feat(generated)!: SDK surface change: Parameter type changed for "expires_at" on "ApiKeys.create_api_key_expire" (+8 more)

.changelog-pending/2026-07-21T17-10-16-341b7f0f1ea67e05b14ab5014622e1f93182cdff.md

@@ -0,0 +1,66 @@
+* [#695](https://github.com/workos/workos-python/pull/695) feat(generated)!: regenerate from spec (9 changes)
+
+  **Features**
+  * **agents**:
+    * Added model `ClaimViewResponse`
+    * Added model `ClaimViewResponseOrganization`
+    * Added model `AgentAdminLinkClaimAttemptToExternalUserRequest`
+    * Added model `AgentAdminLinkClaimAttemptToExternalUserRequestUser`
+    * Added enum `ClaimViewResponseStatus`
+    * Added endpoint `PATCH /agents/claims/attempts`
+    * Added model `AgentRegistration`
+    * Added model `AgentCredentialValidation`
+    * Added model `AgentRegistrationAgentIdentity`
+    * Added model `AgentRegistrationClaim`
+    * Added model `AgentAdminValidateCredentialRequest`
+    * Added model `AgentRegistrationClaimClaimCompletion`
+    * Added enum `AgentRegistrationStatus`
+    * Added enum `AgentRegistrationKind`
+    * Added enum `AgentAdminValidateCredentialRequestType`
+    * Added service `Agents`
+  * **[api_keys](https://workos.com/docs/reference/authkit/api-keys)**:
+    * Added `agent_registration_id` to `ApiKeyValidationResponse`
+  * **[connect](https://workos.com/docs/reference/workos-connect/standalone)**:
+    * Added enum `ApplicationsRegistrationTypes`
+    * Added parameter `Applications.list.registration_types`
+  * **[directory_sync](https://workos.com/docs/reference/directory-sync)**:
+    * Added parameter `DirectoryUsers.list.idp_id`
+    * Added parameter `DirectoryUsers.list.email`
+  * **[organizations](https://workos.com/docs/reference/organization)**:
+    * Added model `OrganizationAuthorizedConnectApplicationList`
+    * Added model `OrganizationAuthorizedConnectApplicationListData`
+    * Added model `OrganizationAuthorizedConnectApplicationListListMetadata`
+    * Added service `OrganizationsAuthorizedApplications`
+  * **[pipes](https://workos.com/docs/reference/pipes)**:
+    * Added model `DataIntegrationInstallation`
+    * Added `auth_methods` to `CreateDataIntegration`
+    * Added `api_key` to `CreateDataIntegration`
+    * Added `api_key` to `UpdateDataIntegration`
+    * Added `auth_methods` to `DataIntegration`
+    * Added `installation` to `DataIntegration`
+    * Added enum `CreateDataIntegrationAuthMethods`
+    * Added enum `DataIntegrationAuthMethods`
+    * Added model `DataIntegrationCredentialsResponse`
+    * Added model `DataIntegrationCredentialsResponseCredential`
+    * Added model `DataIntegrationsUpsertApiKeyRequest`
+    * Added model `DataIntegrationsVendCredentialsRequest`
+    * Added enum `DataIntegrationCredentialsResponseError`
+    * Added endpoint `PUT /data-integrations/{slug}/api-key`
+    * Added endpoint `POST /data-integrations/{slug}/credentials`
+  * **[sso](https://workos.com/docs/reference/sso)**:
+    * Added parameter `SSO.authorize.prompt`
+  * **[user_management](https://workos.com/docs/reference/authkit/user)**:
+    * Added `ssha256` to `CreateUserPasswordHashType`
+    * Added `ssha256` to `UpdateUserPasswordHashType`
+    * Added endpoint `GET /user_management/radar_challenges/{id}`
+  * **[webhooks](https://workos.com/docs/reference/webhooks)**:
+    * Added `agent.registration.revoked` to `CreateWebhookEndpointEvents`
+    * Added `agent.registration.revoked` to `UpdateWebhookEndpointEvents`
+    * Added `agent.registration.deleted` to `CreateWebhookEndpointEvents`
+    * Added `agent.registration.deleted` to `UpdateWebhookEndpointEvents`
+    * Added `radar.challenge_created` to `CreateWebhookEndpointEvents`
+    * Added `radar.challenge_created` to `UpdateWebhookEndpointEvents`
+    * Added `agent.registration.expired` to `CreateWebhookEndpointEvents`
+    * Added `agent.registration.expired` to `UpdateWebhookEndpointEvents`
+  * **[widgets](https://workos.com/docs/reference/widgets)**:
+    * Made `WidgetSessionToken.organization_id` optional

.last-synced-sha

@@ -1 +1 @@
-56a015eaa3c5fb42a7dd77526c43953a971f4907
+f40851a620a1ba0badec95e80faac475382c8dd0

src/workos/_client.py

@@ -8,6 +8,7 @@
     WorkOSClient as _SyncBase,
     AsyncWorkOSClient as _AsyncBase,
 )
+from .agents._resource import Agents, AsyncAgents
 from .multi_factor_auth._resource import MultiFactorAuth, AsyncMultiFactorAuth
 from .connect._resource import Connect, AsyncConnect
 from .authorization._resource import Authorization, AsyncAuthorization
@@ -44,6 +45,11 @@
 class WorkOSClient(_SyncBase):
     """Synchronous WorkOS API client with service accessors."""
 
+    @functools.cached_property
+    def agents(self) -> Agents:
+        """Agents API resources."""
+        return Agents(self)
+
     @functools.cached_property
     def multi_factor_auth(self) -> MultiFactorAuth:
         """Multi Factor Auth API resources."""
@@ -182,6 +188,11 @@ def pkce(self) -> PKCE:
 class AsyncWorkOSClient(_AsyncBase):
     """Asynchronous WorkOS API client with service accessors."""
 
+    @functools.cached_property
+    def agents(self) -> AsyncAgents:
+        """Agents API resources."""
+        return AsyncAgents(self)
+
     @functools.cached_property
     def multi_factor_auth(self) -> AsyncMultiFactorAuth:
         """Multi Factor Auth API resources."""

src/workos/agents/__init__.py

@@ -0,0 +1,4 @@
+# This file is auto-generated by oagen. Do not edit.
+
+from ._resource import Agents as Agents, AsyncAgents as AsyncAgents
+from .models import *

src/workos/agents/_resource.py

@@ -0,0 +1,279 @@
+# This file is auto-generated by oagen. Do not edit.
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, Any, Dict, Literal, Optional, Union
+
+if TYPE_CHECKING:
+    from .._client import AsyncWorkOSClient, WorkOSClient
+
+from .._types import RequestOptions, enum_value
+from .models import (
+    AgentAdminLinkClaimAttemptToExternalUserRequestUser,
+    AgentCredentialValidation,
+    AgentRegistration,
+    ClaimViewResponse,
+)
+from workos.common.models.agent_admin_validate_credential_request_type import (
+    AgentAdminValidateCredentialRequestType,
+)
+
+
+class Agents:
+    """Agents API resources."""
+
+    def __init__(self, client: "WorkOSClient") -> None:
+        self._client = client
+
+    def update_attempts(
+        self,
+        *,
+        type: Literal["link_external_user"],
+        claim_attempt_token: str,
+        user: AgentAdminLinkClaimAttemptToExternalUserRequestUser,
+        organization_id: Optional[str] = None,
+        request_options: Optional[RequestOptions] = None,
+    ) -> ClaimViewResponse:
+        """Link a claim attempt to an external user
+
+        Link an external user to a claim attempt and retrieve the code needed for the agent to complete the claim. The user is looked up by external ID; if no user exists, one is created. When the user belongs to multiple organizations, an explicit organization must be provided.
+
+        Args:
+            type: The operation to perform on the claim attempt. Currently only `link_external_user` is supported.
+            claim_attempt_token: The token identifying the claim attempt.
+            user: The user to attach to the claim attempt, identified by email and external ID.
+            organization_id: The organization to place the agent in. Required when the user belongs to more than one organization.
+            request_options: Per-request options. Supports extra_headers, timeout, max_retries, and base_url override.
+
+        Returns:
+            ClaimViewResponse
+
+        Raises:
+            BadRequestError: If the request is malformed (400).
+            AuthorizationError: If the request is forbidden (403).
+            ConflictError: If a conflict occurs (409).
+            AuthenticationError: If the API key is invalid (401).
+            RateLimitExceededError: If rate limited (429).
+            ServerError: If the server returns a 5xx error.
+        """
+        body: Dict[str, Any] = {
+            k: v
+            for k, v in {
+                "type": type,
+                "claim_attempt_token": claim_attempt_token,
+                "user": user.to_dict(),
+                "organization_id": organization_id,
+            }.items()
+            if v is not None
+        }
+        return self._client.request(
+            method="patch",
+            path=("agents", "claims", "attempts"),
+            body=body,
+            model=ClaimViewResponse,
+            request_options=request_options,
+        )
+
+    def create_validate(
+        self,
+        *,
+        type: Union[AgentAdminValidateCredentialRequestType, str],
+        credential: str,
+        audience: Optional[str] = None,
+        request_options: Optional[RequestOptions] = None,
+    ) -> AgentCredentialValidation:
+        """Validate an agent credential
+
+        Validate an agent credential — an API key or access token — against the environment of the API key used to authenticate the request. This is a read-only check: it never consumes or mutates the credential.
+
+        Args:
+            type: The kind of credential being validated — an agent API key or an agent access token.
+            credential: The credential value to validate: the API key value for `api_key`, or the access token (JWT) for `access_token`.
+            audience: When provided, the access token's `aud` claim is verified against this value. Tokens issued for a different resource are rejected.
+            request_options: Per-request options. Supports extra_headers, timeout, max_retries, and base_url override.
+
+        Returns:
+            AgentCredentialValidation
+
+        Raises:
+            BadRequestError: If the request is malformed (400).
+            AuthenticationError: If the API key is invalid (401).
+            RateLimitExceededError: If rate limited (429).
+            ServerError: If the server returns a 5xx error.
+        """
+        body: Dict[str, Any] = {
+            k: v
+            for k, v in {
+                "type": enum_value(type),
+                "credential": credential,
+                "audience": audience,
+            }.items()
+            if v is not None
+        }
+        return self._client.request(
+            method="post",
+            path=("agents", "credentials", "validate"),
+            body=body,
+            model=AgentCredentialValidation,
+            request_options=request_options,
+        )
+
+    def get_registration(
+        self,
+        id: str,
+        *,
+        request_options: Optional[RequestOptions] = None,
+    ) -> AgentRegistration:
+        """Get an agent registration
+
+        Retrieve the details of an agent registration by ID. The registration is scoped to the environment of the API key used to authenticate the request.
+
+        Args:
+            id: The unique ID of the agent registration.
+            request_options: Per-request options. Supports extra_headers, timeout, max_retries, and base_url override.
+
+        Returns:
+            AgentRegistration
+
+        Raises:
+            NotFoundError: If the resource is not found (404).
+            AuthenticationError: If the API key is invalid (401).
+            RateLimitExceededError: If rate limited (429).
+            ServerError: If the server returns a 5xx error.
+        """
+        return self._client.request(
+            method="get",
+            path=("agents", "registrations", str(id)),
+            model=AgentRegistration,
+            request_options=request_options,
+        )
+
+
+class AsyncAgents:
+    """Agents API resources (async)."""
+
+    def __init__(self, client: "AsyncWorkOSClient") -> None:
+        self._client = client
+
+    async def update_attempts(
+        self,
+        *,
+        type: Literal["link_external_user"],
+        claim_attempt_token: str,
+        user: AgentAdminLinkClaimAttemptToExternalUserRequestUser,
+        organization_id: Optional[str] = None,
+        request_options: Optional[RequestOptions] = None,
+    ) -> ClaimViewResponse:
+        """Link a claim attempt to an external user
+
+        Link an external user to a claim attempt and retrieve the code needed for the agent to complete the claim. The user is looked up by external ID; if no user exists, one is created. When the user belongs to multiple organizations, an explicit organization must be provided.
+
+        Args:
+            type: The operation to perform on the claim attempt. Currently only `link_external_user` is supported.
+            claim_attempt_token: The token identifying the claim attempt.
+            user: The user to attach to the claim attempt, identified by email and external ID.
+            organization_id: The organization to place the agent in. Required when the user belongs to more than one organization.
+            request_options: Per-request options. Supports extra_headers, timeout, max_retries, and base_url override.
+
+        Returns:
+            ClaimViewResponse
+
+        Raises:
+            BadRequestError: If the request is malformed (400).
+            AuthorizationError: If the request is forbidden (403).
+            ConflictError: If a conflict occurs (409).
+            AuthenticationError: If the API key is invalid (401).
+            RateLimitExceededError: If rate limited (429).
+            ServerError: If the server returns a 5xx error.
+        """
+        body: Dict[str, Any] = {
+            k: v
+            for k, v in {
+                "type": type,
+                "claim_attempt_token": claim_attempt_token,
+                "user": user.to_dict(),
+                "organization_id": organization_id,
+            }.items()
+            if v is not None
+        }
+        return await self._client.request(
+            method="patch",
+            path=("agents", "claims", "attempts"),
+            body=body,
+            model=ClaimViewResponse,
+            request_options=request_options,
+        )
+
+    async def create_validate(
+        self,
+        *,
+        type: Union[AgentAdminValidateCredentialRequestType, str],
+        credential: str,
+        audience: Optional[str] = None,
+        request_options: Optional[RequestOptions] = None,
+    ) -> AgentCredentialValidation:
+        """Validate an agent credential
+
+        Validate an agent credential — an API key or access token — against the environment of the API key used to authenticate the request. This is a read-only check: it never consumes or mutates the credential.
+
+        Args:
+            type: The kind of credential being validated — an agent API key or an agent access token.
+            credential: The credential value to validate: the API key value for `api_key`, or the access token (JWT) for `access_token`.
+            audience: When provided, the access token's `aud` claim is verified against this value. Tokens issued for a different resource are rejected.
+            request_options: Per-request options. Supports extra_headers, timeout, max_retries, and base_url override.
+
+        Returns:
+            AgentCredentialValidation
+
+        Raises:
+            BadRequestError: If the request is malformed (400).
+            AuthenticationError: If the API key is invalid (401).
+            RateLimitExceededError: If rate limited (429).
+            ServerError: If the server returns a 5xx error.
+        """
+        body: Dict[str, Any] = {
+            k: v
+            for k, v in {
+                "type": enum_value(type),
+                "credential": credential,
+                "audience": audience,
+            }.items()
+            if v is not None
+        }
+        return await self._client.request(
+            method="post",
+            path=("agents", "credentials", "validate"),
+            body=body,
+            model=AgentCredentialValidation,
+            request_options=request_options,
+        )
+
+    async def get_registration(
+        self,
+        id: str,
+        *,
+        request_options: Optional[RequestOptions] = None,
+    ) -> AgentRegistration:
+        """Get an agent registration
+
+        Retrieve the details of an agent registration by ID. The registration is scoped to the environment of the API key used to authenticate the request.
+
+        Args:
+            id: The unique ID of the agent registration.
+            request_options: Per-request options. Supports extra_headers, timeout, max_retries, and base_url override.
+
+        Returns:
+            AgentRegistration
+
+        Raises:
+            NotFoundError: If the resource is not found (404).
+            AuthenticationError: If the API key is invalid (401).
+            RateLimitExceededError: If rate limited (429).
+            ServerError: If the server returns a 5xx error.
+        """
+        return await self._client.request(
+            method="get",
+            path=("agents", "registrations", str(id)),
+            model=AgentRegistration,
+            request_options=request_options,
+        )