# paths./agents/claims/attempts.patch.description
Link an external user to a claim attempt and retrieve the code needed for the agent to complete the claim. The user is looked up by external ID; if no user exists, one is created. When the user belongs to multiple organizations, an explicit organization must be provided.

# paths./agents/claims/attempts.patch.requestBody.content.application/json.schema.properties.type.description
The operation to perform on the claim attempt. Currently only `link_external_user` is supported.

# paths./agents/claims/attempts.patch.requestBody.content.application/json.schema.properties.claim_attempt_token.description
The token identifying the claim attempt.

# paths./agents/claims/attempts.patch.requestBody.content.application/json.schema.properties.user.description
The user to attach to the claim attempt, identified by email and external ID.

# paths./agents/claims/attempts.patch.requestBody.content.application/json.schema.properties.organization_id.description
The organization to place the agent in. Required when the user belongs to more than one organization.

# paths./agents/claims/attempts.patch.responses.400.description
Invalid request, email mismatch, invalid claim, invalid organization, or wrong account.

# paths./agents/claims/attempts.patch.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./agents/claims/attempts.patch.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./agents/claims/attempts.patch.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./agents/claims/attempts.patch.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./agents/claims/attempts.patch.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./agents/claims/attempts.patch.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./agents/claims/attempts.patch.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./agents/claims/attempts.patch.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./agents/claims/attempts.patch.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./agents/claims/attempts.patch.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./agents/claims/attempts.patch.responses.403.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./agents/claims/attempts.patch.responses.403.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./agents/claims/attempts.patch.responses.403.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./agents/claims/attempts.patch.responses.403.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./agents/claims/attempts.patch.responses.409.description
Organization selection required, email already in use, or claim already completed.

# paths./agents/claims/attempts.patch.responses.409.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./agents/claims/attempts.patch.responses.409.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./agents/claims/attempts.patch.responses.409.content.application/json.schema.oneOf[].properties.organizations.description
Organizations the user belongs to. Pick one and retry with organization_id.

# paths./agents/claims/attempts.patch.responses.409.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./agents/claims/attempts.patch.responses.409.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./agents/claims/attempts.patch.responses.409.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./agents/claims/attempts.patch.responses.409.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./agents/claims/attempts.patch.responses.410.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./agents/claims/attempts.patch.responses.410.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./agents/claims/attempts.patch.responses.410.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./agents/claims/attempts.patch.responses.410.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./agents/claims/attempts.patch.summary
Link a claim attempt to an external user

# paths./agents/credentials/validate.post.description
Validate an agent credential — an API key or access token — against the environment of the API key used to authenticate the request. This is a read-only check: it never consumes or mutates the credential.

# paths./agents/credentials/validate.post.requestBody.content.application/json.schema.oneOf[].properties.type.description
The kind of credential being validated — an agent API key or an agent access token.

# paths./agents/credentials/validate.post.requestBody.content.application/json.schema.oneOf[].properties.credential.description
The credential value to validate: the API key value for `api_key`, or the access token (JWT) for `access_token`.

# paths./agents/credentials/validate.post.requestBody.content.application/json.schema.oneOf[].properties.type.description
The kind of credential being validated — an agent API key or an agent access token.

# paths./agents/credentials/validate.post.requestBody.content.application/json.schema.oneOf[].properties.credential.description
The credential value to validate: the API key value for `api_key`, or the access token (JWT) for `access_token`.

# paths./agents/credentials/validate.post.requestBody.content.application/json.schema.oneOf[].properties.audience.description
When provided, the access token's `aud` claim is verified against this value. Tokens issued for a different resource are rejected.

# paths./agents/credentials/validate.post.requestBody.content.application/json.schema.description
The agent credential to validate. Either an `api_key` or an `access_token`, discriminated by `type`.

# paths./agents/credentials/validate.post.responses.400.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./agents/credentials/validate.post.responses.400.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./agents/registrations/{id}.get.description
Retrieve the details of an agent registration by ID. The registration is scoped to the environment of the API key used to authenticate the request.

# paths./agents/registrations/{id}.get.parameters[].description
The unique ID of the agent registration.

# paths./agents/registrations/{id}.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./api_keys/validations.post.description
Validate an API key value and return the API key object if valid.

# paths./api_keys/validations.post.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./api_keys/{id}.delete.description
Permanently deletes an API key. This action cannot be undone. Once deleted, any requests using this API key will fail authentication.

# paths./api_keys/{id}.delete.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./api_keys/{id}/expire.post.description
Expire an API key immediately, schedule a future expiration, or clear a scheduled future expiration.

# paths./api_keys/{id}/expire.post.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./api_keys/{id}/expire.post.responses.409.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./api_keys/{id}/expire.post.responses.409.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./api_keys/{id}/expire.post.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./audit_logs/actions.get.description
Get a list of all Audit Log actions in the current environment.

# paths./audit_logs/actions.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.

# paths./audit_logs/actions.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.

# paths./audit_logs/actions.get.parameters[].description
Upper limit on the number of objects to return, between `1` and `100`.

# paths./audit_logs/actions.get.responses.200.content.application/json.schema.allOf[].properties.list_metadata.properties.before.description
An object ID that defines your place in the list. When the ID is not present, you are at the start of the list.

# paths./audit_logs/actions.get.responses.200.content.application/json.schema.allOf[].properties.list_metadata.properties.after.description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.

# paths./audit_logs/actions.get.responses.200.content.application/json.schema.allOf[].properties.list_metadata.description
Pagination cursors for navigating between pages of results.

# paths./audit_logs/actions.get.responses.200.content.application/json.schema.allOf[].properties.data.description
The list of records for the current page.

# paths./audit_logs/actions.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./audit_logs/actions.get.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./audit_logs/actions/{actionName}/schemas.post.description
Creates a new Audit Log schema used to validate the payload of incoming Audit Log Events. If the `action` does not exist, it will also be created.

# paths./audit_logs/actions/{actionName}/schemas.post.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./audit_logs/actions/{actionName}/schemas.get.description
Get a list of all schemas for the Audit Logs action identified by `:name`.

# paths./audit_logs/actions/{actionName}/schemas.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.

# paths./audit_logs/actions/{actionName}/schemas.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.

# paths./audit_logs/actions/{actionName}/schemas.get.parameters[].description
Upper limit on the number of objects to return, between `1` and `100`.

# paths./audit_logs/actions/{actionName}/schemas.get.responses.200.content.application/json.schema.allOf[].properties.list_metadata.properties.before.description
An object ID that defines your place in the list. When the ID is not present, you are at the start of the list.

# paths./audit_logs/actions/{actionName}/schemas.get.responses.200.content.application/json.schema.allOf[].properties.list_metadata.properties.after.description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.

# paths./audit_logs/actions/{actionName}/schemas.get.responses.200.content.application/json.schema.allOf[].properties.list_metadata.description
Pagination cursors for navigating between pages of results.

# paths./audit_logs/actions/{actionName}/schemas.get.responses.200.content.application/json.schema.allOf[].properties.data.description
The list of records for the current page.

# paths./audit_logs/actions/{actionName}/schemas.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./audit_logs/actions/{actionName}/schemas.get.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./audit_logs/events.post.description
Create an Audit Log Event.

This API supports idempotency which guarantees that performing the same operation multiple times will have the same result as if the operation were performed only once. This is handy in situations where you may need to retry a request due to a failure or prevent accidental duplicate requests from creating more than one resource.

To achieve idempotency, you can add `Idempotency-Key` request header to a Create Event request with a unique string as the value. Each subsequent request matching this unique string will return the same response. We suggest using [v4 UUIDs](https://en.wikipedia.org/wiki/Universally_unique_identifier) for idempotency keys to avoid collisions.

Idempotency keys expire after 24 hours. The API will generate a new response if you submit a request with an expired key.

# paths./audit_logs/events.post.parameters[].description
A unique string to prevent duplicate requests. Each subsequent request matching this unique string will return the same response. We suggest using v4 UUIDs. Keys expire after 24 hours.

# paths./audit_logs/events.post.responses.400.content.application/json.schema.anyOf[].properties.errors.items.properties.instancePath.description
The JSON path to the invalid field in the event payload.

# paths./audit_logs/events.post.responses.400.content.application/json.schema.anyOf[].properties.message.description
A human-readable description of the error.

# paths./audit_logs/events.post.responses.400.content.application/json.schema.anyOf[].properties.code.description
The error code identifying the type of error.

# paths./audit_logs/events.post.responses.400.content.application/json.schema.anyOf[].properties.message.description
A human-readable description of the error.

# paths./audit_logs/events.post.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./audit_logs/events.post.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./audit_logs/events.post.responses.429.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./audit_logs/events.post.responses.429.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./audit_logs/exports.post.description
Create an Audit Log Export. Exports are scoped to a single organization within a specified date range.

# paths./audit_logs/exports.post.responses.400.description
Invalid request parameters or date range.

# paths./audit_logs/exports.post.responses.400.content.application/json.schema.anyOf[].properties.message.description
A human-readable description of the error.

# paths./audit_logs/exports.post.responses.400.content.application/json.schema.anyOf[].properties.message.description
A list of human-readable error messages describing the validation failures.

# paths./audit_logs/exports/{auditLogExportId}.get.description
Get an Audit Log Export. The URL will expire after 10 minutes. If the export is needed again at a later time, refetching the export will regenerate the URL.

# paths./audit_logs/exports/{auditLogExportId}.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./auth/challenges/{id}/verify.post.parameters[].description
The unique ID of the Authentication Challenge.

# paths./auth/challenges/{id}/verify.post.responses.400.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./auth/challenges/{id}/verify.post.responses.400.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./auth/challenges/{id}/verify.post.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./auth/challenges/{id}/verify.post.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./auth/factors/enroll.post.description
Enrolls an Authentication Factor to be used as an additional factor of authentication. The returned ID should be used to create an authentication Challenge.

# paths./auth/factors/enroll.post.requestBody.content.application/json.schema.properties.user_id.description
The ID of the user to associate the factor with.

# paths./auth/factors/enroll.post.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./auth/factors/{id}.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./auth/factors/{id}.delete.description
Permanently deletes an Authentication Factor. It cannot be undone.

# paths./auth/factors/{id}.delete.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./auth/factors/{id}/challenge.post.description
Creates a Challenge for an Authentication Factor.

# paths./auth/factors/{id}/challenge.post.parameters[].description
The unique ID of the Authentication Factor to be challenged.

# paths./auth/factors/{id}/challenge.post.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./auth/factors/{id}/challenge.post.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authkit/oauth2/complete.post.description
Completes an external authentication flow and returns control to AuthKit. This endpoint is used with [Standalone Connect](/authkit/connect/standalone) to bridge your existing authentication system with the Connect OAuth API infrastructure.

After successfully authenticating a user in your application, calling this endpoint will:

- Create or update the user in AuthKit, using the given `id` as its `external_id`.
- Return a `redirect_uri` your application should redirect to in order for AuthKit to complete the flow

Users are automatically created or updated based on the `id` and `email` provided. If a user with the same `id` exists, their information is updated. Otherwise, a new user is created.

If you provide a new `id` with an `email` that already belongs to an existing user, the request will fail with an error as email addresses are unique to a user.

# paths./authkit/oauth2/complete.post.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./authkit/oauth2/complete.post.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./authkit/oauth2/complete.post.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./authkit/oauth2/complete.post.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./authkit/oauth2/complete.post.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./authkit/oauth2/complete.post.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./authkit/oauth2/complete.post.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./authkit/oauth2/complete.post.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./authkit/oauth2/complete.post.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./authkit/oauth2/complete.post.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./authkit/oauth2/complete.post.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./authkit/oauth2/complete.post.responses.400.content.application/json.schema.oneOf[].properties.message.example
Claim "sub" is reserved and cannot be used.

# paths./authkit/oauth2/complete.post.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authkit/oauth2/complete.post.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/groups/{group_id}/role_assignments.get.description
List all role assignments granted to a group. Each assignment represents a role granted to the group on a resource.

# paths./authorization/groups/{group_id}/role_assignments.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`.

# paths./authorization/groups/{group_id}/role_assignments.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`.

# paths./authorization/groups/{group_id}/role_assignments.get.parameters[].description
Upper limit on the number of objects to return, between `1` and `100`.

# paths./authorization/groups/{group_id}/role_assignments.get.parameters[].description
Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records).

# paths./authorization/groups/{group_id}/role_assignments.get.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/groups/{group_id}/role_assignments.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/groups/{group_id}/role_assignments.post.description
Assign a role to a group on a specific resource.

# paths./authorization/groups/{group_id}/role_assignments.post.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/groups/{group_id}/role_assignments.post.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/groups/{group_id}/role_assignments.post.responses.409.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./authorization/groups/{group_id}/role_assignments.post.responses.409.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/groups/{group_id}/role_assignments.post.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/groups/{group_id}/role_assignments.put.description
Replace all role assignments for a group with the provided list. Existing assignments not in the list will be removed.

# paths./authorization/groups/{group_id}/role_assignments.put.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/groups/{group_id}/role_assignments.put.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/groups/{group_id}/role_assignments.put.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/groups/{group_id}/role_assignments.put.summary
Replace all role assignments for a group

# paths./authorization/groups/{group_id}/role_assignments.delete.description
Remove role assignments from a group that match the provided criteria. Returns 404 when no matching active assignment is found.

# paths./authorization/groups/{group_id}/role_assignments.delete.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/groups/{group_id}/role_assignments.delete.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/groups/{group_id}/role_assignments.delete.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/groups/{group_id}/role_assignments.delete.summary
Remove group role assignments by criteria

# paths./authorization/groups/{group_id}/role_assignments/{role_assignme.get.description
Get a specific role assignment for a group by its ID.

# paths./authorization/groups/{group_id}/role_assignments/{role_assignme.get.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/groups/{group_id}/role_assignments/{role_assignme.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/groups/{group_id}/role_assignments/{role_assignme.delete.description
Remove a specific role assignment from a group by its ID.

# paths./authorization/groups/{group_id}/role_assignments/{role_assignme.delete.parameters[].description
The ID of the group role assignment to remove.

# paths./authorization/groups/{group_id}/role_assignments/{role_assignme.delete.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/groups/{group_id}/role_assignments/{role_assignme.delete.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organization_memberships/{organization_membership.post.description
Check if an organization membership has a specific permission on a resource. Supports identification by resource_id OR by resource_external_id + resource_type_slug.

# paths./authorization/organization_memberships/{organization_membership.post.parameters[].description
The ID of the organization membership to check.

# paths./authorization/organization_memberships/{organization_membership.post.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organization_memberships/{organization_membership.post.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organization_memberships/{organization_membership.post.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organization_memberships/{organization_membership.get.description
Returns all child resources of a parent resource where the organization membership has a specific permission. This is useful for resource discovery—answering "What projects can this user access in this workspace?"

You must provide either `parent_resource_id` or both `parent_resource_external_id` and `parent_resource_type_slug` to identify the parent resource.

# paths./authorization/organization_memberships/{organization_membership.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`.

# paths./authorization/organization_memberships/{organization_membership.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`.

# paths./authorization/organization_memberships/{organization_membership.get.parameters[].description
Upper limit on the number of objects to return, between `1` and `100`.

# paths./authorization/organization_memberships/{organization_membership.get.parameters[].description
Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records).

# paths./authorization/organization_memberships/{organization_membership.get.parameters[].description
The permission slug to filter by. Only child resources where the organization membership has this permission are returned.

# paths./authorization/organization_memberships/{organization_membership.get.parameters[].description
The WorkOS ID of the parent resource. Provide this or both `parent_resource_external_id` and `parent_resource_type_slug`, but not both. Mutually exclusive with `parent_resource_type_slug` and `parent_resource_external_id`.

# paths./authorization/organization_memberships/{organization_membership.get.parameters[].description
The slug of the parent resource type. Must be provided together with `parent_resource_external_id`. Required with `parent_resource_external_id`. Mutually exclusive with `parent_resource_id`.

# paths./authorization/organization_memberships/{organization_membership.get.parameters[].description
The application-specific external identifier of the parent resource. Must be provided together with `parent_resource_type_slug`. Required with `parent_resource_type_slug`. Mutually exclusive with `parent_resource_id`.

# paths./authorization/organization_memberships/{organization_membership.get.responses.400.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./authorization/organization_memberships/{organization_membership.get.responses.400.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organization_memberships/{organization_membership.get.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organization_memberships/{organization_membership.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organization_memberships/{organization_membership.get.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organization_memberships/{organization_membership.get.summary
List resources for organization membership

# paths./authorization/organization_memberships/{organization_membership.get.description
Returns all permissions the organization membership effectively has on a resource, including permissions inherited through roles assigned to ancestor resources.

# paths./authorization/organization_memberships/{organization_membership.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`.

# paths./authorization/organization_memberships/{organization_membership.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`.

# paths./authorization/organization_memberships/{organization_membership.get.parameters[].description
Upper limit on the number of objects to return, between `1` and `100`.

# paths./authorization/organization_memberships/{organization_membership.get.parameters[].description
Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records).

# paths./authorization/organization_memberships/{organization_membership.get.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organization_memberships/{organization_membership.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organization_memberships/{organization_membership.get.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organization_memberships/{organization_membership.get.summary
List effective permissions for an organization membership on a resource

# paths./authorization/organization_memberships/{organization_membership.get.description
Returns all permissions the organization membership effectively has on a resource identified by its external ID, including permissions inherited through roles assigned to ancestor resources.

# paths./authorization/organization_memberships/{organization_membership.get.parameters[].description
An identifier you provide to reference the resource in your system.

# paths./authorization/organization_memberships/{organization_membership.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`.

# paths./authorization/organization_memberships/{organization_membership.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`.

# paths./authorization/organization_memberships/{organization_membership.get.parameters[].description
Upper limit on the number of objects to return, between `1` and `100`.

# paths./authorization/organization_memberships/{organization_membership.get.parameters[].description
Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records).

# paths./authorization/organization_memberships/{organization_membership.get.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organization_memberships/{organization_membership.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organization_memberships/{organization_membership.get.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organization_memberships/{organization_membership.get.summary
List effective permissions for an organization membership on a resource by external ID

# paths./authorization/organization_memberships/{organization_membership.get.description
List all role assignments for an organization membership. This returns all roles that have been assigned to the user on resources, including organization-level and sub-resource roles.

# paths./authorization/organization_memberships/{organization_membership.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`.

# paths./authorization/organization_memberships/{organization_membership.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`.

# paths./authorization/organization_memberships/{organization_membership.get.parameters[].description
Upper limit on the number of objects to return, between `1` and `100`.

# paths./authorization/organization_memberships/{organization_membership.get.parameters[].description
Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records).

# paths./authorization/organization_memberships/{organization_membership.get.parameters[].description
Filter assignments by the ID of the resource.

# paths./authorization/organization_memberships/{organization_membership.get.parameters[].description
Filter assignments by the external ID of the resource.

# paths./authorization/organization_memberships/{organization_membership.get.parameters[].description
Filter assignments by the slug of the resource type.

# paths./authorization/organization_memberships/{organization_membership.get.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organization_memberships/{organization_membership.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organization_memberships/{organization_membership.post.description
Assign a role to an organization membership on a specific resource.

# paths./authorization/organization_memberships/{organization_membership.post.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organization_memberships/{organization_membership.post.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organization_memberships/{organization_membership.post.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organization_memberships/{organization_membership.delete.description
Remove a role assignment by role slug and resource.

# paths./authorization/organization_memberships/{organization_membership.delete.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organization_memberships/{organization_membership.delete.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organization_memberships/{organization_membership.delete.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organization_memberships/{organization_membership.delete.parameters[].description
The ID of the role assignment to remove.

# paths./authorization/organization_memberships/{organization_membership.delete.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organization_memberships/{organization_membership.delete.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organizations/{organizationId}/roles.post.description
Create a new custom role for this organization.

# paths./authorization/organizations/{organizationId}/roles.post.responses.201.content.application/json.schema.properties.type.description
Whether the role is scoped to the environment or an organization (custom role).

# paths./authorization/organizations/{organizationId}/roles.post.responses.201.content.application/json.schema.properties.resource_type_slug.description
The slug of the resource type the role is scoped to.

# paths./authorization/organizations/{organizationId}/roles.post.responses.201.content.application/json.schema.properties.permissions.description
The permission slugs assigned to the role.

# paths./authorization/organizations/{organizationId}/roles.post.responses.400.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./authorization/organizations/{organizationId}/roles.post.responses.400.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organizations/{organizationId}/roles.post.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organizations/{organizationId}/roles.post.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organizations/{organizationId}/roles.post.responses.409.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./authorization/organizations/{organizationId}/roles.post.responses.409.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organizations/{organizationId}/roles.post.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organizations/{organizationId}/roles.get.description
Get a list of all roles that apply to an organization. This includes both environment roles and custom roles, returned in priority order.

# paths./authorization/organizations/{organizationId}/roles.get.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organizations/{organizationId}/roles.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organizations/{organizationId}/roles/{slug}.get.description
Retrieve a role that applies to an organization by its slug. This can return either an environment role or a custom role.

# paths./authorization/organizations/{organizationId}/roles/{slug}.get.responses.200.content.application/json.schema.properties.type.description
Whether the role is scoped to the environment or an organization (custom role).

# paths./authorization/organizations/{organizationId}/roles/{slug}.get.responses.200.content.application/json.schema.properties.resource_type_slug.description
The slug of the resource type the role is scoped to.

# paths./authorization/organizations/{organizationId}/roles/{slug}.get.responses.200.content.application/json.schema.properties.permissions.description
The permission slugs assigned to the role.

# paths./authorization/organizations/{organizationId}/roles/{slug}.get.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organizations/{organizationId}/roles/{slug}.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organizations/{organizationId}/roles/{slug}.patch.description
Update an existing custom role. Only the fields provided in the request body will be updated.

# paths./authorization/organizations/{organizationId}/roles/{slug}.patch.responses.200.content.application/json.schema.properties.type.description
Whether the role is scoped to the environment or an organization (custom role).

# paths./authorization/organizations/{organizationId}/roles/{slug}.patch.responses.200.content.application/json.schema.properties.resource_type_slug.description
The slug of the resource type the role is scoped to.

# paths./authorization/organizations/{organizationId}/roles/{slug}.patch.responses.200.content.application/json.schema.properties.permissions.description
The permission slugs assigned to the role.

# paths./authorization/organizations/{organizationId}/roles/{slug}.patch.responses.400.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./authorization/organizations/{organizationId}/roles/{slug}.patch.responses.400.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organizations/{organizationId}/roles/{slug}.patch.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organizations/{organizationId}/roles/{slug}.patch.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organizations/{organizationId}/roles/{slug}.patch.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organizations/{organizationId}/roles/{slug}.delete.responses.400.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./authorization/organizations/{organizationId}/roles/{slug}.delete.responses.400.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organizations/{organizationId}/roles/{slug}.delete.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organizations/{organizationId}/roles/{slug}.delete.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organizations/{organizationId}/roles/{slug}.delete.responses.409.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./authorization/organizations/{organizationId}/roles/{slug}.delete.responses.409.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./authorization/organizations/{organizationId}/roles/{slug}.delete.responses.409.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./authorization/organizations/{organizationId}/roles/{slug}.delete.responses.409.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./authorization/organizations/{organizationId}/roles/{slug}/permi.put.description
Replace all permissions on a custom role with the provided list.

