diff --git a/.changelog-pending/2026-07-02T17-30-17-71b13e04b6092eeef8253b4bfbcda055ceb2f35a.md b/.changelog-pending/2026-07-02T17-30-17-71b13e04b6092eeef8253b4bfbcda055ceb2f35a.md
new file mode 100644
index 00000000..f42a2185
--- /dev/null
+++ b/.changelog-pending/2026-07-02T17-30-17-71b13e04b6092eeef8253b4bfbcda055ceb2f35a.md
@@ -0,0 +1,30 @@
+* [#414](https://github.com/workos/workos-php/pull/414) feat(generated): regenerate from spec (2 changes)
+
+  **Features**
+  * **[user_management](https://workos.com/docs/reference/authkit/user)**:
+    * Added model `SendRadarSmsChallenge`
+    * Added model `SendRadarSmsChallengeResponse`
+    * Added model `UrnWorkosOAuthGrantTypeRadarEmailChallengeCodeSessionAuthenticateRequest`
+    * Added model `UrnWorkosOAuthGrantTypeRadarSmsChallengeCodeSessionAuthenticateRequest`
+    * Added model `MagicAuthSendMagicAuthCodeAndReturnResponse`
+    * Added model `UserCreateResponse`
+    * Added `ip_address` to `CreateMagicCodeAndReturn`
+    * Added `user_agent` to `CreateMagicCodeAndReturn`
+    * Added `radar_auth_attempt_id` to `CreateMagicCodeAndReturn`
+    * Added `signals_id` to `CreateMagicCodeAndReturn`
+    * Added `ip_address` to `CreateUser`
+    * Added `user_agent` to `CreateUser`
+    * Added `signals_id` to `CreateUser`
+    * Added `signals_id` to `AuthorizationCodeSessionAuthenticateRequest`
+    * Added `signals_id` to `PasswordSessionAuthenticateRequest`
+    * Added `radar_auth_attempt_id` to `PasswordSessionAuthenticateRequest`
+    * Added `radar_auth_attempt_id` to `UrnWorkosOAuthGrantTypeMagicAuthCodeSessionAuthenticateRequest`
+    * Added endpoint `POST /user_management/radar_challenges`
+  * **[radar](https://workos.com/docs/reference/radar)**:
+    * Added `signals_id` to `RadarStandaloneAssessRequest`
+
+  **Fixes**
+  * **[user_management](https://workos.com/docs/reference/authkit/user)**:
+    * Changed request body for `UserManagementAuthentication.authenticate`
+    * Changed response of `UserManagementUsers.create` from `User` to `UserCreateResponse`
+    * Changed response of `UserManagementMagicAuth.sendMagicAuthCodeAndReturn` from `MagicAuth` to `MagicAuthSendMagicAuthCodeAndReturnResponse`
diff --git a/.oagen-manifest.json b/.oagen-manifest.json
index 45889b3e..407f6a69 100644
--- a/.oagen-manifest.json
+++ b/.oagen-manifest.json
@@ -1,7 +1,7 @@
 {
   "version": 2,
   "language": "php",
-  "generatedAt": "2026-07-02T14:58:50.844Z",
+  "generatedAt": "2026-07-02T17:29:52.899Z",
   "files": [
     "lib/Resource/ActionAuthenticationDenied.php",
     "lib/Resource/ActionAuthenticationDeniedData.php",
@@ -342,6 +342,7 @@
     "lib/Resource/MagicAuthCodeSessionAuthenticateRequest.php",
     "lib/Resource/MagicAuthCreated.php",
     "lib/Resource/MagicAuthCreatedData.php",
+    "lib/Resource/MagicAuthSendMagicAuthCodeAndReturnResponse.php",
     "lib/Resource/NewConnectApplicationSecret.php",
     "lib/Resource/ObjectMetadata.php",
     "lib/Resource/ObjectSummary.php",
@@ -416,9 +417,11 @@
     "lib/Resource/PipesConnectedAccountReauthorizationNeeded.php",
     "lib/Resource/PortalLinkResponse.php",
     "lib/Resource/Profile.php",
+    "lib/Resource/RadarEmailChallengeCodeSessionAuthenticateRequest.php",
     "lib/Resource/RadarListAction.php",
     "lib/Resource/RadarListEntryAlreadyPresentResponse.php",
     "lib/Resource/RadarListType.php",
+    "lib/Resource/RadarSmsChallengeCodeSessionAuthenticateRequest.php",
     "lib/Resource/RadarStandaloneAssessRequest.php",
     "lib/Resource/RadarStandaloneAssessRequestAction.php",
     "lib/Resource/RadarStandaloneAssessRequestAuthMethod.php",
@@ -456,6 +459,8 @@
     "lib/Resource/SSOTokenResponse.php",
     "lib/Resource/SSOTokenResponseOAuthToken.php",
     "lib/Resource/SendEmailChange.php",
+    "lib/Resource/SendRadarSmsChallenge.php",
+    "lib/Resource/SendRadarSmsChallengeResponse.php",
     "lib/Resource/SendVerificationEmailResponse.php",
     "lib/Resource/SessionCreated.php",
     "lib/Resource/SessionCreatedData.php",
@@ -492,6 +497,7 @@
     "lib/Resource/UserAuthenticationFactorEnrollResponse.php",
     "lib/Resource/UserConsentOption.php",
     "lib/Resource/UserConsentOptionChoice.php",
+    "lib/Resource/UserCreateResponse.php",
     "lib/Resource/UserCreated.php",
     "lib/Resource/UserDeleted.php",
     "lib/Resource/UserIdentitiesGetItem.php",
@@ -914,6 +920,7 @@
     "tests/Fixtures/magic_auth_code_session_authenticate_request.json",
     "tests/Fixtures/magic_auth_created.json",
     "tests/Fixtures/magic_auth_created_data.json",
+    "tests/Fixtures/magic_auth_send_magic_auth_code_and_return_response.json",
     "tests/Fixtures/mfa_totp_session_authenticate_request.json",
     "tests/Fixtures/new_connect_application_secret.json",
     "tests/Fixtures/object_metadata.json",
@@ -984,7 +991,9 @@
     "tests/Fixtures/pipes_connected_account_reauthorization_needed.json",
     "tests/Fixtures/portal_link_response.json",
     "tests/Fixtures/profile.json",
+    "tests/Fixtures/radar_email_challenge_code_session_authenticate_request.json",
     "tests/Fixtures/radar_list_entry_already_present_response.json",
+    "tests/Fixtures/radar_sms_challenge_code_session_authenticate_request.json",
     "tests/Fixtures/radar_standalone_assess_request.json",
     "tests/Fixtures/radar_standalone_delete_radar_list_entry_request.json",
     "tests/Fixtures/radar_standalone_response.json",
@@ -1009,6 +1018,8 @@
     "tests/Fixtures/role_updated.json",
     "tests/Fixtures/role_updated_data.json",
     "tests/Fixtures/send_email_change.json",
+    "tests/Fixtures/send_radar_sms_challenge.json",
+    "tests/Fixtures/send_radar_sms_challenge_response.json",
     "tests/Fixtures/send_verification_email_response.json",
     "tests/Fixtures/session_created.json",
     "tests/Fixtures/session_created_data.json",
@@ -1055,6 +1066,7 @@
     "tests/Fixtures/user_authentication_factor_enroll_response.json",
     "tests/Fixtures/user_consent_option.json",
     "tests/Fixtures/user_consent_option_choice.json",
+    "tests/Fixtures/user_create_response.json",
     "tests/Fixtures/user_created.json",
     "tests/Fixtures/user_deleted.json",
     "tests/Fixtures/user_identities_get_item.json",
diff --git a/lib/Resource/AuthorizationCodeSessionAuthenticateRequest.php b/lib/Resource/AuthorizationCodeSessionAuthenticateRequest.php
index b91b29be..aaa01ac8 100644
--- a/lib/Resource/AuthorizationCodeSessionAuthenticateRequest.php
+++ b/lib/Resource/AuthorizationCodeSessionAuthenticateRequest.php
@@ -28,6 +28,8 @@ public function __construct(
         public ?string $deviceId = null,
         /** The user agent string from the user's browser. */
         public ?string $userAgent = null,
+        /** An optional Radar signals ID to correlate client-side signals with this authentication attempt. */
+        public ?string $signalsId = null,
     ) {
     }
 
@@ -43,6 +45,7 @@ public static function fromArray(array $data): self
             ipAddress: $data['ip_address'] ?? null,
             deviceId: $data['device_id'] ?? null,
             userAgent: $data['user_agent'] ?? null,
+            signalsId: $data['signals_id'] ?? null,
         );
     }
 
@@ -58,6 +61,7 @@ public function toArray(): array
             'ip_address' => $this->ipAddress,
             'device_id' => $this->deviceId,
             'user_agent' => $this->userAgent,
+            'signals_id' => $this->signalsId,
         ];
     }
 }
diff --git a/lib/Resource/CreateMagicCodeAndReturn.php b/lib/Resource/CreateMagicCodeAndReturn.php
index 8272306b..81d5fad5 100644
--- a/lib/Resource/CreateMagicCodeAndReturn.php
+++ b/lib/Resource/CreateMagicCodeAndReturn.php
@@ -15,6 +15,14 @@ public function __construct(
         public string $email,
         /** The invitation token to associate with this magic code. */
         public ?string $invitationToken = null,
+        /** The IP address of the user's request. */
+        public ?string $ipAddress = null,
+        /** The user agent string from the user's request. */
+        public ?string $userAgent = null,
+        /** The ID of an existing Radar authentication attempt to associate with this request. */
+        public ?string $radarAuthAttemptId = null,
+        /** An optional Radar signals ID to correlate client-side signals with this request. */
+        public ?string $signalsId = null,
     ) {
     }
 
@@ -23,6 +31,10 @@ public static function fromArray(array $data): self
         return new self(
             email: $data['email'],
             invitationToken: $data['invitation_token'] ?? null,
+            ipAddress: $data['ip_address'] ?? null,
+            userAgent: $data['user_agent'] ?? null,
+            radarAuthAttemptId: $data['radar_auth_attempt_id'] ?? null,
+            signalsId: $data['signals_id'] ?? null,
         );
     }
 
@@ -31,6 +43,10 @@ public function toArray(): array
         return [
             'email' => $this->email,
             'invitation_token' => $this->invitationToken,
+            'ip_address' => $this->ipAddress,
+            'user_agent' => $this->userAgent,
+            'radar_auth_attempt_id' => $this->radarAuthAttemptId,
+            'signals_id' => $this->signalsId,
         ];
     }
 }
diff --git a/lib/Resource/CreateUser.php b/lib/Resource/CreateUser.php
index 17910f46..7057f093 100644
--- a/lib/Resource/CreateUser.php
+++ b/lib/Resource/CreateUser.php
@@ -28,6 +28,12 @@ public function __construct(
         public ?array $metadata = null,
         /** The external ID of the user. */
         public ?string $externalId = null,
+        /** The IP address of the user's request. */
+        public ?string $ipAddress = null,
+        /** The user agent string from the user's request. */
+        public ?string $userAgent = null,
+        /** An optional Radar signals ID to correlate client-side signals with this request. */
+        public ?string $signalsId = null,
         /** The password to set for the user. Mutually exclusive with `password_hash` and `password_hash_type`. */
         public ?string $password = null,
         /** The hashed password to set for the user. Required with `password_hash_type`. Mutually exclusive with `password`. */
@@ -47,6 +53,9 @@ public static function fromArray(array $data): self
             emailVerified: $data['email_verified'] ?? null,
             metadata: $data['metadata'] ?? null,
             externalId: $data['external_id'] ?? null,
+            ipAddress: $data['ip_address'] ?? null,
+            userAgent: $data['user_agent'] ?? null,
+            signalsId: $data['signals_id'] ?? null,
             password: $data['password'] ?? null,
             passwordHash: $data['password_hash'] ?? null,
             passwordHashType: isset($data['password_hash_type']) ? CreateUserPasswordHashType::from($data['password_hash_type']) : null,
@@ -63,6 +72,9 @@ public function toArray(): array
             'email_verified' => $this->emailVerified,
             'metadata' => $this->metadata,
             'external_id' => $this->externalId,
+            'ip_address' => $this->ipAddress,
+            'user_agent' => $this->userAgent,
+            'signals_id' => $this->signalsId,
             'password' => $this->password,
             'password_hash' => $this->passwordHash,
             'password_hash_type' => $this->passwordHashType?->value,
diff --git a/lib/Resource/MagicAuthCodeSessionAuthenticateRequest.php b/lib/Resource/MagicAuthCodeSessionAuthenticateRequest.php
index b40a9333..5fb5c1c9 100644
--- a/lib/Resource/MagicAuthCodeSessionAuthenticateRequest.php
+++ b/lib/Resource/MagicAuthCodeSessionAuthenticateRequest.php
@@ -28,6 +28,8 @@ public function __construct(
         public ?string $deviceId = null,
         /** The user agent string from the user's browser. */
         public ?string $userAgent = null,
+        /** The ID of an existing Radar authentication attempt to associate with this authentication. */
+        public ?string $radarAuthAttemptId = null,
     ) {
     }
 
@@ -43,6 +45,7 @@ public static function fromArray(array $data): self
             ipAddress: $data['ip_address'] ?? null,
             deviceId: $data['device_id'] ?? null,
             userAgent: $data['user_agent'] ?? null,
+            radarAuthAttemptId: $data['radar_auth_attempt_id'] ?? null,
         );
     }
 
@@ -58,6 +61,7 @@ public function toArray(): array
             'ip_address' => $this->ipAddress,
             'device_id' => $this->deviceId,
             'user_agent' => $this->userAgent,
+            'radar_auth_attempt_id' => $this->radarAuthAttemptId,
         ];
     }
 }
diff --git a/lib/Resource/MagicAuthSendMagicAuthCodeAndReturnResponse.php b/lib/Resource/MagicAuthSendMagicAuthCodeAndReturnResponse.php
new file mode 100644
index 00000000..6641379f
--- /dev/null
+++ b/lib/Resource/MagicAuthSendMagicAuthCodeAndReturnResponse.php
@@ -0,0 +1,32 @@
+<?php
+
+declare(strict_types=1);
+
+// This file is auto-generated by oagen. Do not edit.
+
+namespace WorkOS\Resource;
+
+readonly class MagicAuthSendMagicAuthCodeAndReturnResponse implements \JsonSerializable
+{
+    use JsonSerializableTrait;
+
+    public function __construct(
+        /** The ID of the Radar authentication attempt created for this request when Radar is enabled. Pass this value to the authenticate endpoint to associate the subsequent authentication with this Radar attempt. */
+        public ?string $radarAuthAttemptId = null,
+    ) {
+    }
+
+    public static function fromArray(array $data): self
+    {
+        return new self(
+            radarAuthAttemptId: $data['radar_auth_attempt_id'] ?? null,
+        );
+    }
+
+    public function toArray(): array
+    {
+        return [
+            'radar_auth_attempt_id' => $this->radarAuthAttemptId,
+        ];
+    }
+}
diff --git a/lib/Resource/PasswordSessionAuthenticateRequest.php b/lib/Resource/PasswordSessionAuthenticateRequest.php
index 8c48fcba..e30d4635 100644
--- a/lib/Resource/PasswordSessionAuthenticateRequest.php
+++ b/lib/Resource/PasswordSessionAuthenticateRequest.php
@@ -28,6 +28,10 @@ public function __construct(
         public ?string $deviceId = null,
         /** The user agent string from the user's browser. */
         public ?string $userAgent = null,
+        /** An optional Radar signals ID to correlate client-side signals with this authentication attempt. */
+        public ?string $signalsId = null,
+        /** The ID of an existing Radar authentication attempt to associate with this authentication. */
+        public ?string $radarAuthAttemptId = null,
     ) {
     }
 
@@ -43,6 +47,8 @@ public static function fromArray(array $data): self
             ipAddress: $data['ip_address'] ?? null,
             deviceId: $data['device_id'] ?? null,
             userAgent: $data['user_agent'] ?? null,
+            signalsId: $data['signals_id'] ?? null,
+            radarAuthAttemptId: $data['radar_auth_attempt_id'] ?? null,
         );
     }
 
@@ -58,6 +64,8 @@ public function toArray(): array
             'ip_address' => $this->ipAddress,
             'device_id' => $this->deviceId,
             'user_agent' => $this->userAgent,
+            'signals_id' => $this->signalsId,
+            'radar_auth_attempt_id' => $this->radarAuthAttemptId,
         ];
     }
 }
diff --git a/lib/Resource/RadarEmailChallengeCodeSessionAuthenticateRequest.php b/lib/Resource/RadarEmailChallengeCodeSessionAuthenticateRequest.php
new file mode 100644
index 00000000..420d8e10
--- /dev/null
+++ b/lib/Resource/RadarEmailChallengeCodeSessionAuthenticateRequest.php
@@ -0,0 +1,63 @@
+<?php
+
+declare(strict_types=1);
+
+// This file is auto-generated by oagen. Do not edit.
+
+namespace WorkOS\Resource;
+
+readonly class RadarEmailChallengeCodeSessionAuthenticateRequest implements \JsonSerializable
+{
+    use JsonSerializableTrait;
+
+    public function __construct(
+        /** The client ID of the application. */
+        public string $clientId,
+        /** The client secret of the application. */
+        public string $clientSecret,
+        public string $grantType,
+        /** The one-time code from the Radar email challenge. */
+        public string $code,
+        /** The ID of the Radar email challenge being verified. */
+        public string $radarChallengeId,
+        /** The pending authentication token from a previous authentication attempt. */
+        public string $pendingAuthenticationToken,
+        /** The IP address of the user's request. */
+        public ?string $ipAddress = null,
+        /** A unique identifier for the device. */
+        public ?string $deviceId = null,
+        /** The user agent string from the user's browser. */
+        public ?string $userAgent = null,
+    ) {
+    }
+
+    public static function fromArray(array $data): self
+    {
+        return new self(
+            clientId: $data['client_id'],
+            clientSecret: $data['client_secret'],
+            grantType: $data['grant_type'] ?? 'urn:workos:oauth:grant-type:radar-email-challenge:code',
+            code: $data['code'],
+            radarChallengeId: $data['radar_challenge_id'],
+            pendingAuthenticationToken: $data['pending_authentication_token'],
+            ipAddress: $data['ip_address'] ?? null,
+            deviceId: $data['device_id'] ?? null,
+            userAgent: $data['user_agent'] ?? null,
+        );
+    }
+
+    public function toArray(): array
+    {
+        return [
+            'client_id' => $this->clientId,
+            'client_secret' => $this->clientSecret,
+            'grant_type' => $this->grantType,
+            'code' => $this->code,
+            'radar_challenge_id' => $this->radarChallengeId,
+            'pending_authentication_token' => $this->pendingAuthenticationToken,
+            'ip_address' => $this->ipAddress,
+            'device_id' => $this->deviceId,
+            'user_agent' => $this->userAgent,
+        ];
+    }
+}
diff --git a/lib/Resource/RadarSmsChallengeCodeSessionAuthenticateRequest.php b/lib/Resource/RadarSmsChallengeCodeSessionAuthenticateRequest.php
new file mode 100644
index 00000000..fe1d52b1
--- /dev/null
+++ b/lib/Resource/RadarSmsChallengeCodeSessionAuthenticateRequest.php
@@ -0,0 +1,67 @@
+<?php
+
+declare(strict_types=1);
+
+// This file is auto-generated by oagen. Do not edit.
+
+namespace WorkOS\Resource;
+
+readonly class RadarSmsChallengeCodeSessionAuthenticateRequest implements \JsonSerializable
+{
+    use JsonSerializableTrait;
+
+    public function __construct(
+        /** The client ID of the application. */
+        public string $clientId,
+        /** The client secret of the application. */
+        public string $clientSecret,
+        public string $grantType,
+        /** The one-time code from the Radar SMS challenge. */
+        public string $code,
+        /** The ID of the Radar SMS verification being confirmed. */
+        public string $verificationId,
+        /** The phone number the Radar SMS challenge was sent to. */
+        public string $phoneNumber,
+        /** The pending authentication token from a previous authentication attempt. */
+        public string $pendingAuthenticationToken,
+        /** The IP address of the user's request. */
+        public ?string $ipAddress = null,
+        /** A unique identifier for the device. */
+        public ?string $deviceId = null,
+        /** The user agent string from the user's browser. */
+        public ?string $userAgent = null,
+    ) {
+    }
+
+    public static function fromArray(array $data): self
+    {
+        return new self(
+            clientId: $data['client_id'],
+            clientSecret: $data['client_secret'],
+            grantType: $data['grant_type'] ?? 'urn:workos:oauth:grant-type:radar-sms-challenge:code',
+            code: $data['code'],
+            verificationId: $data['verification_id'],
+            phoneNumber: $data['phone_number'],
+            pendingAuthenticationToken: $data['pending_authentication_token'],
+            ipAddress: $data['ip_address'] ?? null,
+            deviceId: $data['device_id'] ?? null,
+            userAgent: $data['user_agent'] ?? null,
+        );
+    }
+
+    public function toArray(): array
+    {
+        return [
+            'client_id' => $this->clientId,
+            'client_secret' => $this->clientSecret,
+            'grant_type' => $this->grantType,
+            'code' => $this->code,
+            'verification_id' => $this->verificationId,
+            'phone_number' => $this->phoneNumber,
+            'pending_authentication_token' => $this->pendingAuthenticationToken,
+            'ip_address' => $this->ipAddress,
+            'device_id' => $this->deviceId,
+            'user_agent' => $this->userAgent,
+        ];
+    }
+}
diff --git a/lib/Resource/RadarStandaloneAssessRequest.php b/lib/Resource/RadarStandaloneAssessRequest.php
index fc554d05..1a38a987 100644
--- a/lib/Resource/RadarStandaloneAssessRequest.php
+++ b/lib/Resource/RadarStandaloneAssessRequest.php
@@ -21,6 +21,8 @@ public function __construct(
         public RadarStandaloneAssessRequestAuthMethod $authMethod,
         /** The action being performed. */
         public RadarStandaloneAssessRequestAction $action,
+        /** An optional Radar signals ID for the request. */
+        public ?string $signalsId = null,
     ) {
     }
 
@@ -32,6 +34,7 @@ public static function fromArray(array $data): self
             email: $data['email'],
             authMethod: RadarStandaloneAssessRequestAuthMethod::from($data['auth_method']),
             action: RadarStandaloneAssessRequestAction::from($data['action']),
+            signalsId: $data['signals_id'] ?? null,
         );
     }
 
@@ -43,6 +46,7 @@ public function toArray(): array
             'email' => $this->email,
             'auth_method' => $this->authMethod->value,
             'action' => $this->action->value,
+            'signals_id' => $this->signalsId,
         ];
     }
 }
diff --git a/lib/Resource/SendRadarSmsChallenge.php b/lib/Resource/SendRadarSmsChallenge.php
new file mode 100644
index 00000000..9ece000f
--- /dev/null
+++ b/lib/Resource/SendRadarSmsChallenge.php
@@ -0,0 +1,48 @@
+<?php
+
+declare(strict_types=1);
+
+// This file is auto-generated by oagen. Do not edit.
+
+namespace WorkOS\Resource;
+
+readonly class SendRadarSmsChallenge implements \JsonSerializable
+{
+    use JsonSerializableTrait;
+
+    public function __construct(
+        /** The ID of the user to send the SMS challenge to. */
+        public string $userId,
+        /** The pending authentication token from a previous authentication attempt that triggered the Radar challenge. */
+        public string $pendingAuthenticationToken,
+        /** The phone number to send the SMS verification code to. */
+        public string $phoneNumber,
+        /** The IP address of the user's request. */
+        public ?string $ipAddress = null,
+        /** The user agent string from the user's request. */
+        public ?string $userAgent = null,
+    ) {
+    }
+
+    public static function fromArray(array $data): self
+    {
+        return new self(
+            userId: $data['user_id'],
+            pendingAuthenticationToken: $data['pending_authentication_token'],
+            phoneNumber: $data['phone_number'],
+            ipAddress: $data['ip_address'] ?? null,
+            userAgent: $data['user_agent'] ?? null,
+        );
+    }
+
+    public function toArray(): array
+    {
+        return [
+            'user_id' => $this->userId,
+            'pending_authentication_token' => $this->pendingAuthenticationToken,
+            'phone_number' => $this->phoneNumber,
+            'ip_address' => $this->ipAddress,
+            'user_agent' => $this->userAgent,
+        ];
+    }
+}
diff --git a/lib/Resource/SendRadarSmsChallengeResponse.php b/lib/Resource/SendRadarSmsChallengeResponse.php
new file mode 100644
index 00000000..8ebc2a92
--- /dev/null
+++ b/lib/Resource/SendRadarSmsChallengeResponse.php
@@ -0,0 +1,36 @@
+<?php
+
+declare(strict_types=1);
+
+// This file is auto-generated by oagen. Do not edit.
+
+namespace WorkOS\Resource;
+
+readonly class SendRadarSmsChallengeResponse implements \JsonSerializable
+{
+    use JsonSerializableTrait;
+
+    public function __construct(
+        /** The ID of the SMS verification. Pass this to the authenticate endpoint to verify the code. */
+        public string $verificationId,
+        /** The phone number the verification code was sent to. */
+        public string $phoneNumber,
+    ) {
+    }
+
+    public static function fromArray(array $data): self
+    {
+        return new self(
+            verificationId: $data['verification_id'],
+            phoneNumber: $data['phone_number'],
+        );
+    }
+
+    public function toArray(): array
+    {
+        return [
+            'verification_id' => $this->verificationId,
+            'phone_number' => $this->phoneNumber,
+        ];
+    }
+}
diff --git a/lib/Resource/UserCreateResponse.php b/lib/Resource/UserCreateResponse.php
new file mode 100644
index 00000000..bf1a0e1c
--- /dev/null
+++ b/lib/Resource/UserCreateResponse.php
@@ -0,0 +1,32 @@
+<?php
+
+declare(strict_types=1);
+
+// This file is auto-generated by oagen. Do not edit.
+
+namespace WorkOS\Resource;
+
+readonly class UserCreateResponse implements \JsonSerializable
+{
+    use JsonSerializableTrait;
+
+    public function __construct(
+        /** The ID of the Radar authentication attempt created for this request when Radar is enabled. Pass this value to the authenticate endpoint to associate the subsequent authentication with this Radar attempt. */
+        public ?string $radarAuthAttemptId = null,
+    ) {
+    }
+
+    public static function fromArray(array $data): self
+    {
+        return new self(
+            radarAuthAttemptId: $data['radar_auth_attempt_id'] ?? null,
+        );
+    }
+
+    public function toArray(): array
+    {
+        return [
+            'radar_auth_attempt_id' => $this->radarAuthAttemptId,
+        ];
+    }
+}
diff --git a/lib/Service/Radar.php b/lib/Service/Radar.php
index c40eb2ea..58c8c166 100644
--- a/lib/Service/Radar.php
+++ b/lib/Service/Radar.php
@@ -25,6 +25,7 @@ public function __construct(
      * @param string $email The email address of the user making the request.
      * @param \WorkOS\Resource\RadarStandaloneAssessRequestAuthMethod $authMethod The authentication method being used.
      * @param \WorkOS\Resource\RadarStandaloneAssessRequestAction $action The action being performed.
+     * @param string|null $signalsId An optional Radar signals ID for the request.
      * @return \WorkOS\Resource\RadarStandaloneResponse
      * @throws \WorkOS\Exception\WorkOSException
      */
@@ -34,15 +35,17 @@ public function createAttempt(
         string $email,
         \WorkOS\Resource\RadarStandaloneAssessRequestAuthMethod $authMethod,
         \WorkOS\Resource\RadarStandaloneAssessRequestAction $action,
+        ?string $signalsId = null,
         ?\WorkOS\RequestOptions $options = null,
     ): \WorkOS\Resource\RadarStandaloneResponse {
-        $body = [
+        $body = array_filter([
             'ip_address' => $ipAddress,
             'user_agent' => $userAgent,
             'email' => $email,
             'auth_method' => $authMethod->value,
             'action' => $action->value,
-        ];
+            'signals_id' => $signalsId,
+        ], fn ($v) => $v !== null);
         $response = $this->client->request(
             method: 'POST',
             path: 'radar/attempts',
diff --git a/lib/Service/UserManagement.php b/lib/Service/UserManagement.php
index 17e75fdf..a7a6739b 100644
--- a/lib/Service/UserManagement.php
+++ b/lib/Service/UserManagement.php
@@ -17,13 +17,16 @@
 use WorkOS\Resource\JwksResponse;
 use WorkOS\Resource\JWTTemplateResponse;
 use WorkOS\Resource\MagicAuth;
+use WorkOS\Resource\MagicAuthSendMagicAuthCodeAndReturnResponse;
 use WorkOS\Resource\PasswordReset;
 use WorkOS\Resource\RedirectUri;
 use WorkOS\Resource\ResetPasswordResponse;
+use WorkOS\Resource\SendRadarSmsChallengeResponse;
 use WorkOS\Resource\SendVerificationEmailResponse;
 use WorkOS\Resource\User;
 use WorkOS\Resource\UserApiKey;
 use WorkOS\Resource\UserApiKeyWithValue;
+use WorkOS\Resource\UserCreateResponse;
 use WorkOS\Resource\UserIdentitiesGetItem;
 use WorkOS\Resource\UserInvite;
 use WorkOS\Resource\UserSessionsListItem;
@@ -446,6 +449,42 @@ public function createDevice(
         return DeviceAuthorizationResponse::fromArray($response);
     }
 
+    /**
+     * Send a Radar SMS challenge
+     *
+     * Sends a one-time verification code over SMS to a user as part of a Radar challenge. Use the returned `verification_id` to authenticate the user with the `urn:workos:oauth:grant-type:radar-sms-challenge:code` grant type.
+     * @param string $userId The ID of the user to send the SMS challenge to.
+     * @param string $pendingAuthenticationToken The pending authentication token from a previous authentication attempt that triggered the Radar challenge.
+     * @param string $phoneNumber The phone number to send the SMS verification code to.
+     * @param string|null $ipAddress The IP address of the user's request.
+     * @param string|null $userAgent The user agent string from the user's request.
+     * @return \WorkOS\Resource\SendRadarSmsChallengeResponse
+     * @throws \WorkOS\Exception\WorkOSException
+     */
+    public function createRadarChallenge(
+        string $userId,
+        string $pendingAuthenticationToken,
+        string $phoneNumber,
+        ?string $ipAddress = null,
+        ?string $userAgent = null,
+        ?\WorkOS\RequestOptions $options = null,
+    ): \WorkOS\Resource\SendRadarSmsChallengeResponse {
+        $body = array_filter([
+            'user_id' => $userId,
+            'pending_authentication_token' => $pendingAuthenticationToken,
+            'phone_number' => $phoneNumber,
+            'ip_address' => $ipAddress,
+            'user_agent' => $userAgent,
+        ], fn ($v) => $v !== null);
+        $response = $this->client->request(
+            method: 'POST',
+            path: 'user_management/radar_challenges',
+            body: $body,
+            options: $options,
+        );
+        return SendRadarSmsChallengeResponse::fromArray($response);
+    }
+
     /**
      * Logout
      *
@@ -691,8 +730,11 @@ public function listUsers(
      * @param bool|null $emailVerified Whether the user's email has been verified.
      * @param array<string, string>|null $metadata Object containing metadata key/value pairs associated with the user.
      * @param string|null $externalId The external ID of the user.
+     * @param string|null $ipAddress The IP address of the user's request.
+     * @param string|null $userAgent The user agent string from the user's request.
+     * @param string|null $signalsId An optional Radar signals ID to correlate client-side signals with this request.
      * @param null|PasswordPlaintext|PasswordHashed $password
-     * @return \WorkOS\Resource\User
+     * @return \WorkOS\Resource\UserCreateResponse
      * @throws \WorkOS\Exception\WorkOSException
      */
     public function createUser(
@@ -703,9 +745,12 @@ public function createUser(
         ?bool $emailVerified = null,
         ?array $metadata = null,
         ?string $externalId = null,
+        ?string $ipAddress = null,
+        ?string $userAgent = null,
+        ?string $signalsId = null,
         null|PasswordPlaintext|PasswordHashed $password = null,
         ?\WorkOS\RequestOptions $options = null,
-    ): \WorkOS\Resource\User {
+    ): \WorkOS\Resource\UserCreateResponse {
         $body = array_filter([
             'email' => $email,
             'first_name' => $firstName,
@@ -714,6 +759,9 @@ public function createUser(
             'email_verified' => $emailVerified,
             'metadata' => $metadata,
             'external_id' => $externalId,
+            'ip_address' => $ipAddress,
+            'user_agent' => $userAgent,
+            'signals_id' => $signalsId,
         ], fn ($v) => $v !== null);
         if ($password instanceof PasswordPlaintext) {
             $body['password'] = $password->password;
@@ -727,7 +775,7 @@ public function createUser(
             body: $body,
             options: $options,
         );
-        return User::fromArray($response);
+        return UserCreateResponse::fromArray($response);
     }
 
     /**
@@ -1229,17 +1277,29 @@ public function updateJWTTemplate(
      * Creates a one-time authentication code that can be sent to the user's email address. The code expires in 10 minutes. To verify the code, [authenticate the user with Magic Auth](https://workos.com/docs/reference/authkit/authentication/magic-auth).
      * @param string $email The email address to send the magic code to.
      * @param string|null $invitationToken The invitation token to associate with this magic code.
-     * @return \WorkOS\Resource\MagicAuth
+     * @param string|null $ipAddress The IP address of the user's request.
+     * @param string|null $userAgent The user agent string from the user's request.
+     * @param string|null $radarAuthAttemptId The ID of an existing Radar authentication attempt to associate with this request.
+     * @param string|null $signalsId An optional Radar signals ID to correlate client-side signals with this request.
+     * @return \WorkOS\Resource\MagicAuthSendMagicAuthCodeAndReturnResponse
      * @throws \WorkOS\Exception\WorkOSException
      */
     public function createMagicAuth(
         string $email,
         ?string $invitationToken = null,
+        ?string $ipAddress = null,
+        ?string $userAgent = null,
+        ?string $radarAuthAttemptId = null,
+        ?string $signalsId = null,
         ?\WorkOS\RequestOptions $options = null,
-    ): \WorkOS\Resource\MagicAuth {
+    ): \WorkOS\Resource\MagicAuthSendMagicAuthCodeAndReturnResponse {
         $body = array_filter([
             'email' => $email,
             'invitation_token' => $invitationToken,
+            'ip_address' => $ipAddress,
+            'user_agent' => $userAgent,
+            'radar_auth_attempt_id' => $radarAuthAttemptId,
+            'signals_id' => $signalsId,
         ], fn ($v) => $v !== null);
         $response = $this->client->request(
             method: 'POST',
@@ -1247,7 +1307,7 @@ public function createMagicAuth(
             body: $body,
             options: $options,
         );
-        return MagicAuth::fromArray($response);
+        return MagicAuthSendMagicAuthCodeAndReturnResponse::fromArray($response);
     }
 
     /**
diff --git a/tests/Fixtures/authorization_code_session_authenticate_request.json b/tests/Fixtures/authorization_code_session_authenticate_request.json
index 0ecd28d0..14a469f7 100644
--- a/tests/Fixtures/authorization_code_session_authenticate_request.json
+++ b/tests/Fixtures/authorization_code_session_authenticate_request.json
@@ -7,5 +7,6 @@
   "device_id": "device_01HXYZ123456789ABCDEFGHIJ",
   "user_agent": "Mozilla/5.0",
   "code_verifier": "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk",
-  "invitation_token": "inv_tok_01HXYZ123456789ABCDEFGHIJ"
+  "invitation_token": "inv_tok_01HXYZ123456789ABCDEFGHIJ",
+  "signals_id": "01JBS0GN92GC2RJQS4X9DBPQ2A"
 }
diff --git a/tests/Fixtures/create_magic_code_and_return.json b/tests/Fixtures/create_magic_code_and_return.json
index 10708580..487b3fad 100644
--- a/tests/Fixtures/create_magic_code_and_return.json
+++ b/tests/Fixtures/create_magic_code_and_return.json
@@ -1,4 +1,8 @@
 {
   "email": "marcelina.davis@example.com",
-  "invitation_token": "Z1Y2X3W4V5U6T7S8R9Q0P1O2N3"
+  "invitation_token": "Z1Y2X3W4V5U6T7S8R9Q0P1O2N3",
+  "ip_address": "203.0.113.42",
+  "user_agent": "Mozilla/5.0",
+  "radar_auth_attempt_id": "radar_auth_attempt_01HXYZ123456789ABCDEFGHIJ",
+  "signals_id": "01JBS0GN92GC2RJQS4X9DBPQ2A"
 }
diff --git a/tests/Fixtures/create_user.json b/tests/Fixtures/create_user.json
index 9be7ecc7..0e134548 100644
--- a/tests/Fixtures/create_user.json
+++ b/tests/Fixtures/create_user.json
@@ -10,5 +10,8 @@
     "timezone": "America/New_York"
   },
   "external_id": "f1ffa2b2-c20b-4d39-be5c-212726e11222",
-  "name": "Marcelina Davis"
+  "name": "Marcelina Davis",
+  "ip_address": "203.0.113.42",
+  "user_agent": "Mozilla/5.0",
+  "signals_id": "01JBS0GN92GC2RJQS4X9DBPQ2A"
 }
diff --git a/tests/Fixtures/magic_auth_code_session_authenticate_request.json b/tests/Fixtures/magic_auth_code_session_authenticate_request.json
index ebd5511b..484b83a4 100644
--- a/tests/Fixtures/magic_auth_code_session_authenticate_request.json
+++ b/tests/Fixtures/magic_auth_code_session_authenticate_request.json
@@ -7,5 +7,6 @@
   "invitation_token": "inv_tok_01HXYZ123456789ABCDEFGHIJ",
   "ip_address": "203.0.113.42",
   "device_id": "device_01HXYZ123456789ABCDEFGHIJ",
-  "user_agent": "Mozilla/5.0"
+  "user_agent": "Mozilla/5.0",
+  "radar_auth_attempt_id": "radar_auth_attempt_01HXYZ123456789ABCDEFGHIJ"
 }
diff --git a/tests/Fixtures/magic_auth_send_magic_auth_code_and_return_response.json b/tests/Fixtures/magic_auth_send_magic_auth_code_and_return_response.json
new file mode 100644
index 00000000..762e42d0
--- /dev/null
+++ b/tests/Fixtures/magic_auth_send_magic_auth_code_and_return_response.json
@@ -0,0 +1,3 @@
+{
+  "radar_auth_attempt_id": "radar_auth_attempt_01HXYZ123456789ABCDEFGHIJ"
+}
diff --git a/tests/Fixtures/password_session_authenticate_request.json b/tests/Fixtures/password_session_authenticate_request.json
index ea240764..ae578a45 100644
--- a/tests/Fixtures/password_session_authenticate_request.json
+++ b/tests/Fixtures/password_session_authenticate_request.json
@@ -7,5 +7,7 @@
   "invitation_token": "inv_tok_01HXYZ123456789ABCDEFGHIJ",
   "ip_address": "203.0.113.42",
   "device_id": "device_01HXYZ123456789ABCDEFGHIJ",
-  "user_agent": "Mozilla/5.0"
+  "user_agent": "Mozilla/5.0",
+  "signals_id": "01JBS0GN92GC2RJQS4X9DBPQ2A",
+  "radar_auth_attempt_id": "radar_auth_attempt_01HXYZ123456789ABCDEFGHIJ"
 }
diff --git a/tests/Fixtures/radar_email_challenge_code_session_authenticate_request.json b/tests/Fixtures/radar_email_challenge_code_session_authenticate_request.json
new file mode 100644
index 00000000..fcd9246b
--- /dev/null
+++ b/tests/Fixtures/radar_email_challenge_code_session_authenticate_request.json
@@ -0,0 +1,11 @@
+{
+  "client_id": "client_01HXYZ123456789ABCDEFGHIJ",
+  "client_secret": "sk_test_....",
+  "grant_type": "urn:workos:oauth:grant-type:radar-email-challenge:code",
+  "code": "123456",
+  "radar_challenge_id": "radar_challenge_01HXYZ123456789ABCDEFGHIJ",
+  "pending_authentication_token": "cTDQJTTkTkkVYxbn...",
+  "ip_address": "203.0.113.42",
+  "device_id": "device_01HXYZ123456789ABCDEFGHIJ",
+  "user_agent": "Mozilla/5.0"
+}
diff --git a/tests/Fixtures/radar_sms_challenge_code_session_authenticate_request.json b/tests/Fixtures/radar_sms_challenge_code_session_authenticate_request.json
new file mode 100644
index 00000000..5c515922
--- /dev/null
+++ b/tests/Fixtures/radar_sms_challenge_code_session_authenticate_request.json
@@ -0,0 +1,12 @@
+{
+  "client_id": "client_01HXYZ123456789ABCDEFGHIJ",
+  "client_secret": "sk_test_....",
+  "grant_type": "urn:workos:oauth:grant-type:radar-sms-challenge:code",
+  "code": "123456",
+  "verification_id": "vrf_01HXYZ123456789ABCDEFGHIJ",
+  "phone_number": "+15555550123",
+  "pending_authentication_token": "cTDQJTTkTkkVYxbn...",
+  "ip_address": "203.0.113.42",
+  "device_id": "device_01HXYZ123456789ABCDEFGHIJ",
+  "user_agent": "Mozilla/5.0"
+}
diff --git a/tests/Fixtures/radar_standalone_assess_request.json b/tests/Fixtures/radar_standalone_assess_request.json
index 0ab0e1dd..024436c7 100644
--- a/tests/Fixtures/radar_standalone_assess_request.json
+++ b/tests/Fixtures/radar_standalone_assess_request.json
@@ -5,5 +5,6 @@
   "auth_method": "Password",
   "action": "sign-in",
   "device_fingerprint": "fp_abc123",
-  "bot_score": "0.1"
+  "bot_score": "0.1",
+  "signals_id": "01JBS0GN92GC2RJQS4X9DBPQ2A"
 }
diff --git a/tests/Fixtures/send_radar_sms_challenge.json b/tests/Fixtures/send_radar_sms_challenge.json
new file mode 100644
index 00000000..b112e128
--- /dev/null
+++ b/tests/Fixtures/send_radar_sms_challenge.json
@@ -0,0 +1,7 @@
+{
+  "user_id": "user_01E4ZCR3C56J083X43JQXF3JK5",
+  "pending_authentication_token": "cTDQJTTkTkkVYxbn...",
+  "phone_number": "+15555550123",
+  "ip_address": "203.0.113.42",
+  "user_agent": "Mozilla/5.0"
+}
diff --git a/tests/Fixtures/send_radar_sms_challenge_response.json b/tests/Fixtures/send_radar_sms_challenge_response.json
new file mode 100644
index 00000000..933637b9
--- /dev/null
+++ b/tests/Fixtures/send_radar_sms_challenge_response.json
@@ -0,0 +1,4 @@
+{
+  "verification_id": "vrf_01HXYZ123456789ABCDEFGHIJ",
+  "phone_number": "+15555550123"
+}
diff --git a/tests/Fixtures/user_create_response.json b/tests/Fixtures/user_create_response.json
new file mode 100644
index 00000000..762e42d0
--- /dev/null
+++ b/tests/Fixtures/user_create_response.json
@@ -0,0 +1,3 @@
+{
+  "radar_auth_attempt_id": "radar_auth_attempt_01HXYZ123456789ABCDEFGHIJ"
+}
diff --git a/tests/Service/UserManagementTest.php b/tests/Service/UserManagementTest.php
index c3fe5f13..5d8dd5da 100644
--- a/tests/Service/UserManagementTest.php
+++ b/tests/Service/UserManagementTest.php
@@ -63,6 +63,23 @@ public function testCreateDevice(): void
         $this->assertSame('test_value', $body['client_id']);
     }
 
+    public function testCreateRadarChallenge(): void
+    {
+        $fixture = $this->loadFixture('send_radar_sms_challenge_response');
+        $client = $this->createMockClient([['status' => 200, 'body' => $fixture]]);
+        $result = $client->userManagement()->createRadarChallenge(userId: 'test_value', pendingAuthenticationToken: 'test_value', phoneNumber: 'test_value');
+        $this->assertInstanceOf(\WorkOS\Resource\SendRadarSmsChallengeResponse::class, $result);
+        $this->assertSame($fixture['verification_id'], $result->verificationId);
+        $this->assertIsArray($result->toArray());
+        $request = $this->getLastRequest();
+        $this->assertSame('POST', $request->getMethod());
+        $this->assertStringEndsWith('user_management/radar_challenges', $request->getUri()->getPath());
+        $body = json_decode((string) $request->getBody(), true);
+        $this->assertSame('test_value', $body['user_id']);
+        $this->assertSame('test_value', $body['pending_authentication_token']);
+        $this->assertSame('test_value', $body['phone_number']);
+    }
+
     public function testGetLogoutUrl(): void
     {
         $client = $this->createMockClient([]);
@@ -195,12 +212,10 @@ public function testListUsers(): void
 
     public function testCreateUser(): void
     {
-        $fixture = $this->loadFixture('user');
+        $fixture = $this->loadFixture('user_create_response');
         $client = $this->createMockClient([['status' => 200, 'body' => $fixture]]);
         $result = $client->userManagement()->createUser(email: 'test_value');
-        $this->assertInstanceOf(\WorkOS\Resource\User::class, $result);
-        $this->assertSame($fixture['id'], $result->id);
-        $this->assertSame($fixture['email'], $result->email);
+        $this->assertInstanceOf(\WorkOS\Resource\UserCreateResponse::class, $result);
         $this->assertIsArray($result->toArray());
         $request = $this->getLastRequest();
         $this->assertSame('POST', $request->getMethod());
@@ -479,12 +494,10 @@ public function testUpdateJWTTemplate(): void
 
     public function testCreateMagicAuth(): void
     {
-        $fixture = $this->loadFixture('magic_auth');
+        $fixture = $this->loadFixture('magic_auth_send_magic_auth_code_and_return_response');
         $client = $this->createMockClient([['status' => 200, 'body' => $fixture]]);
         $result = $client->userManagement()->createMagicAuth(email: 'test_value');
-        $this->assertInstanceOf(\WorkOS\Resource\MagicAuth::class, $result);
-        $this->assertSame($fixture['id'], $result->id);
-        $this->assertSame($fixture['user_id'], $result->userId);
+        $this->assertInstanceOf(\WorkOS\Resource\MagicAuthSendMagicAuthCodeAndReturnResponse::class, $result);
         $this->assertIsArray($result->toArray());
         $request = $this->getLastRequest();
         $this->assertSame('POST', $request->getMethod());