OrganizationAuthorizedConnectApplicationListListMetadata
    • Added service OrganizationsAuthorizedApplications
  • pipes:
    • Added model DataIntegrationInstallation
    • Added auth_methods to CreateDataIntegration
    • Added api_key to CreateDataIntegration
    • Added api_key to UpdateDataIntegration
    • Added auth_methods to DataIntegration
    • Added installation to DataIntegration
    • Added enum CreateDataIntegrationAuthMethods
    • Added enum DataIntegrationAuthMethods
    • Added model DataIntegrationCredentialsResponse
    • Added model DataIntegrationCredentialsResponseCredential
    • Added model DataIntegrationsUpsertApiKeyRequest
    • Added model DataIntegrationsVendCredentialsRequest
    • Added enum DataIntegrationCredentialsResponseError
    • Added endpoint PUT /data-integrations/{slug}/api-key
    • Added endpoint POST /data-integrations/{slug}/credentials
  • sso:
    • Added parameter SSO.authorize.prompt
  • user_management:
    • Added ssha256 to CreateUserPasswordHashType
    • Added ssha256 to UpdateUserPasswordHashType
    • Added endpoint GET /user_management/radar_challenges/{id}
  • webhooks:
    • Added agent.registration.revoked to CreateWebhookEndpointEvents
    • Added agent.registration.revoked to UpdateWebhookEndpointEvents
    • Added agent.registration.deleted to CreateWebhookEndpointEvents
    • Added agent.registration.deleted to UpdateWebhookEndpointEvents
    • Added radar.challenge_created to CreateWebhookEndpointEvents
    • Added radar.challenge_created to UpdateWebhookEndpointEvents
    • Added agent.registration.expired to CreateWebhookEndpointEvents
    • Added agent.registration.expired to UpdateWebhookEndpointEvents
  • widgets:
    • Made WidgetSessionToken.organization_id optional

• #698 feat(generated)!: regenerate from spec (5 changes)

  ⚠️ Breaking

  • admin_portal:
    • SDK surface change: Symbol "IntentOptions" was removed
  • connect:
    • SDK surface change: Symbol "ConnectedAccountDto" was removed
  • organization_domains:
    • SDK surface change: Symbol "DomainVerificationIntentOptions" was removed
  • pipes:
    • SDK surface change: Symbol "DataIntegrationCredentialsDto" was removed
  • sso:
    • SDK surface change: Symbol "SSOIntentOptions" was removed

• #687 fix(generated): regenerate from spec

  Features

  • user_management:
    • Added model UserRoleAssignmentSource
    • Added source to UserRoleAssignment
    • Added enum UserRoleAssignmentSourceType
    • Added parameter UserManagementAuthentication.authorize.max_age
    • Added endpoint GET /user_management/cors_origins
    • Added endpoint GET /user_management/redirect_uris

  Fixes

  • Restore mistakenly removed CreateMagicAuth logic from previous release

• #681 fix(generated): regenerate from spec

  Features

  • pipes:
    • Added model DataIntegrationCredentialsResponse
    • Added model DataIntegrationCredentialsResponseCredential
    • Added model DataIntegrationsUpsertApiKeyRequest
    • Added model DataIntegrationsVendCredentialsRequest
    • Added enum DataIntegrationCredentialsResponseError
    • Added endpoint PUT /data-integrations/{slug}/api-key
    • Added endpoint POST /data-integrations/{slug}/credentials

• #683 fix(generated): regenerate from spec

  ⚠️ Breaking

  • user_management:
    • Removed model SessionReauthenticated
    • Removed model SessionReauthenticatedData
    • Removed model SessionReauthenticatedDataImpersonator
    • Removed enum SessionReauthenticatedDataAuthMethod
    • Removed enum SessionReauthenticatedDataStatus

  Features

  • webhooks:
    • Added agent.registration.created to CreateWebhookEndpointEvents
    • Added agent.registration.claim.attempt.created to CreateWebhookEndpointEvents
    • Added agent.registration.claim.completed to CreateWebhookEndpointEvents
    • Added agent.registration.credential.issued to CreateWebhookEndpointEvents
    • Added agent.registration.organization.switched to CreateWebhookEndpointEvents
    • Added authentication.reauthentication_succeeded to CreateWebhookEndpointEvents
    • Added agent.registration.created to UpdateWebhookEndpointEvents
    • Added agent.registration.claim.attempt.created to UpdateWebhookEndpointEvents
    • Added agent.registration.claim.completed to UpdateWebhookEndpointEvents
    • Added agent.registration.credential.issued to UpdateWebhookEndpointEvents
    • Added agent.registration.organization.switched to UpdateWebhookEndpointEvents
    • Added authentication.reauthentication_succeeded to UpdateWebhookEndpointEvents
  • webhooks:
    • Added session.reauthenticated to CreateWebhookEndpointEvents
    • Added session.reauthenticated to UpdateWebhookEndpointEvents
  • webhooks:
    • Added pipes.connected_account.connection_failed to CreateWebhookEndpointEvents
    • Added pipes.connected_account.connection_failed to UpdateWebhookEndpointEvents
  • user_management:
    • Added model UserRoleAssignmentSource
    • Added source to UserRoleAssignment
    • Added enum UserRoleAssignmentSourceType
    • Added parameter UserManagementAuthentication.authorize.max_age
    • Added endpoint GET /user_management/cors_origins
    • Added endpoint GET /user_management/redirect_uris
  • audit_logs:
    • Changed the format of AuditLogExportCreation.range_start
    • Changed the format of AuditLogExportCreation.range_end
  • audit_logs:
    • Added expired to AuditLogExportState

  Fixes

  • admin_portal:
    • Removed intent_options from GenerateLink
  • webhooks:
    • Removed session.reauthenticated from CreateWebhookEndpointEvents
    • Removed session.reauthenticated from UpdateWebhookEndpointEvents

• #685 feat(generated): regenerate from spec (1 change)

  Features

  • pipes:
    • Added model DataIntegrationCredentialsDto
    • Added model CustomProviderDefinition
    • Added model CreateDataIntegration
    • Added model UpdateCustomProviderDefinition
    • Added model UpdateDataIntegration
    • Added model DataIntegration
    • Added model DataIntegrationList
    • Added model DataIntegrationListListMetadata
    • Added model DataIntegrationCredential
    • Added model DataIntegrationCustomProvider
    • Added enum DataIntegrationCredentialsType
    • Added enum CustomProviderDefinitionAuthenticateVia
    • Added enum UpdateCustomProviderDefinitionAuthenticateVia
    • Added enum DataIntegrationState
    • Added enum DataIntegrationCredentialType
    • Added enum DataIntegrationCustomProviderAuthenticateVia
    • Added endpoint GET /data-integrations
    • Added endpoint POST /data-integrations
    • Added endpoint GET /data-integrations/{slug}
    • Added endpoint PUT /data-integrations/{slug}
    • Added endpoint DELETE /data-integrations/{slug}
    • Added endpoint POST /user_management/users/{user_id}/connected_accounts/{slug}
    • Added endpoint PUT /user_management/users/{user_id}/connected_accounts/{slug}

• #686 feat(generated)!: regenerate from spec (3 changes)

  Features

  • user_management:
    • Added model SendRadarSmsChallenge
    • Added model SendRadarSmsChallengeResponse
    • Added model UrnWorkosOAuthGrantTypeRadarEmailChallengeCodeSessionAuthenticateRequest
    • Added model UrnWorkosOAuthGrantTypeRadarSmsChallengeCodeSessionAuthenticateRequest
    • Added model MagicAuthSendMagicAuthCodeAndReturnResponse
    • Added model UserCreateResponse
    • Added ip_address to CreateMagicCodeAndReturn
    • Added user_agent to CreateMagicCodeAndReturn
    • Added radar_auth_attempt_id to CreateMagicCodeAndReturn
    • Added signals_id to CreateMagicCodeAndReturn
    • Added ip_address to CreateUser
    • Added user_agent to CreateUser
    • Added signals_id to CreateUser
    • Added signals_id to AuthorizationCodeSessionAuthenticateRequest
    • Added signals_id to PasswordSessionAuthenticateRequest
    • Added radar_auth_attempt_id to PasswordSessionAuthenticateRequest
    • Added radar_auth_attempt_id to UrnWorkosOAuthGrantTypeMagicAuthCodeSessionAuthenticateRequest
    • Added endpoint POST /user_management/radar_challenges
  • radar:
    • Added signals_id to RadarStandaloneAssessRequest

  Fixes

  • user_management:
    • Changed request body for UserManagementAuthentication.authenticate
    • Changed response of UserManagementUsers.create from User to UserCreateResponse
    • Changed response of UserManagementMagicAuth.sendMagicAuthCodeAndReturn from MagicAuth to MagicAuthSendMagicAuthCodeAndReturnResponse

• #676 fix(generated): regenerate from spec

  Fixes

  • organization_membership:
    • Added roles to organization membership models

What's Changed

• fix: backport SSO Profile custom_attributes to 5.9.x (5.9.1) by @claude[bot] in #677

New Contributors

• @claude[bot] made their first contribution in #677

Full Changelog: v5.9.0...v5.9.1

Bug Fixes

• Fix Session.refresh() KeyError by sealing session client-side (#673) (6c7ccfd)

• #670 feat(generated)!: regenerate from spec (12 changes)

  ⚠️ Breaking

  • organization_membership:
    • Changed response for UserManagementOrganizationMembership.list
  • pipes:
    • SDK surface change: Symbol "AsyncPipes.create_data_integration_token" was removed
  • user_management:
    • Changed response for UserManagementInvitations.list
  • widgets:
    • SDK surface change: Symbol "WidgetSessionTokenResponse" was removed

  Features

  • authorization:
    • Added model ReplaceGroupRoleAssignmentEntry
    • Added model ReplaceGroupRoleAssignments
    • Added model DeleteGroupRoleAssignmentsByCriteria
    • Added endpoint POST /authorization/groups/{group_id}/role_assignments
    • Added endpoint PUT /authorization/groups/{group_id}/role_assignments
    • Added endpoint DELETE /authorization/groups/{group_id}/role_assignments
    • Added endpoint GET /authorization/groups/{group_id}/role_assignments/{role_assignment_id}
    • Added endpoint DELETE /authorization/groups/{group_id}/role_assignments/{role_assignment_id}
  • client:
    • Added model ClientApiToken
    • Added model ClientApiTokenResponse
    • Added service Client
  • connect:
    • Added auth_method to ConnectedAccount
    • Added api_key_last_4 to ConnectedAccount
    • Added enum ConnectedAccountAuthMethod
  • groups:
    • Added model CreateGroupRoleAssignment
    • Added model GroupRoleAssignment
    • Added model GroupRoleAssignmentList
    • Added model GroupRoleAssignmentResource
  • organization_membership:
    • Added model UserOrganizationMembershipList
    • Added model UserOrganizationMembershipListListMetadata
  • pipes:
    • Added model DataIntegrationCredentials
    • Added model DataIntegrationConfigurationResponse
    • Added model DataIntegrationConfigurationListResponse
    • Added model ConfigureDataIntegrationBody
    • Added auth_methods to DataIntegrationsListResponseData
    • Added auth_method to DataIntegrationsListResponseDataConnectedAccount
    • Added api_key_last_4 to DataIntegrationsListResponseDataConnectedAccount
    • Added enum DataIntegrationCredentialsCredentialsType
    • Added enum DataIntegrationsListResponseDataAuthMethods
    • Added enum DataIntegrationsListResponseDataConnectedAccountAuthMethod
    • Added service PipesProvider
  • user_management:
    • Added model UserInviteList
    • Added model UserInviteListListMetadata
    • Made AuthorizationCodeSessionAuthenticateRequest.client_secret optional
    • Made RefreshTokenSessionAuthenticateRequest.client_secret optional
  • widgets:
    • Added widgets:pipes:manage to WidgetSessionTokenScopes

Bug Fixes

• renovate: explicitly enable minor and patch updates (#663) (ff8ad1b)

• #665 feat(generated)!: regenerate from spec (9 changes)

  ⚠️ Breaking

  • api_keys:
    • Made expires_at required in API key models
  • directory_sync:
    • Removed model DsyncDeactivated
    • Removed model DsyncDeactivatedData
    • Removed model DsyncDeactivatedDataDomain
    • Removed enum DsyncDeactivatedDataType
    • Removed enum DsyncDeactivatedDataState
  • radar:
    • Removed domain_sign_up_rate_limit from RadarStandaloneResponseControl
  • user_management:
    • Removed return_to from RevokeSession

  Features

  • api_keys:
    • Added model ExpireApiKey
    • Added model ApiKeyUpdated
    • Added model ApiKeyUpdatedData
    • Added model ApiKeyUpdatedDataOwner
    • Added model UserApiKeyUpdatedDataOwner
    • Added model ApiKeyUpdatedDataPreviousAttribute
    • Added endpoint POST /api_keys/{id}/expire
  • audit_logs:
    • Added Snowflake to AuditLogConfigurationLogStreamType
  • connect:
    • Added name to UserObject
  • directory_sync:
    • Added model DsyncTokenCreated
    • Added model DsyncTokenCreatedData
    • Added model DsyncTokenRevoked
    • Added model DsyncTokenRevokedData
  • user_management:
    • Added name to user management models
  • webhooks:
    • Added api_key.updated to CreateWebhookEndpointEvents
    • Added api_key.updated to UpdateWebhookEndpointEvents