# paths./authorization/organizations/{organizationId}/roles/{slug}/permi.put.responses.200.content.application/json.schema.properties.type.description
Whether the role is scoped to the environment or an organization (custom role).

# paths./authorization/organizations/{organizationId}/roles/{slug}/permi.put.responses.200.content.application/json.schema.properties.resource_type_slug.description
The slug of the resource type the role is scoped to.

# paths./authorization/organizations/{organizationId}/roles/{slug}/permi.put.responses.200.content.application/json.schema.properties.permissions.description
The permission slugs assigned to the role.

# paths./authorization/organizations/{organizationId}/roles/{slug}/permi.put.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organizations/{organizationId}/roles/{slug}/permi.put.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organizations/{organizationId}/roles/{slug}/permi.put.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organizations/{organizationId}/roles/{slug}/permi.post.description
Add a single permission to a custom role. If the permission is already assigned to the role, this operation has no effect.

# paths./authorization/organizations/{organizationId}/roles/{slug}/permi.post.responses.200.content.application/json.schema.properties.type.description
Whether the role is scoped to the environment or an organization (custom role).

# paths./authorization/organizations/{organizationId}/roles/{slug}/permi.post.responses.200.content.application/json.schema.properties.resource_type_slug.description
The slug of the resource type the role is scoped to.

# paths./authorization/organizations/{organizationId}/roles/{slug}/permi.post.responses.200.content.application/json.schema.properties.permissions.description
The permission slugs assigned to the role.

# paths./authorization/organizations/{organizationId}/roles/{slug}/permi.post.responses.400.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./authorization/organizations/{organizationId}/roles/{slug}/permi.post.responses.400.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organizations/{organizationId}/roles/{slug}/permi.post.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organizations/{organizationId}/roles/{slug}/permi.post.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organizations/{organizationId}/roles/{slug}/permi.post.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organizations/{organizationId}/roles/{slug}/permi.delete.description
Remove a single permission from a custom role by its slug.

# paths./authorization/organizations/{organizationId}/roles/{slug}/permi.delete.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organizations/{organizationId}/roles/{slug}/permi.delete.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organizations/{organization_id}/resources/{resour.get.description
Retrieve the details of an authorization resource by its external ID, organization, and resource type. This is useful when you only have the external ID from your system and need to fetch the full resource details.

# paths./authorization/organizations/{organization_id}/resources/{resour.get.parameters[].description
The ID of the organization that owns the resource.

# paths./authorization/organizations/{organization_id}/resources/{resour.get.parameters[].description
An identifier you provide to reference the resource in your system.

# paths./authorization/organizations/{organization_id}/resources/{resour.get.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organizations/{organization_id}/resources/{resour.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organizations/{organization_id}/resources/{resour.patch.description
Update an existing authorization resource using its external ID.

# paths./authorization/organizations/{organization_id}/resources/{resour.patch.parameters[].description
The ID of the organization that owns the resource.

# paths./authorization/organizations/{organization_id}/resources/{resour.patch.parameters[].description
An identifier you provide to reference the resource in your system.

# paths./authorization/organizations/{organization_id}/resources/{resour.patch.responses.200.content.application/json.schema.properties.description.description
An optional description of the Resource.

# paths./authorization/organizations/{organization_id}/resources/{resour.patch.responses.200.content.application/json.schema.properties.organization_id.description
The ID of the organization that owns the resource.

# paths./authorization/organizations/{organization_id}/resources/{resour.patch.responses.200.content.application/json.schema.properties.parent_resource_id.description
The ID of the parent resource, if this resource is nested.

# paths./authorization/organizations/{organization_id}/resources/{resour.patch.responses.200.content.application/json.schema.properties.external_id.description
An identifier you provide to reference the resource in your system.

# paths./authorization/organizations/{organization_id}/resources/{resour.patch.responses.200.content.application/json.schema.properties.resource_type_slug.description
The slug of the resource type this resource belongs to.

# paths./authorization/organizations/{organization_id}/resources/{resour.patch.responses.400.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./authorization/organizations/{organization_id}/resources/{resour.patch.responses.400.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organizations/{organization_id}/resources/{resour.patch.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organizations/{organization_id}/resources/{resour.patch.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organizations/{organization_id}/resources/{resour.patch.responses.409.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./authorization/organizations/{organization_id}/resources/{resour.patch.responses.409.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organizations/{organization_id}/resources/{resour.patch.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organizations/{organization_id}/resources/{resour.delete.description
Delete an authorization resource by organization, resource type, and external ID. This also deletes all descendant resources.

# paths./authorization/organizations/{organization_id}/resources/{resour.delete.parameters[].description
The ID of the organization that owns the resource.

# paths./authorization/organizations/{organization_id}/resources/{resour.delete.parameters[].description
An identifier you provide to reference the resource in your system.

# paths./authorization/organizations/{organization_id}/resources/{resour.delete.parameters[].description
If true, deletes all descendant resources and role assignments. If not set and the resource has children or assignments, the request will fail.

# paths./authorization/organizations/{organization_id}/resources/{resour.delete.responses.400.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./authorization/organizations/{organization_id}/resources/{resour.delete.responses.400.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organizations/{organization_id}/resources/{resour.delete.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organizations/{organization_id}/resources/{resour.delete.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organizations/{organization_id}/resources/{resour.delete.responses.409.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./authorization/organizations/{organization_id}/resources/{resour.delete.responses.409.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./authorization/organizations/{organization_id}/resources/{resour.delete.responses.409.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./authorization/organizations/{organization_id}/resources/{resour.delete.responses.409.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./authorization/organizations/{organization_id}/resources/{resour.delete.summary
Delete an authorization resource by external ID

# paths./authorization/organizations/{organization_id}/resources/{resour.get.description
Returns all organization memberships that have a specific permission on a resource, using the resource's external ID. This is useful for answering "Who can access this resource?" when you only have the external ID.

# paths./authorization/organizations/{organization_id}/resources/{resour.get.parameters[].description
The ID of the organization that owns the resource.

# paths./authorization/organizations/{organization_id}/resources/{resour.get.parameters[].description
The slug of the resource type this resource belongs to.

# paths./authorization/organizations/{organization_id}/resources/{resour.get.parameters[].description
An identifier you provide to reference the resource in your system.

# paths./authorization/organizations/{organization_id}/resources/{resour.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`.

# paths./authorization/organizations/{organization_id}/resources/{resour.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`.

# paths./authorization/organizations/{organization_id}/resources/{resour.get.parameters[].description
Upper limit on the number of objects to return, between `1` and `100`.

# paths./authorization/organizations/{organization_id}/resources/{resour.get.parameters[].description
Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records).

# paths./authorization/organizations/{organization_id}/resources/{resour.get.parameters[].description
The permission slug to filter by. Only users with this permission on the resource are returned.

# paths./authorization/organizations/{organization_id}/resources/{resour.get.parameters[].description
Filter by assignment type. Use "direct" for direct assignments only, or "indirect" to include inherited assignments.

# paths./authorization/organizations/{organization_id}/resources/{resour.get.responses.400.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./authorization/organizations/{organization_id}/resources/{resour.get.responses.400.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organizations/{organization_id}/resources/{resour.get.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organizations/{organization_id}/resources/{resour.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organizations/{organization_id}/resources/{resour.get.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organizations/{organization_id}/resources/{resour.get.summary
List memberships for a resource by external ID

# paths./authorization/organizations/{organization_id}/resources/{resour.get.description
List all role assignments granted on a resource, identified by its external ID. Each assignment includes the organization membership it was granted to.

# paths./authorization/organizations/{organization_id}/resources/{resour.get.parameters[].description
The ID of the organization that owns the resource.

# paths./authorization/organizations/{organization_id}/resources/{resour.get.parameters[].description
An identifier you provide to reference the resource in your system.

# paths./authorization/organizations/{organization_id}/resources/{resour.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`.

# paths./authorization/organizations/{organization_id}/resources/{resour.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`.

# paths./authorization/organizations/{organization_id}/resources/{resour.get.parameters[].description
Upper limit on the number of objects to return, between `1` and `100`.

# paths./authorization/organizations/{organization_id}/resources/{resour.get.parameters[].description
Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records).

# paths./authorization/organizations/{organization_id}/resources/{resour.get.parameters[].description
Filter assignments by the slug of the role.

# paths./authorization/organizations/{organization_id}/resources/{resour.get.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organizations/{organization_id}/resources/{resour.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/organizations/{organization_id}/resources/{resour.get.summary
List role assignments for a resource by external ID

# paths./authorization/permissions.get.description
Get a list of all permissions in your WorkOS environment.

# paths./authorization/permissions.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`.

# paths./authorization/permissions.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`.

# paths./authorization/permissions.get.parameters[].description
Upper limit on the number of objects to return, between `1` and `100`.

# paths./authorization/permissions.get.parameters[].description
Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records).

# paths./authorization/permissions.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/permissions.post.description
Create a new permission in your WorkOS environment. The permission can then be assigned to environment roles and custom roles.

# paths./authorization/permissions.post.responses.201.content.application/json.schema.properties.slug.description
A unique key to reference the permission. Must be lowercase and contain only letters, numbers, hyphens, underscores, colons, periods, and asterisks.

# paths./authorization/permissions.post.responses.201.content.application/json.schema.properties.description.description
An optional description of the Permission.

# paths./authorization/permissions.post.responses.201.content.application/json.schema.properties.system.description
Whether the permission is a system permission. System permissions are managed by WorkOS and cannot be deleted.

# paths./authorization/permissions.post.responses.201.content.application/json.schema.properties.resource_type_slug.description
The slug of the resource type associated with the permission.

# paths./authorization/permissions.post.responses.400.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./authorization/permissions.post.responses.400.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/permissions.post.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/permissions.post.responses.409.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./authorization/permissions.post.responses.409.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/permissions.post.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/permissions/{slug}.get.description
Retrieve a permission by its unique slug.

# paths./authorization/permissions/{slug}.get.parameters[].description
A unique key to reference the permission. Must be lowercase and contain only letters, numbers, hyphens, underscores, colons, periods, and asterisks.

# paths./authorization/permissions/{slug}.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/permissions/{slug}.patch.description
Update an existing permission. Only the fields provided in the request body will be updated.

# paths./authorization/permissions/{slug}.patch.parameters[].description
A unique key to reference the permission. Must be lowercase and contain only letters, numbers, hyphens, underscores, colons, periods, and asterisks.

# paths./authorization/permissions/{slug}.patch.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/permissions/{slug}.patch.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/permissions/{slug}.patch.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/permissions/{slug}.delete.description
Delete an existing permission. System permissions cannot be deleted.

# paths./authorization/permissions/{slug}.delete.parameters[].description
A unique key to reference the permission. Must be lowercase and contain only letters, numbers, hyphens, underscores, colons, periods, and asterisks.

# paths./authorization/permissions/{slug}.delete.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/permissions/{slug}.delete.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/resources.get.description
Get a paginated list of authorization resources.

# paths./authorization/resources.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`.

# paths./authorization/resources.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`.

# paths./authorization/resources.get.parameters[].description
Upper limit on the number of objects to return, between `1` and `100`.

# paths./authorization/resources.get.parameters[].description
Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records).

# paths./authorization/resources.get.parameters[].description
Filter resources by parent resource ID. Mutually exclusive with `parent_resource_type_slug` and `parent_external_id`.

# paths./authorization/resources.get.parameters[].description
Filter resources by parent resource type slug. Required with `parent_external_id`. Mutually exclusive with `parent_resource_id`.

# paths./authorization/resources.get.parameters[].description
Filter resources by parent external ID. Required with `parent_resource_type_slug`. Mutually exclusive with `parent_resource_id`.

# paths./authorization/resources.get.responses.400.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./authorization/resources.get.responses.400.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/resources.get.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/resources.get.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/resources.post.responses.201.content.application/json.schema.properties.description.description
An optional description of the Resource.

# paths./authorization/resources.post.responses.201.content.application/json.schema.properties.organization_id.description
The ID of the organization that owns the resource.

# paths./authorization/resources.post.responses.201.content.application/json.schema.properties.parent_resource_id.description
The ID of the parent resource, if this resource is nested.

# paths./authorization/resources.post.responses.201.content.application/json.schema.properties.external_id.description
An identifier you provide to reference the resource in your system.

# paths./authorization/resources.post.responses.201.content.application/json.schema.properties.resource_type_slug.description
The slug of the resource type this resource belongs to.

# paths./authorization/resources.post.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./authorization/resources.post.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./authorization/resources.post.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./authorization/resources.post.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./authorization/resources.post.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/resources.post.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/resources.post.responses.409.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./authorization/resources.post.responses.409.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./authorization/resources.post.responses.409.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./authorization/resources.post.responses.409.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./authorization/resources.post.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/resources/{resource_id}.get.description
Retrieve the details of an authorization resource by its ID.

# paths./authorization/resources/{resource_id}.get.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/resources/{resource_id}.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/resources/{resource_id}.get.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/resources/{resource_id}.patch.description
Update an existing authorization resource.

# paths./authorization/resources/{resource_id}.patch.responses.200.content.application/json.schema.properties.description.description
An optional description of the Resource.

# paths./authorization/resources/{resource_id}.patch.responses.200.content.application/json.schema.properties.organization_id.description
The ID of the organization that owns the resource.

# paths./authorization/resources/{resource_id}.patch.responses.200.content.application/json.schema.properties.parent_resource_id.description
The ID of the parent resource, if this resource is nested.

# paths./authorization/resources/{resource_id}.patch.responses.200.content.application/json.schema.properties.external_id.description
An identifier you provide to reference the resource in your system.

# paths./authorization/resources/{resource_id}.patch.responses.200.content.application/json.schema.properties.resource_type_slug.description
The slug of the resource type this resource belongs to.

# paths./authorization/resources/{resource_id}.patch.responses.400.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./authorization/resources/{resource_id}.patch.responses.400.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/resources/{resource_id}.patch.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/resources/{resource_id}.patch.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/resources/{resource_id}.patch.responses.409.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./authorization/resources/{resource_id}.patch.responses.409.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/resources/{resource_id}.patch.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/resources/{resource_id}.delete.description
Delete an authorization resource and all its descendants.

# paths./authorization/resources/{resource_id}.delete.parameters[].description
If true, deletes all descendant resources and role assignments. If not set and the resource has children or assignments, the request will fail.

# paths./authorization/resources/{resource_id}.delete.responses.400.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./authorization/resources/{resource_id}.delete.responses.400.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/resources/{resource_id}.delete.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/resources/{resource_id}.delete.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/resources/{resource_id}.delete.responses.409.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./authorization/resources/{resource_id}.delete.responses.409.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./authorization/resources/{resource_id}.delete.responses.409.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./authorization/resources/{resource_id}.delete.responses.409.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./authorization/resources/{resource_id}/organization_memberships.get.description
Returns all organization memberships that have a specific permission on a resource instance. This is useful for answering "Who can access this resource?".

# paths./authorization/resources/{resource_id}/organization_memberships.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`.

# paths./authorization/resources/{resource_id}/organization_memberships.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`.

# paths./authorization/resources/{resource_id}/organization_memberships.get.parameters[].description
Upper limit on the number of objects to return, between `1` and `100`.

# paths./authorization/resources/{resource_id}/organization_memberships.get.parameters[].description
Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records).

# paths./authorization/resources/{resource_id}/organization_memberships.get.parameters[].description
The permission slug to filter by. Only users with this permission on the resource are returned.

# paths./authorization/resources/{resource_id}/organization_memberships.get.parameters[].description
Filter by assignment type. Use `direct` for direct assignments only, or `indirect` to include inherited assignments.

# paths./authorization/resources/{resource_id}/organization_memberships.get.responses.400.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./authorization/resources/{resource_id}/organization_memberships.get.responses.400.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/resources/{resource_id}/organization_memberships.get.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/resources/{resource_id}/organization_memberships.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/resources/{resource_id}/organization_memberships.get.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/resources/{resource_id}/organization_memberships.get.summary
List organization memberships for resource

# paths./authorization/resources/{resource_id}/role_assignments.get.description
List all role assignments granted on a specific resource instance. Each assignment includes the organization membership it was granted to.

# paths./authorization/resources/{resource_id}/role_assignments.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`.

# paths./authorization/resources/{resource_id}/role_assignments.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`.

# paths./authorization/resources/{resource_id}/role_assignments.get.parameters[].description
Upper limit on the number of objects to return, between `1` and `100`.

# paths./authorization/resources/{resource_id}/role_assignments.get.parameters[].description
Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records).

# paths./authorization/resources/{resource_id}/role_assignments.get.parameters[].description
Filter assignments by the slug of the role.

# paths./authorization/resources/{resource_id}/role_assignments.get.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/resources/{resource_id}/role_assignments.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/roles.post.responses.201.content.application/json.schema.properties.type.description
Whether the role is scoped to the environment or an organization (custom role).

# paths./authorization/roles.post.responses.201.content.application/json.schema.properties.resource_type_slug.description
The slug of the resource type the role is scoped to.

# paths./authorization/roles.post.responses.201.content.application/json.schema.properties.permissions.description
The permission slugs assigned to the role.

# paths./authorization/roles.post.responses.400.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./authorization/roles.post.responses.400.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/roles.post.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/roles.post.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/roles.post.responses.409.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./authorization/roles.post.responses.409.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/roles.post.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/roles.get.description
List all environment roles in priority order.

# paths./authorization/roles.get.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/roles/{slug}.get.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/roles/{slug}.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/roles/{slug}.patch.responses.200.content.application/json.schema.properties.description.example
Full administrative access to all resources

# paths./authorization/roles/{slug}.patch.responses.200.content.application/json.schema.properties.type.description
Whether the role is scoped to the environment or an organization (custom role).

# paths./authorization/roles/{slug}.patch.responses.200.content.application/json.schema.properties.resource_type_slug.description
The slug of the resource type the role is scoped to.

# paths./authorization/roles/{slug}.patch.responses.200.content.application/json.schema.properties.permissions.description
The permission slugs assigned to the role.

# paths./authorization/roles/{slug}.patch.responses.400.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./authorization/roles/{slug}.patch.responses.400.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/roles/{slug}.patch.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/roles/{slug}.patch.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/roles/{slug}.patch.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/roles/{slug}/permissions.put.description
Replace all permissions on an environment role with the provided list.

# paths./authorization/roles/{slug}/permissions.put.responses.200.content.application/json.schema.properties.type.description
Whether the role is scoped to the environment or an organization (custom role).

# paths./authorization/roles/{slug}/permissions.put.responses.200.content.application/json.schema.properties.resource_type_slug.description
The slug of the resource type the role is scoped to.

# paths./authorization/roles/{slug}/permissions.put.responses.200.content.application/json.schema.properties.permissions.description
The permission slugs assigned to the role.

# paths./authorization/roles/{slug}/permissions.put.responses.400.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./authorization/roles/{slug}/permissions.put.responses.400.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/roles/{slug}/permissions.put.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/roles/{slug}/permissions.put.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/roles/{slug}/permissions.put.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/roles/{slug}/permissions.post.description
Add a single permission to an environment role. If the permission is already assigned to the role, this operation has no effect.

# paths./authorization/roles/{slug}/permissions.post.responses.200.content.application/json.schema.properties.type.description
Whether the role is scoped to the environment or an organization (custom role).

# paths./authorization/roles/{slug}/permissions.post.responses.200.content.application/json.schema.properties.resource_type_slug.description
The slug of the resource type the role is scoped to.

# paths./authorization/roles/{slug}/permissions.post.responses.200.content.application/json.schema.properties.permissions.description
The permission slugs assigned to the role.

# paths./authorization/roles/{slug}/permissions.post.responses.400.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./authorization/roles/{slug}/permissions.post.responses.400.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/roles/{slug}/permissions.post.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/roles/{slug}/permissions.post.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./authorization/roles/{slug}/permissions.post.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./client/token.post.description
Generate a short-lived, session-bound token for the Client GraphQL API, scoped to an organization and user.

# paths./client/token.post.responses.400.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./client/token.post.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./client/token.post.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./connect/applications.get.description
List all Connect Applications in the current environment with optional filtering.

# paths./connect/applications.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`.

# paths./connect/applications.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`.

# paths./connect/applications.get.parameters[].description
Upper limit on the number of objects to return, between `1` and `100`.

# paths./connect/applications.get.parameters[].description
Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records).

# paths./connect/applications.get.parameters[].description
Filter Connect Applications by registration type. Specify multiple as a comma-separated list (e.g. `registration_types=dynamic,authenticated`). Defaults to `authenticated` only when not specified.

# paths./connect/applications.get.parameters[].description
Filter Connect Applications by organization ID.

# paths./connect/applications.get.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./connect/applications.post.description
Create a new Connect Application. Supports both OAuth and Machine-to-Machine (M2M) application types.

# paths./connect/applications.post.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./connect/applications.post.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./connect/applications/{id}.get.description
Retrieve details for a specific Connect Application by ID or client ID.

# paths./connect/applications/{id}.get.parameters[].description
The application ID or client ID of the Connect Application.

# paths./connect/applications/{id}.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./connect/applications/{id}.put.description
Update an existing Connect Application. For OAuth applications, you can update redirect URIs. For all applications, you can update the name, description, and scopes.

# paths./connect/applications/{id}.put.parameters[].description
The application ID or client ID of the Connect Application.

# paths./connect/applications/{id}.put.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./connect/applications/{id}.put.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./connect/applications/{id}.delete.parameters[].description
The application ID or client ID of the Connect Application.

# paths./connect/applications/{id}.delete.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./connect/applications/{id}/client_secrets.get.description
List all client secrets associated with a Connect Application.

# paths./connect/applications/{id}/client_secrets.get.parameters[].description
The application ID or client ID of the Connect Application.

# paths./connect/applications/{id}/client_secrets.get.responses.200.content.application/json.schema.items.properties.object.description
Distinguishes the connect application secret object.

# paths./connect/applications/{id}/client_secrets.get.responses.200.content.application/json.schema.items.properties.secret_hint.description
A hint showing the last few characters of the secret value.

# paths./connect/applications/{id}/client_secrets.get.responses.200.content.application/json.schema.items.properties.last_used_at.description
The timestamp when the client secret was last used, or null if never used.

# paths./connect/applications/{id}/client_secrets.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./connect/applications/{id}/client_secrets.get.summary
List Client Secrets for a Connect Application

# paths./connect/applications/{id}/client_secrets.post.description
Create new secrets for a Connect Application.

# paths./connect/applications/{id}/client_secrets.post.parameters[].description
The application ID or client ID of the Connect Application.

# paths./connect/applications/{id}/client_secrets.post.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./connect/applications/{id}/client_secrets.post.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./connect/applications/{id}/client_secrets.post.summary
Create a new client secret for a Connect Application

# paths./connect/client_secrets/{id}.delete.description
Delete (revoke) an existing client secret.

# paths./connect/client_secrets/{id}.delete.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./connections.get.description
Get a list of all of your existing connections matching the criteria specified.

# paths./connections.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.

# paths./connections.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.

# paths./connections.get.parameters[].description
Upper limit on the number of objects to return, between `1` and `100`.

# paths./connections.get.parameters[].description
Filter Connections by their associated domain.

# paths./connections.get.parameters[].description
Filter Connections by their associated organization.

# paths./connections.get.parameters[].description
Searchable text to match against Connection names.

# paths./connections.get.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./connections.get.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./connections/{id}.get.description
Get the details of an existing connection.

# paths./connections/{id}.get.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./connections/{id}.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./connections/{id}.delete.description
Permanently deletes an existing connection. It cannot be undone.

# paths./connections/{id}.delete.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./connections/{id}.delete.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./data-integrations.post.description
Creates a data integration for a provider. Set `credentials.type` to `custom` to use your own OAuth app credentials or `organization` to have each organization supply its own. Set `auth_methods` to `["api_key"]` to create an API key integration; you may optionally supply an `api_key` block to install a first tenant in the same call. Set `auth_methods` to `["client_credentials"]` to create a client-credentials integration; client credentials are installed per-tenant afterwards. For a built-in provider, pass its slug as `provider`. For a custom provider, pass a new slug plus a `custom_provider` definition.

# paths./data-integrations.post.responses.400.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./data-integrations.post.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./data-integrations.post.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./data-integrations.post.responses.409.description
A data integration with this slug already exists in the environment.

# paths./data-integrations.post.responses.409.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./data-integrations.post.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./data-integrations.get.description
Lists the environment's data integrations configured with `custom` or `organization` credentials, including custom providers and API key integrations.

# paths./data-integrations.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`.

# paths./data-integrations.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`.

# paths./data-integrations.get.parameters[].description
Upper limit on the number of objects to return, between `1` and `100`.

# paths./data-integrations.get.parameters[].description
Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records).

# paths./data-integrations/{slug}.get.description
Retrieves a data integration by its slug.

# paths./data-integrations/{slug}.get.parameters[].description
The slug identifier of the data integration.

# paths./data-integrations/{slug}.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./data-integrations/{slug}.put.description
Updates the description, enabled state, or custom credentials of a data integration. For custom providers, `custom_provider` updates the OAuth definition.

# paths./data-integrations/{slug}.put.parameters[].description
The slug identifier of the data integration.

# paths./data-integrations/{slug}.put.responses.400.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./data-integrations/{slug}.put.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./data-integrations/{slug}.put.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./data-integrations/{slug}.put.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./data-integrations/{slug}.delete.description
Deletes a data integration and all of its connected installations. For a custom provider, also deletes the custom provider definition.

# paths./data-integrations/{slug}.delete.parameters[].description
The slug identifier of the data integration.

# paths./data-integrations/{slug}.delete.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./data-integrations/{slug}/api-key.put.description
Creates or updates an API-key-based installation for the specified integration and user. If an installation already exists, the stored API key is rotated to the new value.

# paths./data-integrations/{slug}/api-key.put.requestBody.content.application/json.schema.properties.organization_id.description
An [Organization](/reference/organization) identifier. Optional parameter to scope the connection to a specific organization.

# paths./data-integrations/{slug}/api-key.put.requestBody.content.application/json.schema.properties.secret.description
The API key secret to store for this integration.

# paths./data-integrations/{slug}/api-key.put.responses.200.description
The resulting connected account after the upsert.

# paths./data-integrations/{slug}/api-key.put.responses.400.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./data-integrations/{slug}/api-key.put.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./data-integrations/{slug}/api-key.put.responses.404.description
Data integration not found for the given provider slug.

# paths./data-integrations/{slug}/api-key.put.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./data-integrations/{slug}/api-key.put.responses.422.description
The matched installation uses a different auth method than this endpoint expects.

# paths./data-integrations/{slug}/api-key.put.summary
Upsert an API key for a connected account

# paths./data-integrations/{slug}/authorize.post.description
Generates an OAuth authorization URL to initiate the connection flow for a user. Redirect the user to the returned URL to begin the OAuth flow with the third-party provider.

# paths./data-integrations/{slug}/authorize.post.parameters[].description
The slug identifier of the provider (e.g., `github`, `slack`, `notion`).

# paths./data-integrations/{slug}/authorize.post.requestBody.content.application/json.schema.properties.organization_id.description
An organization ID to scope the authorization to a specific organization.

# paths./data-integrations/{slug}/authorize.post.requestBody.content.application/json.schema.properties.return_to.description
The URL to redirect the user to after authorization.

# paths./data-integrations/{slug}/authorize.post.requestBody.content.application/json.schema.properties.config.description
Connect-time config values for the provider-declared `installation`-scope fields (e.g. a Zendesk `subdomain`), keyed by the config field. Only fields the provider declares may be supplied, and required fields must be provided unless already pinned on the integration.

# paths./data-integrations/{slug}/authorize.post.responses.400.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./data-integrations/{slug}/authorize.post.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./data-integrations/{slug}/authorize.post.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./data-integrations/{slug}/client-credentials.put.description
Creates or updates a client-credentials-based installation for the specified integration and user. If an installation already exists, the stored client credentials are rotated to the new values.

# paths./data-integrations/{slug}/client-credentials.put.requestBody.content.application/json.schema.properties.organization_id.description
An [Organization](/reference/organization) identifier. Optional parameter to scope the connection to a specific organization.

# paths./data-integrations/{slug}/client-credentials.put.requestBody.content.application/json.schema.properties.client_id.description
The OAuth client ID to store for this integration.

# paths./data-integrations/{slug}/client-credentials.put.requestBody.content.application/json.schema.properties.client_secret.description
The OAuth client secret to store for this integration.

# paths./data-integrations/{slug}/client-credentials.put.requestBody.content.application/json.schema.properties.config.description
Provider-specific configuration values collected for this installation, keyed by the provider's config field descriptors.

# paths./data-integrations/{slug}/client-credentials.put.responses.200.description
The resulting connected account after the upsert.

# paths./data-integrations/{slug}/client-credentials.put.responses.400.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./data-integrations/{slug}/client-credentials.put.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./data-integrations/{slug}/client-credentials.put.responses.404.description
Data integration not found for the given provider slug.

# paths./data-integrations/{slug}/client-credentials.put.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./data-integrations/{slug}/client-credentials.put.responses.422.description
The matched installation uses a different auth method than this endpoint expects.

# paths./data-integrations/{slug}/client-credentials.put.summary
Upsert client credentials for a connected account

# paths./data-integrations/{slug}/credentials.post.description
Returns credentials for a user's connected account. Branches on the installation's `auth_method`: OAuth installations return an access token (refreshed if needed); API-key installations return the stored secret.

# paths./data-integrations/{slug}/credentials.post.requestBody.content.application/json.schema.properties.organization_id.description
An [Organization](/reference/organization) identifier. Optional parameter to scope the connection to a specific organization.

# paths./data-integrations/{slug}/credentials.post.responses.400.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./data-integrations/{slug}/credentials.post.responses.404.description
Data integration not found for the given provider slug.

# paths./data-integrations/{slug}/credentials.post.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./data-integrations/{slug}/credentials.post.responses.422.description
The installation uses an auth method that is not yet supported by this endpoint.

# paths./data-integrations/{slug}/credentials.post.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./data-integrations/{slug}/credentials.post.summary
Vend credentials for a connected account

# paths./data-integrations/{slug}/token.post.description
Fetches a valid OAuth access token for a user's connected account. WorkOS automatically handles token refresh, ensuring you always receive a valid, non-expired token.

# paths./data-integrations/{slug}/token.post.requestBody.content.application/json.schema.properties.organization_id.description
An [Organization](/reference/organization) identifier. Optional parameter to scope the connection to a specific organization.

# paths./data-integrations/{slug}/token.post.responses.400.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./data-integrations/{slug}/token.post.responses.404.description
Data integration not found for the given provider slug.

# paths./data-integrations/{slug}/token.post.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./data-integrations/{slug}/token.post.responses.422.description
The matched installation uses a different auth method than this endpoint expects.

# paths./data-integrations/{slug}/token.post.summary
Get an access token for a connected account

# paths./directories.get.description
Get a list of all of your existing directories matching the criteria specified.

# paths./directories.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.

# paths./directories.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.

# paths./directories.get.parameters[].description
Upper limit on the number of objects to return, between `1` and `100`.

# paths./directories.get.parameters[].description
Filter Directories by their associated organization.

# paths./directories.get.parameters[].description
Searchable text to match against Directory names.

# paths./directories.get.parameters[].description
Filter Directories by their associated domain.

# paths./directories.get.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./directories.get.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./directories/{id}.get.description
Get the details of an existing directory.

# paths./directories/{id}.get.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./directories/{id}.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./directories/{id}.delete.description
Permanently deletes an existing directory. It cannot be undone.

# paths./directories/{id}.delete.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./directory_groups.get.description
Get a list of all of existing directory groups matching the criteria specified.

# paths./directory_groups.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`.

# paths./directory_groups.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`.

# paths./directory_groups.get.parameters[].description
Upper limit on the number of objects to return, between `1` and `100`.

# paths./directory_groups.get.parameters[].description
Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records).

# paths./directory_groups.get.parameters[].description
Unique identifier of the WorkOS Directory. This value can be obtained from the WorkOS dashboard or from the WorkOS API.

# paths./directory_groups.get.parameters[].description
Unique identifier of the WorkOS Directory User. This value can be obtained from the WorkOS API.

# paths./directory_groups.get.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./directory_groups.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./directory_groups.get.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./directory_groups/{id}.get.description
Get the details of an existing Directory Group.

# paths./directory_groups/{id}.get.parameters[].description
Unique identifier for the Directory Group.

# paths./directory_groups/{id}.get.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./directory_groups/{id}.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./directory_users.get.description
Get a list of all of existing Directory Users matching the criteria specified.

# paths./directory_users.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`.

# paths./directory_users.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`.

# paths./directory_users.get.parameters[].description
Upper limit on the number of objects to return, between `1` and `100`.

# paths./directory_users.get.parameters[].description
Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records).

# paths./directory_users.get.parameters[].description
Unique identifier of the WorkOS Directory. This value can be obtained from the WorkOS dashboard or from the WorkOS API.

# paths./directory_users.get.parameters[].description
Unique identifier of the WorkOS Directory Group. This value can be obtained from the WorkOS API.

# paths./directory_users.get.parameters[].description
Filter Directory Users by the identity provider's unique identifier (`idp_id`). Requires the `directory` parameter to also be provided.

# paths./directory_users.get.parameters[].description
Filter Directory Users by their primary email address. Requires the `directory` parameter to also be provided.

# paths./directory_users.get.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./directory_users.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./directory_users.get.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./directory_users/{id}.get.description
Get the details of an existing Directory User.

# paths./directory_users/{id}.get.parameters[].description
Unique identifier for the Directory User.

# paths./directory_users/{id}.get.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./directory_users/{id}.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./events.get.description
List events for the current environment.

# paths./events.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`.

# paths./events.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`.

# paths./events.get.parameters[].description
Upper limit on the number of objects to return, between `1` and `100`.

# paths./events.get.parameters[].description
Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records).

# paths./events.get.parameters[].description
Filter events by one or more event types (e.g. `dsync.user.created`).

# paths./events.get.parameters[].description
ISO-8601 date string to filter events created after this date.

# paths./events.get.parameters[].description
ISO-8601 date string to filter events created before this date.

# paths./events.get.parameters[].description
Filter events by the [Organization](/reference/organization) that the event is associated with.

# paths./events.get.responses.400.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./events.get.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./feature-flags.get.description
Get a list of all of your existing feature flags matching the criteria specified.

# paths./feature-flags.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.

# paths./feature-flags.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.

# paths./feature-flags.get.parameters[].description
Upper limit on the number of objects to return, between `1` and `100`.

# paths./feature-flags.get.responses.400.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./feature-flags.get.responses.400.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./feature-flags.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./feature-flags.get.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./feature-flags/{slug}.get.description
Get the details of an existing feature flag by its slug.

# paths./feature-flags/{slug}.get.parameters[].description
A unique key to reference the Feature Flag.

# paths./feature-flags/{slug}.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./feature-flags/{slug}/disable.put.description
Disables a feature flag in the current environment.

# paths./feature-flags/{slug}/disable.put.parameters[].description
A unique key to reference the Feature Flag.

# paths./feature-flags/{slug}/disable.put.responses.200.content.application/json.schema.properties.slug.description
A unique key to reference the Feature Flag.

# paths./feature-flags/{slug}/disable.put.responses.200.content.application/json.schema.properties.name.description
A descriptive name for the Feature Flag. This field does not need to be unique.

# paths./feature-flags/{slug}/disable.put.responses.200.content.application/json.schema.properties.description.example
Enable advanced analytics dashboard feature

# paths./feature-flags/{slug}/disable.put.responses.200.content.application/json.schema.properties.tags.description
Labels assigned to the Feature Flag for categorizing and filtering.

# paths./feature-flags/{slug}/disable.put.responses.200.content.application/json.schema.properties.enabled.description
Specifies whether the Feature Flag is active for the current environment.

# paths./feature-flags/{slug}/disable.put.responses.200.content.application/json.schema.properties.default_value.description
The value returned for users and organizations who don't match any configured targeting rules.

# paths./feature-flags/{slug}/disable.put.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./feature-flags/{slug}/enable.put.description
Enables a feature flag in the current environment.

# paths./feature-flags/{slug}/enable.put.parameters[].description
A unique key to reference the Feature Flag.

# paths./feature-flags/{slug}/enable.put.responses.200.content.application/json.schema.properties.slug.description
A unique key to reference the Feature Flag.

# paths./feature-flags/{slug}/enable.put.responses.200.content.application/json.schema.properties.name.description
A descriptive name for the Feature Flag. This field does not need to be unique.

# paths./feature-flags/{slug}/enable.put.responses.200.content.application/json.schema.properties.description.example
Enable advanced analytics dashboard feature

# paths./feature-flags/{slug}/enable.put.responses.200.content.application/json.schema.properties.tags.description
Labels assigned to the Feature Flag for categorizing and filtering.

# paths./feature-flags/{slug}/enable.put.responses.200.content.application/json.schema.properties.enabled.description
Specifies whether the Feature Flag is active for the current environment.

# paths./feature-flags/{slug}/enable.put.responses.200.content.application/json.schema.properties.default_value.description
The value returned for users and organizations who don't match any configured targeting rules.

# paths./feature-flags/{slug}/enable.put.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./feature-flags/{slug}/targets/{resourceId}.post.description
Enables a feature flag for a specific target in the current environment. Currently, supported targets include users and organizations.

# paths./feature-flags/{slug}/targets/{resourceId}.post.parameters[].description
The resource ID in format "user_<id>" or "org_<id>".

# paths./feature-flags/{slug}/targets/{resourceId}.post.parameters[].description
The unique slug identifier of the feature flag.

# paths./feature-flags/{slug}/targets/{resourceId}.post.responses.400.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./feature-flags/{slug}/targets/{resourceId}.post.responses.400.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./feature-flags/{slug}/targets/{resourceId}.post.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./feature-flags/{slug}/targets/{resourceId}.post.responses.404.description
Feature flag, user, or organization not found.

# paths./feature-flags/{slug}/targets/{resourceId}.post.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./feature-flags/{slug}/targets/{resourceId}.delete.description
Removes a target from the feature flag's target list in the current environment. Currently, supported targets include users and organizations.

# paths./feature-flags/{slug}/targets/{resourceId}.delete.parameters[].description
The resource ID in format "user_<id>" or "org_<id>".

# paths./feature-flags/{slug}/targets/{resourceId}.delete.parameters[].description
The unique slug identifier of the feature flag.

# paths./feature-flags/{slug}/targets/{resourceId}.delete.responses.400.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./feature-flags/{slug}/targets/{resourceId}.delete.responses.400.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./feature-flags/{slug}/targets/{resourceId}.delete.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./feature-flags/{slug}/targets/{resourceId}.delete.responses.404.description
Feature flag, user, or organization not found.

# paths./feature-flags/{slug}/targets/{resourceId}.delete.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./organization_domains.post.responses.201.content.application/json.schema.properties.object.description
Distinguishes the organization domain object.

# paths./organization_domains.post.responses.201.content.application/json.schema.properties.id.description
Unique identifier of the organization domain.

# paths./organization_domains.post.responses.201.content.application/json.schema.properties.verification_token.description
Validation token to be used in DNS TXT record.

# paths./organization_domains.post.responses.409.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./organization_domains.post.responses.409.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./organization_domains.post.responses.409.content.application/json.schema.properties.message.example
Domain already exists for this organization.

# paths./organization_domains/{id}.get.description
Get the details of an existing organization domain.

# paths./organization_domains/{id}.get.parameters[].description
Unique identifier of the organization domain.

# paths./organization_domains/{id}.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./organization_domains/{id}.delete.description
Permanently deletes an organization domain. It cannot be undone.

# paths./organization_domains/{id}.delete.parameters[].description
Unique identifier of the organization domain.

# paths./organization_domains/{id}.delete.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./organization_domains/{id}/verify.post.description
Initiates verification process for an Organization Domain.

# paths./organization_domains/{id}/verify.post.parameters[].description
Unique identifier of the organization domain.

# paths./organization_domains/{id}/verify.post.responses.400.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./organization_domains/{id}/verify.post.responses.400.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./organizations.get.description
Get a list of all of your existing organizations matching the criteria specified.

# paths./organizations.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`.

# paths./organizations.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`.

# paths./organizations.get.parameters[].description
Upper limit on the number of objects to return, between `1` and `100`.

# paths./organizations.get.parameters[].description
Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records).

# paths./organizations.get.parameters[].description
The domains of an Organization. Any Organization with a matching domain will be returned.

# paths./organizations.get.parameters[].description
Searchable text for an Organization. Matches against the organization name.

# paths./organizations.get.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./organizations.post.description
Creates a new organization in the current environment.

# paths./organizations.post.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./organizations.post.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./organizations.post.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./organizations.post.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./organizations.post.responses.409.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./organizations.post.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./organizations/external_id/{external_id}.get.description
Get the details of an existing organization by an [external identifier](/authkit/metadata/external-identifiers).

# paths./organizations/external_id/{external_id}.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./organizations/{id}.get.description
Get the details of an existing organization.

# paths./organizations/{id}.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./organizations/{id}.put.description
Updates an organization in the current environment.

# paths./organizations/{id}.put.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./organizations/{id}.put.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./organizations/{id}.put.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./organizations/{id}.put.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./organizations/{id}.put.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./organizations/{id}.put.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./organizations/{id}.put.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./organizations/{id}.put.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./organizations/{id}.put.responses.409.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./organizations/{id}.put.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./organizations/{id}.delete.description
Permanently deletes an organization in the current environment. It cannot be undone.

# paths./organizations/{id}.delete.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./organizations/{id}/audit_log_configuration.get.description
Get the unified view of audit log trail and stream configuration for an organization.

# paths./organizations/{id}/audit_log_configuration.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./organizations/{id}/audit_logs_retention.get.description
Get the configured event retention period for the given Organization.

# paths./organizations/{id}/audit_logs_retention.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./organizations/{id}/audit_logs_retention.put.description
Set the event retention period for the given Organization.

# paths./organizations/{id}/audit_logs_retention.put.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./organizations/{id}/audit_logs_retention.put.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./organizations/{organizationId}/api_keys.get.description
Get a list of all API keys for an organization.

# paths./organizations/{organizationId}/api_keys.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.

# paths./organizations/{organizationId}/api_keys.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.

# paths./organizations/{organizationId}/api_keys.get.parameters[].description
Upper limit on the number of objects to return, between `1` and `100`.

# paths./organizations/{organizationId}/api_keys.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./organizations/{organizationId}/api_keys.post.description
Create a new API key for an organization.

# paths./organizations/{organizationId}/api_keys.post.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./organizations/{organizationId}/api_keys.post.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./organizations/{organizationId}/data_integration_configurations.get.description
Returns a list of all providers available to the specified organization, along with any configured custom OAuth scopes, enabled state, and organization-managed credentials where applicable.

# paths./organizations/{organizationId}/data_integration_configurations.get.responses.200.description
A list of provider configurations for the organization.

# paths./organizations/{organizationId}/data_integration_configurations.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./organizations/{organizationId}/data_integration_configurations/.put.description
Creates or updates an organization's provider configuration. Use this endpoint to enable or disable a provider, set custom OAuth scopes, or supply organization-managed OAuth credentials.

# paths./organizations/{organizationId}/data_integration_configurations/.put.parameters[].description
An [Organization](/reference/organization) identifier to configure the provider for.

# paths./organizations/{organizationId}/data_integration_configurations/.put.parameters[].description
The slug identifier of the provider to configure (e.g., `github`, `slack`, `notion`).

# paths./organizations/{organizationId}/data_integration_configurations/.put.responses.200.description
The provider configuration that was created or updated.

# paths./organizations/{organizationId}/data_integration_configurations/.put.responses.400.description
The request body is invalid. Possible reasons: the body is empty (at least one of `enabled`, `scopes`, `client_id`, or `config` must be provided); `client_id` and `client_secret` are not provided together; `client_id`/`client_secret` were supplied for a provider that does not support organization-managed credentials; or `config` contains a field the provider does not declare, a value that does not match that field's pattern, or was supplied for a provider whose credentials are not organization-managed.

# paths./organizations/{organizationId}/data_integration_configurations/.put.responses.400.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./organizations/{organizationId}/data_integration_configurations/.put.responses.404.description
The organization or provider was not found.

# paths./organizations/{organizationId}/data_integration_configurations/.put.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./organizations/{organizationId}/data_integration_configurations/.put.responses.422.description
One or more of the supplied `scopes` are not valid for the provider. Only scopes configured on the provider may be used.

# paths./organizations/{organizationId}/data_integration_configurations/.put.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./organizations/{organizationId}/data_integration_configurations/.put.summary
Configure a provider for an organization

# paths./organizations/{organizationId}/feature-flags.get.description
Get a list of all enabled feature flags for an organization.

# paths./organizations/{organizationId}/feature-flags.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.

# paths./organizations/{organizationId}/feature-flags.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.

# paths./organizations/{organizationId}/feature-flags.get.parameters[].description
Upper limit on the number of objects to return, between `1` and `100`.

# paths./organizations/{organizationId}/feature-flags.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./organizations/{organizationId}/feature-flags.get.summary
List enabled feature flags for an organization

# paths./organizations/{organizationId}/groups.post.description
Create a new group within an organization.

# paths./organizations/{organizationId}/groups.post.responses.400.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./organizations/{organizationId}/groups.post.responses.400.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./organizations/{organizationId}/groups.post.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./organizations/{organizationId}/groups.post.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./organizations/{organizationId}/groups.post.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./organizations/{organizationId}/groups.get.description
Get a paginated list of groups within an organization.

# paths./organizations/{organizationId}/groups.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`.

# paths./organizations/{organizationId}/groups.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`.

# paths./organizations/{organizationId}/groups.get.parameters[].description
Upper limit on the number of objects to return, between `1` and `100`.

# paths./organizations/{organizationId}/groups.get.parameters[].description
Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records).

# paths./organizations/{organizationId}/groups.get.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./organizations/{organizationId}/groups.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./organizations/{organizationId}/groups/{groupId}.get.description
Retrieve a group by its ID within an organization.

# paths./organizations/{organizationId}/groups/{groupId}.get.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./organizations/{organizationId}/groups/{groupId}.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./organizations/{organizationId}/groups/{groupId}.patch.description
Update an existing group. Only the fields provided in the request body will be updated.

# paths./organizations/{organizationId}/groups/{groupId}.patch.responses.400.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./organizations/{organizationId}/groups/{groupId}.patch.responses.400.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./organizations/{organizationId}/groups/{groupId}.patch.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./organizations/{organizationId}/groups/{groupId}.patch.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./organizations/{organizationId}/groups/{groupId}.patch.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./organizations/{organizationId}/groups/{groupId}.delete.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./organizations/{organizationId}/groups/{groupId}.delete.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./organizations/{organizationId}/groups/{groupId}/organization-me.post.description
Add an organization membership to a group.

# paths./organizations/{organizationId}/groups/{groupId}/organization-me.post.responses.400.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./organizations/{organizationId}/groups/{groupId}/organization-me.post.responses.400.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./organizations/{organizationId}/groups/{groupId}/organization-me.post.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./organizations/{organizationId}/groups/{groupId}/organization-me.post.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./organizations/{organizationId}/groups/{groupId}/organization-me.post.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./organizations/{organizationId}/groups/{groupId}/organization-me.get.description
Get a list of organization memberships in a group.

# paths./organizations/{organizationId}/groups/{groupId}/organization-me.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`.

# paths./organizations/{organizationId}/groups/{groupId}/organization-me.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`.

# paths./organizations/{organizationId}/groups/{groupId}/organization-me.get.parameters[].description
Upper limit on the number of objects to return, between `1` and `100`.

# paths./organizations/{organizationId}/groups/{groupId}/organization-me.get.parameters[].description
Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records).

# paths./organizations/{organizationId}/groups/{groupId}/organization-me.get.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./organizations/{organizationId}/groups/{groupId}/organization-me.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./organizations/{organizationId}/groups/{groupId}/organization-me.delete.description
Remove an organization membership from a group.

# paths./organizations/{organizationId}/groups/{groupId}/organization-me.delete.parameters[].description
Unique identifier of the Organization Membership.

# paths./organizations/{organizationId}/groups/{groupId}/organization-me.delete.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./organizations/{organizationId}/groups/{groupId}/organization-me.delete.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./organizations/{organization_id}/authorized_applications.get.description
Get a list of all Connect applications that users in the organization have authorized.

# paths./organizations/{organization_id}/authorized_applications.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`.

# paths./organizations/{organization_id}/authorized_applications.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`.

# paths./organizations/{organization_id}/authorized_applications.get.parameters[].description
Upper limit on the number of objects to return, between `1` and `100`.

# paths./organizations/{organization_id}/authorized_applications.get.parameters[].description
Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records).

# paths./organizations/{organization_id}/authorized_applications.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./organizations/{organization_id}/authorized_applications.get.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./portal/generate_link.post.description
Generate a Portal Link scoped to an Organization.

# paths./portal/generate_link.post.responses.400.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./portal/generate_link.post.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./portal/generate_link.post.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./portal/generate_link.post.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./radar/attempts.post.description
Assess a request for risk using the Radar engine and receive a verdict.

# paths./radar/attempts.post.requestBody.content.application/json.schema.properties.ip_address.description
The IP address of the request to assess.

# paths./radar/attempts.post.requestBody.content.application/json.schema.properties.user_agent.description
The user agent string of the request to assess.

# paths./radar/attempts.post.requestBody.content.application/json.schema.properties.email.description
The email address of the user making the request.

# paths./radar/attempts.post.requestBody.content.application/json.schema.properties.signals_id.description
An optional Radar signals ID for the request.

# paths./radar/attempts.post.responses.400.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./radar/attempts/{id}.put.description
You may optionally inform Radar that an authentication attempt or challenge was successful using this endpoint. Some Radar controls depend on tracking recent successful attempts, such as impossible travel.

# paths./radar/attempts/{id}.put.parameters[].description
The unique identifier of the Radar attempt to update.

# paths./radar/attempts/{id}.put.requestBody.content.application/json.schema.properties.challenge_status.description
Set to `"success"` to mark the challenge as completed.

# paths./radar/attempts/{id}.put.requestBody.content.application/json.schema.properties.attempt_status.description
Set to `"success"` to mark the authentication attempt as successful.

# paths./radar/attempts/{id}.put.responses.400.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./radar/attempts/{id}.put.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./radar/lists/{type}/{action}.post.parameters[].description
The type of the Radar list (e.g. ip_address, domain, email).

# paths./radar/lists/{type}/{action}.post.parameters[].description
The list action indicating whether to add the entry to the allow or block list.

# paths./radar/lists/{type}/{action}.post.requestBody.content.application/json.schema.properties.entry.description
The value to add to the list. Must match the format of the list type (e.g. a valid IP address for `ip_address`, a valid email for `email`).

# paths./radar/lists/{type}/{action}.post.responses.400.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./radar/lists/{type}/{action}.delete.parameters[].description
The type of the Radar list (e.g. ip_address, domain, email).

# paths./radar/lists/{type}/{action}.delete.parameters[].description
The list action indicating whether to remove the entry from the allow or block list.

# paths./radar/lists/{type}/{action}.delete.requestBody.content.application/json.schema.properties.entry.description
The value to remove from the list. Must match an existing entry.

# paths./radar/lists/{type}/{action}.delete.responses.400.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./radar/lists/{type}/{action}.delete.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./sso/authorize.get.parameters[].description
Additional scopes to request from the identity provider. Applicable when using OAuth or OpenID Connect connections.

# paths./sso/authorize.get.parameters[].description
Key/value pairs of query parameters to pass to the OAuth provider. Only applicable when using OAuth connections.

# paths./sso/authorize.get.parameters[].description
The unique identifier of the WorkOS environment client.

# paths./sso/authorize.get.parameters[].description
Deprecated. Use `connection` or `organization` instead. Used to initiate SSO for a connection by domain. The domain must be associated with a connection in your WorkOS environment.

# paths./sso/authorize.get.parameters[].description
Used to initiate OAuth authentication with various providers.

# paths./sso/authorize.get.parameters[].description
Where to redirect the user after they complete the authentication process. You must use one of the redirect URIs configured via the [Redirects](https://dashboard.workos.com/redirects) page on the dashboard.

# paths./sso/authorize.get.parameters[].description
The only valid option for the response type parameter is `"code"`.

The `"code"` parameter value initiates an [authorization code grant type](https://tools.ietf.org/html/rfc6749#section-4.1). This grant type allows you to exchange an authorization code for an access token during the redirect that takes place after a user has authenticated with an identity provider.

# paths./sso/authorize.get.parameters[].description
An optional parameter that can be used to encode arbitrary information to help restore application state between redirects. If included, the redirect URI received from WorkOS will contain the exact `state` that was passed.

# paths./sso/authorize.get.parameters[].description
Used to initiate SSO for a connection. The value should be a WorkOS connection ID.

You can persist the WorkOS connection ID with application user or team identifiers. WorkOS will use the connection indicated by the connection parameter to direct the user to the corresponding IdP for authentication.

# paths./sso/authorize.get.parameters[].description
Used to initiate SSO for an organization. The value should be a WorkOS organization ID.

You can persist the WorkOS organization ID with application user or team identifiers. WorkOS will use the organization ID to determine the appropriate connection and the IdP to direct the user to for authentication.

# paths./sso/authorize.get.parameters[].description
Can be used to pre-fill the domain field when initiating authentication with Microsoft OAuth or with a Google SAML connection type.

# paths./sso/authorize.get.parameters[].description
Can be used to pre-fill the username/email address field of the IdP sign-in page for the user, if you know their username ahead of time. Currently supported for OAuth, OpenID Connect, Okta, Entra ID, and custom SAML connections.

# paths./sso/authorize.get.parameters[].description
A random string generated by the client that is used to mitigate replay attacks.

# paths./sso/authorize.get.parameters[].description
If set to `login`, forces re-authentication at the identity provider. For supported SAML providers this sets `ForceAuthn="true"` in the SAML request; providers that don't support it are unaffected.

# paths./sso/jwks/{clientId}.get.description
Returns the JSON Web Key Set (JWKS) containing the public keys used for verifying access tokens.

# paths./sso/jwks/{clientId}.get.parameters[].description
Identifies the application making the request to the WorkOS server. You can obtain your client ID from the [API Keys](https://dashboard.workos.com/api-keys) page in the dashboard.

# paths./sso/jwks/{clientId}.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./sso/logout.get.description
Logout allows to sign out a user from your application by triggering the identity provider sign out flow. This `GET` endpoint should be a redirection, since the identity provider user will be identified in the browser session.

Before redirecting to this endpoint, you need to generate a short-lived logout token using the [Logout Authorize](/reference/sso/logout/authorize) endpoint.

# paths./sso/logout.get.parameters[].description
The logout token returned from the [Logout Authorize](/reference/sso/logout/authorize) endpoint.

# paths./sso/logout.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./sso/logout/authorize.post.description
You should call this endpoint from your server to generate a logout token which is required for the [Logout Redirect](/reference/sso/logout) endpoint.

# paths./sso/logout/authorize.post.requestBody.content.application/json.schema.properties.profile_id.description
The unique ID of the profile to log out.

# paths./sso/logout/authorize.post.responses.400.content.application/json.schema.oneOf[].properties.error_description.description
A human-readable description of the error.

# paths./sso/logout/authorize.post.responses.400.content.application/json.schema.oneOf[].properties.error_description.example
Single Logout is only supported for GenericOIDC connections.

# paths./sso/logout/authorize.post.responses.400.content.application/json.schema.oneOf[].properties.error_description.description
A human-readable description of the error.

# paths./sso/logout/authorize.post.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./sso/profile.get.description
Exchange an access token for a user's [Profile](/reference/sso/profile). Because this profile is returned in the [Get a Profile and Token endpoint](/reference/sso/profile/get-profile-and-token) your application usually does not need to call this endpoint. It is available for any authentication flows that require an additional endpoint to retrieve a user's profile.

# paths./sso/profile.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./sso/token.post.description
Get an access token along with the user [Profile](/reference/sso/profile) using the code passed to your [Redirect URI](/reference/sso/get-authorization-url/redirect-uri).

# paths./sso/token.post.parameters[].description
The client ID of the WorkOS environment.

# paths./sso/token.post.parameters[].description
The client secret of the WorkOS environment.

# paths./sso/token.post.parameters[].description
The authorization code received from the authorization callback.

# paths./sso/token.post.responses.400.content.application/json.schema.oneOf[].properties.error_description.description
A human-readable description of the error.

# paths./sso/token.post.responses.400.content.application/json.schema.oneOf[].properties.error_description.description
A human-readable description of the error.

# paths./sso/token.post.responses.400.content.application/json.schema.oneOf[].properties.error_description.example
The client is not authorized to use this grant type.

# paths./sso/token.post.responses.400.content.application/json.schema.oneOf[].properties.error_description.description
A human-readable description of the error.

# paths./sso/token.post.responses.400.content.application/json.schema.oneOf[].properties.error_description.example
The code has expired or has already been used.

# paths./sso/token.post.responses.400.content.application/json.schema.oneOf[].properties.error_description.description
A human-readable description of the error.

# paths./sso/token.post.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./sso/token.post.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/authenticate.post.requestBody.content.application/json.schema.oneOf[].properties.client_secret.description
The client secret of the application. May be omitted by public clients that authenticate through other means, such as a PKCE `code_verifier`.

# paths./user_management/authenticate.post.requestBody.content.application/json.schema.oneOf[].properties.code.description
The authorization code received from the redirect.

# paths./user_management/authenticate.post.requestBody.content.application/json.schema.oneOf[].properties.code_verifier.description
The PKCE code verifier used to derive the code challenge passed to the authorization URL.

# paths./user_management/authenticate.post.requestBody.content.application/json.schema.oneOf[].properties.invitation_token.description
An invitation token to accept during authentication.

# paths./user_management/authenticate.post.requestBody.content.application/json.schema.oneOf[].properties.user_agent.description
The user agent string from the user's browser.

# paths./user_management/authenticate.post.requestBody.content.application/json.schema.oneOf[].properties.signals_id.description
An optional Radar signals ID to correlate client-side signals with this authentication attempt.

# paths./user_management/authenticate.post.requestBody.content.application/json.schema.oneOf[].properties.invitation_token.description
An invitation token to accept during authentication.

# paths./user_management/authenticate.post.requestBody.content.application/json.schema.oneOf[].properties.user_agent.description
The user agent string from the user's browser.

# paths./user_management/authenticate.post.requestBody.content.application/json.schema.oneOf[].properties.signals_id.description
An optional Radar signals ID to correlate client-side signals with this authentication attempt.

# paths./user_management/authenticate.post.requestBody.content.application/json.schema.oneOf[].properties.radar_auth_attempt_id.description
The ID of an existing Radar authentication attempt to associate with this authentication.

# paths./user_management/authenticate.post.requestBody.content.application/json.schema.oneOf[].properties.client_secret.description
The client secret of the application. May be omitted by public clients that authenticate through other means, such as a PKCE `code_verifier`.

# paths./user_management/authenticate.post.requestBody.content.application/json.schema.oneOf[].properties.refresh_token.description
The refresh token to exchange for new tokens.

# paths./user_management/authenticate.post.requestBody.content.application/json.schema.oneOf[].properties.organization_id.description
The ID of the organization to scope the session to.

# paths./user_management/authenticate.post.requestBody.content.application/json.schema.oneOf[].properties.user_agent.description
The user agent string from the user's browser.

# paths./user_management/authenticate.post.requestBody.content.application/json.schema.oneOf[].properties.code.description
The one-time code for Magic Auth authentication.

# paths./user_management/authenticate.post.requestBody.content.application/json.schema.oneOf[].properties.invitation_token.description
An invitation token to accept during authentication.

# paths./user_management/authenticate.post.requestBody.content.application/json.schema.oneOf[].properties.user_agent.description
The user agent string from the user's browser.

# paths./user_management/authenticate.post.requestBody.content.application/json.schema.oneOf[].properties.radar_auth_attempt_id.description
The ID of an existing Radar authentication attempt to associate with this authentication.

# paths./user_management/authenticate.post.requestBody.content.application/json.schema.oneOf[].properties.pending_authentication_token.description
The pending authentication token from a previous authentication attempt.

# paths./user_management/authenticate.post.requestBody.content.application/json.schema.oneOf[].properties.user_agent.description
The user agent string from the user's browser.

# paths./user_management/authenticate.post.requestBody.content.application/json.schema.oneOf[].properties.code.description
The TOTP code from the authenticator app.

# paths./user_management/authenticate.post.requestBody.content.application/json.schema.oneOf[].properties.pending_authentication_token.description
The pending authentication token from a previous authentication attempt.

# paths./user_management/authenticate.post.requestBody.content.application/json.schema.oneOf[].properties.authentication_challenge_id.description
The ID of the MFA authentication challenge.

# paths./user_management/authenticate.post.requestBody.content.application/json.schema.oneOf[].properties.user_agent.description
The user agent string from the user's browser.

# paths./user_management/authenticate.post.requestBody.content.application/json.schema.oneOf[].properties.pending_authentication_token.description
The pending authentication token from a previous authentication attempt.

# paths./user_management/authenticate.post.requestBody.content.application/json.schema.oneOf[].properties.organization_id.description
The ID of the organization the user selected.

# paths./user_management/authenticate.post.requestBody.content.application/json.schema.oneOf[].properties.user_agent.description
The user agent string from the user's browser.

# paths./user_management/authenticate.post.requestBody.content.application/json.schema.oneOf[].properties.code.description
The one-time code from the Radar email challenge.

# paths./user_management/authenticate.post.requestBody.content.application/json.schema.oneOf[].properties.radar_challenge_id.description
The ID of the Radar email challenge being verified.

# paths./user_management/authenticate.post.requestBody.content.application/json.schema.oneOf[].properties.pending_authentication_token.description
The pending authentication token from a previous authentication attempt.

# paths./user_management/authenticate.post.requestBody.content.application/json.schema.oneOf[].properties.user_agent.description
The user agent string from the user's browser.

# paths./user_management/authenticate.post.requestBody.content.application/json.schema.oneOf[].properties.code.description
The one-time code from the Radar SMS challenge.

# paths./user_management/authenticate.post.requestBody.content.application/json.schema.oneOf[].properties.verification_id.description
The ID of the Radar SMS verification being confirmed. Required for sign-up challenges; omitted for sign-in challenges, where the verification is resolved server-side.

# paths./user_management/authenticate.post.requestBody.content.application/json.schema.oneOf[].properties.phone_number.description
The phone number the Radar SMS challenge was sent to. Required for sign-up challenges; omitted for sign-in challenges, where the phone number on file is resolved server-side.

# paths./user_management/authenticate.post.requestBody.content.application/json.schema.oneOf[].properties.pending_authentication_token.description
The pending authentication token from a previous authentication attempt.

# paths./user_management/authenticate.post.requestBody.content.application/json.schema.oneOf[].properties.user_agent.description
The user agent string from the user's browser.

# paths./user_management/authenticate.post.requestBody.content.application/json.schema.oneOf[].properties.user_agent.description
The user agent string from the user's browser.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].properties.error_description.description
A human-readable description of the error.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].properties.error_description.example
The request failed due to: invalid_client.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].properties.error_description.description
A human-readable description of the error.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].properties.error_description.example
The request failed due to: unauthorized_client.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].properties.error_description.description
A human-readable description of the error.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].properties.error_description.example
The request failed due to: invalid_profile.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].properties.error_description.description
A human-readable description of the error.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].properties.error_description.example
The request failed due to: invitation_invalid.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].properties.error_description.description
A human-readable description of the error.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].properties.error_description.description
A human-readable description of the error.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].properties.error_description.description
A human-readable description of the error.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].properties.error_description.example
The request failed due to: invalid_connection.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].properties.error_description.description
A human-readable description of the error.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].properties.error_description.example
The request failed due to: sign_up_not_allowed.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].properties.error_description.description
A human-readable description of the error.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].properties.error_description.description
A human-readable description of the error.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].properties.error_description.example
The request failed due to: invalid_link_authorization_code.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].properties.error_description.description
A human-readable description of the error.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].properties.error_description.example
The request failed due to: extra_attributes_required.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].properties.error_description.description
A human-readable description of the error.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].properties.error_description.example
The request failed due to: pkce_not_supported.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].properties.error_description.description
A human-readable description of the error.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].properties.error_description.example
The request failed due to: expired_token.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].properties.error_description.description
A human-readable description of the error.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].properties.error_description.example
The request failed due to: authorization_pending.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].properties.error_description.description
A human-readable description of the error.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].properties.error_description.example
The request failed due to: access_denied.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].properties.error_description.description
A human-readable description of the error.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].oneOf[].properties.error_description.description
A human-readable description of the error.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].oneOf[].properties.error_description.example
The request failed due to: invalid_grant.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].oneOf[].properties.error_description.description
A human-readable description of the error.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].oneOf[].properties.error_description.example
The request failed due to: invalid_request.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].oneOf[].properties.error_description.description
A human-readable description of the error.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].oneOf[].properties.error_description.example
The request failed due to: organization_not_found.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].oneOf[].properties.error_description.description
A human-readable description of the error.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].oneOf[].properties.error_description.description
A human-readable description of the error.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].oneOf[].properties.error_description.example
The request failed due to: mfa_enrollment.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].oneOf[].properties.error_description.description
A human-readable description of the error.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].oneOf[].properties.error_description.example
The request failed due to: token_too_big.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].oneOf[].allOf[].properties.error_description.description
A human-readable description of the error.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].oneOf[].allOf[].properties.error_description.example
The request failed due to: sso_required.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].oneOf[].allOf[].properties.connection_ids.description
The IDs of the SSO connections the user must authenticate through.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].oneOf[].allOf[].properties.email.description
The email address of the user that must authenticate via SSO.

# paths./user_management/authenticate.post.responses.400.content.application/json.schema.oneOf[].oneOf[].allOf[].properties.pending_authentication_token.description
A token that links the subsequent SSO authentication back to the pending authentication so the authorization session can be completed.

# paths./user_management/authenticate.post.responses.403.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/authenticate.post.responses.403.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/authenticate.post.responses.403.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/authenticate.post.responses.403.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/authenticate.post.responses.403.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/authenticate.post.responses.403.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/authenticate.post.responses.403.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/authenticate.post.responses.403.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/authenticate.post.responses.403.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/authenticate.post.responses.403.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/authenticate.post.responses.403.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/authenticate.post.responses.403.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/authenticate.post.responses.403.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/authenticate.post.responses.403.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/authenticate.post.responses.403.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/authenticate.post.responses.403.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/authenticate.post.responses.403.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/authenticate.post.responses.403.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/authenticate.post.responses.403.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/authenticate.post.responses.403.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/authenticate.post.responses.403.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/authenticate.post.responses.403.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/authenticate.post.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/authenticate.post.responses.422.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./user_management/authenticate.post.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/authenticate.post.responses.429.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/authenticate.post.responses.429.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/authenticate.post.responses.429.content.application/json.schema.oneOf[].properties.error_description.description
A human-readable description of the error.

# paths./user_management/authenticate.post.responses.429.content.application/json.schema.oneOf[].properties.error_description.example
The request failed due to: too_many_requests.

# paths./user_management/authorize.get.description
Generates an OAuth 2.0 authorization URL to authenticate a user with AuthKit or SSO.

# paths./user_management/authorize.get.parameters[].description
The only valid PKCE code challenge method is `"S256"`. Required when specifying a `code_challenge`.

# paths./user_management/authorize.get.parameters[].description
Code challenge derived from the code verifier used for the PKCE flow.

# paths./user_management/authorize.get.parameters[].description
A domain hint for SSO connection lookup.

# paths./user_management/authorize.get.parameters[].description
The ID of an SSO connection to use for authentication.

# paths./user_management/authorize.get.parameters[].description
Key/value pairs of query parameters to pass to the OAuth provider.

# paths./user_management/authorize.get.parameters[].description
Additional OAuth scopes to request from the identity provider.

# paths./user_management/authorize.get.parameters[].description
A token representing a user invitation to redeem during authentication.

# paths./user_management/authorize.get.parameters[].description
Maximum allowable elapsed time, in seconds, since the user last actively authenticated. If the last authentication is older than this value, the user is prompted to re-authenticate; a value of `0` forces re-authentication. Only supported when the provider is `authkit`.

# paths./user_management/authorize.get.parameters[].description
Used to specify which screen to display when the provider is `authkit`.

# paths./user_management/authorize.get.parameters[].description
A hint to the authorization server about the login identifier the user might use.

# paths./user_management/authorize.get.parameters[].description
The OAuth provider to authenticate with (e.g., GoogleOAuth, MicrosoftOAuth, GitHubOAuth).

# paths./user_management/authorize.get.parameters[].description
Controls the authentication flow behavior for the user.

# paths./user_management/authorize.get.parameters[].description
An opaque value used to maintain state between the request and the callback.

# paths./user_management/authorize.get.parameters[].description
The ID of the organization to authenticate the user against.

# paths./user_management/authorize.get.parameters[].description
The callback URI where the authorization code will be sent after authentication.

# paths./user_management/authorize.get.parameters[].description
The unique identifier of the WorkOS environment client.

# paths./user_management/authorize/device.post.description
Initiates the CLI Auth flow by requesting a device code and verification URLs. This endpoint implements the OAuth 2.0 Device Authorization Flow ([RFC 8628](https://datatracker.ietf.org/doc/html/rfc8628)) and is designed for command-line applications or other devices with limited input capabilities.

# paths./user_management/authorize/device.post.requestBody.content.application/json.schema.properties.client_id.description
The WorkOS client ID for your application.

# paths./user_management/authorize/device.post.responses.200.description
Device authorization response with codes and verification URI.

# paths./user_management/authorize/device.post.responses.403.content.application/json.schema.properties.error_description.example
Device authorization grant is not enabled for this team

# paths./user_management/cors_origins.post.description
Creates a new CORS origin for the API key's application. CORS origins allow browser-based applications to make requests to the WorkOS API.

# paths./user_management/cors_origins.get.description
Lists the CORS origins for the current environment.

# paths./user_management/cors_origins.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`.

# paths./user_management/cors_origins.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`.

# paths./user_management/cors_origins.get.parameters[].description
Upper limit on the number of objects to return, between `1` and `100`.

# paths./user_management/cors_origins.get.parameters[].description
Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records).

# paths./user_management/cors_origins.get.responses.200.content.application/json.schema.allOf[].properties.list_metadata.properties.before.description
An object ID that defines your place in the list. When the ID is not present, you are at the start of the list.

# paths./user_management/cors_origins.get.responses.200.content.application/json.schema.allOf[].properties.list_metadata.properties.after.description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.

# paths./user_management/cors_origins.get.responses.200.content.application/json.schema.allOf[].properties.list_metadata.description
Pagination cursors for navigating between pages of results.

# paths./user_management/cors_origins.get.responses.200.content.application/json.schema.allOf[].properties.data.description
The list of records for the current page.

# paths./user_management/cors_origins.get.responses.401.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/email_verification/{id}.get.description
Get the details of an existing email verification code that can be used to send an email to a user for verification.

# paths./user_management/email_verification/{id}.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/invitations.get.description
Get a list of all of invitations matching the criteria specified.

# paths./user_management/invitations.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`.

# paths./user_management/invitations.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`.

# paths./user_management/invitations.get.parameters[].description
Upper limit on the number of objects to return, between `1` and `100`.

# paths./user_management/invitations.get.parameters[].description
Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records).

# paths./user_management/invitations.get.parameters[].description
The ID of the [organization](/reference/organization) that the recipient will join.

# paths./user_management/invitations.get.responses.422.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./user_management/invitations.get.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/invitations.post.description
Sends an invitation email to the recipient.

# paths./user_management/invitations.post.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/invitations.post.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/invitations.post.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/invitations.post.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/invitations.post.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/invitations.post.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/invitations.post.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/invitations.post.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/invitations.post.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/invitations.post.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/invitations.post.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/invitations.post.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/invitations.post.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/invitations.post.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/invitations.post.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/invitations.post.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/invitations.post.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/invitations.post.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/invitations.post.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/invitations.post.responses.422.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./user_management/invitations.post.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/invitations/by_token/{token}.get.description
Retrieve an existing invitation using the token.

# paths./user_management/invitations/by_token/{token}.get.parameters[].description
The token used to accept the invitation.

# paths./user_management/invitations/by_token/{token}.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/invitations/{id}.get.description
Get the details of an existing invitation.

# paths./user_management/invitations/{id}.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/invitations/{id}/accept.post.description
Accepts an invitation and, if linked to an organization, activates the user's membership in that organization.

# paths./user_management/invitations/{id}/accept.post.responses.200.content.application/json.schema.properties.accepted_at.description
The timestamp when the invitation was accepted, or null if not yet accepted.

# paths./user_management/invitations/{id}/accept.post.responses.200.content.application/json.schema.properties.revoked_at.description
The timestamp when the invitation was revoked, or null if not revoked.

# paths./user_management/invitations/{id}/accept.post.responses.200.content.application/json.schema.properties.expires_at.description
The timestamp when the invitation expires.

# paths./user_management/invitations/{id}/accept.post.responses.200.content.application/json.schema.properties.organization_id.description
The ID of the [organization](/reference/organization) that the recipient will join.

# paths./user_management/invitations/{id}/accept.post.responses.200.content.application/json.schema.properties.inviter_user_id.description
The ID of the user who invited the recipient, if provided.

# paths./user_management/invitations/{id}/accept.post.responses.200.content.application/json.schema.properties.accepted_user_id.description
The ID of the user who accepted the invitation, once accepted.

# paths./user_management/invitations/{id}/accept.post.responses.200.content.application/json.schema.properties.role_slug.description
Slug of the role the invitee will be assigned on acceptance. Reflects the current role on the invitee's organization membership. null when the invitation has no associated organization.

# paths./user_management/invitations/{id}/accept.post.responses.200.content.application/json.schema.properties.token.description
The token used to accept the invitation.

# paths./user_management/invitations/{id}/accept.post.responses.200.content.application/json.schema.properties.accept_invitation_url.description
The URL where the recipient can accept the invitation.

# paths./user_management/invitations/{id}/accept.post.responses.400.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/invitations/{id}/accept.post.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/invitations/{id}/resend.post.description
Resends an invitation email to the recipient. The invitation must be in a pending state.

# paths./user_management/invitations/{id}/resend.post.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/invitations/{id}/resend.post.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/invitations/{id}/resend.post.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/invitations/{id}/resend.post.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/invitations/{id}/resend.post.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/invitations/{id}/resend.post.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/invitations/{id}/resend.post.responses.422.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./user_management/invitations/{id}/resend.post.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/invitations/{id}/revoke.post.responses.200.content.application/json.schema.properties.accepted_at.description
The timestamp when the invitation was accepted, or null if not yet accepted.

# paths./user_management/invitations/{id}/revoke.post.responses.200.content.application/json.schema.properties.revoked_at.description
The timestamp when the invitation was revoked, or null if not revoked.

# paths./user_management/invitations/{id}/revoke.post.responses.200.content.application/json.schema.properties.expires_at.description
The timestamp when the invitation expires.

# paths./user_management/invitations/{id}/revoke.post.responses.200.content.application/json.schema.properties.organization_id.description
The ID of the [organization](/reference/organization) that the recipient will join.

# paths./user_management/invitations/{id}/revoke.post.responses.200.content.application/json.schema.properties.inviter_user_id.description
The ID of the user who invited the recipient, if provided.

# paths./user_management/invitations/{id}/revoke.post.responses.200.content.application/json.schema.properties.accepted_user_id.description
The ID of the user who accepted the invitation, once accepted.

# paths./user_management/invitations/{id}/revoke.post.responses.200.content.application/json.schema.properties.role_slug.description
Slug of the role the invitee will be assigned on acceptance. Reflects the current role on the invitee's organization membership. null when the invitation has no associated organization.

# paths./user_management/invitations/{id}/revoke.post.responses.200.content.application/json.schema.properties.token.description
The token used to accept the invitation.

# paths./user_management/invitations/{id}/revoke.post.responses.200.content.application/json.schema.properties.accept_invitation_url.description
The URL where the recipient can accept the invitation.

# paths./user_management/invitations/{id}/revoke.post.responses.400.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./user_management/invitations/{id}/revoke.post.responses.400.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/jwt_template.get.description
Get the JWT template for the current environment.

# paths./user_management/jwt_template.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/jwt_template.put.description
Update the JWT template for the current environment.

# paths./user_management/jwt_template.put.responses.422.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./user_management/jwt_template.put.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/magic_auth.post.description
Creates a one-time authentication code that can be sent to the user's email address. The code expires in 10 minutes. To verify the code, [authenticate the user with Magic Auth](/reference/authkit/authentication/magic-auth).

# paths./user_management/magic_auth.post.responses.201.content.application/json.schema.allOf[].properties.radar_auth_attempt_id.description
The ID of the Radar authentication attempt created for this request when Radar is enabled. Pass this value to the authenticate endpoint to associate the subsequent authentication with this Radar attempt.

# paths./user_management/magic_auth.post.responses.400.content.application/json.schema.oneOf[].properties.error_description.description
A human-readable description of the error.

# paths./user_management/magic_auth.post.responses.400.content.application/json.schema.oneOf[].properties.error_description.example
The request failed due to: invitation_invalid.

# paths./user_management/magic_auth.post.responses.400.content.application/json.schema.oneOf[].properties.error_description.description
A human-readable description of the error.

# paths./user_management/magic_auth.post.responses.400.content.application/json.schema.oneOf[].properties.error_description.description
A human-readable description of the error.

# paths./user_management/magic_auth.post.responses.400.content.application/json.schema.oneOf[].properties.error_description.example
The request failed due to: sign_up_not_allowed.

# paths./user_management/magic_auth.post.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/magic_auth.post.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/magic_auth.post.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/magic_auth.post.responses.429.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./user_management/magic_auth.post.responses.429.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/magic_auth/{id}.get.description
Get the details of an existing [Magic Auth](/reference/authkit/magic-auth) code that can be used to send an email to a user for authentication.

# paths./user_management/magic_auth/{id}.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/organization_memberships.get.description
Get a list of all organization memberships matching the criteria specified. At least one of `user_id` or `organization_id` must be provided. By default only active memberships are returned. Use the `statuses` parameter to filter by other statuses.

# paths./user_management/organization_memberships.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`.

# paths./user_management/organization_memberships.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`.

# paths./user_management/organization_memberships.get.parameters[].description
Upper limit on the number of objects to return, between `1` and `100`.

# paths./user_management/organization_memberships.get.parameters[].description
Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records).

# paths./user_management/organization_memberships.get.parameters[].description
The ID of the [organization](/reference/organization) which the user belongs to.

# paths./user_management/organization_memberships.get.parameters[].description
Filter by the status of the organization membership. Array including any of `active`, `inactive`, or `pending`.

# paths./user_management/organization_memberships.get.parameters[].description
The ID of the [user](/reference/authkit/user).

# paths./user_management/organization_memberships.get.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/organization_memberships.get.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/organization_memberships.get.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/organization_memberships.get.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/organization_memberships.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/organization_memberships.get.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/organization_memberships.post.description
Creates a new `active` organization membership for the given organization and user.

Calling this API with an organization and user that match an `inactive` organization membership will activate the membership with the specified role(s).

# paths./user_management/organization_memberships.post.responses.201.content.application/json.schema.properties.id.description
The unique ID of the organization membership.

# paths./user_management/organization_memberships.post.responses.201.content.application/json.schema.properties.organization_id.description
The ID of the organization which the user belongs to.

# paths./user_management/organization_memberships.post.responses.201.content.application/json.schema.properties.status.description
The status of the organization membership. One of `active`, `inactive`, or `pending`.

# paths./user_management/organization_memberships.post.responses.201.content.application/json.schema.properties.directory_managed.description
Whether this organization membership is managed by a directory sync connection.

# paths./user_management/organization_memberships.post.responses.201.content.application/json.schema.properties.organization_name.description
The name of the organization which the user belongs to.

# paths./user_management/organization_memberships.post.responses.201.content.application/json.schema.properties.custom_attributes.description
An object containing IdP-sourced attributes from the linked [Directory User](/reference/directory-sync/directory-user) or [SSO Profile](/reference/sso/profile). Directory User attributes take precedence when both are linked.

# paths./user_management/organization_memberships.post.responses.201.content.application/json.schema.properties.role.description
The primary role assigned to the user within the organization.

# paths./user_management/organization_memberships.post.responses.201.content.application/json.schema.properties.roles.description
The list of roles assigned to the user within the organization.

# paths./user_management/organization_memberships.post.responses.201.content.application/json.schema.properties.user.description
The user that belongs to the organization through this membership.

# paths./user_management/organization_memberships.post.responses.400.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/organization_memberships.post.responses.400.content.application/json.schema.properties.message.example
A pending organization membership cannot be reactivated. The user needs to accept the invitation instead.

# paths./user_management/organization_memberships.post.responses.400.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./user_management/organization_memberships.post.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/organization_memberships.post.responses.422.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/organization_memberships.post.responses.422.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/organization_memberships.post.responses.422.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/organization_memberships.post.responses.422.content.application/json.schema.oneOf[].properties.message.example
Role 'invalid_slug' is not a valid role.

# paths./user_management/organization_memberships.post.responses.422.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/organization_memberships.post.responses.422.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/organization_memberships.post.responses.422.content.application/json.schema.oneOf[].properties.message.example
Multiple roles are not enabled for this environment.

# paths./user_management/organization_memberships.post.responses.422.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/organization_memberships.post.responses.422.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/organization_memberships.post.responses.422.content.application/json.schema.oneOf[].properties.message.example
Sub-resource scoped roles are not allowed for this operation.

# paths./user_management/organization_memberships.post.responses.422.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/organization_memberships.post.responses.422.content.application/json.schema.oneOf[].properties.role_slug.description
The slug of the role that is not allowed.

# paths./user_management/organization_memberships/{id}.get.description
Get the details of an existing organization membership.

# paths./user_management/organization_memberships/{id}.get.parameters[].description
The unique ID of the organization membership.

# paths./user_management/organization_memberships/{id}.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/organization_memberships/{id}.delete.description
Permanently deletes an existing organization membership. It cannot be undone.

# paths./user_management/organization_memberships/{id}.delete.parameters[].description
The unique ID of the organization membership.

# paths./user_management/organization_memberships/{id}.delete.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/organization_memberships/{id}.put.description
Update the details of an existing organization membership.

# paths./user_management/organization_memberships/{id}.put.parameters[].description
The unique ID of the organization membership.

# paths./user_management/organization_memberships/{id}.put.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/organization_memberships/{id}.put.responses.422.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/organization_memberships/{id}.put.responses.422.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/organization_memberships/{id}.put.responses.422.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/organization_memberships/{id}.put.responses.422.content.application/json.schema.oneOf[].properties.message.example
Role 'invalid_slug' is not a valid role.

# paths./user_management/organization_memberships/{id}.put.responses.422.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/organization_memberships/{id}.put.responses.422.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/organization_memberships/{id}.put.responses.422.content.application/json.schema.oneOf[].properties.message.example
Multiple roles are not enabled for this environment.

# paths./user_management/organization_memberships/{id}.put.responses.422.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/organization_memberships/{id}.put.responses.422.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/organization_memberships/{id}.put.responses.422.content.application/json.schema.oneOf[].properties.message.example
Sub-resource scoped roles are not allowed for this operation.

# paths./user_management/organization_memberships/{id}.put.responses.422.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/organization_memberships/{id}.put.responses.422.content.application/json.schema.oneOf[].properties.role_slug.description
The slug of the role that is not allowed.

# paths./user_management/organization_memberships/{id}/deactivate.put.description
Deactivates an `active` organization membership. Emits an [organization_membership.updated](/events/organization-membership) event upon successful deactivation.

- Deactivating an `inactive` membership is a no-op and does not emit an event.
- Deactivating a `pending` membership returns an error. This membership should be [deleted](/reference/authkit/organization-membership/delete) instead.

See the [membership management documentation](/authkit/users-organizations/organizations/membership-management) for additional details.

# paths./user_management/organization_memberships/{id}/deactivate.put.parameters[].description
The unique ID of the organization membership.

# paths./user_management/organization_memberships/{id}/deactivate.put.responses.200.content.application/json.schema.properties.id.description
The unique ID of the organization membership.

# paths./user_management/organization_memberships/{id}/deactivate.put.responses.200.content.application/json.schema.properties.organization_id.description
The ID of the organization which the user belongs to.

# paths./user_management/organization_memberships/{id}/deactivate.put.responses.200.content.application/json.schema.properties.status.description
The status of the organization membership. One of `active`, `inactive`, or `pending`.

# paths./user_management/organization_memberships/{id}/deactivate.put.responses.200.content.application/json.schema.properties.directory_managed.description
Whether this organization membership is managed by a directory sync connection.

# paths./user_management/organization_memberships/{id}/deactivate.put.responses.200.content.application/json.schema.properties.organization_name.description
The name of the organization which the user belongs to.

# paths./user_management/organization_memberships/{id}/deactivate.put.responses.200.content.application/json.schema.properties.custom_attributes.description
An object containing IdP-sourced attributes from the linked [Directory User](/reference/directory-sync/directory-user) or [SSO Profile](/reference/sso/profile). Directory User attributes take precedence when both are linked.

# paths./user_management/organization_memberships/{id}/deactivate.put.responses.200.content.application/json.schema.properties.role.description
The primary role assigned to the user within the organization.

# paths./user_management/organization_memberships/{id}/deactivate.put.responses.200.content.application/json.schema.properties.roles.description
The list of roles assigned to the user within the organization.

# paths./user_management/organization_memberships/{id}/deactivate.put.responses.200.content.application/json.schema.properties.user.description
The user that belongs to the organization through this membership.

# paths./user_management/organization_memberships/{id}/deactivate.put.responses.400.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/organization_memberships/{id}/deactivate.put.responses.400.content.application/json.schema.properties.message.example
A pending organization membership cannot be deactivated. This membership should be deleted instead.

# paths./user_management/organization_memberships/{id}/deactivate.put.responses.400.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./user_management/organization_memberships/{id}/deactivate.put.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/organization_memberships/{id}/deactivate.put.responses.422.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./user_management/organization_memberships/{id}/deactivate.put.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/organization_memberships/{id}/reactivate.put.description
Reactivates an `inactive` organization membership, retaining the pre-existing role(s). Emits an [organization_membership.updated](/events/organization-membership) event upon successful reactivation.

- Reactivating an `active` membership is a no-op and does not emit an event.
- Reactivating a `pending` membership returns an error. The user needs to [accept the invitation](/authkit/invitations) instead.

See the [membership management documentation](/authkit/users-organizations/organizations/membership-management) for additional details.

# paths./user_management/organization_memberships/{id}/reactivate.put.parameters[].description
The unique ID of the organization membership.

# paths./user_management/organization_memberships/{id}/reactivate.put.responses.400.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/organization_memberships/{id}/reactivate.put.responses.400.content.application/json.schema.properties.message.example
A pending organization membership cannot be reactivated. The user needs to accept the invitation instead.

# paths./user_management/organization_memberships/{id}/reactivate.put.responses.400.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./user_management/organization_memberships/{id}/reactivate.put.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/organization_memberships/{id}/reactivate.put.responses.422.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./user_management/organization_memberships/{id}/reactivate.put.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/organization_memberships/{omId}/groups.get.description
Get a list of groups that an organization membership belongs to.

# paths./user_management/organization_memberships/{omId}/groups.get.parameters[].description
Unique identifier of the Organization Membership.

# paths./user_management/organization_memberships/{omId}/groups.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`.

# paths./user_management/organization_memberships/{omId}/groups.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`.

# paths./user_management/organization_memberships/{omId}/groups.get.parameters[].description
Upper limit on the number of objects to return, between `1` and `100`.

# paths./user_management/organization_memberships/{omId}/groups.get.parameters[].description
Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records).

# paths./user_management/organization_memberships/{omId}/groups.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/password_reset.post.description
Creates a one-time token that can be used to reset a user's password.

# paths./user_management/password_reset.post.responses.403.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/password_reset.post.responses.403.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/password_reset.post.responses.403.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/password_reset.post.responses.403.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/password_reset.post.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/password_reset.post.responses.422.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./user_management/password_reset.post.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/password_reset.post.responses.429.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./user_management/password_reset.post.responses.429.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/password_reset/confirm.post.description
Sets a new password using the `token` query parameter from the link that the user received. Successfully resetting the password will verify a user's email, if it hasn't been verified yet.

# paths./user_management/password_reset/confirm.post.responses.400.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./user_management/password_reset/confirm.post.responses.400.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/password_reset/confirm.post.responses.400.content.application/json.schema.properties.errors.items.properties.message.description
A human-readable description of the validation error.

# paths./user_management/password_reset/confirm.post.responses.403.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./user_management/password_reset/confirm.post.responses.403.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/password_reset/confirm.post.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/password_reset/confirm.post.responses.422.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./user_management/password_reset/confirm.post.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/password_reset/{id}.get.description
Get the details of an existing password reset token that can be used to reset a user's password.

# paths./user_management/password_reset/{id}.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/radar_challenges.post.description
Sends a one-time verification code over SMS to a user as part of a Radar challenge. Use the returned `verification_id` to authenticate the user with the `urn:workos:oauth:grant-type:radar-sms-challenge:code` grant type.

# paths./user_management/radar_challenges/{id}.get.description
Get the details of an existing Radar Challenge, including the OTP code.

# paths./user_management/radar_challenges/{id}.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/redirect_uris.post.description
Creates a new redirect URI for an application.

# paths./user_management/redirect_uris.post.responses.400.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/redirect_uris.post.responses.401.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/redirect_uris.post.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/redirect_uris.get.description
Lists the redirect URIs for an environment.

# paths./user_management/redirect_uris.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`.

# paths./user_management/redirect_uris.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`.

# paths./user_management/redirect_uris.get.parameters[].description
Upper limit on the number of objects to return, between `1` and `100`.

# paths./user_management/redirect_uris.get.parameters[].description
Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records).

# paths./user_management/redirect_uris.get.responses.200.content.application/json.schema.allOf[].properties.list_metadata.properties.before.description
An object ID that defines your place in the list. When the ID is not present, you are at the start of the list.

# paths./user_management/redirect_uris.get.responses.200.content.application/json.schema.allOf[].properties.list_metadata.properties.after.description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.

# paths./user_management/redirect_uris.get.responses.200.content.application/json.schema.allOf[].properties.list_metadata.description
Pagination cursors for navigating between pages of results.

# paths./user_management/redirect_uris.get.responses.200.content.application/json.schema.allOf[].properties.data.description
The list of records for the current page.

# paths./user_management/redirect_uris.get.responses.401.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/redirect_uris/{id}.delete.description
Deletes a redirect URI from an application.

# paths./user_management/redirect_uris/{id}.delete.responses.401.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/redirect_uris/{id}.delete.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/redirect_uris/{id}.delete.responses.409.description
The redirect URI is the default and cannot be deleted.

