From d1e3892b45504b9087e6ee7b3988b9f9a6029589 Mon Sep 17 00:00:00 2001 From: "workos-sdk-automation[bot]" <255426317+workos-sdk-automation[bot]@users.noreply.github.com> Date: Fri, 28 Aug 2026 17:09:53 +0000 Subject: [PATCH] Update OpenAPI spec from workos/workos@895153ab38a314e05c8bd0aee6d44ffd10de4c7d --- .last-synced-sha | 2 +- spec/open-api-spec.yaml | 2580 +++++++++++++++++++++++++++++++++++---- 2 files changed, 2349 insertions(+), 233 deletions(-) diff --git a/.last-synced-sha b/.last-synced-sha index 6482b5e..6059eb1 100644 --- a/.last-synced-sha +++ b/.last-synced-sha @@ -1 +1 @@ -4949f089632deb545a54c26f997fe022a56fdf20 +895153ab38a314e05c8bd0aee6d44ffd10de4c7d diff --git a/spec/open-api-spec.yaml b/spec/open-api-spec.yaml index b411f1e..9dd1228 100644 --- a/spec/open-api-spec.yaml +++ b/spec/open-api-spec.yaml @@ -7024,131 +7024,1471 @@ paths: tags: - application.client-secrets /connections: + post: + description: >- + Creates a new connection for an organization. Provide `saml_options` or + `oidc_options` to configure the identity provider. When `external_id` + matches an existing connection in the organization, that connection is + returned instead of creating a duplicate. + operationId: ConnectionsController_create + parameters: [] + requestBody: + required: true + content: + application/json: + schema: + $ref: '#/components/schemas/CreateConnectionDto' + responses: + '201': + description: Created + content: + application/json: + schema: + $ref: '#/components/schemas/Connection' + '400': + description: Bad Request + content: + application/json: + schema: + oneOf: + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: external_id_already_in_use + const: external_id_already_in_use + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: connection_type_not_supported + const: connection_type_not_supported + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: connection_type_or_options_required + const: connection_type_or_options_required + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: connection_type_conflicts_with_options + const: connection_type_conflicts_with_options + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: both_saml_and_oidc_options_provided + const: both_saml_and_oidc_options_provided + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: ambiguous_saml_options + const: ambiguous_saml_options + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: incomplete_saml_options + const: incomplete_saml_options + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: saml_options_required + const: saml_options_required + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: oidc_options_required + const: oidc_options_required + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: invalid_certificate + const: invalid_certificate + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: client_secret_required + const: client_secret_required + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: client_secret_not_accepted + const: client_secret_not_accepted + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: key_pair_not_accepted + const: key_pair_not_accepted + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: discovery_endpoint_must_use_https + const: discovery_endpoint_must_use_https + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: token_authentication_method_not_supported + const: token_authentication_method_not_supported + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + '403': + description: Forbidden + content: + application/json: + schema: + type: object + properties: + message: + type: string + description: A human-readable description of the error. + example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.' + required: + - message + '404': + description: Not Found + content: + application/json: + schema: + type: object + properties: + message: + type: string + description: A human-readable description of the error. + example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.' + required: + - message + '409': + description: '' + content: + application/json: + schema: + type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: connection_deletion_in_progress + const: connection_deletion_in_progress + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + '422': + description: Unprocessable Entity + content: + application/json: + schema: + oneOf: + - type: object + properties: + message: + type: string + description: A human-readable description of the error. + example: >- + Organization not found: + 'org_01EHQMYV6MBK39QC5PZXHY59C3'. + required: + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: idp_metadata_fetch_failed + const: idp_metadata_fetch_failed + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: connection_could_not_be_verified + const: connection_could_not_be_verified + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: invalid_idp_sso_url + const: invalid_idp_sso_url + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + summary: Create a Connection + tags: + - connections + x-feature-flag: connections-api-migrations-capabilities-api + x-mutually-exclusive-body-groups: &ref_7 + protocol_options: + optional: false + variants: + saml: + - saml_options + oidc: + - oidc_options + get: + description: >- + Get a list of all of your existing connections matching the criteria + specified. + operationId: ConnectionsController_list + parameters: + - name: before + required: false + in: query + description: >- + An object ID that defines your place in the list. When the ID is not + present, you are at the end of the list. + schema: + example: obj_1234567890 + type: string + - name: after + required: false + in: query + description: >- + An object ID that defines your place in the list. When the ID is not + present, you are at the end of the list. + schema: + example: obj_1234567890 + type: string + - name: limit + required: false + in: query + description: >- + Upper limit on the number of objects to return, between `1` and + `100`. + schema: + minimum: 1 + maximum: 100 + default: 10 + example: 10 + type: integer + - name: order + required: false + in: query + description: Order the results by the creation time. Defaults to `normal`. + schema: + $ref: '#/components/schemas/PaginationOrder' + - name: connection_type + required: false + in: query + description: Filter Connections by their type. + schema: + example: GithubOAuth + enum: + - ADFSSAML + - AdpOidc + - AppleOAuth + - Auth0SAML + - AzureSAML + - BitbucketOAuth + - CasSAML + - CloudflareSAML + - ClassLinkSAML + - CleverOIDC + - CyberArkSAML + - DuoSAML + - EntraIdOIDC + - GenericOIDC + - GenericSAML + - GithubOAuth + - GitLabOAuth + - GoogleOAuth + - GoogleOIDC + - GoogleSAML + - IntuitOAuth + - JumpCloudSAML + - KeycloakSAML + - LastPassSAML + - LinkedInOAuth + - LoginGovOidc + - MagicLink + - MicrosoftOAuth + - MiniOrangeSAML + - NetIqSAML + - OktaOIDC + - OktaSAML + - OneLoginSAML + - OracleSAML + - PingFederateSAML + - PingOneSAML + - RipplingSAML + - SalesforceSAML + - ShibbolethGenericSAML + - ShibbolethSAML + - SimpleSamlPhpSAML + - SalesforceOAuth + - SlackOAuth + - VercelMarketplaceOAuth + - VercelOAuth + - VMwareSAML + - XeroOAuth + type: string + - name: domain + required: false + in: query + description: Filter Connections by their associated domain. + schema: + example: foo-corp.com + type: string + - name: organization_id + required: false + in: query + description: Filter Connections by their associated organization. + schema: + example: org_01EHWNCE74X7JSDV0X3SZ3KJNY + type: string + - name: search + required: false + in: query + description: Searchable text to match against Connection names. + schema: + example: Foo Corp + type: string + responses: + '200': + description: OK + content: + application/json: + schema: + $ref: '#/components/schemas/ConnectionList' + '403': + description: Forbidden + content: + application/json: + schema: + type: object + properties: + message: + type: string + description: A human-readable description of the error. + example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.' + required: + - message + '422': + description: Unprocessable Entity + content: + application/json: + schema: + type: object + properties: + message: + type: string + description: A human-readable description of the error. + example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.' + required: + - message + summary: List Connections + tags: + - connections + /connections/{connectionId}/saml_idp_signing_certs: + get: + description: >- + Lists every Identity Provider signing certificate on the connection, + including expired ones, oldest first. + operationId: SamlIdpSigningCertificatesController_list + parameters: + - name: connectionId + required: true + in: path + description: Unique identifier for the Connection. + schema: + example: conn_01E4ZCR3C56J083X43JQXF3JK5 + type: string + responses: + '200': + description: OK + content: + application/json: + schema: + $ref: '#/components/schemas/SamlIdpSigningCertificateList' + '400': + description: Bad Request + content: + application/json: + schema: + type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: connection_is_not_saml + const: connection_is_not_saml + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + '403': + description: Forbidden + content: + application/json: + schema: + type: object + properties: + message: + type: string + description: A human-readable description of the error. + example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.' + required: + - message + '404': + description: Not Found + content: + application/json: + schema: + type: object + properties: + message: + type: string + description: A human-readable description of the error. + example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.' + required: + - message + summary: List IdP signing certificates + tags: + - connections + x-feature-flag: connections-api-migrations-capabilities-api + post: + description: >- + Adds an Identity Provider signing certificate to the connection, so SAML + responses signed with its key can be verified. Use this to import a new + certificate ahead of an Identity Provider rotation — the existing + certificates keep working until they are deleted or expire. + operationId: SamlIdpSigningCertificatesController_create + parameters: + - name: connectionId + required: true + in: path + description: Unique identifier for the Connection. + schema: + example: conn_01E4ZCR3C56J083X43JQXF3JK5 + type: string + requestBody: + required: true + content: + application/json: + schema: + $ref: '#/components/schemas/CreateSamlIdpSigningCertificateDto' + responses: + '201': + description: Created + content: + application/json: + schema: + $ref: '#/components/schemas/SamlIdpSigningCertificate' + '400': + description: Bad Request + content: + application/json: + schema: + oneOf: + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: connection_is_not_saml + const: connection_is_not_saml + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: invalid_certificate + const: invalid_certificate + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: certificate_expired + const: certificate_expired + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + '403': + description: Forbidden + content: + application/json: + schema: + type: object + properties: + message: + type: string + description: A human-readable description of the error. + example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.' + required: + - message + '404': + description: Not Found + content: + application/json: + schema: + type: object + properties: + message: + type: string + description: A human-readable description of the error. + example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.' + required: + - message + '422': + description: Unprocessable Entity + content: + application/json: + schema: + type: object + properties: + message: + type: string + description: A human-readable description of the error. + example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.' + required: + - message + summary: Create an IdP signing certificate + tags: + - connections + x-feature-flag: connections-api-migrations-capabilities-api + /connections/{connectionId}/saml_idp_signing_certs/{certificateId}: + delete: + description: >- + Removes an Identity Provider signing certificate from the connection. + The last remaining certificate cannot be deleted. A certificate still + published in the Identity Provider metadata may be restored by a + metadata refresh. + operationId: SamlIdpSigningCertificatesController_delete + parameters: + - name: connectionId + required: true + in: path + description: Unique identifier for the Connection. + schema: + example: conn_01E4ZCR3C56J083X43JQXF3JK5 + type: string + - name: certificateId + required: true + in: path + description: Unique identifier for the Identity Provider signing certificate. + schema: + example: saml_x509_cert_01E4ZCR3C56J083X43JQXF3JK5 + type: string + responses: + '204': + description: No Content + '400': + description: Bad Request + content: + application/json: + schema: + type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: cannot_delete_last_certificate + const: cannot_delete_last_certificate + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + '403': + description: Forbidden + content: + application/json: + schema: + type: object + properties: + message: + type: string + description: A human-readable description of the error. + example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.' + required: + - message + '404': + description: Not Found + content: + application/json: + schema: + type: object + properties: + message: + type: string + description: A human-readable description of the error. + example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.' + required: + - message + summary: Delete an IdP signing certificate + tags: + - connections + x-feature-flag: connections-api-migrations-capabilities-api + /connections/{connectionId}/saml_sp_encryption_certs: + get: + description: >- + Lists the public certificates the Identity Provider can use to encrypt + SAML responses sent to WorkOS, including expired ones, oldest first. + operationId: SamlSpEncryptionCertificatesController_list + parameters: + - name: connectionId + required: true + in: path + description: Unique identifier for the Connection. + schema: + example: conn_01E4ZCR3C56J083X43JQXF3JK5 + type: string + responses: + '200': + description: OK + content: + application/json: + schema: + $ref: '#/components/schemas/SamlSpEncryptionCertificateList' + '400': + description: Bad Request + content: + application/json: + schema: + type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: connection_is_not_saml + const: connection_is_not_saml + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + '403': + description: Forbidden + content: + application/json: + schema: + type: object + properties: + message: + type: string + description: A human-readable description of the error. + example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.' + required: + - message + '404': + description: Not Found + content: + application/json: + schema: + type: object + properties: + message: + type: string + description: A human-readable description of the error. + example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.' + required: + - message + summary: List SP encryption certificates + tags: + - connections + x-feature-flag: connections-api-migrations-capabilities-api + post: + description: >- + Generates a new encryption key pair for the connection and returns its + public certificate. WorkOS holds the private key, so the request takes + no body — to bring your own key pairs, provide + `saml_options.sp_encryption_key_pairs` when creating the connection + instead. Creating a certificate appends rather than replaces: every + active private key is tried when decrypting, which lets a rotation + overlap the old and new certificates. + operationId: SamlSpEncryptionCertificatesController_create + parameters: + - name: connectionId + required: true + in: path + description: Unique identifier for the Connection. + schema: + example: conn_01E4ZCR3C56J083X43JQXF3JK5 + type: string + responses: + '201': + description: Created + content: + application/json: + schema: + $ref: '#/components/schemas/SamlSpEncryptionCertificate' + '400': + description: Bad Request + content: + application/json: + schema: + oneOf: + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: connection_is_not_saml + const: connection_is_not_saml + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: key_pair_not_accepted + const: key_pair_not_accepted + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + '403': + description: Forbidden + content: + application/json: + schema: + type: object + properties: + message: + type: string + description: A human-readable description of the error. + example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.' + required: + - message + '404': + description: Not Found + content: + application/json: + schema: + type: object + properties: + message: + type: string + description: A human-readable description of the error. + example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.' + required: + - message + '409': + description: '' + content: + application/json: + schema: + type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: too_many_sp_encryption_certs + const: too_many_sp_encryption_certs + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + '503': + description: '' + content: + application/json: + schema: + type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: concurrent_request + const: concurrent_request + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + summary: Create an SP encryption certificate + tags: + - connections + x-feature-flag: connections-api-migrations-capabilities-api + /connections/{connectionId}/saml_sp_encryption_certs/{certificateId}: + delete: + description: >- + Removes an encryption key pair from the connection. SAML responses + encrypted with its certificate can no longer be decrypted, so remove the + certificate from the Identity Provider first when rotating. + operationId: SamlSpEncryptionCertificatesController_delete + parameters: + - name: connectionId + required: true + in: path + description: Unique identifier for the Connection. + schema: + example: conn_01E4ZCR3C56J083X43JQXF3JK5 + type: string + - name: certificateId + required: true + in: path + description: >- + Unique identifier for the Service Provider encryption key pair. + WorkOS holds the corresponding private key, which is never exposed. + schema: + example: saml_enc_key_pair_01E4ZCR3C56J083X43JQXF3JK5 + type: string + responses: + '204': + description: No Content + '403': + description: Forbidden + content: + application/json: + schema: + type: object + properties: + message: + type: string + description: A human-readable description of the error. + example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.' + required: + - message + '404': + description: Not Found + content: + application/json: + schema: + type: object + properties: + message: + type: string + description: A human-readable description of the error. + example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.' + required: + - message + summary: Delete an SP encryption certificate + tags: + - connections + x-feature-flag: connections-api-migrations-capabilities-api + /connections/{connectionId}/saml_sp_signing_cert: get: description: >- - Get a list of all of your existing connections matching the criteria - specified. - operationId: ConnectionsController_list + Returns the public certificate the Identity Provider can use to verify + the signature of SAML requests sent by WorkOS. Responds with `404` when + the connection has no request signing key pair. + operationId: SamlSpSigningCertificatesController_get + parameters: + - name: connectionId + required: true + in: path + description: Unique identifier for the Connection. + schema: + example: conn_01E4ZCR3C56J083X43JQXF3JK5 + type: string + responses: + '200': + description: OK + content: + application/json: + schema: + $ref: '#/components/schemas/SamlSpSigningCertificate' + '400': + description: Bad Request + content: + application/json: + schema: + type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: connection_is_not_saml + const: connection_is_not_saml + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + '403': + description: Forbidden + content: + application/json: + schema: + type: object + properties: + message: + type: string + description: A human-readable description of the error. + example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.' + required: + - message + '404': + description: Not Found + content: + application/json: + schema: + type: object + properties: + message: + type: string + description: A human-readable description of the error. + example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.' + required: + - message + summary: Get the SP signing certificate + tags: + - connections + x-feature-flag: connections-api-migrations-capabilities-api + post: + description: >- + Generates a new request signing key pair for the connection and returns + its public certificate. WorkOS holds the private key, so the request + takes no body — to bring your own key pair, provide + `saml_options.sp_signing_key_pair` when creating the connection instead. + A connection signs with one key pair at a time: delete the existing + certificate before creating its replacement. + operationId: SamlSpSigningCertificatesController_create parameters: - - name: before - required: false - in: query - description: >- - An object ID that defines your place in the list. When the ID is not - present, you are at the end of the list. + - name: connectionId + required: true + in: path + description: Unique identifier for the Connection. schema: - example: obj_1234567890 + example: conn_01E4ZCR3C56J083X43JQXF3JK5 type: string - - name: after - required: false - in: query - description: >- - An object ID that defines your place in the list. When the ID is not - present, you are at the end of the list. + responses: + '201': + description: Created + content: + application/json: + schema: + $ref: '#/components/schemas/SamlSpSigningCertificate' + '400': + description: Bad Request + content: + application/json: + schema: + oneOf: + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: connection_is_not_saml + const: connection_is_not_saml + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: key_pair_not_accepted + const: key_pair_not_accepted + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: connection_type_not_supported + const: connection_type_not_supported + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + '403': + description: Forbidden + content: + application/json: + schema: + type: object + properties: + message: + type: string + description: A human-readable description of the error. + example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.' + required: + - message + '404': + description: Not Found + content: + application/json: + schema: + type: object + properties: + message: + type: string + description: A human-readable description of the error. + example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.' + required: + - message + '409': + description: '' + content: + application/json: + schema: + type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: sp_signing_cert_already_exists + const: sp_signing_cert_already_exists + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + '503': + description: '' + content: + application/json: + schema: + type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: concurrent_request + const: concurrent_request + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + summary: Create an SP signing certificate + tags: + - connections + x-feature-flag: connections-api-migrations-capabilities-api + /connections/{connectionId}/saml_sp_signing_cert/{certificateId}: + delete: + description: >- + Removes the request signing key pair from the connection, after which + SAML requests are sent unsigned. Delete the certificate before creating + its replacement when rotating. + operationId: SamlSpSigningCertificatesController_delete + parameters: + - name: connectionId + required: true + in: path + description: Unique identifier for the Connection. schema: - example: obj_1234567890 + example: conn_01E4ZCR3C56J083X43JQXF3JK5 type: string - - name: limit - required: false - in: query + - name: certificateId + required: true + in: path description: >- - Upper limit on the number of objects to return, between `1` and - `100`. - schema: - minimum: 1 - maximum: 100 - default: 10 - example: 10 - type: integer - - name: order - required: false - in: query - description: Order the results by the creation time. Defaults to `normal`. - schema: - $ref: '#/components/schemas/PaginationOrder' - - name: connection_type - required: false - in: query - description: Filter Connections by their type. - schema: - example: GithubOAuth - enum: - - ADFSSAML - - AdpOidc - - AppleOAuth - - Auth0SAML - - AzureSAML - - BitbucketOAuth - - CasSAML - - CloudflareSAML - - ClassLinkSAML - - CleverOIDC - - CyberArkSAML - - DuoSAML - - EntraIdOIDC - - GenericOIDC - - GenericSAML - - GithubOAuth - - GitLabOAuth - - GoogleOAuth - - GoogleOIDC - - GoogleSAML - - IntuitOAuth - - JumpCloudSAML - - KeycloakSAML - - LastPassSAML - - LinkedInOAuth - - LoginGovOidc - - MagicLink - - MicrosoftOAuth - - MiniOrangeSAML - - NetIqSAML - - OktaOIDC - - OktaSAML - - OneLoginSAML - - OracleSAML - - PingFederateSAML - - PingOneSAML - - RipplingSAML - - SalesforceSAML - - ShibbolethGenericSAML - - ShibbolethSAML - - SimpleSamlPhpSAML - - SalesforceOAuth - - SlackOAuth - - VercelMarketplaceOAuth - - VercelOAuth - - VMwareSAML - - XeroOAuth - type: string - - name: domain - required: false - in: query - description: Filter Connections by their associated domain. - schema: - example: foo-corp.com - type: string - - name: organization_id - required: false - in: query - description: Filter Connections by their associated organization. + Unique identifier for the Service Provider signing key pair. WorkOS + holds the corresponding private key, which is never exposed. schema: - example: org_01EHWNCE74X7JSDV0X3SZ3KJNY + example: saml_party_trust_01E4ZCR3C56J083X43JQXF3JK5 type: string - - name: search - required: false - in: query - description: Searchable text to match against Connection names. + responses: + '204': + description: No Content + '403': + description: Forbidden + content: + application/json: + schema: + type: object + properties: + message: + type: string + description: A human-readable description of the error. + example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.' + required: + - message + '404': + description: Not Found + content: + application/json: + schema: + type: object + properties: + message: + type: string + description: A human-readable description of the error. + example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.' + required: + - message + summary: Delete the SP signing certificate + tags: + - connections + x-feature-flag: connections-api-migrations-capabilities-api + /connections/{id}: + patch: + description: >- + Updates an existing connection. Only the provided fields are changed; + fields that accept `null` are reset to their default behavior. + operationId: ConnectionsController_patch + parameters: + - name: id + required: true + in: path + description: Unique identifier for the Connection. schema: - example: Foo Corp + example: conn_01E4ZCR3C56J083X43JQXF3JK5 type: string + requestBody: + required: true + content: + application/json: + schema: + $ref: '#/components/schemas/PatchConnectionDto' responses: '200': description: OK content: application/json: schema: - $ref: '#/components/schemas/ConnectionList' + $ref: '#/components/schemas/Connection' + '400': + description: Bad Request + content: + application/json: + schema: + oneOf: + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: external_id_already_in_use + const: external_id_already_in_use + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: connection_type_not_supported + const: connection_type_not_supported + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: connection_type_conflicts_with_options + const: connection_type_conflicts_with_options + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: both_saml_and_oidc_options_provided + const: both_saml_and_oidc_options_provided + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: ambiguous_saml_options + const: ambiguous_saml_options + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: token_authentication_method_not_supported + const: token_authentication_method_not_supported + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: id_token_signature_algorithm_not_supported + const: id_token_signature_algorithm_not_supported + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: client_secret_required + const: client_secret_required + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: client_secret_not_accepted + const: client_secret_not_accepted + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: discovery_endpoint_must_use_https + const: discovery_endpoint_must_use_https + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message '403': description: Forbidden content: @@ -7162,8 +8502,8 @@ paths: example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.' required: - message - '422': - description: Unprocessable Entity + '404': + description: Not Found content: application/json: schema: @@ -7175,10 +8515,95 @@ paths: example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.' required: - message - summary: List Connections + '409': + description: '' + content: + application/json: + schema: + type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: connection_deletion_in_progress + const: connection_deletion_in_progress + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + '422': + description: Unprocessable Entity + content: + application/json: + schema: + oneOf: + - type: object + properties: + message: + type: string + description: A human-readable description of the error. + example: >- + Organization not found: + 'org_01EHQMYV6MBK39QC5PZXHY59C3'. + required: + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: connection_type_not_updatable + const: connection_type_not_updatable + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: idp_metadata_fetch_failed + const: idp_metadata_fetch_failed + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: connection_could_not_be_verified + const: connection_could_not_be_verified + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + summary: Update a Connection tags: - connections - /connections/{id}: + x-feature-flag: connections-api-migrations-capabilities-api + x-mutually-exclusive-body-groups: &ref_10 + protocol_options: + optional: true + variants: + saml: + - saml_options + oidc: + - oidc_options get: description: Get the details of an existing connection. operationId: ConnectionsController_find @@ -15777,7 +17202,7 @@ paths: summary: Create an organization membership tags: - user-management.organization-membership - x-mutually-exclusive-body-groups: &ref_10 + x-mutually-exclusive-body-groups: &ref_14 role: optional: true variants: @@ -15961,7 +17386,7 @@ paths: summary: Update an organization membership tags: - user-management.organization-membership - x-mutually-exclusive-body-groups: &ref_11 + x-mutually-exclusive-body-groups: &ref_15 role: optional: true variants: @@ -17281,7 +18706,7 @@ paths: summary: Create a user tags: - user-management.users - x-mutually-exclusive-body-groups: &ref_12 + x-mutually-exclusive-body-groups: &ref_16 password: optional: true variants: @@ -17574,7 +18999,7 @@ paths: summary: Update a user tags: - user-management.users - x-mutually-exclusive-body-groups: &ref_16 + x-mutually-exclusive-body-groups: &ref_20 password: optional: true variants: @@ -22048,108 +23473,627 @@ components: allOf: - type: object properties: - external_id: - type: string - maxLength: 128 - pattern: ^[\x00-\x7F]+$ - description: An external identifier for the resource. - example: my-workspace-01 + external_id: + type: string + maxLength: 128 + pattern: ^[\x00-\x7F]+$ + description: An external identifier for the resource. + example: my-workspace-01 + name: + type: string + maxLength: 48 + description: A display name for the resource. + example: Acme Workspace + description: + type: + - string + - 'null' + maxLength: 150 + description: An optional description of the resource. + example: Primary workspace for the Acme team + resource_type_slug: + type: string + description: The slug of the resource type. + example: workspace + organization_id: + type: string + description: The ID of the organization this resource belongs to. + example: org_01EHQMYV6MBK39QC5PZXHY59C3 + required: + - external_id + - name + - resource_type_slug + - organization_id + - oneOf: + - type: object + not: + anyOf: + - properties: + parent_resource_id: + x-exclude-from-lint: true + required: + - parent_resource_id + - properties: + parent_resource_external_id: + x-exclude-from-lint: true + required: + - parent_resource_external_id + - properties: + parent_resource_type_slug: + x-exclude-from-lint: true + required: + - parent_resource_type_slug + - type: object + properties: + parent_resource_id: + type: + - string + - 'null' + description: >- + The ID of the parent resource. Mutually exclusive with + `parent_resource_external_id` and + `parent_resource_type_slug`. + example: authz_resource_01HXYZ123456789ABCDEFGHIJ + required: + - parent_resource_id + not: + anyOf: + - properties: + parent_resource_external_id: + x-exclude-from-lint: true + required: + - parent_resource_external_id + - properties: + parent_resource_type_slug: + x-exclude-from-lint: true + required: + - parent_resource_type_slug + - type: object + properties: + parent_resource_external_id: + type: string + description: >- + The external ID of the parent resource. Required with + `parent_resource_type_slug`. Mutually exclusive with + `parent_resource_id`. + example: parent-workspace-01 + parent_resource_type_slug: + type: string + description: >- + The resource type slug of the parent resource. Required with + `parent_resource_external_id`. Mutually exclusive with + `parent_resource_id`. + example: workspace + required: + - parent_resource_external_id + - parent_resource_type_slug + not: + anyOf: + - properties: + parent_resource_id: + x-exclude-from-lint: true + required: + - parent_resource_id + x-mutually-exclusive-body-groups: *ref_6 + CreateConnectionKeyPairDto: + type: object + properties: + key: + type: string + description: The PEM-encoded private key. + example: |- + -----BEGIN PRIVATE KEY----- + MIIE... + -----END PRIVATE KEY----- + cert: + type: string + description: The PEM-encoded X.509 certificate for the key. + example: |- + -----BEGIN CERTIFICATE----- + MIIC... + -----END CERTIFICATE----- + required: + - key + - cert + CreateConnectionSamlOptionsDto: + type: object + properties: + idp_metadata_url: + type: string + format: uri + description: >- + The Identity Provider metadata URL. When provided, the IdP fields + and signing certificates are imported from the metadata document. + Mutually exclusive with the manual IdP fields. + example: https://idp.example.com/metadata.xml + acs_url: + type: string + format: uri + description: >- + A custom Assertion Consumer Service (ACS) URL override. When + omitted, the standard WorkOS-generated ACS URL is used. + example: https://example.auth0.com/login/callback?connection=123 + sp_entity_id: + type: string + description: >- + A custom Service Provider Entity ID (audience) override. When + omitted, the connection external key is used. + example: https://example.auth0.com/login/callback?connection=123 + idp_entity_id: + type: string + description: The Identity Provider Entity ID. + example: https://idp.example.com/entity + idp_sso_url: + type: string + format: uri + description: >- + The Identity Provider SSO URL. Required when configuring the + connection with manual IdP fields. + example: https://idp.example.com/sso + idp_signing_certs: + description: >- + The X.509 certificates used to verify signed SAML responses from the + Identity Provider. Required when configuring the connection with + manual IdP fields. + example: + - |- + -----BEGIN CERTIFICATE----- + MIIC... + -----END CERTIFICATE----- + type: array + items: + type: string + sp_signing_key_pair: + description: >- + The customer-owned key pair used to sign SAML requests sent to the + Identity Provider. When omitted, WorkOS generates and manages the + signing key pair. + $ref: '#/components/schemas/CreateConnectionKeyPairDto' + sp_encryption_key_pairs: + description: >- + The customer-owned key pairs used to decrypt encrypted SAML + responses from the Identity Provider. When omitted, WorkOS generates + and manages the encryption key pair. + type: array + items: + $ref: '#/components/schemas/CreateConnectionKeyPairDto' + CreateConnectionOidcOptionsDto: + type: object + properties: + discovery_endpoint: + type: string + format: uri + description: The OIDC discovery endpoint. + example: https://idp.example.com/.well-known/openid-configuration + client_id: + type: string + description: The OIDC client ID. + example: client_123 + client_secret: + type: string + description: >- + The OIDC client secret. Required for `client_secret_basic` and + `client_secret_post`, and rejected for `private_key_jwt`, which + authenticates with a key pair instead. This value is write-only and + is never returned. + example: secret_xyz + redirect_uri: + type: string + format: uri + description: >- + A custom OAuth callback URL override. When omitted, the standard + WorkOS-generated redirect URI is used. + example: https://auth.workos.com/sso/oidc/conn_externalkey/callback + pkce: + type: boolean + description: Whether PKCE is enabled for the connection. + example: true + default: true + token_authentication_method: + type: string + enum: &ref_8 + - client_secret_post + - client_secret_basic + - private_key_jwt + description: The token-endpoint client authentication method. + example: client_secret_basic + default: client_secret_basic + jwt_signing_key_pair: + description: >- + A key pair for WorkOS to sign `private_key_jwt` client assertions + with. Only accepted when `token_authentication_method` is + `private_key_jwt`; when omitted, WorkOS generates one and returns + its certificate in `oidc_options.jwt_signing_certs`. + $ref: '#/components/schemas/CreateConnectionKeyPairDto' + id_token_signature_algorithm: + type: string + enum: &ref_9 + - ES256 + - ES384 + - ES512 + - EdDSA + - HS256 + - HS384 + - HS512 + - PS256 + - PS384 + - PS512 + - RS256 + - RS384 + - RS512 + description: The ID-token signing algorithm. + example: RS256 + fetch_user_info: + type: boolean + description: >- + Whether to fetch additional profile attributes from the userinfo + endpoint. + example: false + required: + - discovery_endpoint + - client_id + CreateConnectionStandardAttributesDto: + type: object + properties: + idp_id: + type: string + description: >- + The IdP attribute or claim the profile's `idp_id` is mapped from. + When omitted, the default for the connection type is used. + example: sub + email: + type: string + description: >- + The IdP attribute or claim the profile's `email` is mapped from. + When omitted, the default for the connection type is used. + example: email + first_name: + type: string + description: >- + The IdP attribute or claim the profile's `first_name` is mapped + from. When omitted, the default for the connection type is used. + example: given_name + last_name: + type: string + description: >- + The IdP attribute or claim the profile's `last_name` is mapped from. + When omitted, the default for the connection type is used. + example: family_name + groups: + type: + - string + - 'null' + description: >- + The IdP attribute or claim the profile's `groups` are mapped from. + `null` leaves the mapping unset. + example: memberOf + name: + type: + - string + - 'null' + description: >- + The IdP attribute or claim the profile's `name` is mapped from. + `null` leaves the mapping unset. + example: displayName + CreateConnectionAttributeMapsDto: + type: object + properties: + standard_attributes: + description: >- + How IdP attributes or claims map onto the standard WorkOS profile + fields. Provided fields override the defaults for the connection + type. + $ref: '#/components/schemas/CreateConnectionStandardAttributesDto' + custom_attributes: + type: object + description: >- + How IdP attributes or claims map onto custom attributes, keyed by + custom attribute name. Custom attributes must already be defined in + the WorkOS dashboard. + additionalProperties: + type: string + example: + company: company_claim + CreateConnectionDto: + allOf: + - type: object + properties: + organization_id: + type: string + description: >- + Unique identifier for the Organization in which the Connection + resides. + example: org_01EHWNCE74X7JSDV0X3SZ3KJNY + name: + type: string + description: >- + A human-readable name for the Connection. This will most + commonly be the organization's name. + example: Foo Corp + external_id: + type: string + maxLength: 128 + pattern: ^[\x00-\x7F]+$ + description: The customer-owned identifier for the Connection. + example: acme-legacy-conn-42 + connection_type: + type: string + description: >- + The type of the Connection. Only SAML and OIDC connection types + may be created. When omitted, the type is inferred from the + provided options. + example: OktaSAML + attribute_maps: + description: >- + How IdP attributes or claims map onto WorkOS profile fields. + Provided fields override the defaults for the connection type. + $ref: '#/components/schemas/CreateConnectionAttributeMapsDto' + required: + - organization_id + - oneOf: + - type: object + properties: + saml_options: + description: >- + Protocol configuration for SAML connections. Mutually + exclusive with `oidc_options`. + $ref: '#/components/schemas/CreateConnectionSamlOptionsDto' + required: + - saml_options + not: + anyOf: + - properties: + oidc_options: + x-exclude-from-lint: true + required: + - oidc_options + - type: object + properties: + oidc_options: + description: >- + Protocol configuration for OIDC connections. Mutually + exclusive with `saml_options`. + $ref: '#/components/schemas/CreateConnectionOidcOptionsDto' + required: + - oidc_options + not: + anyOf: + - properties: + saml_options: + x-exclude-from-lint: true + required: + - saml_options + x-mutually-exclusive-body-groups: *ref_7 + PatchConnectionSamlOptionsDto: + type: object + properties: + idp_metadata_url: + type: + - string + - 'null' + format: uri + description: >- + The Identity Provider metadata URL. When provided, the IdP fields + and signing certificates are re-imported from the metadata document, + replacing the current set. Mutually exclusive with the manual IdP + fields. Set to `null` to stop tracking a metadata URL. + example: https://idp.example.com/metadata.xml + acs_url: + type: + - string + - 'null' + format: uri + description: >- + A custom Assertion Consumer Service (ACS) URL override. Set to + `null` to revert to the standard WorkOS-generated ACS URL. + example: https://example.auth0.com/login/callback?connection=123 + sp_entity_id: + type: + - string + - 'null' + description: >- + A custom Service Provider Entity ID (audience) override. Set to + `null` to revert to the connection external key. + example: https://example.auth0.com/login/callback?connection=123 + idp_entity_id: + type: string + description: The Identity Provider Entity ID. + example: https://idp.example.com/entity + idp_sso_url: + type: string + format: uri + description: The Identity Provider SSO URL. + example: https://idp.example.com/sso + PatchConnectionOidcOptionsDto: + type: object + properties: + discovery_endpoint: + type: string + format: uri + description: The OIDC discovery endpoint. + example: https://idp.example.com/.well-known/openid-configuration + client_id: + type: string + description: The OIDC client ID. + example: client_123 + client_secret: + type: string + description: >- + The OIDC client secret. Required when moving the connection to + `client_secret_basic` or `client_secret_post`, and rejected for + `private_key_jwt`, which authenticates with a key pair instead. This + value is write-only and is never returned. + example: secret_xyz + redirect_uri: + type: + - string + - 'null' + format: uri + description: >- + A custom OAuth callback URL override. Set to `null` to revert to the + standard WorkOS-generated redirect URI. + example: https://auth.workos.com/sso/oidc/conn_externalkey/callback + pkce: + type: boolean + description: Whether PKCE is enabled for the connection. + example: true + token_authentication_method: + type: string + enum: *ref_8 + description: >- + The token-endpoint client authentication method. Moving to + `private_key_jwt` generates a signing key pair if the connection has + none; its certificate is returned in + `oidc_options.jwt_signing_certs` and must be registered at the + Identity Provider. + example: client_secret_basic + id_token_signature_algorithm: + type: string + enum: *ref_9 + description: The ID-token signing algorithm. + example: RS256 + fetch_user_info: + type: boolean + description: >- + Whether to fetch additional profile attributes from the userinfo + endpoint. + example: false + PatchConnectionStandardAttributesDto: + type: object + properties: + idp_id: + type: string + description: The IdP attribute or claim the profile's `idp_id` is mapped from. + example: sub + email: + type: string + description: The IdP attribute or claim the profile's `email` is mapped from. + example: email + first_name: + type: string + description: >- + The IdP attribute or claim the profile's `first_name` is mapped + from. + example: given_name + last_name: + type: string + description: The IdP attribute or claim the profile's `last_name` is mapped from. + example: family_name + groups: + type: + - string + - 'null' + description: >- + The IdP attribute or claim the profile's `groups` are mapped from. + Set to `null` to unset the mapping. + example: memberOf + name: + type: + - string + - 'null' + description: >- + The IdP attribute or claim the profile's `name` is mapped from. Set + to `null` to unset the mapping. + example: displayName + PatchConnectionAttributeMapsDto: + type: object + properties: + standard_attributes: + description: >- + How IdP attributes or claims map onto the standard WorkOS profile + fields. Only the provided fields are updated. + $ref: '#/components/schemas/PatchConnectionStandardAttributesDto' + custom_attributes: + type: object + description: >- + How IdP attributes or claims map onto custom attributes, keyed by + custom attribute name. Custom attributes must already be defined in + the WorkOS dashboard. Only the provided keys are updated; a `null` + value unsets that mapping. + additionalProperties: + oneOf: + - type: string + - type: 'null' + example: + company: company_claim + PatchConnectionDto: + allOf: + - type: object + properties: name: type: string - maxLength: 48 - description: A display name for the resource. - example: Acme Workspace - description: + description: A human-readable name for the Connection. + example: Foo Corp + external_id: type: - string - 'null' - maxLength: 150 - description: An optional description of the resource. - example: Primary workspace for the Acme team - resource_type_slug: - type: string - description: The slug of the resource type. - example: workspace - organization_id: + maxLength: 128 + pattern: ^[\x00-\x7F]+$ + description: >- + The customer-owned identifier for the Connection. Set to `null` + to stop tracking one. + example: acme-legacy-conn-42 + connection_type: type: string - description: The ID of the organization this resource belongs to. - example: org_01EHQMYV6MBK39QC5PZXHY59C3 - required: - - external_id - - name - - resource_type_slug - - organization_id + description: >- + The type of the Connection. Immutable after creation — it may be + sent, but only with the Connection current type. + example: OktaSAML + attribute_maps: + description: >- + How IdP attributes or claims map onto WorkOS profile fields. + Only the provided fields are updated. + $ref: '#/components/schemas/PatchConnectionAttributeMapsDto' - oneOf: - type: object not: anyOf: - properties: - parent_resource_id: - x-exclude-from-lint: true - required: - - parent_resource_id - - properties: - parent_resource_external_id: + saml_options: x-exclude-from-lint: true required: - - parent_resource_external_id + - saml_options - properties: - parent_resource_type_slug: + oidc_options: x-exclude-from-lint: true required: - - parent_resource_type_slug + - oidc_options - type: object properties: - parent_resource_id: - type: - - string - - 'null' + saml_options: description: >- - The ID of the parent resource. Mutually exclusive with - `parent_resource_external_id` and - `parent_resource_type_slug`. - example: authz_resource_01HXYZ123456789ABCDEFGHIJ + Protocol configuration for SAML connections. Only the + provided fields are updated. Mutually exclusive with + `oidc_options`. + $ref: '#/components/schemas/PatchConnectionSamlOptionsDto' required: - - parent_resource_id + - saml_options not: anyOf: - properties: - parent_resource_external_id: - x-exclude-from-lint: true - required: - - parent_resource_external_id - - properties: - parent_resource_type_slug: + oidc_options: x-exclude-from-lint: true required: - - parent_resource_type_slug + - oidc_options - type: object properties: - parent_resource_external_id: - type: string + oidc_options: description: >- - The external ID of the parent resource. Required with - `parent_resource_type_slug`. Mutually exclusive with - `parent_resource_id`. - example: parent-workspace-01 - parent_resource_type_slug: - type: string - description: >- - The resource type slug of the parent resource. Required with - `parent_resource_external_id`. Mutually exclusive with - `parent_resource_id`. - example: workspace + Protocol configuration for OIDC connections. Only the + provided fields are updated. Mutually exclusive with + `saml_options`. + $ref: '#/components/schemas/PatchConnectionOidcOptionsDto' required: - - parent_resource_external_id - - parent_resource_type_slug + - oidc_options not: anyOf: - properties: - parent_resource_id: + saml_options: x-exclude-from-lint: true required: - - parent_resource_id - x-mutually-exclusive-body-groups: *ref_6 + - saml_options + x-mutually-exclusive-body-groups: *ref_10 CreateCorsOriginDto: type: object properties: @@ -22331,11 +24275,11 @@ components: type: - object - 'null' - additionalProperties: &ref_7 + additionalProperties: &ref_11 type: string maxLength: 600 maxProperties: 50 - example: &ref_8 + example: &ref_12 tier: diamond description: >- Object containing [metadata](/authkit/metadata) key/value pairs @@ -22390,9 +24334,9 @@ components: type: - object - 'null' - additionalProperties: *ref_7 + additionalProperties: *ref_11 maxProperties: 50 - example: *ref_8 + example: *ref_12 description: >- Object containing [metadata](/authkit/metadata) key/value pairs associated with the Organization. @@ -22526,7 +24470,7 @@ components: example: application/x-www-form-urlencoded authenticate_via: type: string - enum: &ref_9 + enum: &ref_13 - request_body - basic_auth_header description: >- @@ -22682,7 +24626,7 @@ components: example: application/x-www-form-urlencoded authenticate_via: type: string - enum: *ref_9 + enum: *ref_13 description: >- How client credentials are sent when exchanging authorization codes and refreshing tokens. @@ -22858,6 +24802,15 @@ components: example: https://example.com/callback required: - uri + CreateSamlIdpSigningCertificateDto: + type: object + properties: + value: + type: string + description: The PEM-encoded X.509 certificate. + example: '-----BEGIN CERTIFICATE-----MIIC...-----END CERTIFICATE-----' + required: + - value CreateTeamDto: type: object properties: @@ -23238,9 +25191,9 @@ components: x-exclude-from-lint: true required: - role_slug - x-mutually-exclusive-body-groups: *ref_10 + x-mutually-exclusive-body-groups: *ref_14 UpdateUserlandUserOrganizationMembershipDto: - x-mutually-exclusive-body-groups: *ref_11 + x-mutually-exclusive-body-groups: *ref_15 oneOf: - type: object not: @@ -23362,9 +25315,9 @@ components: type: - object - 'null' - additionalProperties: *ref_7 + additionalProperties: *ref_11 maxProperties: 50 - example: &ref_13 + example: &ref_17 timezone: America/New_York description: >- Object containing metadata key/value pairs associated with the @@ -23463,7 +25416,7 @@ components: example: $2a$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy password_hash_type: type: string - enum: &ref_14 + enum: &ref_18 - bcrypt - firebase-scrypt - ssha @@ -23478,7 +25431,7 @@ components: example: bcrypt password_salt_position: type: string - enum: &ref_15 + enum: &ref_19 - prefix - suffix description: >- @@ -23499,7 +25452,7 @@ components: x-exclude-from-lint: true required: - password - x-mutually-exclusive-body-groups: *ref_12 + x-mutually-exclusive-body-groups: *ref_16 UpdateUserlandUserDto: allOf: - type: object @@ -23529,9 +25482,9 @@ components: type: - object - 'null' - additionalProperties: *ref_7 + additionalProperties: *ref_11 maxProperties: 50 - example: *ref_13 + example: *ref_17 description: >- Object containing metadata key/value pairs associated with the user. @@ -23613,7 +25566,7 @@ components: example: $2a$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy password_hash_type: type: string - enum: *ref_14 + enum: *ref_18 description: >- The algorithm originally used to hash the password, used when providing a `password_hash`. Required with @@ -23621,7 +25574,7 @@ components: example: bcrypt password_salt_position: type: string - enum: *ref_15 + enum: *ref_19 description: >- The position of the salt relative to the password when the `password_hash` digest was computed: `prefix` for `hash(salt @@ -23640,7 +25593,7 @@ components: x-exclude-from-lint: true required: - password - x-mutually-exclusive-body-groups: *ref_16 + x-mutually-exclusive-body-groups: *ref_20 VerifyEmailAddressDto: type: object properties: @@ -23746,7 +25699,7 @@ components: description: The events that the Webhook Endpoint is subscribed to. items: type: string - enum: &ref_17 + enum: &ref_21 - agent.blueprint.created - agent.blueprint.deleted - agent.blueprint.updated @@ -23868,7 +25821,7 @@ components: description: The events that the Webhook Endpoint is subscribed to. items: type: string - enum: *ref_17 + enum: *ref_21 example: - user.created - dsync.user.created @@ -27194,7 +29147,7 @@ components: description: >- An object containing the custom attribute mapping for the Directory Provider. - example: &ref_23 + example: &ref_27 department: Engineering job_title: Software Engineer role: @@ -27388,7 +29341,7 @@ components: type: object additionalProperties: {} description: The event payload. - example: &ref_18 + example: &ref_22 id: directory_user_01E1JG7J09H96KYP8HM9B0G5SJ directory_id: directory_01ECAZ4NV9QMV47GW873HDCX74 organization_id: org_01EZTR6WYX1A0DSE2CYMGXQ24Y @@ -27423,11 +29376,11 @@ components: - data - created_at description: An event emitted by WorkOS. - example: &ref_28 + example: &ref_32 object: event id: event_01EHZNVPK3SFK441A1RGBFSHRT event: dsync.user.created - data: *ref_18 + data: *ref_22 created_at: '2021-06-25T19:07:33.155Z' context: {} - oneOf: @@ -27627,7 +29580,7 @@ components: description: >- Permission slugs forming the ceiling on what sessions minted from this blueprint may do. - example: &ref_19 + example: &ref_23 - crm:read - email:send invocable_by: @@ -27640,7 +29593,7 @@ components: description: >- Role slugs whose members may mint user-delegated sessions from this blueprint. - example: &ref_20 + example: &ref_24 - manager organization_ids: type: array @@ -27649,7 +29602,7 @@ components: description: >- Organizations in which autonomous sessions may be minted from this blueprint. - example: &ref_21 + example: &ref_25 - org_01EHWNCE74X7JSDV0X3SZ3KJNY required: - role_slugs @@ -27808,7 +29761,7 @@ components: description: >- Permission slugs forming the ceiling on what sessions minted from this blueprint may do. - example: *ref_19 + example: *ref_23 invocable_by: type: object properties: @@ -27819,7 +29772,7 @@ components: description: >- Role slugs whose members may mint user-delegated sessions from