From 4626263ef855f5096e473a959d4031b7673130be Mon Sep 17 00:00:00 2001 From: "workos-sdk-automation[bot]" <255426317+workos-sdk-automation[bot]@users.noreply.github.com> Date: Fri, 28 Aug 2026 17:34:30 +0000 Subject: [PATCH] Update OpenAPI spec from workos/workos@f5be71fe0caf7d8f1ad5ca023a33be785b49299a --- .last-synced-sha | 2 +- spec/open-api-spec.yaml | 3186 ++++++++++++++++++++++++++++++++++----- 2 files changed, 2813 insertions(+), 375 deletions(-) diff --git a/.last-synced-sha b/.last-synced-sha index 6482b5e..9fbb523 100644 --- a/.last-synced-sha +++ b/.last-synced-sha @@ -1 +1 @@ -4949f089632deb545a54c26f997fe022a56fdf20 +f5be71fe0caf7d8f1ad5ca023a33be785b49299a diff --git a/spec/open-api-spec.yaml b/spec/open-api-spec.yaml index b411f1e..162f1c2 100644 --- a/spec/open-api-spec.yaml +++ b/spec/open-api-spec.yaml @@ -7024,131 +7024,1471 @@ paths: tags: - application.client-secrets /connections: + post: + description: >- + Creates a new connection for an organization. Provide `saml_options` or + `oidc_options` to configure the identity provider. When `external_id` + matches an existing connection in the organization, that connection is + returned instead of creating a duplicate. + operationId: ConnectionsController_create + parameters: [] + requestBody: + required: true + content: + application/json: + schema: + $ref: '#/components/schemas/CreateConnectionDto' + responses: + '201': + description: Created + content: + application/json: + schema: + $ref: '#/components/schemas/Connection' + '400': + description: Bad Request + content: + application/json: + schema: + oneOf: + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: external_id_already_in_use + const: external_id_already_in_use + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: connection_type_not_supported + const: connection_type_not_supported + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: connection_type_or_options_required + const: connection_type_or_options_required + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: connection_type_conflicts_with_options + const: connection_type_conflicts_with_options + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: both_saml_and_oidc_options_provided + const: both_saml_and_oidc_options_provided + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: ambiguous_saml_options + const: ambiguous_saml_options + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: incomplete_saml_options + const: incomplete_saml_options + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: saml_options_required + const: saml_options_required + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: oidc_options_required + const: oidc_options_required + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: invalid_certificate + const: invalid_certificate + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: client_secret_required + const: client_secret_required + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: client_secret_not_accepted + const: client_secret_not_accepted + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: key_pair_not_accepted + const: key_pair_not_accepted + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: discovery_endpoint_must_use_https + const: discovery_endpoint_must_use_https + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: token_authentication_method_not_supported + const: token_authentication_method_not_supported + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + '403': + description: Forbidden + content: + application/json: + schema: + type: object + properties: + message: + type: string + description: A human-readable description of the error. + example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.' + required: + - message + '404': + description: Not Found + content: + application/json: + schema: + type: object + properties: + message: + type: string + description: A human-readable description of the error. + example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.' + required: + - message + '409': + description: '' + content: + application/json: + schema: + type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: connection_deletion_in_progress + const: connection_deletion_in_progress + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + '422': + description: Unprocessable Entity + content: + application/json: + schema: + oneOf: + - type: object + properties: + message: + type: string + description: A human-readable description of the error. + example: >- + Organization not found: + 'org_01EHQMYV6MBK39QC5PZXHY59C3'. + required: + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: idp_metadata_fetch_failed + const: idp_metadata_fetch_failed + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: connection_could_not_be_verified + const: connection_could_not_be_verified + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: invalid_idp_sso_url + const: invalid_idp_sso_url + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + summary: Create a Connection + tags: + - connections + x-feature-flag: connections-api-migrations-capabilities-api + x-mutually-exclusive-body-groups: &ref_7 + protocol_options: + optional: false + variants: + saml: + - saml_options + oidc: + - oidc_options get: description: >- - Get a list of all of your existing connections matching the criteria - specified. - operationId: ConnectionsController_list + Get a list of all of your existing connections matching the criteria + specified. + operationId: ConnectionsController_list + parameters: + - name: before + required: false + in: query + description: >- + An object ID that defines your place in the list. When the ID is not + present, you are at the end of the list. + schema: + example: obj_1234567890 + type: string + - name: after + required: false + in: query + description: >- + An object ID that defines your place in the list. When the ID is not + present, you are at the end of the list. + schema: + example: obj_1234567890 + type: string + - name: limit + required: false + in: query + description: >- + Upper limit on the number of objects to return, between `1` and + `100`. + schema: + minimum: 1 + maximum: 100 + default: 10 + example: 10 + type: integer + - name: order + required: false + in: query + description: Order the results by the creation time. Defaults to `normal`. + schema: + $ref: '#/components/schemas/PaginationOrder' + - name: connection_type + required: false + in: query + description: Filter Connections by their type. + schema: + example: GithubOAuth + enum: + - ADFSSAML + - AdpOidc + - AppleOAuth + - Auth0SAML + - AzureSAML + - BitbucketOAuth + - CasSAML + - CloudflareSAML + - ClassLinkSAML + - CleverOIDC + - CyberArkSAML + - DuoSAML + - EntraIdOIDC + - GenericOIDC + - GenericSAML + - GithubOAuth + - GitLabOAuth + - GoogleOAuth + - GoogleOIDC + - GoogleSAML + - IntuitOAuth + - JumpCloudSAML + - KeycloakSAML + - LastPassSAML + - LinkedInOAuth + - LoginGovOidc + - MagicLink + - MicrosoftOAuth + - MiniOrangeSAML + - NetIqSAML + - OktaOIDC + - OktaSAML + - OneLoginSAML + - OracleSAML + - PingFederateSAML + - PingOneSAML + - RipplingSAML + - SalesforceSAML + - ShibbolethGenericSAML + - ShibbolethSAML + - SimpleSamlPhpSAML + - SalesforceOAuth + - SlackOAuth + - VercelMarketplaceOAuth + - VercelOAuth + - VMwareSAML + - XeroOAuth + type: string + - name: domain + required: false + in: query + description: Filter Connections by their associated domain. + schema: + example: foo-corp.com + type: string + - name: organization_id + required: false + in: query + description: Filter Connections by their associated organization. + schema: + example: org_01EHWNCE74X7JSDV0X3SZ3KJNY + type: string + - name: search + required: false + in: query + description: Searchable text to match against Connection names. + schema: + example: Foo Corp + type: string + responses: + '200': + description: OK + content: + application/json: + schema: + $ref: '#/components/schemas/ConnectionList' + '403': + description: Forbidden + content: + application/json: + schema: + type: object + properties: + message: + type: string + description: A human-readable description of the error. + example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.' + required: + - message + '422': + description: Unprocessable Entity + content: + application/json: + schema: + type: object + properties: + message: + type: string + description: A human-readable description of the error. + example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.' + required: + - message + summary: List Connections + tags: + - connections + /connections/{connectionId}/saml_idp_signing_certs: + get: + description: >- + Lists every Identity Provider signing certificate on the connection, + including expired ones, oldest first. + operationId: SamlIdpSigningCertificatesController_list + parameters: + - name: connectionId + required: true + in: path + description: Unique identifier for the Connection. + schema: + example: conn_01E4ZCR3C56J083X43JQXF3JK5 + type: string + responses: + '200': + description: OK + content: + application/json: + schema: + $ref: '#/components/schemas/SamlIdpSigningCertificateList' + '400': + description: Bad Request + content: + application/json: + schema: + type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: connection_is_not_saml + const: connection_is_not_saml + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + '403': + description: Forbidden + content: + application/json: + schema: + type: object + properties: + message: + type: string + description: A human-readable description of the error. + example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.' + required: + - message + '404': + description: Not Found + content: + application/json: + schema: + type: object + properties: + message: + type: string + description: A human-readable description of the error. + example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.' + required: + - message + summary: List IdP signing certificates + tags: + - connections + x-feature-flag: connections-api-migrations-capabilities-api + post: + description: >- + Adds an Identity Provider signing certificate to the connection, so SAML + responses signed with its key can be verified. Use this to import a new + certificate ahead of an Identity Provider rotation — the existing + certificates keep working until they are deleted or expire. + operationId: SamlIdpSigningCertificatesController_create + parameters: + - name: connectionId + required: true + in: path + description: Unique identifier for the Connection. + schema: + example: conn_01E4ZCR3C56J083X43JQXF3JK5 + type: string + requestBody: + required: true + content: + application/json: + schema: + $ref: '#/components/schemas/CreateSamlIdpSigningCertificateDto' + responses: + '201': + description: Created + content: + application/json: + schema: + $ref: '#/components/schemas/SamlIdpSigningCertificate' + '400': + description: Bad Request + content: + application/json: + schema: + oneOf: + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: connection_is_not_saml + const: connection_is_not_saml + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: invalid_certificate + const: invalid_certificate + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: certificate_expired + const: certificate_expired + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + '403': + description: Forbidden + content: + application/json: + schema: + type: object + properties: + message: + type: string + description: A human-readable description of the error. + example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.' + required: + - message + '404': + description: Not Found + content: + application/json: + schema: + type: object + properties: + message: + type: string + description: A human-readable description of the error. + example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.' + required: + - message + '422': + description: Unprocessable Entity + content: + application/json: + schema: + type: object + properties: + message: + type: string + description: A human-readable description of the error. + example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.' + required: + - message + summary: Create an IdP signing certificate + tags: + - connections + x-feature-flag: connections-api-migrations-capabilities-api + /connections/{connectionId}/saml_idp_signing_certs/{certificateId}: + delete: + description: >- + Removes an Identity Provider signing certificate from the connection. + The last remaining certificate cannot be deleted. A certificate still + published in the Identity Provider metadata may be restored by a + metadata refresh. + operationId: SamlIdpSigningCertificatesController_delete + parameters: + - name: connectionId + required: true + in: path + description: Unique identifier for the Connection. + schema: + example: conn_01E4ZCR3C56J083X43JQXF3JK5 + type: string + - name: certificateId + required: true + in: path + description: Unique identifier for the Identity Provider signing certificate. + schema: + example: saml_x509_cert_01E4ZCR3C56J083X43JQXF3JK5 + type: string + responses: + '204': + description: No Content + '400': + description: Bad Request + content: + application/json: + schema: + type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: cannot_delete_last_certificate + const: cannot_delete_last_certificate + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + '403': + description: Forbidden + content: + application/json: + schema: + type: object + properties: + message: + type: string + description: A human-readable description of the error. + example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.' + required: + - message + '404': + description: Not Found + content: + application/json: + schema: + type: object + properties: + message: + type: string + description: A human-readable description of the error. + example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.' + required: + - message + summary: Delete an IdP signing certificate + tags: + - connections + x-feature-flag: connections-api-migrations-capabilities-api + /connections/{connectionId}/saml_sp_encryption_certs: + get: + description: >- + Lists the public certificates the Identity Provider can use to encrypt + SAML responses sent to WorkOS, including expired ones, oldest first. + operationId: SamlSpEncryptionCertificatesController_list + parameters: + - name: connectionId + required: true + in: path + description: Unique identifier for the Connection. + schema: + example: conn_01E4ZCR3C56J083X43JQXF3JK5 + type: string + responses: + '200': + description: OK + content: + application/json: + schema: + $ref: '#/components/schemas/SamlSpEncryptionCertificateList' + '400': + description: Bad Request + content: + application/json: + schema: + type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: connection_is_not_saml + const: connection_is_not_saml + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + '403': + description: Forbidden + content: + application/json: + schema: + type: object + properties: + message: + type: string + description: A human-readable description of the error. + example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.' + required: + - message + '404': + description: Not Found + content: + application/json: + schema: + type: object + properties: + message: + type: string + description: A human-readable description of the error. + example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.' + required: + - message + summary: List SP encryption certificates + tags: + - connections + x-feature-flag: connections-api-migrations-capabilities-api + post: + description: >- + Generates a new encryption key pair for the connection and returns its + public certificate. WorkOS holds the private key, so the request takes + no body — to bring your own key pairs, provide + `saml_options.sp_encryption_key_pairs` when creating the connection + instead. Creating a certificate appends rather than replaces: every + active private key is tried when decrypting, which lets a rotation + overlap the old and new certificates. + operationId: SamlSpEncryptionCertificatesController_create + parameters: + - name: connectionId + required: true + in: path + description: Unique identifier for the Connection. + schema: + example: conn_01E4ZCR3C56J083X43JQXF3JK5 + type: string + responses: + '201': + description: Created + content: + application/json: + schema: + $ref: '#/components/schemas/SamlSpEncryptionCertificate' + '400': + description: Bad Request + content: + application/json: + schema: + oneOf: + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: connection_is_not_saml + const: connection_is_not_saml + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: key_pair_not_accepted + const: key_pair_not_accepted + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + '403': + description: Forbidden + content: + application/json: + schema: + type: object + properties: + message: + type: string + description: A human-readable description of the error. + example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.' + required: + - message + '404': + description: Not Found + content: + application/json: + schema: + type: object + properties: + message: + type: string + description: A human-readable description of the error. + example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.' + required: + - message + '409': + description: '' + content: + application/json: + schema: + type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: too_many_sp_encryption_certs + const: too_many_sp_encryption_certs + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + '503': + description: '' + content: + application/json: + schema: + type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: concurrent_request + const: concurrent_request + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + summary: Create an SP encryption certificate + tags: + - connections + x-feature-flag: connections-api-migrations-capabilities-api + /connections/{connectionId}/saml_sp_encryption_certs/{certificateId}: + delete: + description: >- + Removes an encryption key pair from the connection. SAML responses + encrypted with its certificate can no longer be decrypted, so remove the + certificate from the Identity Provider first when rotating. + operationId: SamlSpEncryptionCertificatesController_delete + parameters: + - name: connectionId + required: true + in: path + description: Unique identifier for the Connection. + schema: + example: conn_01E4ZCR3C56J083X43JQXF3JK5 + type: string + - name: certificateId + required: true + in: path + description: >- + Unique identifier for the Service Provider encryption key pair. + WorkOS holds the corresponding private key, which is never exposed. + schema: + example: saml_enc_key_pair_01E4ZCR3C56J083X43JQXF3JK5 + type: string + responses: + '204': + description: No Content + '403': + description: Forbidden + content: + application/json: + schema: + type: object + properties: + message: + type: string + description: A human-readable description of the error. + example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.' + required: + - message + '404': + description: Not Found + content: + application/json: + schema: + type: object + properties: + message: + type: string + description: A human-readable description of the error. + example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.' + required: + - message + summary: Delete an SP encryption certificate + tags: + - connections + x-feature-flag: connections-api-migrations-capabilities-api + /connections/{connectionId}/saml_sp_signing_cert: + get: + description: >- + Returns the public certificate the Identity Provider can use to verify + the signature of SAML requests sent by WorkOS. Responds with `404` when + the connection has no request signing key pair. + operationId: SamlSpSigningCertificatesController_get + parameters: + - name: connectionId + required: true + in: path + description: Unique identifier for the Connection. + schema: + example: conn_01E4ZCR3C56J083X43JQXF3JK5 + type: string + responses: + '200': + description: OK + content: + application/json: + schema: + $ref: '#/components/schemas/SamlSpSigningCertificate' + '400': + description: Bad Request + content: + application/json: + schema: + type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: connection_is_not_saml + const: connection_is_not_saml + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + '403': + description: Forbidden + content: + application/json: + schema: + type: object + properties: + message: + type: string + description: A human-readable description of the error. + example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.' + required: + - message + '404': + description: Not Found + content: + application/json: + schema: + type: object + properties: + message: + type: string + description: A human-readable description of the error. + example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.' + required: + - message + summary: Get the SP signing certificate + tags: + - connections + x-feature-flag: connections-api-migrations-capabilities-api + post: + description: >- + Generates a new request signing key pair for the connection and returns + its public certificate. WorkOS holds the private key, so the request + takes no body — to bring your own key pair, provide + `saml_options.sp_signing_key_pair` when creating the connection instead. + A connection signs with one key pair at a time: delete the existing + certificate before creating its replacement. + operationId: SamlSpSigningCertificatesController_create parameters: - - name: before - required: false - in: query - description: >- - An object ID that defines your place in the list. When the ID is not - present, you are at the end of the list. + - name: connectionId + required: true + in: path + description: Unique identifier for the Connection. schema: - example: obj_1234567890 + example: conn_01E4ZCR3C56J083X43JQXF3JK5 type: string - - name: after - required: false - in: query - description: >- - An object ID that defines your place in the list. When the ID is not - present, you are at the end of the list. + responses: + '201': + description: Created + content: + application/json: + schema: + $ref: '#/components/schemas/SamlSpSigningCertificate' + '400': + description: Bad Request + content: + application/json: + schema: + oneOf: + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: connection_is_not_saml + const: connection_is_not_saml + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: key_pair_not_accepted + const: key_pair_not_accepted + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: connection_type_not_supported + const: connection_type_not_supported + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + '403': + description: Forbidden + content: + application/json: + schema: + type: object + properties: + message: + type: string + description: A human-readable description of the error. + example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.' + required: + - message + '404': + description: Not Found + content: + application/json: + schema: + type: object + properties: + message: + type: string + description: A human-readable description of the error. + example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.' + required: + - message + '409': + description: '' + content: + application/json: + schema: + type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: sp_signing_cert_already_exists + const: sp_signing_cert_already_exists + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + '503': + description: '' + content: + application/json: + schema: + type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: concurrent_request + const: concurrent_request + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + summary: Create an SP signing certificate + tags: + - connections + x-feature-flag: connections-api-migrations-capabilities-api + /connections/{connectionId}/saml_sp_signing_cert/{certificateId}: + delete: + description: >- + Removes the request signing key pair from the connection, after which + SAML requests are sent unsigned. Delete the certificate before creating + its replacement when rotating. + operationId: SamlSpSigningCertificatesController_delete + parameters: + - name: connectionId + required: true + in: path + description: Unique identifier for the Connection. schema: - example: obj_1234567890 + example: conn_01E4ZCR3C56J083X43JQXF3JK5 type: string - - name: limit - required: false - in: query + - name: certificateId + required: true + in: path description: >- - Upper limit on the number of objects to return, between `1` and - `100`. - schema: - minimum: 1 - maximum: 100 - default: 10 - example: 10 - type: integer - - name: order - required: false - in: query - description: Order the results by the creation time. Defaults to `normal`. - schema: - $ref: '#/components/schemas/PaginationOrder' - - name: connection_type - required: false - in: query - description: Filter Connections by their type. - schema: - example: GithubOAuth - enum: - - ADFSSAML - - AdpOidc - - AppleOAuth - - Auth0SAML - - AzureSAML - - BitbucketOAuth - - CasSAML - - CloudflareSAML - - ClassLinkSAML - - CleverOIDC - - CyberArkSAML - - DuoSAML - - EntraIdOIDC - - GenericOIDC - - GenericSAML - - GithubOAuth - - GitLabOAuth - - GoogleOAuth - - GoogleOIDC - - GoogleSAML - - IntuitOAuth - - JumpCloudSAML - - KeycloakSAML - - LastPassSAML - - LinkedInOAuth - - LoginGovOidc - - MagicLink - - MicrosoftOAuth - - MiniOrangeSAML - - NetIqSAML - - OktaOIDC - - OktaSAML - - OneLoginSAML - - OracleSAML - - PingFederateSAML - - PingOneSAML - - RipplingSAML - - SalesforceSAML - - ShibbolethGenericSAML - - ShibbolethSAML - - SimpleSamlPhpSAML - - SalesforceOAuth - - SlackOAuth - - VercelMarketplaceOAuth - - VercelOAuth - - VMwareSAML - - XeroOAuth - type: string - - name: domain - required: false - in: query - description: Filter Connections by their associated domain. - schema: - example: foo-corp.com - type: string - - name: organization_id - required: false - in: query - description: Filter Connections by their associated organization. + Unique identifier for the Service Provider signing key pair. WorkOS + holds the corresponding private key, which is never exposed. schema: - example: org_01EHWNCE74X7JSDV0X3SZ3KJNY + example: saml_party_trust_01E4ZCR3C56J083X43JQXF3JK5 type: string - - name: search - required: false - in: query - description: Searchable text to match against Connection names. + responses: + '204': + description: No Content + '403': + description: Forbidden + content: + application/json: + schema: + type: object + properties: + message: + type: string + description: A human-readable description of the error. + example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.' + required: + - message + '404': + description: Not Found + content: + application/json: + schema: + type: object + properties: + message: + type: string + description: A human-readable description of the error. + example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.' + required: + - message + summary: Delete the SP signing certificate + tags: + - connections + x-feature-flag: connections-api-migrations-capabilities-api + /connections/{id}: + patch: + description: >- + Updates an existing connection. Only the provided fields are changed; + fields that accept `null` are reset to their default behavior. + operationId: ConnectionsController_patch + parameters: + - name: id + required: true + in: path + description: Unique identifier for the Connection. schema: - example: Foo Corp + example: conn_01E4ZCR3C56J083X43JQXF3JK5 type: string + requestBody: + required: true + content: + application/json: + schema: + $ref: '#/components/schemas/PatchConnectionDto' responses: '200': description: OK content: application/json: schema: - $ref: '#/components/schemas/ConnectionList' + $ref: '#/components/schemas/Connection' + '400': + description: Bad Request + content: + application/json: + schema: + oneOf: + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: external_id_already_in_use + const: external_id_already_in_use + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: connection_type_not_supported + const: connection_type_not_supported + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: connection_type_conflicts_with_options + const: connection_type_conflicts_with_options + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: both_saml_and_oidc_options_provided + const: both_saml_and_oidc_options_provided + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: ambiguous_saml_options + const: ambiguous_saml_options + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: token_authentication_method_not_supported + const: token_authentication_method_not_supported + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: id_token_signature_algorithm_not_supported + const: id_token_signature_algorithm_not_supported + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: client_secret_required + const: client_secret_required + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: client_secret_not_accepted + const: client_secret_not_accepted + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: discovery_endpoint_must_use_https + const: discovery_endpoint_must_use_https + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message '403': description: Forbidden content: @@ -7162,8 +8502,8 @@ paths: example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.' required: - message - '422': - description: Unprocessable Entity + '404': + description: Not Found content: application/json: schema: @@ -7175,10 +8515,95 @@ paths: example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.' required: - message - summary: List Connections + '409': + description: '' + content: + application/json: + schema: + type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: connection_deletion_in_progress + const: connection_deletion_in_progress + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + '422': + description: Unprocessable Entity + content: + application/json: + schema: + oneOf: + - type: object + properties: + message: + type: string + description: A human-readable description of the error. + example: >- + Organization not found: + 'org_01EHQMYV6MBK39QC5PZXHY59C3'. + required: + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: connection_type_not_updatable + const: connection_type_not_updatable + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: idp_metadata_fetch_failed + const: idp_metadata_fetch_failed + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + - type: object + properties: + code: + type: string + description: The error code identifying the type of error. + example: connection_could_not_be_verified + const: connection_could_not_be_verified + message: + type: string + description: A human-readable description of the error. + example: Request could not be processed. + required: + - code + - message + summary: Update a Connection tags: - connections - /connections/{id}: + x-feature-flag: connections-api-migrations-capabilities-api + x-mutually-exclusive-body-groups: &ref_10 + protocol_options: + optional: true + variants: + saml: + - saml_options + oidc: + - oidc_options get: description: Get the details of an existing connection. operationId: ConnectionsController_find @@ -15777,7 +17202,7 @@ paths: summary: Create an organization membership tags: - user-management.organization-membership - x-mutually-exclusive-body-groups: &ref_10 + x-mutually-exclusive-body-groups: &ref_14 role: optional: true variants: @@ -15961,7 +17386,7 @@ paths: summary: Update an organization membership tags: - user-management.organization-membership - x-mutually-exclusive-body-groups: &ref_11 + x-mutually-exclusive-body-groups: &ref_15 role: optional: true variants: @@ -17281,7 +18706,7 @@ paths: summary: Create a user tags: - user-management.users - x-mutually-exclusive-body-groups: &ref_12 + x-mutually-exclusive-body-groups: &ref_16 password: optional: true variants: @@ -17574,7 +18999,7 @@ paths: summary: Update a user tags: - user-management.users - x-mutually-exclusive-body-groups: &ref_16 + x-mutually-exclusive-body-groups: &ref_20 password: optional: true variants: @@ -22150,6 +23575,525 @@ components: required: - parent_resource_id x-mutually-exclusive-body-groups: *ref_6 + CreateConnectionKeyPairDto: + type: object + properties: + key: + type: string + description: The PEM-encoded private key. + example: |- + -----BEGIN PRIVATE KEY----- + MIIE... + -----END PRIVATE KEY----- + cert: + type: string + description: The PEM-encoded X.509 certificate for the key. + example: |- + -----BEGIN CERTIFICATE----- + MIIC... + -----END CERTIFICATE----- + required: + - key + - cert + CreateConnectionSamlOptionsDto: + type: object + properties: + idp_metadata_url: + type: string + format: uri + description: >- + The Identity Provider metadata URL. When provided, the IdP fields + and signing certificates are imported from the metadata document. + Mutually exclusive with the manual IdP fields. + example: https://idp.example.com/metadata.xml + acs_url: + type: string + format: uri + description: >- + A custom Assertion Consumer Service (ACS) URL override. When + omitted, the standard WorkOS-generated ACS URL is used. + example: https://example.auth0.com/login/callback?connection=123 + sp_entity_id: + type: string + description: >- + A custom Service Provider Entity ID (audience) override. When + omitted, the connection external key is used. + example: https://example.auth0.com/login/callback?connection=123 + idp_entity_id: + type: string + description: The Identity Provider Entity ID. + example: https://idp.example.com/entity + idp_sso_url: + type: string + format: uri + description: >- + The Identity Provider SSO URL. Required when configuring the + connection with manual IdP fields. + example: https://idp.example.com/sso + idp_signing_certs: + description: >- + The X.509 certificates used to verify signed SAML responses from the + Identity Provider. Required when configuring the connection with + manual IdP fields. + example: + - |- + -----BEGIN CERTIFICATE----- + MIIC... + -----END CERTIFICATE----- + type: array + items: + type: string + sp_signing_key_pair: + description: >- + The customer-owned key pair used to sign SAML requests sent to the + Identity Provider. When omitted, WorkOS generates and manages the + signing key pair. + $ref: '#/components/schemas/CreateConnectionKeyPairDto' + sp_encryption_key_pairs: + description: >- + The customer-owned key pairs used to decrypt encrypted SAML + responses from the Identity Provider. When omitted, WorkOS generates + and manages the encryption key pair. + type: array + items: + $ref: '#/components/schemas/CreateConnectionKeyPairDto' + CreateConnectionOidcOptionsDto: + type: object + properties: + discovery_endpoint: + type: string + format: uri + description: The OIDC discovery endpoint. + example: https://idp.example.com/.well-known/openid-configuration + client_id: + type: string + description: The OIDC client ID. + example: client_123 + client_secret: + type: string + description: >- + The OIDC client secret. Required for `client_secret_basic` and + `client_secret_post`, and rejected for `private_key_jwt`, which + authenticates with a key pair instead. This value is write-only and + is never returned. + example: secret_xyz + redirect_uri: + type: string + format: uri + description: >- + A custom OAuth callback URL override. When omitted, the standard + WorkOS-generated redirect URI is used. + example: https://auth.workos.com/sso/oidc/conn_externalkey/callback + pkce: + type: boolean + description: Whether PKCE is enabled for the connection. + example: true + default: true + token_authentication_method: + type: string + enum: &ref_8 + - client_secret_post + - client_secret_basic + - private_key_jwt + description: The token-endpoint client authentication method. + example: client_secret_basic + default: client_secret_basic + jwt_signing_key_pair: + description: >- + A key pair for WorkOS to sign `private_key_jwt` client assertions + with. Only accepted when `token_authentication_method` is + `private_key_jwt`; when omitted, WorkOS generates one and returns + its certificate in `oidc_options.jwt_signing_certs`. + $ref: '#/components/schemas/CreateConnectionKeyPairDto' + id_token_signature_algorithm: + type: string + enum: &ref_9 + - ES256 + - ES384 + - ES512 + - EdDSA + - HS256 + - HS384 + - HS512 + - PS256 + - PS384 + - PS512 + - RS256 + - RS384 + - RS512 + description: The ID-token signing algorithm. + example: RS256 + fetch_user_info: + type: boolean + description: >- + Whether to fetch additional profile attributes from the userinfo + endpoint. + example: false + required: + - discovery_endpoint + - client_id + CreateConnectionStandardAttributesDto: + type: object + properties: + idp_id: + type: string + description: >- + The IdP attribute or claim the profile's `idp_id` is mapped from. + When omitted, the default for the connection type is used. + example: sub + email: + type: string + description: >- + The IdP attribute or claim the profile's `email` is mapped from. + When omitted, the default for the connection type is used. + example: email + first_name: + type: string + description: >- + The IdP attribute or claim the profile's `first_name` is mapped + from. When omitted, the default for the connection type is used. + example: given_name + last_name: + type: string + description: >- + The IdP attribute or claim the profile's `last_name` is mapped from. + When omitted, the default for the connection type is used. + example: family_name + groups: + type: + - string + - 'null' + description: >- + The IdP attribute or claim the profile's `groups` are mapped from. + `null` leaves the mapping unset. + example: memberOf + name: + type: + - string + - 'null' + description: >- + The IdP attribute or claim the profile's `name` is mapped from. + `null` leaves the mapping unset. + example: displayName + CreateConnectionAttributeMapsDto: + type: object + properties: + standard_attributes: + description: >- + How IdP attributes or claims map onto the standard WorkOS profile + fields. Provided fields override the defaults for the connection + type. + $ref: '#/components/schemas/CreateConnectionStandardAttributesDto' + custom_attributes: + type: object + description: >- + How IdP attributes or claims map onto custom attributes, keyed by + custom attribute name. Custom attributes must already be defined in + the WorkOS dashboard. + additionalProperties: + type: string + example: + company: company_claim + CreateConnectionDto: + allOf: + - type: object + properties: + organization_id: + type: string + description: >- + Unique identifier for the Organization in which the Connection + resides. + example: org_01EHWNCE74X7JSDV0X3SZ3KJNY + name: + type: string + description: >- + A human-readable name for the Connection. This will most + commonly be the organization's name. + example: Foo Corp + external_id: + type: string + maxLength: 128 + pattern: ^[\x00-\x7F]+$ + description: The customer-owned identifier for the Connection. + example: acme-legacy-conn-42 + connection_type: + type: string + description: >- + The type of the Connection. Only SAML and OIDC connection types + may be created. When omitted, the type is inferred from the + provided options. + example: OktaSAML + attribute_maps: + description: >- + How IdP attributes or claims map onto WorkOS profile fields. + Provided fields override the defaults for the connection type. + $ref: '#/components/schemas/CreateConnectionAttributeMapsDto' + required: + - organization_id + - oneOf: + - type: object + properties: + saml_options: + description: >- + Protocol configuration for SAML connections. Mutually + exclusive with `oidc_options`. + $ref: '#/components/schemas/CreateConnectionSamlOptionsDto' + required: + - saml_options + not: + anyOf: + - properties: + oidc_options: + x-exclude-from-lint: true + required: + - oidc_options + - type: object + properties: + oidc_options: + description: >- + Protocol configuration for OIDC connections. Mutually + exclusive with `saml_options`. + $ref: '#/components/schemas/CreateConnectionOidcOptionsDto' + required: + - oidc_options + not: + anyOf: + - properties: + saml_options: + x-exclude-from-lint: true + required: + - saml_options + x-mutually-exclusive-body-groups: *ref_7 + PatchConnectionSamlOptionsDto: + type: object + properties: + idp_metadata_url: + type: + - string + - 'null' + format: uri + description: >- + The Identity Provider metadata URL. When provided, the IdP fields + and signing certificates are re-imported from the metadata document, + replacing the current set. Mutually exclusive with the manual IdP + fields. Set to `null` to stop tracking a metadata URL. + example: https://idp.example.com/metadata.xml + acs_url: + type: + - string + - 'null' + format: uri + description: >- + A custom Assertion Consumer Service (ACS) URL override. Set to + `null` to revert to the standard WorkOS-generated ACS URL. + example: https://example.auth0.com/login/callback?connection=123 + sp_entity_id: + type: + - string + - 'null' + description: >- + A custom Service Provider Entity ID (audience) override. Set to + `null` to revert to the connection external key. + example: https://example.auth0.com/login/callback?connection=123 + idp_entity_id: + type: string + description: The Identity Provider Entity ID. + example: https://idp.example.com/entity + idp_sso_url: + type: string + format: uri + description: The Identity Provider SSO URL. + example: https://idp.example.com/sso + PatchConnectionOidcOptionsDto: + type: object + properties: + discovery_endpoint: + type: string + format: uri + description: The OIDC discovery endpoint. + example: https://idp.example.com/.well-known/openid-configuration + client_id: + type: string + description: The OIDC client ID. + example: client_123 + client_secret: + type: string + description: >- + The OIDC client secret. Required when moving the connection to + `client_secret_basic` or `client_secret_post`, and rejected for + `private_key_jwt`, which authenticates with a key pair instead. This + value is write-only and is never returned. + example: secret_xyz + redirect_uri: + type: + - string + - 'null' + format: uri + description: >- + A custom OAuth callback URL override. Set to `null` to revert to the + standard WorkOS-generated redirect URI. + example: https://auth.workos.com/sso/oidc/conn_externalkey/callback + pkce: + type: boolean + description: Whether PKCE is enabled for the connection. + example: true + token_authentication_method: + type: string + enum: *ref_8 + description: >- + The token-endpoint client authentication method. Moving to + `private_key_jwt` generates a signing key pair if the connection has + none; its certificate is returned in + `oidc_options.jwt_signing_certs` and must be registered at the + Identity Provider. + example: client_secret_basic + id_token_signature_algorithm: + type: string + enum: *ref_9 + description: The ID-token signing algorithm. + example: RS256 + fetch_user_info: + type: boolean + description: >- + Whether to fetch additional profile attributes from the userinfo + endpoint. + example: false + PatchConnectionStandardAttributesDto: + type: object + properties: + idp_id: + type: string + description: The IdP attribute or claim the profile's `idp_id` is mapped from. + example: sub + email: + type: string + description: The IdP attribute or claim the profile's `email` is mapped from. + example: email + first_name: + type: string + description: >- + The IdP attribute or claim the profile's `first_name` is mapped + from. + example: given_name + last_name: + type: string + description: The IdP attribute or claim the profile's `last_name` is mapped from. + example: family_name + groups: + type: + - string + - 'null' + description: >- + The IdP attribute or claim the profile's `groups` are mapped from. + Set to `null` to unset the mapping. + example: memberOf + name: + type: + - string + - 'null' + description: >- + The IdP attribute or claim the profile's `name` is mapped from. Set + to `null` to unset the mapping. + example: displayName + PatchConnectionAttributeMapsDto: + type: object + properties: + standard_attributes: + description: >- + How IdP attributes or claims map onto the standard WorkOS profile + fields. Only the provided fields are updated. + $ref: '#/components/schemas/PatchConnectionStandardAttributesDto' + custom_attributes: + type: object + description: >- + How IdP attributes or claims map onto custom attributes, keyed by + custom attribute name. Custom attributes must already be defined in + the WorkOS dashboard. Only the provided keys are updated; a `null` + value unsets that mapping. + additionalProperties: + oneOf: + - type: string + - type: 'null' + example: + company: company_claim + PatchConnectionDto: + allOf: + - type: object + properties: + name: + type: string + description: A human-readable name for the Connection. + example: Foo Corp + external_id: + type: + - string + - 'null' + maxLength: 128 + pattern: ^[\x00-\x7F]+$ + description: >- + The customer-owned identifier for the Connection. Set to `null` + to stop tracking one. + example: acme-legacy-conn-42 + connection_type: + type: string + description: >- + The type of the Connection. Immutable after creation — it may be + sent, but only with the Connection current type. + example: OktaSAML + attribute_maps: + description: >- + How IdP attributes or claims map onto WorkOS profile fields. + Only the provided fields are updated. + $ref: '#/components/schemas/PatchConnectionAttributeMapsDto' + - oneOf: + - type: object + not: + anyOf: + - properties: + saml_options: + x-exclude-from-lint: true + required: + - saml_options + - properties: + oidc_options: + x-exclude-from-lint: true + required: + - oidc_options + - type: object + properties: + saml_options: + description: >- + Protocol configuration for SAML connections. Only the + provided fields are updated. Mutually exclusive with + `oidc_options`. + $ref: '#/components/schemas/PatchConnectionSamlOptionsDto' + required: + - saml_options + not: + anyOf: + - properties: + oidc_options: + x-exclude-from-lint: true + required: + - oidc_options + - type: object + properties: + oidc_options: + description: >- + Protocol configuration for OIDC connections. Only the + provided fields are updated. Mutually exclusive with + `saml_options`. + $ref: '#/components/schemas/PatchConnectionOidcOptionsDto' + required: + - oidc_options + not: + anyOf: + - properties: + saml_options: + x-exclude-from-lint: true + required: + - saml_options + x-mutually-exclusive-body-groups: *ref_10 CreateCorsOriginDto: type: object properties: @@ -22331,11 +24275,11 @@ components: type: - object - 'null' - additionalProperties: &ref_7 + additionalProperties: &ref_11 type: string maxLength: 600 maxProperties: 50 - example: &ref_8 + example: &ref_12 tier: diamond description: >- Object containing [metadata](/authkit/metadata) key/value pairs @@ -22390,9 +24334,9 @@ components: type: - object - 'null' - additionalProperties: *ref_7 + additionalProperties: *ref_11 maxProperties: 50 - example: *ref_8 + example: *ref_12 description: >- Object containing [metadata](/authkit/metadata) key/value pairs associated with the Organization. @@ -22526,7 +24470,7 @@ components: example: application/x-www-form-urlencoded authenticate_via: type: string - enum: &ref_9 + enum: &ref_13 - request_body - basic_auth_header description: >- @@ -22682,7 +24626,7 @@ components: example: application/x-www-form-urlencoded authenticate_via: type: string - enum: *ref_9 + enum: *ref_13 description: >- How client credentials are sent when exchanging authorization codes and refreshing tokens. @@ -22858,6 +24802,15 @@ components: example: https://example.com/callback required: - uri + CreateSamlIdpSigningCertificateDto: + type: object + properties: + value: + type: string + description: The PEM-encoded X.509 certificate. + example: '-----BEGIN CERTIFICATE-----MIIC...