# paths./user_management/redirect_uris/{id}.delete.responses.409.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/sessions/logout.get.description
Logout a user from the current [session](/reference/authkit/session).

# paths./user_management/sessions/logout.get.parameters[].description
The ID of the session. This can be extracted from the `sid` claim of the access token.

# paths./user_management/sessions/logout.get.parameters[].description
The URL to redirect the user to after logout.

# paths./user_management/sessions/logout.get.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/sessions/revoke.post.responses.400.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/users.get.description
Get a list of all of your existing users matching the criteria specified.

# paths./user_management/users.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`.

# paths./user_management/users.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`.

# paths./user_management/users.get.parameters[].description
Upper limit on the number of objects to return, between `1` and `100`.

# paths./user_management/users.get.parameters[].description
Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records).

# paths./user_management/users.get.parameters[].description
Filter users by the organization they are a member of. Deprecated in favor of `organization_id`.

# paths./user_management/users.get.parameters[].description
Filter users by the organization they are a member of.

# paths./user_management/users.get.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/users.post.description
Create a new user in the current environment.

# paths./user_management/users.post.responses.201.content.application/json.schema.allOf[].properties.radar_auth_attempt_id.description
The ID of the Radar authentication attempt created for this request when Radar is enabled. Pass this value to the authenticate endpoint to associate the subsequent authentication with this Radar attempt.

# paths./user_management/users.post.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/users.post.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/users.post.responses.400.content.application/json.schema.oneOf[].properties.errors.items.properties.message.description
A human-readable description of the validation error.

# paths./user_management/users.post.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/users.post.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/users.post.responses.400.content.application/json.schema.oneOf[].properties.errors.items.properties.message.description
A human-readable description of the validation error.

# paths./user_management/users.post.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/users.post.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/users.post.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/users.post.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/users.post.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/users.post.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/users.post.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/users.post.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/users.post.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/users.post.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/users.post.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/users.post.responses.422.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./user_management/users.post.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/users/external_id/{external_id}.get.description
Get the details of an existing user by an [external identifier](/authkit/metadata/external-identifiers).

# paths./user_management/users/external_id/{external_id}.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/users/{id}.put.description
Updates properties of a user. The omitted properties will be left unchanged.

# paths./user_management/users/{id}.put.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/users/{id}.put.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/users/{id}.put.responses.400.content.application/json.schema.oneOf[].properties.errors.items.properties.message.description
A human-readable description of the validation error.

# paths./user_management/users/{id}.put.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/users/{id}.put.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/users/{id}.put.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/users/{id}.put.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/users/{id}.put.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/users/{id}.put.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/users/{id}.put.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/users/{id}.put.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/users/{id}.put.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/users/{id}.put.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/users/{id}.put.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/users/{id}.put.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/users/{id}.put.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/users/{id}.put.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/users/{id}.put.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/users/{id}.put.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/users/{id}.put.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/users/{id}.put.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/users/{id}.put.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/users/{id}.put.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/users/{id}.put.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/users/{id}.put.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/users/{id}.put.responses.422.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./user_management/users/{id}.put.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/users/{id}.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/users/{id}.delete.description
Permanently deletes a user in the current environment. It cannot be undone.

# paths./user_management/users/{id}.delete.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/users/{id}.delete.responses.409.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./user_management/users/{id}.delete.responses.409.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/users/{id}/email_change/confirm.post.description
Confirms an email change using the one-time code received by the user.

# paths./user_management/users/{id}/email_change/confirm.post.responses.200.content.application/json.schema.properties.object.description
Distinguishes the email change confirmation object.

# paths./user_management/users/{id}/email_change/confirm.post.responses.200.content.application/json.schema.properties.user.properties.profile_picture_url.description
A URL reference to an image representing the user.

# paths./user_management/users/{id}/email_change/confirm.post.responses.200.content.application/json.schema.properties.user.properties.email_verified.description
Whether the user's email has been verified.

# paths./user_management/users/{id}/email_change/confirm.post.responses.200.content.application/json.schema.properties.user.properties.metadata.description
Object containing metadata key/value pairs associated with the user.

# paths./user_management/users/{id}/email_change/confirm.post.responses.200.content.application/json.schema.properties.user.properties.last_sign_in_at.description
The timestamp when the user last signed in.

# paths./user_management/users/{id}/email_change/confirm.post.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/users/{id}/email_change/confirm.post.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/users/{id}/email_change/confirm.post.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/users/{id}/email_change/confirm.post.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/users/{id}/email_change/confirm.post.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/users/{id}/email_change/confirm.post.responses.409.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/users/{id}/email_change/confirm.post.responses.409.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/users/{id}/email_change/confirm.post.responses.409.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/users/{id}/email_change/confirm.post.responses.409.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/users/{id}/email_change/confirm.post.responses.409.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/users/{id}/email_change/confirm.post.responses.409.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/users/{id}/email_change/confirm.post.responses.409.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/users/{id}/email_change/confirm.post.responses.409.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/users/{id}/email_change/confirm.post.responses.422.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/users/{id}/email_change/confirm.post.responses.422.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/users/{id}/email_change/confirm.post.responses.422.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/users/{id}/email_change/confirm.post.responses.422.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/users/{id}/email_change/confirm.post.responses.429.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./user_management/users/{id}/email_change/confirm.post.responses.429.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/users/{id}/email_change/send.post.description
Sends an email that contains a one-time code used to change a user's email address.

# paths./user_management/users/{id}/email_change/send.post.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/users/{id}/email_change/send.post.responses.409.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/users/{id}/email_change/send.post.responses.409.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/users/{id}/email_change/send.post.responses.409.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/users/{id}/email_change/send.post.responses.409.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/users/{id}/email_change/send.post.responses.409.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/users/{id}/email_change/send.post.responses.409.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/users/{id}/email_change/send.post.responses.422.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/users/{id}/email_change/send.post.responses.422.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/users/{id}/email_change/send.post.responses.422.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/users/{id}/email_change/send.post.responses.422.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/users/{id}/email_change/send.post.responses.429.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./user_management/users/{id}/email_change/send.post.responses.429.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/users/{id}/email_verification/confirm.post.description
Verifies an email address using the one-time code received by the user.

# paths./user_management/users/{id}/email_verification/confirm.post.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/users/{id}/email_verification/confirm.post.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/users/{id}/email_verification/confirm.post.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/users/{id}/email_verification/confirm.post.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/users/{id}/email_verification/confirm.post.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/users/{id}/email_verification/confirm.post.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/users/{id}/email_verification/confirm.post.responses.400.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./user_management/users/{id}/email_verification/confirm.post.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./user_management/users/{id}/email_verification/confirm.post.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/users/{id}/email_verification/confirm.post.responses.422.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./user_management/users/{id}/email_verification/confirm.post.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/users/{id}/email_verification/send.post.description
Sends an email that contains a one-time code used to verify a user's email address.

# paths./user_management/users/{id}/email_verification/send.post.responses.400.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./user_management/users/{id}/email_verification/send.post.responses.400.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/users/{id}/email_verification/send.post.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/users/{id}/email_verification/send.post.responses.429.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./user_management/users/{id}/email_verification/send.post.responses.429.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/users/{id}/identities.get.description
Get a list of identities associated with the user. A user can have multiple associated identities after going through [identity linking](/authkit/identity-linking). Currently only OAuth identities are supported. More provider types may be added in the future.

# paths./user_management/users/{id}/identities.get.responses.200.content.application/json.schema.items.properties.idp_id.description
The unique ID of the user in the external identity provider.

# paths./user_management/users/{id}/identities.get.responses.200.content.application/json.schema.items.properties.provider.description
The type of OAuth provider for the identity.

# paths./user_management/users/{id}/identities.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/users/{id}/sessions.get.description
Get a list of all active sessions for a specific user.

# paths./user_management/users/{id}/sessions.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`.

# paths./user_management/users/{id}/sessions.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`.

# paths./user_management/users/{id}/sessions.get.parameters[].description
Upper limit on the number of objects to return, between `1` and `100`.

# paths./user_management/users/{id}/sessions.get.parameters[].description
Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records).

# paths./user_management/users/{id}/sessions.get.responses.200.content.application/json.schema.allOf[].properties.list_metadata.properties.before.description
An object ID that defines your place in the list. When the ID is not present, you are at the start of the list.

# paths./user_management/users/{id}/sessions.get.responses.200.content.application/json.schema.allOf[].properties.list_metadata.properties.after.description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.

# paths./user_management/users/{id}/sessions.get.responses.200.content.application/json.schema.allOf[].properties.list_metadata.description
Pagination cursors for navigating between pages of results.

# paths./user_management/users/{id}/sessions.get.responses.200.content.application/json.schema.allOf[].properties.data.description
The list of records for the current page.

# paths./user_management/users/{id}/sessions.get.responses.200.content.application/json.schema.allOf[].properties.data.items.properties.impersonator.properties.email.description
The email address of the WorkOS Dashboard user who is impersonating the user.

# paths./user_management/users/{id}/sessions.get.responses.200.content.application/json.schema.allOf[].properties.data.items.properties.impersonator.properties.reason.description
The justification the impersonator gave for impersonating the user.

# paths./user_management/users/{id}/sessions.get.responses.200.content.application/json.schema.allOf[].properties.data.items.properties.impersonator.properties.reason.example
Investigating an issue with the customer's account.

# paths./user_management/users/{id}/sessions.get.responses.200.content.application/json.schema.allOf[].properties.data.items.properties.impersonator.description
Information about the impersonator if this session was created via impersonation.

# paths./user_management/users/{id}/sessions.get.responses.200.content.application/json.schema.allOf[].properties.data.items.properties.ip_address.description
The IP address from which the session was created.

# paths./user_management/users/{id}/sessions.get.responses.200.content.application/json.schema.allOf[].properties.data.items.properties.organization_id.description
The ID of the organization this session is associated with.

# paths./user_management/users/{id}/sessions.get.responses.200.content.application/json.schema.allOf[].properties.data.items.properties.user_agent.description
The user agent string from the device that created the session.

# paths./user_management/users/{id}/sessions.get.responses.200.content.application/json.schema.allOf[].properties.data.items.properties.user_agent.example
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36

# paths./user_management/users/{id}/sessions.get.responses.200.content.application/json.schema.allOf[].properties.data.items.properties.user_id.description
The ID of the user this session belongs to.

# paths./user_management/users/{id}/sessions.get.responses.200.content.application/json.schema.allOf[].properties.data.items.properties.auth_method.description
The authentication method used to create this session.

# paths./user_management/users/{id}/sessions.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/users/{id}/sessions.get.responses.422.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./user_management/users/{id}/sessions.get.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/users/{userId}/api_keys.get.description
Get a list of API keys owned by a specific user.

# paths./user_management/users/{userId}/api_keys.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.

# paths./user_management/users/{userId}/api_keys.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.

# paths./user_management/users/{userId}/api_keys.get.parameters[].description
Upper limit on the number of objects to return, between `1` and `100`.

# paths./user_management/users/{userId}/api_keys.get.parameters[].description
The ID of the organization to filter user API keys by. When provided, only API keys created against that organization membership are returned.

# paths./user_management/users/{userId}/api_keys.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/users/{userId}/api_keys.post.description
Create a new API key owned by a user. The user must have an active membership in the specified organization.

# paths./user_management/users/{userId}/api_keys.post.responses.400.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/users/{userId}/api_keys.post.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/users/{userId}/api_keys.post.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/users/{userId}/feature-flags.get.description
Get a list of all enabled feature flags for the provided user. This includes feature flags enabled specifically for the user as well as any organizations that the user is a member of.

# paths./user_management/users/{userId}/feature-flags.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.

# paths./user_management/users/{userId}/feature-flags.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.

# paths./user_management/users/{userId}/feature-flags.get.parameters[].description
Upper limit on the number of objects to return, between `1` and `100`.

# paths./user_management/users/{userId}/feature-flags.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/users/{user_id}/authorized_applications.get.description
Get a list of all Connect applications that the user has authorized.

# paths./user_management/users/{user_id}/authorized_applications.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`.

# paths./user_management/users/{user_id}/authorized_applications.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`.

# paths./user_management/users/{user_id}/authorized_applications.get.parameters[].description
Upper limit on the number of objects to return, between `1` and `100`.

# paths./user_management/users/{user_id}/authorized_applications.get.parameters[].description
Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records).

# paths./user_management/users/{user_id}/authorized_applications.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/users/{user_id}/authorized_applications.get.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/users/{user_id}/authorized_applications/{applic.delete.description
Delete an existing Authorized Connect Application.

# paths./user_management/users/{user_id}/authorized_applications/{applic.delete.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/users/{user_id}/connected_accounts/{slug}.get.parameters[].description
The slug identifier of the provider (e.g., `github`, `slack`, `notion`).

# paths./user_management/users/{user_id}/connected_accounts/{slug}.get.parameters[].description
An [Organization](/reference/organization) identifier. Optional parameter if the connection is scoped to an organization.

# paths./user_management/users/{user_id}/connected_accounts/{slug}.get.responses.200.description
The connected account was retrieved successfully.

# paths./user_management/users/{user_id}/connected_accounts/{slug}.get.responses.404.description
The user, organization, or connected account was not found.

# paths./user_management/users/{user_id}/connected_accounts/{slug}.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/users/{user_id}/connected_accounts/{slug}.delete.description
Disconnects WorkOS's account for the user, including removing any stored access and refresh tokens. The user will need to reauthorize if they want to reconnect. This does not revoke access on the provider side.

# paths./user_management/users/{user_id}/connected_accounts/{slug}.delete.parameters[].description
The slug identifier of the provider (e.g., `github`, `slack`, `notion`).

# paths./user_management/users/{user_id}/connected_accounts/{slug}.delete.parameters[].description
An [Organization](/reference/organization) identifier. Optional parameter if the connection is scoped to an organization.

# paths./user_management/users/{user_id}/connected_accounts/{slug}.delete.responses.204.description
The connected account was deleted successfully.

# paths./user_management/users/{user_id}/connected_accounts/{slug}.delete.responses.404.description
The user, organization, or connected account was not found.

# paths./user_management/users/{user_id}/connected_accounts/{slug}.delete.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/users/{user_id}/connected_accounts/{slug}.post.description
Imports a [connected account](/reference/pipes/connected-account) for a user by providing OAuth tokens directly. Use this to migrate existing connections or set up connections without going through the OAuth flow.

# paths./user_management/users/{user_id}/connected_accounts/{slug}.post.parameters[].description
The slug identifier of the provider (e.g., `github`, `slack`, `notion`).

# paths./user_management/users/{user_id}/connected_accounts/{slug}.post.parameters[].description
An [Organization](/reference/organization) identifier. Optional parameter if the connection is scoped to an organization.

# paths./user_management/users/{user_id}/connected_accounts/{slug}.post.responses.201.description
The connected account was created successfully.

# paths./user_management/users/{user_id}/connected_accounts/{slug}.post.responses.404.description
The user, organization, or data integration was not found.

# paths./user_management/users/{user_id}/connected_accounts/{slug}.post.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/users/{user_id}/connected_accounts/{slug}.post.responses.409.description
A connected account already exists for this user, integration, and organization.

# paths./user_management/users/{user_id}/connected_accounts/{slug}.post.responses.409.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/users/{user_id}/connected_accounts/{slug}.post.responses.422.description
The data integration is not in a valid state or the token combination is invalid.

# paths./user_management/users/{user_id}/connected_accounts/{slug}.post.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/users/{user_id}/connected_accounts/{slug}.put.description
Updates a user's [connected account](/reference/pipes/connected-account) tokens, scopes, or state for a specific provider.

# paths./user_management/users/{user_id}/connected_accounts/{slug}.put.parameters[].description
The slug identifier of the provider (e.g., `github`, `slack`, `notion`).

# paths./user_management/users/{user_id}/connected_accounts/{slug}.put.parameters[].description
An [Organization](/reference/organization) identifier. Optional parameter if the connection is scoped to an organization.

# paths./user_management/users/{user_id}/connected_accounts/{slug}.put.responses.200.description
The connected account was updated successfully.

# paths./user_management/users/{user_id}/connected_accounts/{slug}.put.responses.404.description
The user, organization, or connected account was not found.

# paths./user_management/users/{user_id}/connected_accounts/{slug}.put.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/users/{user_id}/data_providers.get.description
Retrieves a list of available providers and the user's connection status for each. Returns all providers configured for your environment, along with the user's [connected account](/reference/pipes/connected-account) information where applicable.

# paths./user_management/users/{user_id}/data_providers.get.parameters[].description
A [User](/reference/authkit/user) identifier to list providers and connected accounts for.

# paths./user_management/users/{user_id}/data_providers.get.parameters[].description
An [Organization](/reference/organization) identifier. Optional parameter to filter connections for a specific organization.

# paths./user_management/users/{user_id}/data_providers.get.responses.200.description
The list of data providers was retrieved successfully.

# paths./user_management/users/{user_id}/data_providers.get.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/users/{userlandUserId}/auth_factors.post.parameters[].description
The ID of the [user](/reference/authkit/user).

# paths./user_management/users/{userlandUserId}/auth_factors.post.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./user_management/users/{userlandUserId}/auth_factors.get.parameters[].description
The ID of the [user](/reference/authkit/user).

# paths./user_management/users/{userlandUserId}/auth_factors.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.

# paths./user_management/users/{userlandUserId}/auth_factors.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.

# paths./user_management/users/{userlandUserId}/auth_factors.get.parameters[].description
Upper limit on the number of objects to return, between `1` and `100`.

# paths./user_management/users/{userlandUserId}/auth_factors.get.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./vault/v1/keys/data-key.post.description
Generate an isolated encryption key for local encryption operations.

# paths./vault/v1/keys/decrypt.post.description
Decrypt a previously encrypted data key from WorkOS Vault.

# paths./vault/v1/keys/rekey.post.description
Decrypt an existing data key and re-encrypt it under a new key context.

# paths./vault/v1/kv.get.description
List all encrypted objects with cursor-based pagination.

# paths./vault/v1/kv.get.parameters[].description
Upper limit on the number of objects to return.

# paths./vault/v1/kv.get.parameters[].description
Cursor for the previous page of results.

# paths./vault/v1/kv.get.parameters[].description
Filter results by name or structured search JSON.

# paths./vault/v1/kv.get.parameters[].description
ISO 8601 timestamp to filter by last modified time.

# paths./vault/v1/kv.post.description
Encrypt and store a new key-value object.

# paths./vault/v1/kv/name/{name}.get.description
Fetch and decrypt an object by its unique name.

# paths./vault/v1/kv/{id}.delete.parameters[].description
Expected current version for optimistic locking.

# paths./vault/v1/kv/{id}.get.description
Fetch and decrypt an object by its unique identifier.

# paths./vault/v1/kv/{id}.put.description
Update the value of an existing encrypted object.

# paths./vault/v1/kv/{id}/metadata.get.description
Fetch metadata for an object without decrypting it.

# paths./vault/v1/kv/{id}/versions.get.description
Retrieve all versions for a specific object.

# paths./webhook_endpoints.get.description
Get a list of all of your existing webhook endpoints.

# paths./webhook_endpoints.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`.

# paths./webhook_endpoints.get.parameters[].description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`.

# paths./webhook_endpoints.get.parameters[].description
Upper limit on the number of objects to return, between `1` and `100`.

# paths./webhook_endpoints.get.parameters[].description
Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records).

# paths./webhook_endpoints.post.description
Create a new webhook endpoint to receive event notifications.

# paths./webhook_endpoints.post.responses.409.description
A Webhook Endpoint with the same endpoint URL already exists.

# paths./webhook_endpoints.post.responses.409.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./webhook_endpoints.post.responses.409.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./webhook_endpoints.post.responses.422.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./webhook_endpoints.post.responses.422.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./webhook_endpoints.post.responses.422.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./webhook_endpoints.post.responses.422.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./webhook_endpoints.post.responses.422.content.application/json.schema.oneOf[].properties.errors.items.properties.message.description
A human-readable description of the validation error.

# paths./webhook_endpoints/{id}.patch.description
Update the properties of an existing webhook endpoint.

# paths./webhook_endpoints/{id}.patch.parameters[].description
Unique identifier of the Webhook Endpoint.

# paths./webhook_endpoints/{id}.patch.responses.404.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./webhook_endpoints/{id}.patch.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./webhook_endpoints/{id}.patch.responses.409.description
A Webhook Endpoint with the same endpoint URL already exists.

# paths./webhook_endpoints/{id}.patch.responses.409.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./webhook_endpoints/{id}.patch.responses.409.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./webhook_endpoints/{id}.patch.responses.422.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./webhook_endpoints/{id}.patch.responses.422.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./webhook_endpoints/{id}.patch.responses.422.content.application/json.schema.oneOf[].properties.code.description
The error code identifying the type of error.

# paths./webhook_endpoints/{id}.patch.responses.422.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./webhook_endpoints/{id}.patch.responses.422.content.application/json.schema.oneOf[].properties.errors.items.properties.message.description
A human-readable description of the validation error.

# paths./webhook_endpoints/{id}.delete.parameters[].description
Unique identifier of the Webhook Endpoint.

# paths./webhook_endpoints/{id}.delete.responses.404.content.application/json.schema.properties.code.description
The error code identifying the type of error.

# paths./webhook_endpoints/{id}.delete.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./widgets/token.post.description
Generate a widget token for a user, optionally scoped to an organization. When an organization is specified, org-scoped widgets are enabled; omitting it issues a user-only token for widgets like `UserProfile` and `UserSecurity`.

# paths./widgets/token.post.responses.400.content.application/json.schema.oneOf[].properties.message.description
A human-readable description of the error.

# paths./widgets/token.post.responses.404.content.application/json.schema.properties.message.description
A human-readable description of the error.

# paths./widgets/token.post.responses.422.content.application/json.schema.properties.message.description
A human-readable description of the error.

# tags[].description
Manage client secrets for Connect Applications.

# tags[].description
Organize and manage user groups within organizations.

# tags[].description
Manage CORS origins for user management.

# tags[].description
Manage groups for a user organization membership.

# tags[].description
Manage authorized applications for users.

# tags[].description
A unified interface that simplifies authentication and authorization across customers, partners, and external SaaS tools.

# components.securitySchemes.bearer.description
Your WorkOS API key prefixed with `sk_`. Pass it as a Bearer token: `Authorization: Bearer sk_example_123456789`.

# components.securitySchemes.access_token.description
An SSO access token returned from the Get a Profile and Token endpoint.

# components.schemas.UserObject.properties.id.description
Your application's user identifier, which will be stored as an [`external_id`](/authkit/metadata/external-identifiers). Used for upserting and deduplication.

# components.schemas.UserObject.properties.metadata.description
A set of key-value pairs to attach to the user.

# components.schemas.UserConsentOption.properties.label.description
A human-readable label for this consent option.

# components.schemas.UserConsentOption.properties.choices.description
The available choices for this consent option.

# components.schemas.UserManagementLoginRequest.properties.external_auth_id.description
Identifier provided when AuthKit redirected to your login page.

