feat(generated)!: regenerate from spec (12 changes)

[workos-sdk-automation]

Summary

feat(authorization)!: Rename RoleAssignment to UserRoleAssignment

• Renamed RoleAssignment model to UserRoleAssignment
• Renamed RoleAssignmentResource to UserRoleAssignmentResource
• Updated ListRoleAssignments to return UserRoleAssignment instead of RoleAssignment
• Updated AssignRole to return UserRoleAssignment instead of RoleAssignment
• Added new ListRoleAssignmentsForResource operation
• Added new ListRoleAssignmentsForResourceByExternalId operation

feat(authorization)!: Change email field type in multiple models

• Changed email field type in GenerateLink, CreateMagicCodeAndReturn, CreateUserInviteOptions, CreateUser, UpdateUser, and CreatePasswordResetToken models
• Standardized field serialization with url: tags across authorization operations

feat(user_management)!: Add user API key management endpoints

• Added ListAPIKeys operation to list API keys for a user
• Added CreateAPIKey operation to create an API key for a user
• Added new models: UserAPIKey, UserAPIKeyWithValue, UserAPIKeyOwner, UserAPIKeyCreatedDataOwner

feat(user_management)!: Change email field type in user management models

• Changed email field type in CreateMagicCodeAndReturn, CreateUserInviteOptions, CreateUser, UpdateUser, and CreatePasswordResetToken models
• Added ListJWTTemplate operation to retrieve JWT template

feat(api_keys): Add organization and user API key models

• Added OrganizationAPIKey and OrganizationAPIKeyWithValue models
• Renamed APIKeyWithValue to OrganizationAPIKeyWithValue
• Updated ListOrganizationAPIKeys return type to OrganizationAPIKey
• Updated CreateOrganizationAPIKey return type to OrganizationAPIKeyWithValue

feat(authorization): Add pagination order enum and update enum handling

• Added PaginationOrder enum with values: normal, desc, asc
• Added VaultByokKeyProvider enum with values: AWS_KMS, GCP_KMS, AZURE_KEY_VAULT
• Removed service-specific order enum aliases in favor of generic PaginationOrder

feat(authorization): Unify BYOK key provider enum

• Replaced VaultByokKeyDeletedDataKeyProvider and VaultByokKeyVerificationCompletedDataKeyProvider with unified VaultByokKeyProvider enum
• Updated VaultByokKeyDeletedData to use VaultByokKeyProvider
• Updated VaultByokKeyVerificationCompletedData to use VaultByokKeyProvider

feat(directory_sync): Add name field to directory user models

• Added Name field to DirectoryUser and DirectoryUserWithGroups models
• Updated related event data models to include the Name field

feat(user_management): Add user field to organization membership models

• Added User field to UserOrganizationMembership and UserOrganizationMembershipBaseListData models
• Added User field to OrganizationMembership model

feat(user_management): Add name field to Profile and SSO models

• Added Name field to Profile model
• Updated related test data to include the Name field

fix(events): Add admin_portal source to EventContextActorSource

• Added EventContextActorSourceAdminPortal value to EventContextActorSource enum

fix(events): Add vault.byok_key.deleted event type

• Added VaultByokKeyDeleted event model
• Added VaultByokKeyDeletedData event data model
• Added test fixtures for vault BYOK key deleted event

Triggered by workos/openapi-spec@a06e54d

BEGIN_COMMIT_OVERRIDE
feat(authorization)!: Rename RoleAssignment to UserRoleAssignment
feat(authorization)!: Change email field type in multiple models
feat(user_management)!: Add user API key management endpoints
feat(user_management)!: Change email field type in user management models
feat(api_keys): Add organization and user API key models
feat(authorization): Add pagination order enum and update enum handling
feat(authorization): Unify BYOK key provider enum
feat(directory_sync): Add name field to directory user models
feat(user_management): Add user field to organization membership models
feat(user_management): Add name field to Profile and SSO models
fix(events): Add admin_portal source to EventContextActorSource
fix(events): Add vault.byok_key.deleted event type
END_COMMIT_OVERRIDE

[greptile-apps]

Greptile Summary

This is a large spec-driven regeneration adding new user and organization API key management endpoints, renaming RoleAssignment to UserRoleAssignment, introducing two new role-assignment-for-resource list operations, unifying BYOK key provider enums, and adding Name/User fields to several existing models.

• New endpoints: ListAPIKeys and CreateAPIKey on UserManagementService; ListRoleAssignmentsForResource and ListRoleAssignmentsForResourceByExternalID on AuthorizationService; ListJWTTemplate on UserManagementService.
• Breaking renames: RoleAssignment → UserRoleAssignment, APIKey → OrganizationAPIKey, APIKeyWithValue → OrganizationAPIKeyWithValue, and all service-specific *Order enum aliases removed in favour of the new generic PaginationOrder enum.
• Cross-cutting change: The hardcoded \"order\": \"desc\" default is removed from every newIterator call across the SDK, altering the implicit sort order for all list operations.

Confidence Score: 3/5

Safe to merge with caution: the bulk of the changes are mechanical spec-driven renames and additions, but the global removal of the "order": "desc" default from every list operation is a silent ordering change for all existing callers who did not explicitly set an order value.

The per-file renames, new models, and new endpoints all look correct and are backed by fixtures and tests. The concern that warrants attention is the cross-cutting removal of the default descending sort: every list iterator in authorization, user management, events, webhooks, and elsewhere previously requested order=desc implicitly, and that default is now gone. Existing consumers who page through resources and rely on recency ordering without explicitly passing an Order param will silently receive results in a different order after upgrading. The PaginationOrder enum is also introduced but left unused at the PaginationParams.Order field level (still *string), which reduces its practical value.

Pay closest attention to authorization.go, user_management.go, events.go, and webhooks.go for the iterator default-params change, and to enums.go / models.go for the PaginationOrder enum wiring.

Important Files Changed

Filename	Overview
models.go	Large model generation: adds UserRoleAssignment, OrganizationAPIKey/WithValue, UserAPIKey/WithValue, UserAPIKeyCreatedDataOwner, JWTTemplateResponse, VaultByokKeyDeleted/Data, and Profile.Name; removes many now-unused input models; struct fields look correct against the testdata fixtures.
enums.go	Adds PaginationOrder and VaultByokKeyProvider enums; removes ApplicationsOrder and all its service-specific aliases; adds EventContextActorSourceAdminPortal. PaginationOrder is unused in PaginationParams.Order (still *string).
authorization.go	Renames RoleAssignment→UserRoleAssignment on ListRoleAssignments/AssignRole; adds ListRoleAssignmentsForResource and ListRoleAssignmentsForResourceByExternalID; adds url:"-" tags to all POST body fields; removes "order":"desc" default from all iterators.
user_management.go	Adds ListJWTTemplate, ListAPIKeys, and CreateAPIKey operations; adds url:"-" tags to all POST body fields; removes "order":"desc" default from all iterators. ListJWTTemplate name is misleading for a single-resource GET.
api_keys.go	Updates ListOrganizationAPIKeys return type from APIKey to OrganizationAPIKey and CreateOrganizationAPIKey return type from APIKeyWithValue to OrganizationAPIKeyWithValue; reorders method definitions; adds url:"-" tags.
workos.go	Reorders the APIKeys service field and accessor to later in the struct/NewClient/methods — purely cosmetic reordering, no functional change.
authorization_test.go	Updates fixture filenames for renamed types; adds tests for ListRoleAssignmentsForResource and ListRoleAssignmentsForResourceByExternalID; updates AssignRole assertion to check OrganizationMembershipID instead of UpdatedAt.
user_management_test.go	Adds TestUserManagement_ListJWTTemplate, TestUserManagement_ListAPIKeys, and TestUserManagement_CreateAPIKey; updates user_id assertions in membership tests to match updated fixtures.
events.go	Removes "order":"desc" default from Event list iterator — same cross-cutting change applied everywhere.

Sequence Diagram

sequenceDiagram
    participant Caller
    participant UserManagementService
    participant AuthorizationService
    participant APIKeyService
    participant WorkOS_API

    Caller->>UserManagementService: ListAPIKeys(userID, params)
    UserManagementService->>WorkOS_API: GET /user_management/users/{userID}/api_keys
    WorkOS_API-->>UserManagementService: Iterator[UserAPIKey]
    UserManagementService-->>Caller: Iterator[UserAPIKey]

    Caller->>UserManagementService: CreateAPIKey(userID, params)
    UserManagementService->>WorkOS_API: POST /user_management/users/{userID}/api_keys
    WorkOS_API-->>UserManagementService: UserAPIKeyWithValue (incl. Value)
    UserManagementService-->>Caller: *UserAPIKeyWithValue

    Caller->>AuthorizationService: ListRoleAssignmentsForResource(resourceID, params)
    AuthorizationService->>WorkOS_API: GET /authorization/resources/{resourceID}/role_assignments
    WorkOS_API-->>AuthorizationService: Iterator[UserRoleAssignment]
    AuthorizationService-->>Caller: Iterator[UserRoleAssignment]

    Caller->>APIKeyService: ListOrganizationAPIKeys(orgID, params)
    APIKeyService->>WorkOS_API: GET /organizations/{orgID}/api_keys
    WorkOS_API-->>APIKeyService: Iterator[OrganizationAPIKey]
    APIKeyService-->>Caller: Iterator[OrganizationAPIKey]

Loading

Comments Outside Diff (2)

1. user_management.go, line 621-628 (link)

   ListJWTTemplate naming inconsistency

   The method is named ListJWTTemplate but it issues a GET /user_management/jwt_template request and returns a single *JWTTemplateResponse — not an iterator or slice. In this SDK, List* methods consistently return *Iterator[T] for paginated collections. Using the List prefix here diverges from that convention and may confuse consumers who expect a list. A name like GetJWTTemplate or FetchJWTTemplate would better reflect that only one template is ever returned.

   Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

2. authorization.go, line 18-19 (link)

   Implicit order: desc default removed from all list operations

   All newIterator calls across authorization.go, user_management.go, events.go, webhooks.go, and others previously included "order": "desc" in their default-params map. That entry has been removed everywhere. Any existing SDK consumer who relies on the SDK always requesting descending order (without setting PaginationParams.Order themselves) will now receive results in whatever order the server chooses by default. This is a silent behavioral break for callers who did not explicitly pass an order value.

_{Reviews (1): Last reviewed commit: "feat(generated)!: regenerate from spec (..." | Re-trigger Greptile}

[greptile-apps]

PaginationOrder enum unused in PaginationParams.Order

The new PaginationOrder enum (with values normal, desc, asc) is added to this file, but PaginationParams.Order remains typed as *string. This means callers passing the Order field get no compile-time validation — an arbitrary string like "DESC" or "ascending" would compile fine but likely cause a server-side error. The entire motivation for adding PaginationOrder is negated when the canonical place it would be used (PaginationParams.Order) still accepts any string.