v8.1.0

• #416 fix(generated): regenerate from spec

  Features

  • user_management:
    • Added model UserRoleAssignmentSource
    • Added source to UserRoleAssignment
    • Added enum UserRoleAssignmentSourceType
    • Added parameter UserManagementAuthentication.authorize.max_age
    • Added endpoint GET /user_management/cors_origins
    • Added endpoint GET /user_management/redirect_uris

  Fixes

  • Restore mistakenly removed CreateMagicAuth logic from previous release

v8.0.0

• #409 fix(generated): regenerate from spec

  Features

  • pipes:
    • Added model DataIntegrationCredentialsResponse
    • Added model DataIntegrationCredentialsResponseCredential
    • Added model DataIntegrationsUpsertApiKeyRequest
    • Added model DataIntegrationsVendCredentialsRequest
    • Added enum DataIntegrationCredentialsResponseError
    • Added endpoint PUT /data-integrations/{slug}/api-key
    • Added endpoint POST /data-integrations/{slug}/credentials

• #411 feat(generated)!: regenerate from spec (1 change)

  ⚠️ Breaking

  • user_management:
    • Removed model SessionReauthenticated
    • Removed model SessionReauthenticatedData
    • Removed model SessionReauthenticatedDataImpersonator
    • Removed enum SessionReauthenticatedDataAuthMethod
    • Removed enum SessionReauthenticatedDataStatus

  Features

  • webhooks:
    • Added agent.registration.created to CreateWebhookEndpointEvents
    • Added agent.registration.claim.attempt.created to CreateWebhookEndpointEvents
    • Added agent.registration.claim.completed to CreateWebhookEndpointEvents
    • Added agent.registration.credential.issued to CreateWebhookEndpointEvents
    • Added agent.registration.organization.switched to CreateWebhookEndpointEvents
    • Added authentication.reauthentication_succeeded to CreateWebhookEndpointEvents
    • Added agent.registration.created to UpdateWebhookEndpointEvents
    • Added agent.registration.claim.attempt.created to UpdateWebhookEndpointEvents
    • Added agent.registration.claim.completed to UpdateWebhookEndpointEvents
    • Added agent.registration.credential.issued to UpdateWebhookEndpointEvents
    • Added agent.registration.organization.switched to UpdateWebhookEndpointEvents
    • Added authentication.reauthentication_succeeded to UpdateWebhookEndpointEvents
  • webhooks:
    • Added session.reauthenticated to CreateWebhookEndpointEvents
    • Added session.reauthenticated to UpdateWebhookEndpointEvents
  • webhooks:
    • Added pipes.connected_account.connection_failed to CreateWebhookEndpointEvents
    • Added pipes.connected_account.connection_failed to UpdateWebhookEndpointEvents
  • user_management:
    • Added model UserRoleAssignmentSource
    • Added source to UserRoleAssignment
    • Added enum UserRoleAssignmentSourceType
    • Added parameter UserManagementAuthentication.authorize.max_age
    • Added endpoint GET /user_management/cors_origins
    • Added endpoint GET /user_management/redirect_uris
  • audit_logs:
    • Changed the format of AuditLogExportCreation.range_start
    • Changed the format of AuditLogExportCreation.range_end
  • audit_logs:
    • Added expired to AuditLogExportState

  Fixes

  • admin_portal:
    • Removed intent_options from GenerateLink
  • webhooks:
    • Removed session.reauthenticated from CreateWebhookEndpointEvents
    • Removed session.reauthenticated from UpdateWebhookEndpointEvents

• #413 feat(generated): regenerate from spec (1 change)

  Features

  • pipes:
    • Added model DataIntegrationCredentialsDto
    • Added model CustomProviderDefinition
    • Added model CreateDataIntegration
    • Added model UpdateCustomProviderDefinition
    • Added model UpdateDataIntegration
    • Added model DataIntegration
    • Added model DataIntegrationList
    • Added model DataIntegrationListListMetadata
    • Added model DataIntegrationCredential
    • Added model DataIntegrationCustomProvider
    • Added enum DataIntegrationCredentialsType
    • Added enum CustomProviderDefinitionAuthenticateVia
    • Added enum UpdateCustomProviderDefinitionAuthenticateVia
    • Added enum DataIntegrationState
    • Added enum DataIntegrationCredentialType
    • Added enum DataIntegrationCustomProviderAuthenticateVia
    • Added endpoint GET /data-integrations
    • Added endpoint POST /data-integrations
    • Added endpoint GET /data-integrations/{slug}
    • Added endpoint PUT /data-integrations/{slug}
    • Added endpoint DELETE /data-integrations/{slug}
    • Added endpoint POST /user_management/users/{user_id}/connected_accounts/{slug}
    • Added endpoint PUT /user_management/users/{user_id}/connected_accounts/{slug}

• #414 feat(generated): regenerate from spec (2 changes)

  Features

  • user_management:
    • Added model SendRadarSmsChallenge
    • Added model SendRadarSmsChallengeResponse
    • Added model UrnWorkosOAuthGrantTypeRadarEmailChallengeCodeSessionAuthenticateRequest
    • Added model UrnWorkosOAuthGrantTypeRadarSmsChallengeCodeSessionAuthenticateRequest
    • Added model MagicAuthSendMagicAuthCodeAndReturnResponse
    • Added model UserCreateResponse
    • Added ip_address to CreateMagicCodeAndReturn
    • Added user_agent to CreateMagicCodeAndReturn
    • Added radar_auth_attempt_id to CreateMagicCodeAndReturn
    • Added signals_id to CreateMagicCodeAndReturn
    • Added ip_address to CreateUser
    • Added user_agent to CreateUser
    • Added signals_id to CreateUser
    • Added signals_id to AuthorizationCodeSessionAuthenticateRequest
    • Added signals_id to PasswordSessionAuthenticateRequest
    • Added radar_auth_attempt_id to PasswordSessionAuthenticateRequest
    • Added radar_auth_attempt_id to UrnWorkosOAuthGrantTypeMagicAuthCodeSessionAuthenticateRequest
    • Added endpoint POST /user_management/radar_challenges
  • radar:
    • Added signals_id to RadarStandaloneAssessRequest

  Fixes

  • user_management:
    • Changed request body for UserManagementAuthentication.authenticate
    • Changed response of UserManagementUsers.create from User to UserCreateResponse
    • Changed response of UserManagementMagicAuth.sendMagicAuthCodeAndReturn from MagicAuth to MagicAuthSendMagicAuthCodeAndReturnResponse

v7.3.0

• #405 fix(generated): regenerate from spec

  Fixes

  • organization_membership:
    • Added roles to organization membership models

v7.2.0

Bug Fixes

• Fix empty body serializing as JSON array instead of object (#403) (29d0099)

Miscellaneous Chores

• commit publishing fixes (c7ba478)

• #401 feat(generated)!: regenerate from spec (11 changes)

  ⚠️ Breaking

  • pipes:
    • SDK surface change: Pipes.createDataIntegrationToken was renamed to Pipes.getAccessToken

  Features

  • authorization:
    • Added model ReplaceGroupRoleAssignmentEntry
    • Added model ReplaceGroupRoleAssignments
    • Added model DeleteGroupRoleAssignmentsByCriteria
    • Added endpoint POST /authorization/groups/{group_id}/role_assignments
    • Added endpoint PUT /authorization/groups/{group_id}/role_assignments
    • Added endpoint DELETE /authorization/groups/{group_id}/role_assignments
    • Added endpoint GET /authorization/groups/{group_id}/role_assignments/{role_assignment_id}
    • Added endpoint DELETE /authorization/groups/{group_id}/role_assignments/{role_assignment_id}
  • client:
    • Added model ClientApiToken
    • Added model ClientApiTokenResponse
    • Added service Client
  • connect:
    • Added auth_method to ConnectedAccount
    • Added api_key_last_4 to ConnectedAccount
    • Added enum ConnectedAccountAuthMethod
  • groups:
    • Added model CreateGroupRoleAssignment
    • Added model GroupRoleAssignment
    • Added model GroupRoleAssignmentList
    • Added model GroupRoleAssignmentResource
  • organization_membership:
    • Added model UserOrganizationMembershipList
    • Added model UserOrganizationMembershipListListMetadata
  • pipes:
    • Added model DataIntegrationCredentials
    • Added model DataIntegrationConfigurationResponse
    • Added model DataIntegrationConfigurationListResponse
    • Added model ConfigureDataIntegrationBody
    • Added auth_methods to DataIntegrationsListResponseData
    • Added auth_method to DataIntegrationsListResponseDataConnectedAccount
    • Added api_key_last_4 to DataIntegrationsListResponseDataConnectedAccount
    • Added enum DataIntegrationCredentialsCredentialsType
    • Added enum DataIntegrationsListResponseDataAuthMethods
    • Added enum DataIntegrationsListResponseDataConnectedAccountAuthMethod
    • Added service PipesProvider
  • user_management:
    • Added model UserInviteList
    • Added model UserInviteListListMetadata
    • Made AuthorizationCodeSessionAuthenticateRequest.client_secret optional
    • Made RefreshTokenSessionAuthenticateRequest.client_secret optional
  • widgets:
    • Added widgets:pipes:manage to WidgetSessionTokenScopes

  Fixes

  • organization_membership:
    • Changed response of UserManagementOrganizationMembership.list from UserOrganizationMembership to UserOrganizationMembershipList
  • user_management:
    • Changed response of UserManagementInvitations.list from UserInvite to UserInviteList

v7.1.0

Miscellaneous Chores

• deps: update github actions non-major (#398) (79fc78c)

• #397 feat(generated)!: regenerate from spec (5 changes)

  ⚠️ Breaking

  • api_keys:
    • Made expires_at required in API key models
  • directory_sync:
    • Removed model DsyncDeactivated
    • Removed model DsyncDeactivatedData
    • Removed model DsyncDeactivatedDataDomain
    • Removed enum DsyncDeactivatedDataType
    • Removed enum DsyncDeactivatedDataState
  • radar:
    • Removed domain_sign_up_rate_limit from RadarStandaloneResponseControl
  • user_management:
    • Removed return_to from RevokeSession

  Features

  • api_keys:
    • Added model ExpireApiKey
    • Added model ApiKeyUpdated
    • Added model ApiKeyUpdatedData
    • Added model ApiKeyUpdatedDataOwner
    • Added model UserApiKeyUpdatedDataOwner
    • Added model ApiKeyUpdatedDataPreviousAttribute
    • Added endpoint POST /api_keys/{id}/expire
  • audit_logs:
    • Added Snowflake to AuditLogConfigurationLogStreamType
  • connect:
    • Added name to UserObject
  • directory_sync:
    • Added model DsyncTokenCreated
    • Added model DsyncTokenCreatedData
    • Added model DsyncTokenRevoked
    • Added model DsyncTokenRevokedData
  • user_management:
    • Added name to user management models
  • webhooks:
    • Added api_key.updated to CreateWebhookEndpointEvents
    • Added api_key.updated to UpdateWebhookEndpointEvents

v7.0.1

Bug Fixes

• renamed misleading Object to VaultObject (c7cef60)
• renovate: explicitly enable minor and patch updates (#393) (e1705f1)
• sdk: omit defaulted screen_hint from auth URLs (#396) (d583c7c)

v7.0.0

Miscellaneous Chores

• deps: update googleapis/release-please-action action to v5 (#389) (f973f21)

• deps: update shivammathur/setup-php action to v2.37.0 (#388) (f9e113f)

• use shared workos/renovate-config preset (99aad6c)

• #392 feat(generated)!: regenerate from spec (10 changes)

  ⚠️ Breaking

  • user_management: Remove organization membership methods from UserManagement service
    • Removed listOrganizationMemberships, createOrganizationMembership, getOrganizationMembership, updateOrganizationMembership, deleteOrganizationMembership, deactivateOrganizationMembership, and reactivateOrganizationMembership methods
    • These methods have been moved to the new OrganizationMembershipService
    • Change to getAuthorizationUrl() parameter screenHint from UserManagementAuthenticationScreenHint to RadarStandaloneAssessRequestAction type
    • Removed UserManagementAuthenticationScreenHint enum
  • user_management: Remove UserManagementOrganizationMembershipGroups service
    • Removed $workos->userManagementOrganizationMembershipGroups() accessor
    • listOrganizationMembershipGroups() has been moved to the new OrganizationMembershipService
  • radar: Remove device fingerprint and bot score from RadarStandaloneAssessRequest
    • Removed deviceFingerprint parameter from Radar.createAttempt() method
    • Removed botScore parameter from Radar.createAttempt() method
    • Removed deviceFingerprint and botScore fields from RadarStandaloneAssessRequest model
    • Removed deprecated enum values from RadarStandaloneAssessRequestAction: Login, Signup, SignUp2, SignUp3, SignIn2, SignIn3
    • Changed enum values in RadarStandaloneAssessRequestAction: SignUp from 'sign up' to 'sign-up', SignIn from 'sign in' to 'sign-in'
    • Removed enum values from RadarStandaloneResponseControl: CredentialStuffing, IpSignUpRateLimit
  • radar: Rename Radar list enums
    • Renamed RadarAction to RadarListAction
    • Renamed RadarType to RadarListType
  • audit_logs: Rename audit log models for consistency
    • Renamed AuditLogActionJson to AuditLogAction
    • Renamed AuditLogExportJson to AuditLogExport
    • Renamed AuditLogExportJsonState to AuditLogExportState
    • Renamed AuditLogSchemaJson to AuditLogSchema
    • Renamed AuditLogSchemaJsonActor to AuditLogSchemaActorInput
    • Renamed AuditLogSchemaJsonTarget to AuditLogSchemaTargetInput
    • Renamed AuditLogsRetentionJson to AuditLogsRetention
    • createSchema() method parameter types changed: AuditLogSchemaActor → AuditLogSchemaActorInput, AuditLogSchemaTarget → AuditLogSchemaTargetInput
  • webhooks: Rename webhook endpoint models and update status field type
    • Renamed WebhookEndpointJson to WebhookEndpoint
    • Renamed WebhookEndpointJsonStatus to WebhookEndpointStatus
    • Changed UpdateWebhookEndpoint.status field type from WebhookEndpointJsonStatus to WebhookEndpointStatus
    • Updated webhook event enums: added PIPES_CONNECTED_ACCOUNT_CONNECTED, PIPES_CONNECTED_ACCOUNT_DISCONNECTED, PIPES_CONNECTED_ACCOUNT_REAUTHORIZATION_NEEDED events
  • authorization: Update Authorization API with new filters and remove search parameter
    • Added resourceId, resourceExternalId, resourceTypeSlug filter parameters to listRoleAssignments()
    • Added roleSlug filter parameter to listRoleAssignmentsForResourceByExternalId() and listRoleAssignmentsForResource()
    • Removed search parameter from listResources() method
  • vault: Replace hand-maintained WorkOS\Vault class with generated WorkOS\Service\Vault
    • The old WorkOS\Vault class (lib/Vault.php) with client-side encrypt/decrypt helpers has been removed
    • $workos->vault() now returns WorkOS\Service\Vault with a different API surface
    • New generated methods: createDataKey(), createDecrypt(), createRekey(), listKv(), createKv(), getName(), getKv(), updateKv(), deleteKv(), listKvMetadata(), listKvVersions()

  Features

  • organization_membership: Introduce OrganizationMembershipService with membership and group operations
    • New service OrganizationMembershipService with methods: listOrganizationMemberships(), createOrganizationMembership(), getOrganizationMembership(), updateOrganizationMembership(), deleteOrganizationMembership(), deactivateOrganizationMembership(), reactivateOrganizationMembership(), and listOrganizationMembershipGroups()
    • Accessible via $workos->organizationMembership()
    • Replaces functionality previously in UserManagement and UserManagementOrganizationMembershipGroups services
  • vault: Add new Vault service for encrypted key-value storage
    • New Vault service with methods: createDataKey(), createDecrypt(), createRekey(), listKv(), createKv(), getName(), getKv(), updateKv(), deleteKv(), listKvMetadata(), and listKvVersions()
    • Support for encrypted object storage and management with key rotation
    • New models: CreateDataKeyResponse, DecryptResponse, ObjectMetadata, ObjectModel, ObjectSummary, ObjectWithoutValue, ObjectVersion, VersionListResponse
    • New enum: VaultOrder for sort direction
    • Accessible via $workos->vault()
  • api_keys: Add expires_at field to API key models and creation methods
    • Added expires_at field to ApiKey, OrganizationApiKey, OrganizationApiKeyWithValue, UserApiKey, UserApiKeyWithValue models
    • Added expires_at field to ApiKeyCreatedData and ApiKeyRevokedData event data models
    • Added optional expiresAt parameter to createOrganizationApiKey() and createUserApiKey() methods
    • Support for setting API key expiration timestamps
  • applications: Update ApplicationCredentialsListItem and NewConnectApplicationSecret field types
    • Changed ApplicationCredentialsListItem.lastUsedAt field type from ?string to ?\DateTimeImmutable
    • Changed NewConnectApplicationSecret.lastUsedAt field type from ?string to ?\DateTimeImmutable
  • pipes: Add connected account event models and related types
    • New models for pipe events: PipeConnectedAccount, PipesConnectedAccountConnected, PipesConnectedAccountDisconnected, PipesConnectedAccountReauthorizationNeeded
    • New enum: PipeConnectedAccountState with values connected and needs_reauthorization
    • Support for monitoring data integration connection status changes

v6.0.2

6.0.2 (2026-05-11)

Bug Fixes

• harden JWT signature verification and URL path encoding (#386) (aa64119)

v6.0.1

6.0.1 (2026-05-07)

Bug Fixes

• Preserve full error response body on ApiException (#385) (57052ab)

Miscellaneous Chores

• release: include v prefix in tags (5517b8b)

v6.0.0

6.0.0 (2026-05-06)

⚠ BREAKING CHANGES

• user_management: Add user API keys and update ordering enum
• api_keys: Restructure API key models and rename ordering enum
• vault: Rename BYOK key provider enum and add vault key deleted event
• authorization: Rename RoleAssignment to UserRoleAssignment

Features

• Add API docs generation and llms.txt index (#382) (ae03f03)
• api_keys: Restructure API key models and rename ordering enum (1bb2fe4)
• authorization: Rename EventsOrder to PaginationOrder (1bb2fe4)
• authorization: Rename RoleAssignment to UserRoleAssignment (1bb2fe4)
• directory_sync: Add name field to directory users (1bb2fe4)
• sso: Add full name support to user profiles (1bb2fe4)
• user_management: Add user API keys and update ordering enum (1bb2fe4)
• user_management: Add user context to organization memberships (1bb2fe4)
• vault: Rename BYOK key provider enum and add vault key deleted event (1bb2fe4)

Bug Fixes

• ci: install composer deps before building docs (8f439e3)
• events: Add admin_portal to actor source enum (1bb2fe4)