# components.schemas.UserManagementLoginRequest.properties.user.description
The user to create or update in AuthKit.

# components.schemas.ExpireApiKeyDto.properties.expires_at.description
When the API key should expire. If omitted or in the past, the key expires immediately. Use null to clear a scheduled future expiration.

# components.schemas.RedirectUriDto.properties.default.description
Whether this is the default redirect URI.

# components.schemas.CreateOAuthApplicationDto.properties.scopes.description
The OAuth scopes granted to the application.

# components.schemas.CreateOAuthApplicationDto.properties.uses_pkce.description
Whether the application uses PKCE (Proof Key for Code Exchange).

# components.schemas.CreateOAuthApplicationDto.properties.is_first_party.description
Whether this is a first-party application. Third-party applications require an organization_id.

# components.schemas.CreateOAuthApplicationDto.properties.organization_id.description
The organization ID this application belongs to. Required when is_first_party is false.

# components.schemas.CreateM2MApplicationDto.properties.scopes.description
The OAuth scopes granted to the application.

# components.schemas.CreateM2MApplicationDto.properties.organization_id.description
The organization ID this application belongs to.

# components.schemas.UpdateOAuthApplicationDto.properties.scopes.description
The OAuth scopes granted to the application.

# components.schemas.UpdateOAuthApplicationDto.properties.redirect_uris.description
Updated redirect URIs for the application. OAuth applications only.

# components.schemas.AuditLogEventActorDto.properties.metadata.description
Additional data associated with the event or entity.

# components.schemas.AuditLogEventTargetDto.properties.metadata.description
Additional data associated with the event or entity.

# components.schemas.AuditLogEventContextDto.properties.location.description
IP Address or some other geolocation identifier.

# components.schemas.AuditLogEventDto.properties.occurred_at.description
ISO-8601 value of when the action occurred.

# components.schemas.AuditLogEventDto.properties.context.description
Additional context about where and how the action occurred.

# components.schemas.AuditLogEventDto.properties.metadata.description
Additional data associated with the event or entity.

# components.schemas.AuditLogEventDto.properties.version.description
What schema version the event is associated with.

# components.schemas.AuditLogExportCreationDto.properties.range_start.description
ISO-8601 value for start of the export range.

# components.schemas.AuditLogExportCreationDto.properties.range_end.description
ISO-8601 value for end of the export range.

# components.schemas.UpdateAuditLogsRetentionDto.properties.retention_period_in_days.description
The number of days Audit Log events will be retained. Valid values are `30` and `365`.

# components.schemas.AuditLogSchemaTargetDto.properties.metadata.description
Optional JSON schema for target metadata.

# components.schemas.AuditLogSchemaDto.properties.metadata.description
Optional JSON schema for event metadata.

# components.schemas.ChallengeAuthenticationFactorDto.properties.sms_template.description
A custom template for the SMS message. Use the {{code}} placeholder to include the verification code.

# components.schemas.CheckAuthorizationDto.allOf[].oneOf[].properties.resource_id.description
The ID of the resource. Mutually exclusive with `resource_external_id` and `resource_type_slug`.

# components.schemas.CheckAuthorizationDto.allOf[].oneOf[].properties.resource_external_id.description
The external ID of the resource. Required with `resource_type_slug`. Mutually exclusive with `resource_id`.

# components.schemas.CheckAuthorizationDto.allOf[].oneOf[].properties.resource_type_slug.description
The slug of the resource type. Required with `resource_external_id`. Mutually exclusive with `resource_id`.

# components.schemas.CreateGroupRoleAssignmentDto.properties.role_slug.description
The slug of the role to assign to the group.

# components.schemas.CreateGroupRoleAssignmentDto.properties.resource_id.description
The ID of the resource. Omit along with the external-id fields to target the organization itself.

# components.schemas.ReplaceGroupRoleAssignmentEntryDto.properties.role_slug.description
The slug of the role to assign to the group.

# components.schemas.ReplaceGroupRoleAssignmentEntryDto.properties.resource_id.description
The ID of the resource. Omit along with the external-id fields to target the organization itself.

# components.schemas.ReplaceGroupRoleAssignmentsDto.properties.role_assignments.description
The list of role assignments that should exist for the group. All existing assignments will be replaced.

# components.schemas.DeleteGroupRoleAssignmentsByCriteriaDto.properties.role_slug.description
The slug of the role to remove assignments for.

# components.schemas.DeleteGroupRoleAssignmentsByCriteriaDto.properties.resource_id.description
The ID of the resource. Mutually exclusive with `resource_external_id` and `resource_type_slug`.

# components.schemas.AssignRoleDto.allOf[].oneOf[].properties.resource_id.description
The ID of the resource. Mutually exclusive with `resource_external_id` and `resource_type_slug`.

# components.schemas.AssignRoleDto.allOf[].oneOf[].properties.resource_external_id.description
The external ID of the resource. Required with `resource_type_slug`. Mutually exclusive with `resource_id`.

# components.schemas.AssignRoleDto.allOf[].oneOf[].properties.resource_type_slug.description
The resource type slug. Required with `resource_external_id`. Mutually exclusive with `resource_id`.

# components.schemas.RemoveRoleDto.allOf[].oneOf[].properties.resource_id.description
The ID of the resource. Mutually exclusive with `resource_external_id` and `resource_type_slug`.

# components.schemas.RemoveRoleDto.allOf[].oneOf[].properties.resource_external_id.description
The external ID of the resource. Required with `resource_type_slug`. Mutually exclusive with `resource_id`.

# components.schemas.RemoveRoleDto.allOf[].oneOf[].properties.resource_type_slug.description
The resource type slug. Required with `resource_external_id`. Mutually exclusive with `resource_id`.

# components.schemas.SetRolePermissionsDto.properties.permissions.description
The permission slugs to assign to the role.

# components.schemas.AddRolePermissionDto.properties.slug.description
The slug of the permission to add to the role.

# components.schemas.CreateOrganizationRoleDto.properties.slug.description
A unique identifier for the role within the organization. When provided, must begin with 'org-' and contain only lowercase letters, numbers, hyphens, and underscores. When omitted, a slug is auto-generated from the role name and a random suffix.

# components.schemas.CreateOrganizationRoleDto.properties.description.description
An optional description of the role's purpose.

# components.schemas.CreateOrganizationRoleDto.properties.resource_type_slug.description
The slug of the resource type the role is scoped to.

# components.schemas.UpdateOrganizationRoleDto.properties.description.description
An optional description of the role's purpose.

# components.schemas.CreateAuthorizationPermissionDto.properties.slug.description
A unique key to reference the permission. Must be lowercase and contain only letters, numbers, hyphens, underscores, colons, periods, and asterisks.

# components.schemas.CreateAuthorizationPermissionDto.properties.description.description
An optional description of the Permission.

# components.schemas.CreateAuthorizationPermissionDto.properties.resource_type_slug.description
The slug of the resource type this permission is scoped to.

# components.schemas.UpdateAuthorizationPermissionDto.properties.description.description
An optional description of the Permission.

# components.schemas.CreateRoleDto.properties.resource_type_slug.description
The slug of the resource type the role is scoped to.

# components.schemas.UpdateRoleDto.properties.description.example
Full administrative access to all resources

# components.schemas.UpdateAuthorizationResourceDto.allOf[].properties.description.description
An optional description of the resource.

# components.schemas.UpdateAuthorizationResourceDto.allOf[].oneOf[].properties.parent_resource_id.description
The ID of the parent resource. Mutually exclusive with `parent_resource_external_id` and `parent_resource_type_slug`.

# components.schemas.UpdateAuthorizationResourceDto.allOf[].oneOf[].properties.parent_resource_external_id.description
The external ID of the parent resource. Required with `parent_resource_type_slug`. Mutually exclusive with `parent_resource_id`.

# components.schemas.UpdateAuthorizationResourceDto.allOf[].oneOf[].properties.parent_resource_type_slug.description
The resource type slug of the parent resource. Required with `parent_resource_external_id`. Mutually exclusive with `parent_resource_id`.

# components.schemas.CreateAuthorizationResourceDto.allOf[].properties.external_id.description
An external identifier for the resource.

# components.schemas.CreateAuthorizationResourceDto.allOf[].properties.description.description
An optional description of the resource.

# components.schemas.CreateAuthorizationResourceDto.allOf[].properties.organization_id.description
The ID of the organization this resource belongs to.

# components.schemas.CreateAuthorizationResourceDto.allOf[].oneOf[].properties.parent_resource_id.description
The ID of the parent resource. Mutually exclusive with `parent_resource_external_id` and `parent_resource_type_slug`.

# components.schemas.CreateAuthorizationResourceDto.allOf[].oneOf[].properties.parent_resource_external_id.description
The external ID of the parent resource. Required with `parent_resource_type_slug`. Mutually exclusive with `parent_resource_id`.

# components.schemas.CreateAuthorizationResourceDto.allOf[].oneOf[].properties.parent_resource_type_slug.description
The resource type slug of the parent resource. Required with `parent_resource_external_id`. Mutually exclusive with `parent_resource_id`.

# components.schemas.CreateCorsOriginDto.properties.origin.description
The origin URL to allow for CORS requests.

# components.schemas.CreateGroupMembershipDto.properties.organization_membership_id.description
The ID of the Organization Membership to add to the group.

# components.schemas.UpdateJwtTemplateDto.properties.content.description
The JWT template content as a Liquid template string.

# components.schemas.CreateOrganizationDomainDto.properties.organization_id.description
The ID of the organization to add the domain to.

# components.schemas.CreateOrganizationApiKeyDto.properties.permissions.description
The permission slugs to assign to the API key.

# components.schemas.CreateOrganizationApiKeyDto.properties.expires_at.description
The timestamp when the API key should expire. Must be a future timestamp. If omitted, the key does not expire.

# components.schemas.OrganizationDto.properties.allow_profiles_outside_organization.description
Whether the organization allows profiles from outside the organization to sign in.

# components.schemas.OrganizationDto.properties.domains.description
The domains associated with the organization. Deprecated in favor of `domain_data`.

# components.schemas.OrganizationDto.properties.domain_data.description
The domains associated with the organization, including verification state.

# components.schemas.OrganizationDto.properties.external_id.description
An external identifier for the Organization.

# components.schemas.UpdateOrganizationDto.properties.allow_profiles_outside_organization.description
Whether the organization allows profiles from outside the organization to sign in.

# components.schemas.UpdateOrganizationDto.properties.domains.description
The domains associated with the organization. Deprecated in favor of `domain_data`.

# components.schemas.UpdateOrganizationDto.properties.domain_data.description
The domains associated with the organization, including verification state.

# components.schemas.UpdateOrganizationDto.properties.stripe_customer_id.description
The Stripe customer ID associated with the organization.

# components.schemas.UpdateOrganizationDto.properties.external_id.description
An external identifier for the Organization.

# components.schemas.DataIntegrationCredentialsDto.properties.type.description
The credentials type. `custom` uses your own OAuth app credentials; `organization` has each organization supply its own credentials (configured per-organization).

# components.schemas.DataIntegrationCredentialsDto.properties.client_id.description
OAuth client ID for the provider app. Required when `type` is `custom`; omit for `organization`.

# components.schemas.DataIntegrationCredentialsDto.properties.client_secret.description
OAuth client secret for the provider app. Required when `type` is `custom`; omit for `organization`.

# components.schemas.ApiKeyInstallationDto.properties.secret.description
The API key secret to store for the tenant.

# components.schemas.ApiKeyInstallationDto.properties.user_id.description
The User identifier the API key is installed for.

# components.schemas.ApiKeyInstallationDto.properties.organization_id.description
An Organization identifier to scope the installation to a specific organization.

# components.schemas.CustomProviderDefinitionDto.properties.name.description
A descriptive name for the custom provider.

# components.schemas.CustomProviderDefinitionDto.properties.authorization_url.description
The provider's OAuth authorization endpoint. Required for OAuth providers; omit for `api_key` providers.

# components.schemas.CustomProviderDefinitionDto.properties.token_url.description
The provider's OAuth token endpoint. Required for OAuth providers; omit for `api_key` providers.

# components.schemas.CustomProviderDefinitionDto.properties.refresh_token_url.description
The endpoint used to refresh tokens, if different from the token endpoint.

# components.schemas.CustomProviderDefinitionDto.properties.pkce_enabled.description
Whether PKCE is used during the authorization code flow. Defaults to `true`.

# components.schemas.CustomProviderDefinitionDto.properties.request_scope_separator.description
The separator used to join requested scopes. Defaults to a space.

# components.schemas.CustomProviderDefinitionDto.properties.scopes_required.description
Whether at least one scope must be selected when connecting an account. Defaults to `false`.

# components.schemas.CustomProviderDefinitionDto.properties.client_secret_required.description
Whether a client secret is required for this provider. Defaults to `true`.

# components.schemas.CustomProviderDefinitionDto.properties.additional_authorization_parameters.description
Additional static query parameters appended to the authorization request.

# components.schemas.CustomProviderDefinitionDto.properties.token_body_content_type.description
The Content-Type used when exchanging the token request.

# components.schemas.CustomProviderDefinitionDto.properties.authenticate_via.description
How client credentials are sent when exchanging authorization codes and refreshing tokens.

# components.schemas.CreateDataIntegrationDto.properties.provider.description
The provider to create a Data Integration for. For a built-in provider use its slug (e.g. `github`, `slack`). For a custom provider, this is the new provider slug and `custom_provider` must be supplied. A custom provider slug cannot shadow an existing global provider slug.

# components.schemas.CreateDataIntegrationDto.properties.description.description
An optional description of the Data Integration.

# components.schemas.CreateDataIntegrationDto.properties.enabled.description
Whether the Data Integration is enabled. Defaults to `false`.

# components.schemas.CreateDataIntegrationDto.properties.scopes.description
The OAuth scopes to request for the Data Integration. Defaults to the provider's configured scopes when omitted.

# components.schemas.CreateDataIntegrationDto.properties.auth_methods.description
How accounts authenticate with the provider. Defaults to `["oauth"]`. Use `["api_key"]` to declare an API key integration; `credentials` is then not required and keys are supplied per-tenant (optionally via `api_key` on this request). Use `["client_credentials"]` to declare a client-credentials integration; `credentials` is likewise not required and client credentials are supplied per-tenant.

# components.schemas.CreateDataIntegrationDto.properties.config.description
Provider-specific config values (e.g. a Snowflake `account`), keyed by the config field. Only fields the built-in provider declares are accepted.

# components.schemas.CreateDataIntegrationDto.properties.credentials.description
The OAuth credentials to configure for the Data Integration. Required for OAuth integrations; omit when `auth_methods` is `["api_key"]`.

# components.schemas.CreateDataIntegrationDto.properties.api_key.description
An optional API key to install for the first tenant on an `api_key` integration. Omit to declare a keyless integration; tenants can be added later via the per-installation API key path.

# components.schemas.CreateDataIntegrationDto.properties.custom_provider.description
The OAuth definition for a custom provider. Supply this to define a custom provider; omit it to create an integration for a built-in provider.

# components.schemas.UpdateCustomProviderDefinitionDto.properties.name.description
A descriptive name for the custom provider.

# components.schemas.UpdateCustomProviderDefinitionDto.properties.authorization_url.description
The provider's OAuth authorization endpoint.

# components.schemas.UpdateCustomProviderDefinitionDto.properties.refresh_token_url.description
The endpoint used to refresh tokens, if different from the token endpoint.

# components.schemas.UpdateCustomProviderDefinitionDto.properties.pkce_enabled.description
Whether PKCE is used during the authorization code flow.

# components.schemas.UpdateCustomProviderDefinitionDto.properties.request_scope_separator.description
The separator used to join requested scopes.

# components.schemas.UpdateCustomProviderDefinitionDto.properties.scopes_required.description
Whether at least one scope must be selected when connecting an account.

# components.schemas.UpdateCustomProviderDefinitionDto.properties.client_secret_required.description
Whether a client secret is required for this provider.

# components.schemas.UpdateCustomProviderDefinitionDto.properties.additional_authorization_parameters.description
Additional static query parameters appended to the authorization request.

# components.schemas.UpdateCustomProviderDefinitionDto.properties.token_body_content_type.description
The Content-Type used when exchanging the token request.

# components.schemas.UpdateCustomProviderDefinitionDto.properties.authenticate_via.description
How client credentials are sent when exchanging authorization codes and refreshing tokens.

# components.schemas.UpdateDataIntegrationDto.properties.description.description
An optional description of the Data Integration.

# components.schemas.UpdateDataIntegrationDto.properties.enabled.description
Whether the Data Integration is enabled.

# components.schemas.UpdateDataIntegrationDto.properties.scopes.description
The OAuth scopes to request for the Data Integration. Pass `null` to reset to the provider's configured scopes.

# components.schemas.UpdateDataIntegrationDto.properties.credentials.description
New OAuth credentials for the Data Integration. When provided, rotates the stored client secret. Mutually exclusive with `api_key`.

# components.schemas.UpdateDataIntegrationDto.properties.api_key.description
An API key to install or rotate for a tenant on an `api_key` integration. Upserts the tenant installation identified by `user_id` (and optional `organization_id`).

# components.schemas.UpdateDataIntegrationDto.properties.custom_provider.description
Updates to a custom provider's OAuth definition. Only valid for custom-provider integrations.

# components.schemas.ConnectedAccountDto.properties.access_token.description
The OAuth access token for the connected account.

# components.schemas.ConnectedAccountDto.properties.refresh_token.description
The OAuth refresh token for the connected account.

# components.schemas.ConnectedAccountDto.properties.expires_at.description
The ISO-8601 timestamp when the access token expires. Required when `access_token` is provided for tokens that expire.

# components.schemas.ConnectedAccountDto.properties.scopes.description
The OAuth scopes granted for this connection.

# components.schemas.ConnectedAccountDto.properties.state.description
Explicitly set the state of the connected account. When omitted, the state is derived from the token combination provided.

# components.schemas.GenerateLinkDto.properties.return_url.description
The URL to go to when an admin clicks on your logo in the Admin Portal. If not specified, the return URL configured on the [Redirects](https://dashboard.workos.com/redirects) page will be used.

# components.schemas.GenerateLinkDto.properties.success_url.description
The URL to redirect the admin to when they finish setup. If not specified, the success URL configured on the [Redirects](https://dashboard.workos.com/redirects) page will be used.

# components.schemas.GenerateLinkDto.properties.intent.description
      The intent of the Admin Portal.
        - `sso` - Launch Admin Portal for creating SSO connections
        - `dsync` - Launch Admin Portal for creating Directory Sync connections
        - `audit_logs` - Launch Admin Portal for viewing Audit Logs
        - `log_streams` - Launch Admin Portal for creating Log Streams
        - `domain_verification` - Launch Admin Portal for Domain Verification
        - `certificate_renewal` - Launch Admin Portal for renewing SAML Certificates
        - `bring_your_own_key` - Launch Admin Portal for configuring Bring Your Own Key

# components.schemas.GenerateLinkDto.properties.it_contact_emails.description
The email addresses of the IT contacts to grant access to the Admin Portal for the given organization. Accepts up to 20 emails.

# components.schemas.SendRadarSmsChallengeDto.properties.user_id.description
The ID of the user to send the SMS challenge to.

# components.schemas.SendRadarSmsChallengeDto.properties.pending_authentication_token.description
The pending authentication token from a previous authentication attempt that triggered the Radar challenge.

# components.schemas.SendRadarSmsChallengeDto.properties.phone_number.description
The phone number to send the SMS verification code to.

# components.schemas.SendRadarSmsChallengeDto.properties.user_agent.description
The user agent string from the user's request.

# components.schemas.EnrollUserlandUserAuthenticationFactorDto.properties.totp_issuer.description
Your application or company name displayed in the user's authenticator app.

# components.schemas.EnrollUserlandUserAuthenticationFactorDto.properties.totp_user.description
The user's account name displayed in their authenticator app.

# components.schemas.EnrollUserlandUserAuthenticationFactorDto.properties.totp_secret.description
The Base32-encoded shared secret for TOTP factors. This can be provided when creating the auth factor, otherwise it will be generated. The algorithm used to derive TOTP codes is SHA-1, the code length is 6 digits, and the timestep is 30 seconds – the secret must be compatible with these parameters.

# components.schemas.CreateUserlandMagicCodeAndReturnDto.properties.email.description
The email address to send the magic code to.

# components.schemas.CreateUserlandMagicCodeAndReturnDto.properties.invitation_token.description
The invitation token to associate with this magic code.

# components.schemas.CreateUserlandMagicCodeAndReturnDto.properties.user_agent.description
The user agent string from the user's request.

# components.schemas.CreateUserlandMagicCodeAndReturnDto.properties.radar_auth_attempt_id.description
The ID of an existing Radar authentication attempt to associate with this request.

# components.schemas.CreateUserlandMagicCodeAndReturnDto.properties.signals_id.description
An optional Radar signals ID to correlate client-side signals with this request.

# components.schemas.CreateUserlandUserInviteOptionsDto.properties.organization_id.description
The ID of the [organization](/reference/organization) that the recipient will join.

# components.schemas.CreateUserlandUserInviteOptionsDto.properties.role_slug.description
The [role](/authkit/roles) that the recipient will receive when they join the organization in the invitation.

# components.schemas.CreateUserlandUserInviteOptionsDto.properties.expires_in_days.description
How many days the invitations will be valid for. Must be between 1 and 30 days. Defaults to 7 days if not specified.

# components.schemas.CreateUserlandUserInviteOptionsDto.properties.inviter_user_id.description
The ID of the [user](/reference/authkit/user) who invites the recipient. The invitation email will mention the name of this user.

# components.schemas.CreateUserlandUserInviteOptionsDto.properties.locale.description
The locale to use when rendering the invitation email. See [supported locales](/authkit/hosted-ui/localization).

# components.schemas.ResendUserlandUserInviteOptionsDto.properties.locale.description
The locale to use when rendering the invitation email. See [supported locales](/authkit/hosted-ui/localization).

# components.schemas.CreateUserlandUserOrganizationMembershipDto.allOf[].properties.user_id.description
The ID of the [user](/reference/authkit/user).

# components.schemas.CreateUserlandUserOrganizationMembershipDto.allOf[].properties.organization_id.description
The ID of the [organization](/reference/organization) which the user belongs to.

# components.schemas.CreateUserlandUserOrganizationMembershipDto.allOf[].oneOf[].properties.role_slug.description
A single role identifier. Defaults to `member` or the explicit default role. Mutually exclusive with `role_slugs`.

# components.schemas.CreateUserlandUserOrganizationMembershipDto.allOf[].oneOf[].properties.role_slugs.description
An array of role identifiers. Limited to one role when Multiple Roles is disabled. Mutually exclusive with `role_slug`.

# components.schemas.UpdateUserlandUserOrganizationMembershipDto.oneOf[].properties.role_slug.description
A single role identifier. Defaults to `member` or the explicit default role. Mutually exclusive with `role_slugs`.

# components.schemas.UpdateUserlandUserOrganizationMembershipDto.oneOf[].properties.role_slugs.description
An array of role identifiers. Limited to one role when Multiple Roles is disabled. Mutually exclusive with `role_slug`.