-----END CERTIFICATE-----' + required: + - value CreateTeamDto: type: object properties: @@ -23238,9 +25191,9 @@ components: x-exclude-from-lint: true required: - role_slug - x-mutually-exclusive-body-groups: *ref_10 + x-mutually-exclusive-body-groups: *ref_14 UpdateUserlandUserOrganizationMembershipDto: - x-mutually-exclusive-body-groups: *ref_11 + x-mutually-exclusive-body-groups: *ref_15 oneOf: - type: object not: @@ -23362,9 +25315,9 @@ components: type: - object - 'null' - additionalProperties: *ref_7 + additionalProperties: *ref_11 maxProperties: 50 - example: &ref_13 + example: &ref_17 timezone: America/New_York description: >- Object containing metadata key/value pairs associated with the @@ -23463,157 +25416,14 @@ components: example: $2a$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy password_hash_type: type: string - enum: &ref_14 - - bcrypt - - firebase-scrypt - - ssha - - ssha256 - - scrypt - - pbkdf2 - - argon2 - description: >- - The algorithm originally used to hash the password, used - when providing a `password_hash`. Required with - `password_hash`. Mutually exclusive with `password`. - example: bcrypt - password_salt_position: - type: string - enum: &ref_15 - - prefix - - suffix - description: >- - The position of the salt relative to the password when the - `password_hash` digest was computed: `prefix` for `hash(salt - + password)` or `suffix` for `hash(password + salt)`. Only - supported with the `ssha256` hash type and only valid when a - `password_hash` is provided. Defaults to `suffix`. Mutually - exclusive with `password`. - example: prefix - required: - - password_hash - - password_hash_type - not: - anyOf: - - properties: - password: - x-exclude-from-lint: true - required: - - password - x-mutually-exclusive-body-groups: *ref_12 - UpdateUserlandUserDto: - allOf: - - type: object - properties: - email: - type: string - format: email - description: The email address of the user. - example: marcelina.davis@example.com - first_name: - type: string - description: The first name of the user. - example: Marcelina - last_name: - type: string - description: The last name of the user. - example: Davis - name: - type: string - description: The user's full name. - example: Marcelina Davis - email_verified: - type: boolean - description: Whether the user's email has been verified. - example: true - metadata: - type: - - object - - 'null' - additionalProperties: *ref_7 - maxProperties: 50 - example: *ref_13 - description: >- - Object containing metadata key/value pairs associated with the - user. - propertyNames: - maxLength: 40 - external_id: - type: - - string - - 'null' - maxLength: 128 - pattern: ^[\x00-\x7F]+$ - description: The external ID of the user. - example: f1ffa2b2-c20b-4d39-be5c-212726e11222 - locale: - type: - - string - - 'null' - description: The user's preferred locale. - example: en-US - - oneOf: - - type: object - not: - anyOf: - - properties: - password: - x-exclude-from-lint: true - required: - - password - - properties: - password_hash: - x-exclude-from-lint: true - required: - - password_hash - - properties: - password_hash_type: - x-exclude-from-lint: true - required: - - password_hash_type - - properties: - password_salt_position: - x-exclude-from-lint: true - required: - - password_salt_position - - type: object - properties: - password: - type: string - description: >- - The password to set for the user. Mutually exclusive with - `password_hash`, `password_hash_type`, and - `password_salt_position`. - example: strong_password_123! - required: - - password - not: - anyOf: - - properties: - password_hash: - x-exclude-from-lint: true - required: - - password_hash - - properties: - password_hash_type: - x-exclude-from-lint: true - required: - - password_hash_type - - properties: - password_salt_position: - x-exclude-from-lint: true - required: - - password_salt_position - - type: object - properties: - password_hash: - type: string - description: >- - The hashed password to set for the user. Required with - `password_hash_type`. Mutually exclusive with `password`. - example: $2a$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy - password_hash_type: - type: string - enum: *ref_14 + enum: &ref_18 + - bcrypt + - firebase-scrypt + - ssha + - ssha256 + - scrypt + - pbkdf2 + - argon2 description: >- The algorithm originally used to hash the password, used when providing a `password_hash`. Required with @@ -23621,7 +25431,9 @@ components: example: bcrypt password_salt_position: type: string - enum: *ref_15 + enum: &ref_19 + - prefix + - suffix description: >- The position of the salt relative to the password when the `password_hash` digest was computed: `prefix` for `hash(salt @@ -23641,6 +25453,147 @@ components: required: - password x-mutually-exclusive-body-groups: *ref_16 + UpdateUserlandUserDto: + allOf: + - type: object + properties: + email: + type: string + format: email + description: The email address of the user. + example: marcelina.davis@example.com + first_name: + type: string + description: The first name of the user. + example: Marcelina + last_name: + type: string + description: The last name of the user. + example: Davis + name: + type: string + description: The user's full name. + example: Marcelina Davis + email_verified: + type: boolean + description: Whether the user's email has been verified. + example: true + metadata: + type: + - object + - 'null' + additionalProperties: *ref_11 + maxProperties: 50 + example: *ref_17 + description: >- + Object containing metadata key/value pairs associated with the + user. + propertyNames: + maxLength: 40 + external_id: + type: + - string + - 'null' + maxLength: 128 + pattern: ^[\x00-\x7F]+$ + description: The external ID of the user. + example: f1ffa2b2-c20b-4d39-be5c-212726e11222 + locale: + type: + - string + - 'null' + description: The user's preferred locale. + example: en-US + - oneOf: + - type: object + not: + anyOf: + - properties: + password: + x-exclude-from-lint: true + required: + - password + - properties: + password_hash: + x-exclude-from-lint: true + required: + - password_hash + - properties: + password_hash_type: + x-exclude-from-lint: true + required: + - password_hash_type + - properties: + password_salt_position: + x-exclude-from-lint: true + required: + - password_salt_position + - type: object + properties: + password: + type: string + description: >- + The password to set for the user. Mutually exclusive with + `password_hash`, `password_hash_type`, and + `password_salt_position`. + example: strong_password_123! + required: + - password + not: + anyOf: + - properties: + password_hash: + x-exclude-from-lint: true + required: + - password_hash + - properties: + password_hash_type: + x-exclude-from-lint: true + required: + - password_hash_type + - properties: + password_salt_position: + x-exclude-from-lint: true + required: + - password_salt_position + - type: object + properties: + password_hash: + type: string + description: >- + The hashed password to set for the user. Required with + `password_hash_type`. Mutually exclusive with `password`. + example: $2a$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy + password_hash_type: + type: string + enum: *ref_18 + description: >- + The algorithm originally used to hash the password, used + when providing a `password_hash`. Required with + `password_hash`. Mutually exclusive with `password`. + example: bcrypt + password_salt_position: + type: string + enum: *ref_19 + description: >- + The position of the salt relative to the password when the + `password_hash` digest was computed: `prefix` for `hash(salt + + password)` or `suffix` for `hash(password + salt)`. Only + supported with the `ssha256` hash type and only valid when a + `password_hash` is provided. Defaults to `suffix`. Mutually + exclusive with `password`. + example: prefix + required: + - password_hash + - password_hash_type + not: + anyOf: + - properties: + password: + x-exclude-from-lint: true + required: + - password + x-mutually-exclusive-body-groups: *ref_20 VerifyEmailAddressDto: type: object properties: @@ -23746,10 +25699,14 @@ components: description: The events that the Webhook Endpoint is subscribed to. items: type: string - enum: &ref_17 + enum: &ref_21 - agent.blueprint.created - agent.blueprint.deleted - agent.blueprint.updated + - agent.instance.created + - agent.instance.deleted + - agent.instance.session.created + - agent.instance.session.revoked - agent.registration.created - agent.registration.claim.attempt.created - agent.registration.claim.completed @@ -23868,7 +25825,7 @@ components: description: The events that the Webhook Endpoint is subscribed to. items: type: string - enum: *ref_17 + enum: *ref_21 example: - user.created - dsync.user.created @@ -27194,7 +29151,7 @@ components: description: >- An object containing the custom attribute mapping for the Directory Provider. - example: &ref_23 + example: &ref_27 department: Engineering job_title: Software Engineer role: @@ -27388,7 +29345,7 @@ components: type: object additionalProperties: {} description: The event payload. - example: &ref_18 + example: &ref_22 id: directory_user_01E1JG7J09H96KYP8HM9B0G5SJ directory_id: directory_01ECAZ4NV9QMV47GW873HDCX74 organization_id: org_01EZTR6WYX1A0DSE2CYMGXQ24Y @@ -27423,11 +29380,11 @@ components: - data - created_at description: An event emitted by WorkOS. - example: &ref_28 + example: &ref_32 object: event id: event_01EHZNVPK3SFK441A1RGBFSHRT event: dsync.user.created - data: *ref_18 + data: *ref_22 created_at: '2021-06-25T19:07:33.155Z' context: {} - oneOf: @@ -27627,7 +29584,7 @@ components: description: >- Permission slugs forming the ceiling on what sessions minted from this blueprint may do. - example: &ref_19 + example: &ref_23 - crm:read - email:send invocable_by: @@ -27640,7 +29597,7 @@ components: description: >- Role slugs whose members may mint user-delegated sessions from this blueprint. - example: &ref_20 + example: &ref_24 - manager organization_ids: type: array @@ -27649,7 +29606,7 @@ components: description: >- Organizations in which autonomous sessions may be minted from this blueprint. - example: &ref_21 + example: &ref_25 - org_01EHWNCE74X7JSDV0X3SZ3KJNY required: - role_slugs @@ -27779,99 +29736,417 @@ components: example: event_01EHZNVPK3SFK441A1RGBFSHRT event: type: string - const: agent.blueprint.updated + const: agent.blueprint.updated + data: + type: object + properties: + object: + type: string + description: Distinguishes the