this blueprint. - example: *ref_20 + example: *ref_24 organization_ids: type: array items: @@ -27827,7 +29780,7 @@ components: description: >- Organizations in which autonomous sessions may be minted from this blueprint. - example: *ref_21 + example: *ref_25 required: - role_slugs - organization_ids @@ -28545,7 +30498,7 @@ components: items: type: string description: The permissions granted to the API key. - example: &ref_22 + example: &ref_26 - users:read - users:write created_at: @@ -28671,7 +30624,7 @@ components: items: type: string description: The permissions granted to the API key. - example: *ref_22 + example: *ref_26 created_at: type: string description: The timestamp when the API key was created. @@ -28795,7 +30748,7 @@ components: items: type: string description: The permissions granted to the API key. - example: *ref_22 + example: *ref_26 created_at: type: string description: The timestamp when the API key was created. @@ -31662,7 +33615,7 @@ components: description: >- An object containing the custom attribute mapping for the Directory Provider. - example: *ref_23 + example: *ref_27 role: $ref: '#/components/schemas/SlimRole' roles: @@ -31852,7 +33805,7 @@ components: description: >- Labels assigned to the Feature Flag for categorizing and filtering. - example: &ref_24 + example: &ref_28 - reports enabled: type: boolean @@ -32013,7 +33966,7 @@ components: description: >- Labels assigned to the Feature Flag for categorizing and filtering. - example: *ref_24 + example: *ref_28 enabled: type: boolean description: >- @@ -32173,7 +34126,7 @@ components: description: >- Labels assigned to the Feature Flag for categorizing and filtering. - example: *ref_24 + example: *ref_28 enabled: type: boolean description: >- @@ -32453,7 +34406,7 @@ components: description: >- Labels assigned to the Feature Flag for categorizing and filtering. - example: *ref_24 + example: *ref_28 enabled: type: boolean description: >- @@ -33441,7 +35394,7 @@ components: description: >- Object containing [metadata](/authkit/metadata) key/value pairs associated with the Organization. - example: &ref_25 + example: &ref_29 tier: diamond propertyNames: maxLength: 40 @@ -33591,7 +35544,7 @@ components: description: >- Object containing [metadata](/authkit/metadata) key/value pairs associated with the Organization. - example: *ref_25 + example: *ref_29 propertyNames: maxLength: 40 maxProperties: 50 @@ -34418,7 +36371,7 @@ components: items: type: string description: The permissions granted by the role. - example: &ref_26 + example: &ref_30 - users:read - users:write created_at: @@ -34502,7 +36455,7 @@ components: items: type: string description: The permissions granted by the role. - example: *ref_26 + example: *ref_30 created_at: format: date-time type: string @@ -34584,7 +36537,7 @@ components: items: type: string description: The permissions granted by the role. - example: *ref_26 + example: *ref_30 created_at: format: date-time type: string @@ -34721,7 +36674,7 @@ components: description: >- Object containing [metadata](/authkit/metadata) key/value pairs associated with the Organization. - example: *ref_25 + example: *ref_29 propertyNames: maxLength: 40 maxProperties: 50 @@ -35588,7 +37541,7 @@ components: items: type: string description: The permissions granted by the role. - example: &ref_27 + example: &ref_31 - users:read - users:write created_at: @@ -35654,7 +37607,7 @@ components: items: type: string description: The permissions granted by the role. - example: *ref_27 + example: *ref_31 created_at: format: date-time type: string @@ -35718,7 +37671,7 @@ components: items: type: string description: The permissions granted by the role. - example: *ref_27 + example: *ref_31 created_at: format: date-time type: string @@ -36858,7 +38811,7 @@ components: - data - created_at - object - example: *ref_28 + example: *ref_32 description: An event emitted by WorkOS. EventList: type: object @@ -36893,7 +38846,7 @@ components: example: object: list data: - - *ref_28 + - *ref_32 list_metadata: after: event_01EHZNVPK3SFK441A1RGBFSHRT JwtTemplate: @@ -39022,6 +40975,169 @@ components: - default - created_at - updated_at + SamlIdpSigningCertificate: + type: object + properties: + object: + type: string + description: Distinguishes the SAML Identity Provider signing certificate object. + const: saml_idp_signing_certificate + id: + type: string + description: Unique identifier for the Identity Provider signing certificate. + example: saml_x509_cert_01E4ZCR3C56J083X43JQXF3JK5 + value: + type: string + description: The PEM-encoded public X.509 certificate. + example: '-----BEGIN CERTIFICATE-----MIIC...-----END CERTIFICATE-----' + not_before: + format: date-time + type: + - string + - 'null' + description: When the certificate becomes valid. + example: '2026-01-15T12:00:00.000Z' + not_after: + format: date-time + type: + - string + - 'null' + description: When the certificate expires. + example: '2026-01-15T12:00:00.000Z' + created_at: + format: date-time + type: string + description: An ISO 8601 timestamp. + example: '2026-01-15T12:00:00.000Z' + required: + - object + - id + - value + - not_before + - not_after + - created_at + SamlIdpSigningCertificateList: + type: object + properties: + object: + type: string + example: list + const: list + data: + type: array + items: + $ref: '#/components/schemas/SamlIdpSigningCertificate' + description: >- + Every Identity Provider signing certificate on the Connection, + including expired ones, oldest first. + required: + - object + - data + SamlSpEncryptionCertificate: + type: object + properties: + object: + type: string + description: >- + Distinguishes the SAML Service Provider encryption certificate + object. + const: saml_sp_encryption_certificate + id: + type: string + description: >- + Unique identifier for the Service Provider encryption key pair. + WorkOS holds the corresponding private key, which is never exposed. + example: saml_enc_key_pair_01E4ZCR3C56J083X43JQXF3JK5 + value: + type: string + description: The PEM-encoded public X.509 certificate. + example: '-----BEGIN CERTIFICATE-----MIIC...-----END CERTIFICATE-----' + not_before: + format: date-time + type: + - string + - 'null' + description: When the certificate becomes valid. + example: '2026-01-15T12:00:00.000Z' + not_after: + format: date-time + type: + - string + - 'null' + description: When the certificate expires. + example: '2026-01-15T12:00:00.000Z' + created_at: + format: date-time + type: string + description: An ISO 8601 timestamp. + example: '2026-01-15T12:00:00.000Z' + required: + - object + - id + - value + - not_before + - not_after + - created_at + SamlSpEncryptionCertificateList: + type: object + properties: + object: + type: string + example: list + const: list + data: + type: array + items: + $ref: '#/components/schemas/SamlSpEncryptionCertificate' + description: >- + Every Service Provider encryption certificate on the Connection, + including expired ones. + required: + - object + - data + SamlSpSigningCertificate: + type: object + properties: + object: + type: string + description: Distinguishes the SAML Service Provider signing certificate object. + const: saml_sp_signing_certificate + id: + type: string + description: >- + Unique identifier for the Service Provider signing key pair. WorkOS + holds the corresponding private key, which is never exposed. + example: saml_party_trust_01E4ZCR3C56J083X43JQXF3JK5 + value: + type: string + description: The PEM-encoded public X.509 certificate. + example: '-----BEGIN CERTIFICATE-----MIIC...-----END CERTIFICATE-----' + not_before: + format: date-time + type: + - string + - 'null' + description: When the certificate becomes valid. + example: '2026-01-15T12:00:00.000Z' + not_after: + format: date-time + type: + - string + - 'null' + description: When the certificate expires. + example: '2026-01-15T12:00:00.000Z' + created_at: + format: date-time + type: string + description: An ISO 8601 timestamp. + example: '2026-01-15T12:00:00.000Z' + required: + - object + - id + - value + - not_before + - not_after + - created_at Team: type: object properties: