feat(generated): Changes to agents, pipes, and user_management

.changelog-pending/2026-09-14T13-28-35-0b4d419df1198eced531b9867bfbfdee80433fe2.md

@@ -0,0 +1,102 @@
+* [#443](https://github.com/workos/workos-php/pull/443) feat(generated): regenerate from spec (4 changes)
+
+  **Features**
+  * **[admin_portal](https://workos.com/docs/reference/admin-portal)**:
+    * Changed the format of `PortalLinkResponse.link`
+  * **[agents](https://workos.com/docs/reference/agents)**:
+    * Added parameter `AgentsSessions.list.organization_id`
+    * Changed the format of `ClaimViewResponse.user_code`
+    * Changed the format of `AgentAdminValidateCredentialRequest.credential`
+  * **[api_keys](https://workos.com/docs/reference/authkit/api-keys)**:
+    * Changed the format of `ValidateApiKey.value`
+    * Changed the format of `OrganizationApiKeyWithValue.value`
+    * Changed the format of `UserApiKeyWithValue.value`
+  * **[multi_factor_auth](https://workos.com/docs/reference/authkit/mfa)**:
+    * Changed the format of `AuthenticationChallenge.code`
+    * Changed the format of `AuthenticationFactorEnrolledTotp.secret`
+    * Changed the format of `AuthenticationFactorEnrolledTotp.qr_code`
+    * Changed the format of `AuthenticationFactorEnrolledTotp.uri`
+    * Changed the format of `AuthenticationChallengesVerifyRequest.code`
+  * **[pipes](https://workos.com/docs/reference/pipes)**:
+    * Added `supports_multiple_connections` to `DataIntegrationsVendCredentialsRequest`
+    * Added `supports_multiple_connections` to `DataIntegrationsGetUserTokenRequest`
+    * Added parameter `UserManagementDataProviders.getUserDataInstallation.supports_multiple_connections`
+    * Added parameter `UserManagementDataProviders.updateUserDataInstallation.supports_multiple_connections`
+    * Added parameter `UserManagementDataProviders.deleteUserDataInstallation.supports_multiple_connections`
+    * Added parameter `UserManagementDataProviders.getUserDataIntegrations.supports_multiple_connections`
+    * Added enum `PipesOwnership`
+    * Added `user` to `CreateDataIntegrationOwnership`
+    * Added `user` to `DataIntegrationOwnership`
+    * Added endpoint `GET /data-integrations/{slug}/organization`
+    * Added endpoint `PUT /data-integrations/{slug}/organization`
+    * Added endpoint `DELETE /data-integrations/{slug}/organization`
+    * Added parameter `Pipes.listDataIntegrations.ownership`
+    * Changed errors for endpoint `GET /data-integrations`
+    * Changed errors for endpoint `PUT /user_management/users/{user_id}/connected_accounts/{slug}`
+    * Changed errors for endpoint `DELETE /user_management/users/{user_id}/connected_accounts/{slug}`
+    * Changed the format of `DataIntegrationCredentialsResponseCredential.value`
+    * Added `connection_owner` to `DataIntegrationsUpsertApiKeyRequest`
+    * Added `connection_owner` to `DataIntegrationsUpsertClientCredentialsRequest`
+    * Added enum `DataIntegrationsUpsertApiKeyRequestConnectionOwner`
+    * Added enum `DataIntegrationsUpsertClientCredentialsRequestConnectionOwner`
+    * Added model `AccountSelectionRequiredError`
+    * Added `connected_account_id` to `DataIntegrationsUpsertApiKeyRequest`
+    * Added `connected_account_id` to `DataIntegrationsUpsertClientCredentialsRequest`
+    * Added `ownership` to `CreateDataIntegration`
+    * Added `ownership` to `DataIntegration`
+    * Added `connection_owner` to `DataIntegrationsVendCredentialsRequest`
+    * Added `connection_owner` to `DataIntegrationsGetUserTokenRequest`
+    * Added enum `CreateDataIntegrationOwnership`
+    * Added enum `DataIntegrationOwnership`
+    * Added enum `DataIntegrationsVendCredentialsRequestConnectionOwner`
+    * Added enum `DataIntegrationsGetUserTokenRequestConnectionOwner`
+    * Changed errors for endpoint `POST /data-integrations/{slug}/credentials`
+    * Changed errors for endpoint `POST /data-integrations/{provider}/token`
+  * **[sso](https://workos.com/docs/reference/sso)**:
+    * Changed the format of `CreateConnectionKeyPair.key`
+    * Changed the format of `TokenQuery.code`
+    * Changed the format of `SSOLogoutAuthorizeResponse.logout_url`
+  * **[user_management](https://workos.com/docs/reference/authkit/user)**:
+    * Added model `CreateAuthkitOAuthResource`
+    * Added model `AuthkitOAuthResource`
+    * Added service `UserManagementAuthkitOAuthResources`
+    * Changed the format of `DeviceAuthorizationResponse.verification_uri_complete`
+    * Changed the format of `VerifyEmailAddress.code`
+    * Changed the format of `ConfirmEmailChange.code`
+    * Changed the format of `MagicAuth.code`
+    * Changed the format of `UserInvite.accept_invitation_url`
+    * Changed the format of `EmailVerification.code`
+    * Changed the format of `PasswordReset.password_reset_url`
+    * Changed the format of `AuthenticateResponse.authkit_authorization_code`
+    * Changed the format of `DeviceAuthorizationResponse.device_code`
+    * Changed the format of `DeviceAuthorizationResponse.user_code`
+    * Changed the format of `AuthorizationCodeSessionAuthenticateRequest.code`
+    * Changed the format of `AuthorizationCodeSessionAuthenticateRequest.code_verifier`
+    * Changed the format of `MagicAuthCodeSessionAuthenticateRequest.code`
+    * Changed the format of `EmailVerificationCodeSessionAuthenticateRequest.code`
+    * Changed the format of `MfaTotpSessionAuthenticateRequest.code`
+    * Changed the format of `RadarEmailChallengeCodeSessionAuthenticateRequest.code`
+    * Changed the format of `RadarSmsChallengeCodeSessionAuthenticateRequest.code`
+    * Changed the format of `DeviceCodeSessionAuthenticateRequest.device_code`
+    * Changed the format of `Invitation.accept_invitation_url`
+    * Changed the format of `MagicAuthSendMagicAuthCodeAndReturnResponse.code`
+  * **[radar](https://workos.com/docs/reference/radar)**:
+    * Changed the format of `RadarChallenge.code`
+  * **[vault](https://workos.com/docs/reference/vault)**:
+    * Changed the format of `CreateObjectRequest.value`
+    * Changed the format of `VaultObject.value`
+    * Changed the format of `UpdateObjectRequest.value`
+
+  **Fixes**
+  * **[pipes](https://workos.com/docs/reference/pipes)**:
+    * Removed `userland_user` from `CreateDataIntegrationOwnership`
+    * Removed `userland_user` from `DataIntegrationOwnership`
+    * Changed errors for endpoint `POST /user_management/users/{user_id}/connected_accounts/{slug}`
+    * Changed errors for endpoint `PUT /data-integrations/{slug}/api-key`
+    * Changed errors for endpoint `PUT /data-integrations/{slug}/client-credentials`
+    * Changed errors for endpoint `POST /data-integrations/{slug}/credentials`
+    * Changed errors for endpoint `POST /data-integrations/{provider}/token`
+    * Changed errors for endpoint `GET /user_management/users/{user_id}/connected_accounts/{slug}`
+    * Changed errors for endpoint `PUT /user_management/users/{user_id}/connected_accounts/{slug}`
+    * Changed errors for endpoint `DELETE /user_management/users/{user_id}/connected_accounts/{slug}`
+    * Changed the type of `DataIntegrationInstallation.user_id`

.last-synced-sha

@@ -1 +1 @@
-6fba233c50a5b651b2df7b859b75bfe715bc825a
+d3fa61120f8b9e73972b9dc5f4b5ea2bc0526636

.oagen-manifest.json

@@ -3,6 +3,7 @@
   "language": "php",
   "files": [
     "lib/Resource/AccessTokenAgentRegistrationCredentialIssuedDataDetail.php",
+    "lib/Resource/AccountSelectionRequiredError.php",
     "lib/Resource/ActionAuthenticationDenied.php",
     "lib/Resource/ActionAuthenticationDeniedData.php",
     "lib/Resource/ActionUserRegistrationDenied.php",
@@ -182,6 +183,7 @@
     "lib/Resource/AuthenticationSSOTimedOutData.php",
     "lib/Resource/AuthenticationSSOTimedOutDataError.php",
     "lib/Resource/AuthenticationSSOTimedOutDataSSO.php",
+    "lib/Resource/AuthkitOAuthResource.php",
     "lib/Resource/AuthorizationAssignment.php",
     "lib/Resource/AuthorizationCheck.php",
     "lib/Resource/AuthorizationCodeSessionAuthenticateRequest.php",
@@ -231,6 +233,7 @@
     "lib/Resource/ConnectionType.php",
     "lib/Resource/ConnectionsConnectionType.php",
     "lib/Resource/CreateApplicationSecret.php",
+    "lib/Resource/CreateAuthkitOAuthResource.php",
     "lib/Resource/CreateAuthorizationPermission.php",
     "lib/Resource/CreateAuthorizationResource.php",
     "lib/Resource/CreateCORSOrigin.php",
@@ -514,6 +517,7 @@
     "lib/Resource/PipesConnectedAccountConnectionFailedData.php",
     "lib/Resource/PipesConnectedAccountDisconnected.php",
     "lib/Resource/PipesConnectedAccountReauthorizationNeeded.php",
+    "lib/Resource/PipesOwnership.php",
     "lib/Resource/PortalLinkResponse.php",
     "lib/Resource/Profile.php",
     "lib/Resource/RadarChallenge.php",
@@ -724,6 +728,7 @@
     "lib/WorkOS.php",
     "tests/ClientTest.php",
     "tests/Fixtures/access_token_agent_registration_credential_issued_data_detail.json",
+    "tests/Fixtures/account_selection_required_error.json",
     "tests/Fixtures/action_authentication_denied.json",
     "tests/Fixtures/action_authentication_denied_data.json",
     "tests/Fixtures/action_user_registration_denied.json",
@@ -888,6 +893,7 @@
     "tests/Fixtures/authentication_sso_timed_out_data.json",
     "tests/Fixtures/authentication_sso_timed_out_data_error.json",
     "tests/Fixtures/authentication_sso_timed_out_data_sso.json",
+    "tests/Fixtures/authkit_oauth_resource.json",
     "tests/Fixtures/authorization_check.json",
     "tests/Fixtures/authorization_code_session_authenticate_request.json",
     "tests/Fixtures/authorization_permission.json",
@@ -927,6 +933,7 @@
     "tests/Fixtures/connection_saml_certificate_renewed_data_connection.json",
     "tests/Fixtures/cors_origin_response.json",
     "tests/Fixtures/create_application_secret.json",
+    "tests/Fixtures/create_authkit_oauth_resource.json",
     "tests/Fixtures/create_authorization_permission.json",
     "tests/Fixtures/create_authorization_resource.json",
     "tests/Fixtures/create_connection.json",
@@ -1104,6 +1111,7 @@
     "tests/Fixtures/list_audit_log_action.json",
     "tests/Fixtures/list_audit_log_schema.json",
     "tests/Fixtures/list_authentication_factor.json",
+    "tests/Fixtures/list_authkit_oauth_resource.json",
     "tests/Fixtures/list_authorization_permission.json",
     "tests/Fixtures/list_authorization_resource.json",
     "tests/Fixtures/list_authorized_connect_application_list_data.json",
@@ -2379,6 +2387,30 @@
     "POST /agents/blueprints/{agent_blueprint_id}/tokens/validate": {
       "sdkMethod": "validateBlueprintToken",
       "service": "agents"
+    },
+    "GET /data-integrations/{slug}/organization": {
+      "sdkMethod": "listDataIntegrationOrganization",
+      "service": "pipes"
+    },
+    "PUT /data-integrations/{slug}/organization": {
+      "sdkMethod": "updateDataIntegrationOrganization",
+      "service": "pipes"
+    },
+    "DELETE /data-integrations/{slug}/organization": {
+      "sdkMethod": "deleteDataIntegrationOrganization",
+      "service": "pipes"
+    },
+    "GET /user_management/authkit_oauth_resources": {
+      "sdkMethod": "listAuthkitOAuthResources",
+      "service": "userManagement"
+    },
+    "POST /user_management/authkit_oauth_resources": {
+      "sdkMethod": "createAuthkitOAuthResource",
+      "service": "userManagement"
+    },
+    "DELETE /user_management/authkit_oauth_resources/{id}": {
+      "sdkMethod": "deleteAuthkitOAuthResource",
+      "service": "userManagement"
     }
   }
 }