agent blueprint object. + const: agent_blueprint + id: + type: string + description: Unique identifier of the agent blueprint. + example: agent_blueprint_01EHWNCE74X7JSDV0X3SZ3KJNY + name: + type: string + description: Human-readable name of the agent blueprint. + example: Prospecting Agent + description: + type: + - string + - 'null' + description: Human-readable description of the agent blueprint. + example: Finds and qualifies sales prospects. + permissions: + type: array + items: + type: string + description: >- + Permission slugs forming the ceiling on what sessions + minted from this blueprint may do. + example: *ref_23 + invocable_by: + type: object + properties: + role_slugs: + type: array + items: + type: string + description: >- + Role slugs whose members may mint user-delegated + sessions from this blueprint. + example: *ref_24 + organization_ids: + type: array + items: + type: string + description: >- + Organizations in which autonomous sessions may be + minted from this blueprint. + example: *ref_25 + required: + - role_slugs + - organization_ids + description: Who may mint sessions from this blueprint. + session_settings: + type: object + properties: + max_age_seconds: + type: number + description: >- + Maximum lifetime of a session in seconds; refreshes + never extend a session past this. + example: 3600 + access_token_ttl_seconds: + type: number + description: Lifetime of each minted access token in seconds. + example: 300 + refresh_token_ttl_seconds: + type: number + description: Lifetime of each rotated refresh token in seconds. + example: 3600 + required: + - max_age_seconds + - access_token_ttl_seconds + - refresh_token_ttl_seconds + description: >- + Token and session lifetimes for sessions minted from + this blueprint. + created_at: + type: string + description: The timestamp when the agent blueprint was created. + example: '2026-01-15T12:00:00.000Z' + updated_at: + type: string + description: The timestamp when the agent blueprint was last updated. + example: '2026-01-15T12:00:00.000Z' + required: + - object + - id + - name + - description + - permissions + - invocable_by + - session_settings + - created_at + - updated_at + description: The event payload. + created_at: + format: date-time + type: string + description: An ISO 8601 timestamp. + example: '2026-01-15T12:00:00.000Z' + context: + $ref: '#/components/schemas/EventContextDto' + object: + type: string + description: Distinguishes the Event object. + const: event + required: + - id + - event + - data + - created_at + - object + - type: object + properties: + id: + type: string + description: Unique identifier for the event. + example: event_01EHZNVPK3SFK441A1RGBFSHRT + event: + type: string + const: agent.instance.created + data: + type: object + properties: + object: + type: string + description: Distinguishes the agent instance object. + const: agent_instance + id: + type: string + description: Unique identifier of the agent instance. + example: agent_01EHWNCE74X7JSDV0X3SZ3KJNY + agent_blueprint_id: + type: string + description: The agent blueprint this instance was minted from. + example: agent_blueprint_01EHWNCE74X7JSDV0X3SZ3KJNY + organization_id: + type: string + description: The organization the instance acts within. + example: org_01EHWNCE74X7JSDV0X3SZ3KJNY + organization_membership_id: + type: + - string + - 'null' + description: >- + The organization membership the instance acts on behalf + of; `null` for an autonomous instance. + example: om_01EHWNCE74X7JSDV0X3SZ3KJNY + type: + type: string + enum: + - delegated + - autonomous + description: >- + Whether the instance acts on behalf of a user + (`delegated`) or as itself within an organization + (`autonomous`). + created_at: + type: string + description: The timestamp when the agent instance was created. + example: '2026-01-15T12:00:00.000Z' + updated_at: + type: string + description: The timestamp when the agent instance was last updated. + example: '2026-01-15T12:00:00.000Z' + required: + - object + - id + - agent_blueprint_id + - organization_id + - organization_membership_id + - type + - created_at + - updated_at + description: The event payload. + created_at: + format: date-time + type: string + description: An ISO 8601 timestamp. + example: '2026-01-15T12:00:00.000Z' + context: + $ref: '#/components/schemas/EventContextDto' + object: + type: string + description: Distinguishes the Event object. + const: event + required: + - id + - event + - data + - created_at + - object + - type: object + properties: + id: + type: string + description: Unique identifier for the event. + example: event_01EHZNVPK3SFK441A1RGBFSHRT + event: + type: string + const: agent.instance.deleted + data: + type: object + properties: + object: + type: string + description: Distinguishes the agent instance object. + const: agent_instance + id: + type: string + description: Unique identifier of the agent instance. + example: agent_01EHWNCE74X7JSDV0X3SZ3KJNY + agent_blueprint_id: + type: string + description: The agent blueprint this instance was minted from. + example: agent_blueprint_01EHWNCE74X7JSDV0X3SZ3KJNY + organization_id: + type: string + description: The organization the instance acts within. + example: org_01EHWNCE74X7JSDV0X3SZ3KJNY + organization_membership_id: + type: + - string + - 'null' + description: >- + The organization membership the instance acts on behalf + of; `null` for an autonomous instance. + example: om_01EHWNCE74X7JSDV0X3SZ3KJNY + type: + type: string + enum: + - delegated + - autonomous + description: >- + Whether the instance acts on behalf of a user + (`delegated`) or as itself within an organization + (`autonomous`). + created_at: + type: string + description: The timestamp when the agent instance was created. + example: '2026-01-15T12:00:00.000Z' + updated_at: + type: string + description: The timestamp when the agent instance was last updated. + example: '2026-01-15T12:00:00.000Z' + required: + - object + - id + - agent_blueprint_id + - organization_id + - organization_membership_id + - type + - created_at + - updated_at + description: The event payload. + created_at: + format: date-time + type: string + description: An ISO 8601 timestamp. + example: '2026-01-15T12:00:00.000Z' + context: + $ref: '#/components/schemas/EventContextDto' + object: + type: string + description: Distinguishes the Event object. + const: event + required: + - id + - event + - data + - created_at + - object + - type: object + properties: + id: + type: string + description: Unique identifier for the event. + example: event_01EHZNVPK3SFK441A1RGBFSHRT + event: + type: string + const: agent.instance.session.created data: type: object properties: object: type: string - description: Distinguishes the agent blueprint object. - const: agent_blueprint + description: Distinguishes the agent instance session object. + const: agent_instance_session id: type: string - description: Unique identifier of the agent blueprint. - example: agent_blueprint_01EHWNCE74X7JSDV0X3SZ3KJNY - name: + description: Unique identifier of the agent instance session. + example: agent_session_01EHWNCE74X7JSDV0X3SZ3KJNY + agent_instance_id: type: string - description: Human-readable name of the agent blueprint. - example: Prospecting Agent - description: + description: The agent instance the session belongs to. + example: agent_01EHWNCE74X7JSDV0X3SZ3KJNY + organization_id: + type: string + description: The organization the owning agent instance belongs to. + example: org_01EHWNCE74X7JSDV0X3SZ3KJNY + expires_at: + type: string + description: Timestamp when the session expires. + example: '2026-01-15T13:00:00.000Z' + revoked_at: type: - string - 'null' - description: Human-readable description of the agent blueprint. - example: Finds and qualifies sales prospects. - permissions: + description: >- + Timestamp when the session was revoked; `null` if it has + not been revoked. + example: null + created_at: + type: string + description: The timestamp when the session was created. + example: '2026-01-15T12:00:00.000Z' + updated_at: + type: string + description: The timestamp when the session was last updated. + example: '2026-01-15T12:00:00.000Z' + permission_slugs: type: array items: type: string + description: The permissions granted to the session at mint time. + example: + - crm:read + required: + - object + - id + - agent_instance_id + - organization_id + - expires_at + - revoked_at + - created_at + - updated_at + - permission_slugs + description: The event payload. + created_at: + format: date-time + type: string + description: An ISO 8601 timestamp. + example: '2026-01-15T12:00:00.000Z' + context: + $ref: '#/components/schemas/EventContextDto' + object: + type: string + description: Distinguishes the Event object. + const: event + required: + - id + - event + - data + - created_at + - object + - type: object + properties: + id: + type: string + description: Unique identifier for the event. + example: event_01EHZNVPK3SFK441A1RGBFSHRT + event: + type: string + const: agent.instance.session.revoked + data: + type: object + properties: + object: + type: string + description: Distinguishes the agent instance session object. + const: agent_instance_session + id: + type: string + description: Unique identifier of the agent instance session. + example: agent_session_01EHWNCE74X7JSDV0X3SZ3KJNY + agent_instance_id: + type: string + description: The agent instance the session belongs to. + example: agent_01EHWNCE74X7JSDV0X3SZ3KJNY + organization_id: + type: string + description: The organization the owning agent instance belongs to. + example: org_01EHWNCE74X7JSDV0X3SZ3KJNY + expires_at: + type: string + description: Timestamp when the session expires. + example: '2026-01-15T13:00:00.000Z' + revoked_at: + type: + - string + - 'null' description: >- - Permission slugs forming the ceiling on what sessions - minted from this blueprint may do. - example: *ref_19 - invocable_by: - type: object - properties: - role_slugs: - type: array - items: - type: string - description: >- - Role slugs whose members may mint user-delegated - sessions from this blueprint. - example: *ref_20 - organization_ids: - type: array - items: - type: string - description: >- - Organizations in which autonomous sessions may be - minted from this blueprint. - example: *ref_21 - required: - - role_slugs - - organization_ids - description: Who may mint sessions from this blueprint. - session_settings: - type: object - properties: - max_age_seconds: - type: number - description: >- - Maximum lifetime of a session in seconds; refreshes - never extend a session past this. - example: 3600 - access_token_ttl_seconds: - type: number - description: Lifetime of each minted access token in seconds. - example: 300 - refresh_token_ttl_seconds: - type: number - description: Lifetime of each rotated refresh token in seconds. - example: 3600 - required: - - max_age_seconds - - access_token_ttl_seconds - - refresh_token_ttl_seconds - description: >- - Token and session lifetimes for sessions minted from - this blueprint. + Timestamp when the session was revoked; `null` if it has + not been revoked. + example: null created_at: type: string - description: The timestamp when the agent blueprint was created. + description: The timestamp when the session was created. example: '2026-01-15T12:00:00.000Z' updated_at: type: string - description: The timestamp when the agent blueprint was last updated. + description: The timestamp when the session was last updated. example: '2026-01-15T12:00:00.000Z' required: - object - id - - name - - description - - permissions - - invocable_by - - session_settings + - agent_instance_id + - organization_id + - expires_at + - revoked_at - created_at - updated_at description: The event payload. @@ -28545,7 +30820,7 @@ components: items: type: string description: The permissions granted to the API key. - example: &ref_22 + example: &ref_26 - users:read - users:write created_at: @@ -28671,7 +30946,7 @@ components: items: type: string description: The permissions granted to the API key. - example: *ref_22 + example: *ref_26 created_at: type: string description: The timestamp when the API key was created. @@ -28795,7 +31070,7 @@ components: items: type: string description: The permissions granted to the API key. - example: *ref_22 + example: *ref_26 created_at: type: string description: The timestamp when the API key was created. @@ -31662,7 +33937,7 @@ components: description: >- An object containing the custom attribute mapping for the Directory Provider. - example: *ref_23 + example: *ref_27 role: $ref: '#/components/schemas/SlimRole' roles: @@ -31852,7 +34127,7 @@ components: description: >- Labels assigned to the Feature Flag for categorizing and filtering. - example: &ref_24 + example: &ref_28 - reports enabled: type: boolean @@ -32013,7 +34288,7 @@ components: description: >- Labels assigned to the Feature Flag for categorizing and filtering. - example: *ref_24 + example: *ref_28 enabled: type: boolean description: >- @@ -32173,7 +34448,7 @@ components: description: >- Labels assigned to the Feature Flag for categorizing and filtering. - example: *ref_24 + example: *ref_28 enabled: type: boolean description: >- @@ -32453,7 +34728,7 @@ components: description: >- Labels assigned to the Feature Flag for categorizing and filtering. - example: *ref_24 + example: *ref_28 enabled: type: boolean description: >- @@ -33441,7 +35716,7 @@ components: description: >- Object containing [metadata](/authkit/metadata) key/value pairs associated with the Organization. - example: &ref_25 + example: &ref_29 tier: diamond propertyNames: maxLength: 40 @@ -33591,7 +35866,7 @@ components: description: >- Object containing [metadata](/authkit/metadata) key/value pairs associated with the Organization. - example: *ref_25 + example: *ref_29 propertyNames: maxLength: 40 maxProperties: 50 @@ -34418,7 +36693,7 @@ components: items: type: string description: The permissions granted by the role. - example: &ref_26 + example: &ref_30 - users:read - users:write created_at: @@ -34502,7 +36777,7 @@ components: items: type: string description: The permissions granted by the role. - example: *ref_26 + example: *ref_30 created_at: format: date-time type: string @@ -34584,7 +36859,7 @@ components: items: type: string description: The permissions granted by the role. - example: *ref_26 + example: *ref_30 created_at: format: date-time type: string @@ -34721,7 +36996,7 @@ components: description: >- Object containing [metadata](/authkit/metadata) key/value pairs associated with the Organization. - example: *ref_25 + example: *ref_29 propertyNames: maxLength: 40 maxProperties: 50 @@ -35588,7 +37863,7 @@ components: items: type: string description: The permissions granted by the role. - example: &ref_27 + example: &ref_31 - users:read - users:write created_at: @@ -35654,7 +37929,7 @@ components: items: type: string description: The permissions granted by the role. - example: *ref_27 + example: *ref_31 created_at: format: date-time type: string @@ -35718,7 +37993,7 @@ components: items: type: string description: The permissions granted by the role. - example: *ref_27 + example: *ref_31 created_at: format: date-time type: string @@ -36858,7 +39133,7 @@ components: - data - created_at - object - example: *ref_28 + example: *ref_32 description: An event emitted by WorkOS. EventList: type: object @@ -36893,7 +39168,7 @@ components: example: object: list data: - - *ref_28 + - *ref_32 list_metadata: after: event_01EHZNVPK3SFK441A1RGBFSHRT JwtTemplate: @@ -39022,6 +41297,169 @@ components: - default - created_at - updated_at + SamlIdpSigningCertificate: + type: object + properties: + object: + type: string + description: Distinguishes the SAML Identity Provider signing certificate object. + const: saml_idp_signing_certificate + id: + type: string + description: Unique identifier for the Identity Provider signing certificate. + example: saml_x509_cert_01E4ZCR3C56J083X43JQXF3JK5 + value: + type: string + description: The PEM-encoded public X.509 certificate. + example: '-----BEGIN CERTIFICATE-----MIIC...-----END CERTIFICATE-----' + not_before: + format: date-time + type: + - string + - 'null' + description: When the certificate becomes valid. + example: '2026-01-15T12:00:00.000Z' + not_after: + format: date-time + type: + - string + - 'null' + description: When the certificate expires. + example: '2026-01-15T12:00:00.000Z' + created_at: + format: date-time + type: string + description: An ISO 8601 timestamp. + example: '2026-01-15T12:00:00.000Z' + required: + - object + - id + - value + - not_before + - not_after + - created_at + SamlIdpSigningCertificateList: + type: object + properties: + object: + type: string + example: list + const: list + data: + type: array + items: + $ref: '#/components/schemas/SamlIdpSigningCertificate' + description: >- + Every Identity Provider signing certificate on the Connection, + including expired ones, oldest first. + required: + - object + - data + SamlSpEncryptionCertificate: + type: object + properties: + object: + type: string + description: >- + Distinguishes the SAML Service Provider encryption certificate + object. + const: saml_sp_encryption_certificate + id: + type: string + description: >- + Unique identifier for the Service Provider encryption key pair. + WorkOS holds the corresponding private key, which is never exposed. + example: saml_enc_key_pair_01E4ZCR3C56J083X43JQXF3JK5 + value: + type: string + description: The PEM-encoded public X.509 certificate. + example: '-----BEGIN CERTIFICATE-----MIIC...-----END CERTIFICATE-----' + not_before: + format: date-time + type: + - string + - 'null' + description: When the certificate becomes valid. + example: '2026-01-15T12:00:00.000Z' + not_after: + format: date-time + type: + - string + - 'null' + description: When the certificate expires. + example: '2026-01-15T12:00:00.000Z' + created_at: + format: date-time + type: string + description: An ISO 8601 timestamp. + example: '2026-01-15T12:00:00.000Z' + required: + - object + - id + - value + - not_before + - not_after + - created_at + SamlSpEncryptionCertificateList: + type: object + properties: + object: + type: string + example: list + const: list + data: + type: array + items: + $ref: '#/components/schemas/SamlSpEncryptionCertificate' + description: >- + Every Service Provider encryption certificate on the Connection, + including expired ones. + required: + - object + - data + SamlSpSigningCertificate: + type: object + properties: + object: + type: string + description: Distinguishes the SAML Service Provider signing certificate object. + const: saml_sp_signing_certificate + id: + type: string + description: >- + Unique identifier for the Service Provider signing key pair. WorkOS + holds the corresponding private key, which is never exposed. + example: saml_party_trust_01E4ZCR3C56J083X43JQXF3JK5 + value: + type: string + description: The PEM-encoded public X.509 certificate. + example: '-----BEGIN CERTIFICATE-----MIIC...-----END CERTIFICATE-----' + not_before: + format: date-time + type: + - string + - 'null' + description: When the certificate becomes valid. + example: '2026-01-15T12:00:00.000Z' + not_after: + format: date-time + type: + - string + - 'null' + description: When the certificate expires. + example: '2026-01-15T12:00:00.000Z' + created_at: + format: date-time + type: string + description: An ISO 8601 timestamp. + example: '2026-01-15T12:00:00.000Z' + required: + - object + - id + - value + - not_before + - not_after + - created_at Team: type: object properties: