feat(generated): Changes to events and user_management

.changelog-pending/2026-08-11T17-12-40-c4d55e190f0f722ec4b6c901f4305221e86fb8f7.md

@@ -0,0 +1,53 @@
+* [#428](https://github.com/workos/workos-php/pull/428) feat(generated)!: regenerate from spec (2 changes)
+
+  **⚠️ Breaking**
+  * **[events](https://workos.com/docs/reference/events)**:
+    * Changed required status for parameter `Events.list.events`
+
+  **Features**
+  * **[groups](https://workos.com/docs/reference/groups)**:
+    * Added parameter `Groups.list.search`
+  * **[connect](https://workos.com/docs/reference/workos-connect/standalone)**:
+    * Added `client_id` to `ConnectedAccount`
+    * Added `client_secret_last_4` to `ConnectedAccount`
+    * Added `config` to `ConnectedAccount`
+  * **[pipes](https://workos.com/docs/reference/pipes)**:
+    * Added `client_id` to `DataIntegrationsListResponseDataConnectedAccount`
+    * Added `client_secret_last_4` to `DataIntegrationsListResponseDataConnectedAccount`
+    * Added `config` to `DataIntegrationsListResponseDataConnectedAccount`
+    * Changed errors for endpoint `POST /data-integrations/{slug}/credentials`
+    * Made `CustomProviderDefinition.authorization_url` optional
+    * Made `CustomProviderDefinition.token_url` optional
+    * Added model `DataIntegrationsUpsertClientCredentialsRequest`
+    * Added `client_credentials` to `CreateDataIntegrationAuthMethods`
+    * Added endpoint `PUT /data-integrations/{slug}/client-credentials`
+  * **[sso](https://workos.com/docs/reference/sso)**:
+    * Added `XOAuth` to `ConnectionType`
+    * Added `XOAuth` to `ProfileConnectionType`
+    * Added `XOAuth` to `ConnectionsConnectionType`
+    * Added `GrokOAuth` to `ConnectionType`
+    * Added `GrokOAuth` to `ProfileConnectionType`
+    * Added `GrokOAuth` to `ConnectionsConnectionType`
+  * **[user_management](https://workos.com/docs/reference/authkit/user)**:
+    * Changed errors for endpoint `DELETE /user_management/users/{id}`
+    * Added `password_salt_position` to `CreateUser`
+    * Added `password_salt_position` to `UpdateUser`
+    * Made `RadarSmsChallengeCodeSessionAuthenticateRequest.verification_id` optional
+    * Made `RadarSmsChallengeCodeSessionAuthenticateRequest.phone_number` optional
+    * Added enum `CreateUserPasswordSaltPosition`
+    * Added enum `UpdateUserPasswordSaltPosition`
+    * Added `XOAuth` to `AuthenticateResponseAuthenticationMethod`
+    * Added `XOAuth` to `UserIdentitiesGetItemProvider`
+    * Added `GrokOAuth` to `AuthenticateResponseAuthenticationMethod`
+    * Added `GrokOAuth` to `UserIdentitiesGetItemProvider`
+  * **[webhooks](https://workos.com/docs/reference/webhooks)**:
+    * Added `agent.registration.refreshed` to `CreateWebhookEndpointEvents`
+    * Added `agent.registration.refreshed` to `UpdateWebhookEndpointEvents`
+
+  **Fixes**
+  * **[pipes](https://workos.com/docs/reference/pipes)**:
+    * Changed the type of `DataIntegration.credentials`
+  * **[user_management](https://workos.com/docs/reference/authkit/user)**:
+    * Changed errors for endpoint `POST /user_management/authenticate`
+    * Changed errors for endpoint `POST /user_management/users`
+    * Changed errors for endpoint `PUT /user_management/users/{id}`

.last-synced-sha

@@ -1 +1 @@
-ae3ebbb08d9b4bf9b2391558e820b7eb6f511fb9
+a07d8e7988d035c2d727787f18f64d71b4b89a84

.oagen-manifest.json

@@ -37,6 +37,8 @@
     "lib/Resource/AgentRegistrationKind.php",
     "lib/Resource/AgentRegistrationOrganizationSwitched.php",
     "lib/Resource/AgentRegistrationOrganizationSwitchedData.php",
+    "lib/Resource/AgentRegistrationRefreshed.php",
+    "lib/Resource/AgentRegistrationRefreshedData.php",
     "lib/Resource/AgentRegistrationRevoked.php",
     "lib/Resource/AgentRegistrationRevokedData.php",
     "lib/Resource/AgentRegistrationStatus.php",
@@ -221,6 +223,7 @@
     "lib/Resource/CreateUserInviteOptionsLocale.php",
     "lib/Resource/CreateUserOrganizationMembership.php",
     "lib/Resource/CreateUserPasswordHashType.php",
+    "lib/Resource/CreateUserPasswordSaltPosition.php",
     "lib/Resource/CreateWebhookEndpoint.php",
     "lib/Resource/CreateWebhookEndpointEvents.php",
     "lib/Resource/CustomProviderDefinition.php",
@@ -250,6 +253,7 @@
     "lib/Resource/DataIntegrationsListResponseDataConnectedAccount.php",
     "lib/Resource/DataIntegrationsListResponseDataOwnership.php",
     "lib/Resource/DataIntegrationsUpsertApiKeyRequest.php",
+    "lib/Resource/DataIntegrationsUpsertClientCredentialsRequest.php",
     "lib/Resource/DataIntegrationsVendCredentialsRequest.php",
     "lib/Resource/DecryptRequest.php",
     "lib/Resource/DecryptResponse.php",
@@ -666,6 +670,8 @@
     "tests/Fixtures/agent_registration_expired_data.json",
     "tests/Fixtures/agent_registration_organization_switched.json",
     "tests/Fixtures/agent_registration_organization_switched_data.json",
+    "tests/Fixtures/agent_registration_refreshed.json",
+    "tests/Fixtures/agent_registration_refreshed_data.json",
     "tests/Fixtures/agent_registration_revoked.json",
     "tests/Fixtures/agent_registration_revoked_data.json",
     "tests/Fixtures/api_key.json",
@@ -848,6 +854,7 @@
     "tests/Fixtures/data_integrations_list_response_data.json",
     "tests/Fixtures/data_integrations_list_response_data_connected_account.json",
     "tests/Fixtures/data_integrations_upsert_api_key_request.json",
+    "tests/Fixtures/data_integrations_upsert_client_credentials_request.json",
     "tests/Fixtures/data_integrations_vend_credentials_request.json",
     "tests/Fixtures/decrypt_request.json",
     "tests/Fixtures/decrypt_response.json",
@@ -2057,6 +2064,10 @@
     "GET /audit_logs/exports/{auditLogExportId}": {
       "sdkMethod": "getExport",
       "service": "auditLogs"
+    },
+    "PUT /data-integrations/{slug}/client-credentials": {
+      "sdkMethod": "updateDataIntegrationClientCredentials",
+      "service": "pipes"
     }
   }
 }

lib/Resource/AgentRegistrationRefreshed.php

@@ -0,0 +1,50 @@
+<?php
+
+declare(strict_types=1);
+
+// This file is auto-generated by oagen. Do not edit.
+
+namespace WorkOS\Resource;
+
+readonly class AgentRegistrationRefreshed implements \JsonSerializable
+{
+    use JsonSerializableTrait;
+
+    public function __construct(
+        /** Distinguishes the Event object. */
+        public string $object,
+        /** Unique identifier for the event. */
+        public string $id,
+        public string $event,
+        /** The event payload. */
+        public AgentRegistrationRefreshedData $data,
+        /** An ISO 8601 timestamp. */
+        public \DateTimeImmutable $createdAt,
+        public ?EventContext $context = null,
+    ) {
+    }
+
+    public static function fromArray(array $data): self
+    {
+        return new self(
+            object: $data['object'] ?? 'event',
+            id: $data['id'],
+            event: $data['event'] ?? 'agent.registration.refreshed',
+            data: AgentRegistrationRefreshedData::fromArray($data['data']),
+            createdAt: new \DateTimeImmutable($data['created_at']),
+            context: isset($data['context']) ? EventContext::fromArray($data['context']) : null,
+        );
+    }
+
+    public function toArray(): array
+    {
+        return [
+            'object' => $this->object,
+            'id' => $this->id,
+            'event' => $this->event,
+            'data' => $this->data->toArray(),
+            'created_at' => $this->createdAt->format(\DateTimeInterface::RFC3339_EXTENDED),
+            'context' => $this->context?->toArray(),
+        ];
+    }
+}

lib/Resource/AgentRegistrationRefreshedData.php

@@ -0,0 +1,33 @@
+<?php
+
+declare(strict_types=1);
+
+// This file is auto-generated by oagen. Do not edit.
+
+namespace WorkOS\Resource;
+
+/** The event payload. */
+readonly class AgentRegistrationRefreshedData implements \JsonSerializable
+{
+    use JsonSerializableTrait;
+
+    public function __construct(
+        /** The agent registration whose identity assertion was refreshed. */
+        public string $agentRegistrationId,
+    ) {
+    }
+
+    public static function fromArray(array $data): self
+    {
+        return new self(
+            agentRegistrationId: $data['agent_registration_id'],
+        );
+    }
+
+    public function toArray(): array
+    {
+        return [
+            'agent_registration_id' => $this->agentRegistrationId,
+        ];
+    }
+}

lib/Resource/AuthenticateResponseAuthenticationMethod.php

@@ -19,6 +19,8 @@ enum AuthenticateResponseAuthenticationMethod: string
     case GitHubOAuth = 'GitHubOAuth';
     case GitLabOAuth = 'GitLabOAuth';
     case GoogleOAuth = 'GoogleOAuth';
+    case GrokOAuth = 'GrokOAuth';
+    case XoAuth = 'XOAuth';
     case IntuitOAuth = 'IntuitOAuth';
     case LinkedInOAuth = 'LinkedInOAuth';
     case MicrosoftOAuth = 'MicrosoftOAuth';

lib/Resource/ConnectedAccount.php

@@ -39,6 +39,15 @@ public function __construct(
         public ?DataIntegrationAuthMethods $authMethod = null,
         /** The last four characters of the API key, or `null` for OAuth connections. */
         public ?string $apiKeyLast4 = null,
+        /** The client ID supplied for this connection. Only present when `auth_method` is `client_credentials`. */
+        public ?string $clientId = null,
+        /** The last four characters of the client secret supplied for this connection, or `null` when it can't be read. Only present when `auth_method` is `client_credentials`. */
+        public ?string $clientSecretLast4 = null,
+        /**
+         * The connection-level configuration values stored for this connection — the fields the provider declares at `installation` scope, excluding any it declares as secret. Only present when `auth_method` is `client_credentials`.
+         * @var array<string, string>|null
+         */
+        public ?array $config = null,
     ) {
     }
 
@@ -55,6 +64,9 @@ public static function fromArray(array $data): self
             updatedAt: $data['updated_at'],
             authMethod: isset($data['auth_method']) ? DataIntegrationAuthMethods::from($data['auth_method']) : null,
             apiKeyLast4: $data['api_key_last_4'] ?? null,
+            clientId: $data['client_id'] ?? null,
+            clientSecretLast4: $data['client_secret_last_4'] ?? null,
+            config: $data['config'] ?? null,
         );
     }
 
@@ -71,6 +83,9 @@ public function toArray(): array
             'updated_at' => $this->updatedAt,
             'auth_method' => $this->authMethod?->value,
             'api_key_last_4' => $this->apiKeyLast4,
+            'client_id' => $this->clientId,
+            'client_secret_last_4' => $this->clientSecretLast4,
+            'config' => $this->config,
         ];
     }
 }

lib/Resource/ConnectionDeletedDataConnectionType.php

@@ -30,6 +30,8 @@ enum ConnectionDeletedDataConnectionType: string
     case GoogleOAuth = 'GoogleOAuth';
     case GoogleOidc = 'GoogleOIDC';
     case GoogleSAML = 'GoogleSAML';
+    case GrokOAuth = 'GrokOAuth';
+    case XoAuth = 'XOAuth';
     case IntuitOAuth = 'IntuitOAuth';
     case JumpCloudSAML = 'JumpCloudSAML';
     case KeycloakSAML = 'KeycloakSAML';

lib/Resource/ConnectionType.php

@@ -31,6 +31,8 @@ enum ConnectionType: string
     case GoogleOAuth = 'GoogleOAuth';
     case GoogleOidc = 'GoogleOIDC';
     case GoogleSAML = 'GoogleSAML';
+    case GrokOAuth = 'GrokOAuth';
+    case XoAuth = 'XOAuth';
     case IntuitOAuth = 'IntuitOAuth';
     case JumpCloudSAML = 'JumpCloudSAML';
     case KeycloakSAML = 'KeycloakSAML';

lib/Resource/ConnectionsConnectionType.php

@@ -29,6 +29,8 @@ enum ConnectionsConnectionType: string
     case GoogleOAuth = 'GoogleOAuth';
     case GoogleOidc = 'GoogleOIDC';
     case GoogleSAML = 'GoogleSAML';
+    case GrokOAuth = 'GrokOAuth';
+    case XoAuth = 'XOAuth';
     case IntuitOAuth = 'IntuitOAuth';
     case JumpCloudSAML = 'JumpCloudSAML';
     case KeycloakSAML = 'KeycloakSAML';

lib/Resource/CreateDataIntegration.php

@@ -23,12 +23,12 @@ public function __construct(
          */
         public ?array $scopes = null,
         /**
-         * How accounts authenticate with the provider. Defaults to `["oauth"]`. Use `["api_key"]` to declare an API key integration; `credentials` is then not required and keys are supplied per-tenant (optionally via `api_key` on this request).
-         * @var array<\WorkOS\Resource\CreateDataIntegrationAuthMethods>|null
+         * How accounts authenticate with the provider. Defaults to `["oauth"]`. Use `["api_key"]` to declare an API key integration; `credentials` is then not required and keys are supplied per-tenant (optionally via `api_key` on this request). Use `["client_credentials"]` to declare a client-credentials integration; `credentials` is likewise not required and client credentials are supplied per-tenant.
+         * @var array<\WorkOS\Resource\DataIntegrationAuthMethods>|null
          */
         public ?array $authMethods = null,
         /**
-         * Provider-specific config values (e.g. a Snowflake `account_identifier`), keyed by the config field. Only fields the built-in provider declares are accepted.
+         * Provider-specific config values (e.g. a Snowflake `account`), keyed by the config field. Only fields the built-in provider declares are accepted.
          * @var array<string, string>|null
          */
         public ?array $config = null,
@@ -48,7 +48,7 @@ public static function fromArray(array $data): self
             description: $data['description'] ?? null,
             enabled: $data['enabled'] ?? null,
             scopes: $data['scopes'] ?? null,
-            authMethods: isset($data['auth_methods']) ? array_map(fn ($item) => CreateDataIntegrationAuthMethods::from($item), $data['auth_methods']) : null,
+            authMethods: isset($data['auth_methods']) ? array_map(fn ($item) => DataIntegrationAuthMethods::from($item), $data['auth_methods']) : null,
             config: $data['config'] ?? null,
             credentials: isset($data['credentials']) ? DataIntegrationCredentialsInput::fromArray($data['credentials']) : null,
             apiKey: isset($data['api_key']) ? ApiKeyInstallation::fromArray($data['api_key']) : null,

lib/Resource/CreateUser.php

@@ -34,12 +34,14 @@ public function __construct(
         public ?string $userAgent = null,
         /** An optional Radar signals ID to correlate client-side signals with this request. */
         public ?string $signalsId = null,
-        /** The password to set for the user. Mutually exclusive with `password_hash` and `password_hash_type`. */
+        /** The password to set for the user. Mutually exclusive with `password_hash`, `password_hash_type`, and `password_salt_position`. */
         public ?string $password = null,
         /** The hashed password to set for the user. Required with `password_hash_type`. Mutually exclusive with `password`. */
         public ?string $passwordHash = null,
         /** The algorithm originally used to hash the password, used when providing a `password_hash`. Required with `password_hash`. Mutually exclusive with `password`. */
         public ?CreateUserPasswordHashType $passwordHashType = null,
+        /** The position of the salt relative to the password when the `password_hash` digest was computed: `prefix` for `hash(salt + password)` or `suffix` for `hash(password + salt)`. Only supported with the `ssha256` hash type and only valid when a `password_hash` is provided. Defaults to `suffix`. Mutually exclusive with `password`. */
+        public ?CreateUserPasswordSaltPosition $passwordSaltPosition = null,
     ) {
     }
 
@@ -59,6 +61,7 @@ public static function fromArray(array $data): self
             password: $data['password'] ?? null,
             passwordHash: $data['password_hash'] ?? null,
             passwordHashType: isset($data['password_hash_type']) ? CreateUserPasswordHashType::from($data['password_hash_type']) : null,
+            passwordSaltPosition: isset($data['password_salt_position']) ? CreateUserPasswordSaltPosition::from($data['password_salt_position']) : null,
         );
     }
 
@@ -78,6 +81,7 @@ public function toArray(): array
             'password' => $this->password,
             'password_hash' => $this->passwordHash,
             'password_hash_type' => $this->passwordHashType?->value,
+            'password_salt_position' => $this->passwordSaltPosition?->value,
         ];
     }
 }

lib/Resource/CreateUserPasswordSaltPosition.php

@@ -0,0 +1,13 @@
+<?php
+
+declare(strict_types=1);
+
+// This file is auto-generated by oagen. Do not edit.
+
+namespace WorkOS\Resource;
+
+enum CreateUserPasswordSaltPosition: string
+{
+    case Prefix = 'prefix';
+    case Suffix = 'suffix';
+}

lib/Resource/CreateWebhookEndpointEvents.php

@@ -13,6 +13,7 @@ enum CreateWebhookEndpointEvents: string
     case AgentRegistrationClaimCompleted = 'agent.registration.claim.completed';
     case AgentRegistrationCredentialIssued = 'agent.registration.credential.issued';
     case AgentRegistrationDeleted = 'agent.registration.deleted';
+    case AgentRegistrationRefreshed = 'agent.registration.refreshed';
     case AgentRegistrationExpired = 'agent.registration.expired';
     case AgentRegistrationOrganizationSwitched = 'agent.registration.organization.switched';
     case AgentRegistrationRevoked = 'agent.registration.revoked';

lib/Resource/CustomProviderDefinition.php

@@ -13,10 +13,10 @@
     public function __construct(
         /** A descriptive name for the custom provider. */
         public string $name,
-        /** The provider's OAuth authorization endpoint. */
-        public string $authorizationUrl,
-        /** The provider's OAuth token endpoint. */
-        public string $tokenUrl,
+        /** The provider's OAuth authorization endpoint. Required for OAuth providers; omit for `api_key` providers. */
+        public ?string $authorizationUrl = null,
+        /** The provider's OAuth token endpoint. Required for OAuth providers; omit for `api_key` providers. */
+        public ?string $tokenUrl = null,
         /** The endpoint used to refresh tokens, if different from the token endpoint. */
         public ?string $refreshTokenUrl = null,
         /** Whether PKCE is used during the authorization code flow. Defaults to `true`. */
@@ -43,8 +43,8 @@ public static function fromArray(array $data): self
     {
         return new self(
             name: $data['name'],
-            authorizationUrl: $data['authorization_url'],
-            tokenUrl: $data['token_url'],
+            authorizationUrl: $data['authorization_url'] ?? null,
+            tokenUrl: $data['token_url'] ?? null,
             refreshTokenUrl: $data['refresh_token_url'] ?? null,
             pkceEnabled: $data['pkce_enabled'] ?? null,
             requestScopeSeparator: $data['request_scope_separator'] ?? null,