lib/Resource/AccountSelectionRequiredError.php

@@ -0,0 +1,36 @@
+<?php
+
+declare(strict_types=1);
+
+// This file is auto-generated by oagen. Do not edit.
+
+namespace WorkOS\Resource;
+
+readonly class AccountSelectionRequiredError implements \JsonSerializable
+{
+    use JsonSerializableTrait;
+
+    public function __construct(
+        /** Indicates that several connected accounts match and the request must name one. */
+        public string $code,
+        /** A human-readable explanation of the ambiguity. */
+        public string $message,
+    ) {
+    }
+
+    public static function fromArray(array $data): self
+    {
+        return new self(
+            code: $data['code'] ?? 'account_selection_required',
+            message: $data['message'],
+        );
+    }
+
+    public function toArray(): array
+    {
+        return [
+            'code' => $this->code,
+            'message' => $this->message,
+        ];
+    }
+}

lib/Resource/AuditLogsRetention.php

@@ -11,7 +11,7 @@
     use JsonSerializableTrait;
 
     public function __construct(
-        /** The number of days Audit Log events will be retained before being permanently deleted. Valid values are 30 and 365. */
+        /** The number of days Audit Log events will be retained before being permanently deleted. Valid values are 30 through 330 in 30-day increments and 365 through 3650 in 365-day increments. */
         public ?int $retentionPeriodInDays,
     ) {
     }

lib/Resource/AuthkitOAuthResource.php

@@ -0,0 +1,52 @@
+<?php
+
+declare(strict_types=1);
+
+// This file is auto-generated by oagen. Do not edit.
+
+namespace WorkOS\Resource;
+
+readonly class AuthkitOAuthResource implements \JsonSerializable
+{
+    use JsonSerializableTrait;
+
+    public function __construct(
+        /** The object type. */
+        public string $object,
+        /** The ID of the MCP resource indicator. */
+        public string $id,
+        /** The resource URI. */
+        public string $uri,
+        /** Whether this is the default MCP resource indicator for the environment. */
+        public bool $default,
+        /** The timestamp when the MCP resource indicator was created. */
+        public string $createdAt,
+        /** The timestamp when the MCP resource indicator was last updated. */
+        public string $updatedAt,
+    ) {
+    }
+
+    public static function fromArray(array $data): self
+    {
+        return new self(
+            object: $data['object'] ?? 'authkit_oauth_resource',
+            id: $data['id'],
+            uri: $data['uri'],
+            default: $data['default'],
+            createdAt: $data['created_at'],
+            updatedAt: $data['updated_at'],
+        );
+    }
+
+    public function toArray(): array
+    {
+        return [
+            'object' => $this->object,
+            'id' => $this->id,
+            'uri' => $this->uri,
+            'default' => $this->default,
+            'created_at' => $this->createdAt,
+            'updated_at' => $this->updatedAt,
+        ];
+    }
+}

lib/Resource/CreateAuthkitOAuthResource.php

@@ -0,0 +1,36 @@
+<?php
+
+declare(strict_types=1);
+
+// This file is auto-generated by oagen. Do not edit.
+
+namespace WorkOS\Resource;
+
+readonly class CreateAuthkitOAuthResource implements \JsonSerializable
+{
+    use JsonSerializableTrait;
+
+    public function __construct(
+        /** The resource URI. May be a wildcard pattern with a single `*` in the leftmost hostname label, where enabled for the environment. */
+        public string $uri,
+        /** Whether the resource being created becomes the environment default, clearing any previous default. Applies at creation only — this API has no update endpoint yet, so changing the default on an existing resource is done from the dashboard. A wildcard pattern cannot be the default. */
+        public ?bool $default = null,
+    ) {
+    }
+
+    public static function fromArray(array $data): self
+    {
+        return new self(
+            uri: $data['uri'],
+            default: $data['default'] ?? null,
+        );
+    }
+
+    public function toArray(): array
+    {
+        return [
+            'uri' => $this->uri,
+            'default' => $this->default,
+        ];
+    }
+}

lib/Resource/CreateDataIntegration.php

@@ -13,6 +13,8 @@
     public function __construct(
         /** The provider to create a Data Integration for. For a built-in provider use its slug (e.g. `github`, `slack`). For a custom provider, this is the new provider slug and `custom_provider` must be supplied. A custom provider slug cannot shadow an existing global provider slug. */
         public string $provider,
+        /** Who owns the Data Integration. `user` (the default) creates the integration users connect their own accounts to; `organization` creates the root organizations connect to. Ownership is fixed at creation, and one integration of each ownership may exist per provider. Independent of `credentials.type`. */
+        public ?PipesOwnership $ownership = null,
         /** An optional description of the Data Integration. */
         public ?string $description = null,
         /** Whether the Data Integration is enabled. Defaults to `false`. */
@@ -45,6 +47,7 @@ public static function fromArray(array $data): self
     {
         return new self(
             provider: $data['provider'],
+            ownership: isset($data['ownership']) ? PipesOwnership::from($data['ownership']) : null,
             description: $data['description'] ?? null,
             enabled: $data['enabled'] ?? null,
             scopes: $data['scopes'] ?? null,
@@ -60,6 +63,7 @@ public function toArray(): array
     {
         return [
             'provider' => $this->provider,
+            'ownership' => $this->ownership?->value,
             'description' => $this->description,
             'enabled' => $this->enabled,
             'scopes' => $this->scopes,

lib/Resource/DataIntegration.php

@@ -19,6 +19,8 @@ public function __construct(
         public string $slug,
         /** The integration type derived from the provider. */
         public string $integrationType,
+        /** Who owns the Data Integration: `user` when users connect their own accounts, `organization` when organizations connect. Fixed at creation. */
+        public PipesOwnership $ownership,
         /** An optional description of the Data Integration. */
         public ?string $description,
         /** Whether the Data Integration is enabled. */
@@ -62,6 +64,7 @@ public static function fromArray(array $data): self
             id: $data['id'],
             slug: $data['slug'],
             integrationType: $data['integration_type'],
+            ownership: PipesOwnership::from($data['ownership']),
             description: $data['description'] ?? null,
             enabled: $data['enabled'],
             state: DataIntegrationState::from($data['state']),
@@ -84,6 +87,7 @@ public function toArray(): array
             'id' => $this->id,
             'slug' => $this->slug,
             'integration_type' => $this->integrationType,
+            'ownership' => $this->ownership->value,
             'description' => $this->description,
             'enabled' => $this->enabled,
             'state' => $this->state->value,