# components.schemas.CreateUserApiKeyDto.properties.organization_id.description
The ID of the organization the user API key is associated with. The user must have an active membership in this organization.

# components.schemas.CreateUserApiKeyDto.properties.permissions.description
The permission slugs to assign to the API key. Each permission must be enabled for user API keys.

# components.schemas.CreateUserApiKeyDto.properties.expires_at.description
The timestamp when the API key should expire. Must be a future timestamp. If omitted, the key does not expire.

# components.schemas.CreateUserlandUserDto.allOf[].properties.email_verified.description
Whether the user's email has been verified.

# components.schemas.CreateUserlandUserDto.allOf[].properties.metadata.description
Object containing metadata key/value pairs associated with the user.

# components.schemas.CreateUserlandUserDto.allOf[].properties.user_agent.description
The user agent string from the user's request.

# components.schemas.CreateUserlandUserDto.allOf[].properties.signals_id.description
An optional Radar signals ID to correlate client-side signals with this request.

# components.schemas.CreateUserlandUserDto.allOf[].oneOf[].properties.password.description
The password to set for the user. Mutually exclusive with `password_hash`, `password_hash_type`, and `password_salt_position`.

# components.schemas.CreateUserlandUserDto.allOf[].oneOf[].properties.password_hash.description
The hashed password to set for the user. Required with `password_hash_type`. Mutually exclusive with `password`.

# components.schemas.CreateUserlandUserDto.allOf[].oneOf[].properties.password_hash_type.description
The algorithm originally used to hash the password, used when providing a `password_hash`. Required with `password_hash`. Mutually exclusive with `password`.

# components.schemas.CreateUserlandUserDto.allOf[].oneOf[].properties.password_salt_position.description
The position of the salt relative to the password when the `password_hash` digest was computed: `prefix` for `hash(salt + password)` or `suffix` for `hash(password + salt)`. Only supported with the `ssha256` hash type and only valid when a `password_hash` is provided. Defaults to `suffix`. Mutually exclusive with `password`.

# components.schemas.UpdateUserlandUserDto.allOf[].properties.email_verified.description
Whether the user's email has been verified.

# components.schemas.UpdateUserlandUserDto.allOf[].properties.metadata.description
Object containing metadata key/value pairs associated with the user.

# components.schemas.UpdateUserlandUserDto.allOf[].oneOf[].properties.password.description
The password to set for the user. Mutually exclusive with `password_hash`, `password_hash_type`, and `password_salt_position`.

# components.schemas.UpdateUserlandUserDto.allOf[].oneOf[].properties.password_hash.description
The hashed password to set for the user. Required with `password_hash_type`. Mutually exclusive with `password`.

# components.schemas.UpdateUserlandUserDto.allOf[].oneOf[].properties.password_hash_type.description
The algorithm originally used to hash the password, used when providing a `password_hash`. Required with `password_hash`. Mutually exclusive with `password`.

# components.schemas.UpdateUserlandUserDto.allOf[].oneOf[].properties.password_salt_position.description
The position of the salt relative to the password when the `password_hash` digest was computed: `prefix` for `hash(salt + password)` or `suffix` for `hash(password + salt)`. Only supported with the `ssha256` hash type and only valid when a `password_hash` is provided. Defaults to `suffix`. Mutually exclusive with `password`.

# components.schemas.CreatePasswordResetTokenDto.properties.email.description
The email address of the user requesting a password reset.

# components.schemas.ConfirmEmailChangeDto.properties.code.description
The one-time code used to confirm the email change.

# components.schemas.UserlandRevokeSessionDto.properties.session_id.description
The ID of the session to revoke. This can be extracted from the `sid` claim of the access token.

# components.schemas.CreateWebhookEndpointDto.properties.endpoint_url.description
The HTTPS URL where webhooks will be sent.

# components.schemas.CreateWebhookEndpointDto.properties.events.description
The events that the Webhook Endpoint is subscribed to.

# components.schemas.UpdateWebhookEndpointDto.properties.endpoint_url.description
The HTTPS URL where webhooks will be sent.

# components.schemas.UpdateWebhookEndpointDto.properties.status.description
Whether the Webhook Endpoint is enabled or disabled.

# components.schemas.UpdateWebhookEndpointDto.properties.events.description
The events that the Webhook Endpoint is subscribed to.

# components.schemas.WidgetSessionTokenDto.properties.organization_id.description
The ID of the organization to scope the widget session to. Required when scopes are provided. Optional when issuing a token for user-only widgets (e.g. `UserProfile`, `UserSecurity`) that do not require organization context.

# components.schemas.WidgetSessionTokenDto.properties.user_id.description
The ID of the user to issue the widget session token for.

# components.schemas.ClientApiTokenDto.properties.organization_id.description
The ID of the organization to scope the Client API token to.

# components.schemas.ClientApiTokenDto.properties.user_id.description
The ID of the user to issue the Client API token for.

# components.schemas.TokenQueryDto.properties.client_id.description
The client ID of the WorkOS environment.

# components.schemas.TokenQueryDto.properties.client_secret.description
The client secret of the WorkOS environment.

# components.schemas.TokenQueryDto.properties.code.description
The authorization code received from the authorization callback.

# components.schemas.Actor.description
The user or API key that performed an action.

# components.schemas.CreateDataKeyRequest.properties.context.description
Map of values used to determine the encryption key.

# components.schemas.CreateDataKeyResponse.properties.context.description
Map of values used to determine the encryption key.

# components.schemas.CreateDataKeyResponse.properties.id.description
Unique identifier for the generated data key.

# components.schemas.CreateObjectRequest.properties.key_context.description
Map of values used to determine the encryption key.

# components.schemas.DecryptRequest.properties.keys.description
Base64-encoded encrypted data key to decrypt.

# components.schemas.DecryptResponse.properties.id.description
Unique identifier of the decrypted data key.

# components.schemas.Error.properties.error.description
A human-readable description of the error.

# components.schemas.ListMetadata.properties.before.description
Cursor for the previous page of results.

# components.schemas.Object.description
An encrypted object with its decrypted value and metadata.

# components.schemas.ObjectMetadata.properties.context.description
Map of values used to determine the encryption key.

# components.schemas.ObjectMetadata.properties.version_id.description
Current version identifier of the object.

# components.schemas.ObjectSummary.description
Summary of an encrypted object returned in list responses.

# components.schemas.ObjectVersion.description
A static snapshot of an encrypted object.

# components.schemas.ObjectWithoutValue.description
An encrypted object's metadata (value excluded).

# components.schemas.RekeyRequest.properties.context.description
Map of values used to determine the new encryption key.

# components.schemas.RekeyRequest.properties.encrypted_keys.description
Base64-encoded encrypted data key blob to re-encrypt.

# components.schemas.UpdateObjectRequest.properties.version_check.description
ID of the expected current version for optimistic locking.

# components.schemas.ExternalAuthCompleteResponse.properties.redirect_uri.description
URI to redirect the user back to AuthKit to complete the OAuth flow.

# components.schemas.AgentRegistration.properties.id.description
Unique identifier of the agent registration.

# components.schemas.AgentRegistration.properties.agent_identity.properties.id.description
Unique identifier of the agent identity.

# components.schemas.AgentRegistration.properties.agent_identity.properties.userland_user_id.description
Identifier of the AuthKit user the agent identity is bound to, or `null` when the agent is not associated with a user.

# components.schemas.AgentRegistration.properties.agent_identity.properties.created_at.description
The timestamp when the agent identity was created.

# components.schemas.AgentRegistration.properties.agent_identity.properties.updated_at.description
The timestamp when the agent identity was last updated.

# components.schemas.AgentRegistration.properties.agent_identity.description
The agent identity associated with this registration.

# components.schemas.AgentRegistration.properties.organization_id.description
Identifier of the organization the agent is registered to.

# components.schemas.AgentRegistration.properties.status.description
The current verification status of the registration.

# components.schemas.AgentRegistration.properties.claim.description
The claim associated with this registration, or `null` if the registration has no claim.

# components.schemas.AgentRegistration.properties.claim.oneOf[].properties.claim_completion.description
The completion record for the claim, or `null` if the claim has not been completed.

# components.schemas.AgentRegistration.properties.claim.oneOf[].properties.claim_completion.oneOf[].properties.id.description
Unique identifier of the claim completion.

# components.schemas.AgentRegistration.properties.claim.oneOf[].properties.claim_completion.oneOf[].properties.created_at.description
The timestamp when the claim completion was created.

# components.schemas.AgentRegistration.properties.claim.oneOf[].properties.claim_completion.oneOf[].properties.updated_at.description
The timestamp when the claim completion was last updated.

# components.schemas.AgentRegistration.properties.claim.oneOf[].properties.claim_completion.oneOf[].properties.expires_at.description
The timestamp when the claim completion expires.

# components.schemas.AgentRegistration.properties.claim.oneOf[].properties.claim_completion.oneOf[].properties.claimed_at.description
The timestamp when the claim was completed.

# components.schemas.AgentRegistration.properties.claim.oneOf[].properties.created_at.description
The timestamp when the claim was created.

# components.schemas.AgentRegistration.properties.claim.oneOf[].properties.updated_at.description
The timestamp when the claim was last updated.

# components.schemas.AgentRegistration.properties.created_at.description
The timestamp when the registration was created.

# components.schemas.AgentRegistration.properties.updated_at.description
The timestamp when the registration was last updated.

# components.schemas.AgentCredentialValidation.properties.valid.description
Whether the presented credential is valid.

# components.schemas.AgentCredentialValidation.properties.registration_id.description
Identifier of the agent registration the credential belongs to, or `null` when the credential is invalid.

# components.schemas.AgentCredentialValidation.properties.expires_at.description
The timestamp when the credential expires, or `null` when the credential is invalid.

# components.schemas.ClaimViewResponse.properties.status.description
Current status of the agent registration.

# components.schemas.ClaimViewResponse.properties.user_code.description
The user code the agent needs to complete the claim.

# components.schemas.ClaimViewResponse.properties.organizations.description
Organizations the user belongs to, offered as placement choices.

# components.schemas.ApiKey.properties.owner.oneOf[].properties.organization_id.description
Unique identifier of the organization the API Key can access.

# components.schemas.ApiKey.properties.obfuscated_value.description
An obfuscated representation of the API Key value.

# components.schemas.ApiKey.properties.last_used_at.description
Timestamp of when the API Key was last used.

# components.schemas.ApiKey.properties.expires_at.description
Timestamp when the API Key expires. Null means the key does not expire.

# components.schemas.ApiKey.properties.permissions.description
The permission slugs assigned to the API Key.

# components.schemas.ApiKeyValidationResponse.properties.agent_registration_id.description
The ID of the agent registration this API Key was issued for. Present only when the API Key is assigned to an agent registration.

# components.schemas.ConnectApplication.allOf[].properties.object.description
Distinguishes the connect application object.

# components.schemas.ConnectApplication.allOf[].properties.id.description
The unique ID of the connect application.

# components.schemas.ConnectApplication.allOf[].properties.client_id.description
The client ID of the connect application.

# components.schemas.ConnectApplication.allOf[].properties.description.description
A description of the connect application.

# components.schemas.ConnectApplication.allOf[].properties.scopes.description
The scopes available for this application.

# components.schemas.ConnectApplication.allOf[].oneOf[].allOf[].properties.redirect_uris.items.properties.default.description
Whether this is the default redirect URI.

# components.schemas.ConnectApplication.allOf[].oneOf[].allOf[].properties.redirect_uris.description
The redirect URIs configured for this application.

# components.schemas.ConnectApplication.allOf[].oneOf[].allOf[].properties.uses_pkce.description
Whether the application uses PKCE for authorization.

# components.schemas.ConnectApplication.allOf[].oneOf[].allOf[].oneOf[].properties.is_first_party.description
Whether the application is a first-party application.

# components.schemas.ConnectApplication.allOf[].oneOf[].allOf[].oneOf[].properties.is_first_party.description
Whether the application is a first-party application.

# components.schemas.ConnectApplication.allOf[].oneOf[].allOf[].oneOf[].properties.was_dynamically_registered.description
Whether the application was dynamically registered.

# components.schemas.ConnectApplication.allOf[].oneOf[].allOf[].oneOf[].properties.organization_id.description
The ID of the organization the application belongs to.

# components.schemas.ConnectApplication.allOf[].oneOf[].allOf[].oneOf[].properties.is_first_party.description
Whether the application is a first-party application.

# components.schemas.ConnectApplication.allOf[].oneOf[].allOf[].oneOf[].properties.was_dynamically_registered.description
Whether the application was dynamically registered.

# components.schemas.ConnectApplication.allOf[].oneOf[].properties.organization_id.description
The ID of the organization the application belongs to.

# components.schemas.ConnectApplicationList.properties.data.description
The list of records for the current page.

# components.schemas.ConnectApplicationList.properties.list_metadata.properties.before.description
An object ID that defines your place in the list. When the ID is not present, you are at the start of the list.

# components.schemas.ConnectApplicationList.properties.list_metadata.properties.after.description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.

# components.schemas.ConnectApplicationList.properties.list_metadata.description
Pagination cursors for navigating between pages of results.

# components.schemas.AuthorizedConnectApplicationList.properties.data.items.properties.object.description
Distinguishes the authorized connect application object.

# components.schemas.AuthorizedConnectApplicationList.properties.data.items.properties.id.description
The unique ID of the authorized connect application.

# components.schemas.AuthorizedConnectApplicationList.properties.data.items.properties.granted_scopes.description
The scopes granted by the user to the application.

# components.schemas.AuthorizedConnectApplicationList.properties.data.items.properties.oauth_resource.description
The OAuth resource associated with the authorized connect application, if one was requested.

# components.schemas.AuthorizedConnectApplicationList.properties.data.description
The list of records for the current page.

# components.schemas.AuthorizedConnectApplicationList.properties.list_metadata.properties.before.description
An object ID that defines your place in the list. When the ID is not present, you are at the start of the list.

# components.schemas.AuthorizedConnectApplicationList.properties.list_metadata.properties.after.description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.

# components.schemas.AuthorizedConnectApplicationList.properties.list_metadata.description
Pagination cursors for navigating between pages of results.

# components.schemas.OrganizationAuthorizedConnectApplicationList.properties.data.items.properties.object.description
Distinguishes the authorized connect application object.

# components.schemas.OrganizationAuthorizedConnectApplicationList.properties.data.items.properties.id.description
The unique ID of the authorized connect application.

# components.schemas.OrganizationAuthorizedConnectApplicationList.properties.data.items.properties.granted_scopes.description
The scopes granted by the user to the application.

# components.schemas.OrganizationAuthorizedConnectApplicationList.properties.data.items.properties.oauth_resource.description
The OAuth resource associated with the authorized connect application, if one was requested.

# components.schemas.OrganizationAuthorizedConnectApplicationList.properties.data.items.properties.user_id.description
The ID of the user who authorized the application.

# components.schemas.OrganizationAuthorizedConnectApplicationList.properties.data.description
The list of records for the current page.

# components.schemas.OrganizationAuthorizedConnectApplicationList.properties.list_metadata.properties.before.description
An object ID that defines your place in the list. When the ID is not present, you are at the start of the list.

# components.schemas.OrganizationAuthorizedConnectApplicationList.properties.list_metadata.properties.after.description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.

# components.schemas.OrganizationAuthorizedConnectApplicationList.properties.list_metadata.description
Pagination cursors for navigating between pages of results.

# components.schemas.NewConnectApplicationSecret.properties.object.description
Distinguishes the connect application secret object.

# components.schemas.NewConnectApplicationSecret.properties.secret_hint.description
A hint showing the last few characters of the secret value.

# components.schemas.NewConnectApplicationSecret.properties.last_used_at.description
The timestamp when the client secret was last used, or null if never used.

# components.schemas.NewConnectApplicationSecret.properties.secret.description
The plaintext secret value. Only returned at creation time and cannot be retrieved later.

# components.schemas.AuditLogEventCreateResponse.properties.success.description
Whether the Audit Log event was created successfully.

# components.schemas.AuditLogExportJson.properties.object.description
Distinguishes the Audit Log Export object.

# components.schemas.AuditLogExportJson.properties.state.description
The state of the export. Possible values: pending, ready, error, expired.

# components.schemas.AuditLogExportJson.properties.url.description
A URL to the CSV file. Only defined when the Audit Log Export is ready.

# components.schemas.AuditLogsRetentionJson.properties.retention_period_in_days.description
The number of days Audit Log events will be retained before being permanently deleted. Valid values are 30 and 365.

# components.schemas.AuditLogSchemaJson.properties.object.description
Distinguishes the Audit Log Schema object.

# components.schemas.AuditLogSchemaJson.properties.actor.properties.metadata.description
The JSON Schema definition for actor metadata.

# components.schemas.AuditLogSchemaJson.properties.targets.items.properties.metadata.description
Additional data associated with the event or entity.

# components.schemas.AuditLogSchemaJson.properties.metadata.description
Additional data associated with the event or entity.

# components.schemas.AuditLogSchemaJson.properties.created_at.description
The timestamp when the Audit Log Schema was created.

# components.schemas.AuditLogActionJson.properties.object.description
Distinguishes the Audit Log Action object.

# components.schemas.AuthenticationChallenge.properties.id.description
The unique ID of the authentication challenge.

# components.schemas.AuthenticationChallenge.properties.expires_at.description
The timestamp when the challenge will expire. Does not apply to TOTP factors.

# components.schemas.AuthenticationChallenge.properties.authentication_factor_id.description
The unique ID of the authentication factor the challenge belongs to.

# components.schemas.AuthenticationFactorEnrolled.properties.object.description
Distinguishes the authentication factor object.

# components.schemas.AuthenticationFactorEnrolled.properties.user_id.description
The ID of the [user](/reference/authkit/user).

# components.schemas.AuthenticationFactorEnrolled.properties.sms.properties.phone_number.description
The user's phone number for SMS-based authentication.

# components.schemas.AuthenticationFactorEnrolled.properties.totp.properties.issuer.description
Your application or company name displayed in the user's authenticator app. Defaults to your WorkOS team name.

# components.schemas.AuthenticationFactorEnrolled.properties.totp.properties.user.description
The user's account name displayed in their authenticator app. Defaults to the user's email.

# components.schemas.AuthenticationFactorEnrolled.properties.totp.properties.secret.description
TOTP secret that can be manually entered into some authenticator apps in place of scanning a QR code.

# components.schemas.AuthenticationFactorEnrolled.properties.totp.properties.qr_code.description
Base64 encoded image containing scannable QR code.

# components.schemas.AuthenticationFactorEnrolled.properties.totp.properties.uri.description
The `otpauth` URI that is encoded by the provided `qr_code`.

# components.schemas.AuthenticationFactorEnrolled.properties.totp.description
TOTP-based authentication factor details. Includes enrollment secrets only available at creation time.

# components.schemas.AuthenticationFactor.properties.object.description
Distinguishes the authentication factor object.

# components.schemas.AuthenticationFactor.properties.user_id.description
The ID of the [user](/reference/authkit/user).

# components.schemas.AuthenticationFactor.properties.sms.properties.phone_number.description
The user's phone number for SMS-based authentication.

# components.schemas.AuthenticationFactor.properties.totp.properties.issuer.description
Your application or company name displayed in the user's authenticator app. Defaults to your WorkOS team name.

# components.schemas.AuthenticationFactor.properties.totp.properties.user.description
The user's account name displayed in their authenticator app. Defaults to the user's email.

# components.schemas.AuthorizationCheck.properties.authorized.description
Whether the organization membership has the specified permission on the resource.

# components.schemas.AuthorizationResource.properties.description.description
An optional description of the Resource.

# components.schemas.AuthorizationResource.properties.organization_id.description
The ID of the organization that owns the resource.

# components.schemas.AuthorizationResource.properties.parent_resource_id.description
The ID of the parent resource, if this resource is nested.

# components.schemas.AuthorizationResource.properties.external_id.description
An identifier you provide to reference the resource in your system.

# components.schemas.AuthorizationResource.properties.resource_type_slug.description
The slug of the resource type this resource belongs to.

# components.schemas.AuthorizationResourceList.properties.data.description
The list of records for the current page.

# components.schemas.AuthorizationResourceList.properties.list_metadata.properties.before.description
An object ID that defines your place in the list. When the ID is not present, you are at the start of the list.

# components.schemas.AuthorizationResourceList.properties.list_metadata.properties.after.description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.

# components.schemas.AuthorizationResourceList.properties.list_metadata.description
Pagination cursors for navigating between pages of results.

# components.schemas.AuthorizationPermission.properties.slug.description
A unique key to reference the permission. Must be lowercase and contain only letters, numbers, hyphens, underscores, colons, periods, and asterisks.

# components.schemas.AuthorizationPermission.properties.description.description
An optional description of the Permission.

# components.schemas.AuthorizationPermission.properties.system.description
Whether the permission is a system permission. System permissions are managed by WorkOS and cannot be deleted.

# components.schemas.AuthorizationPermission.properties.resource_type_slug.description
The slug of the resource type associated with the permission.

# components.schemas.AuthorizationPermissionList.properties.data.description
The list of records for the current page.

# components.schemas.AuthorizationPermissionList.properties.list_metadata.properties.before.description
An object ID that defines your place in the list. When the ID is not present, you are at the start of the list.

# components.schemas.AuthorizationPermissionList.properties.list_metadata.properties.after.description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.

# components.schemas.AuthorizationPermissionList.properties.list_metadata.description
Pagination cursors for navigating between pages of results.

# components.schemas.GroupRoleAssignment.properties.object.description
Distinguishes the group role assignment object.

# components.schemas.GroupRoleAssignment.properties.id.description
Unique identifier of the group role assignment.

# components.schemas.GroupRoleAssignment.properties.group_id.description
The ID of the group the role is assigned to.

# components.schemas.GroupRoleAssignment.properties.resource.properties.external_id.description
An identifier you provide to reference the resource in your system.

# components.schemas.GroupRoleAssignment.properties.resource.properties.resource_type_slug.description
The slug of the resource type this resource belongs to.

# components.schemas.GroupRoleAssignmentList.properties.data.description
The list of records for the current page.

# components.schemas.GroupRoleAssignmentList.properties.list_metadata.properties.before.description
An object ID that defines your place in the list. When the ID is not present, you are at the start of the list.

# components.schemas.GroupRoleAssignmentList.properties.list_metadata.properties.after.description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.

# components.schemas.GroupRoleAssignmentList.properties.list_metadata.description
Pagination cursors for navigating between pages of results.

# components.schemas.UserRoleAssignment.properties.object.description
Distinguishes the role assignment object.

# components.schemas.UserRoleAssignment.properties.id.description
Unique identifier of the role assignment.

# components.schemas.UserRoleAssignment.properties.organization_membership_id.description
The ID of the organization membership the role is assigned to.

# components.schemas.UserRoleAssignment.properties.resource.properties.external_id.description
An identifier you provide to reference the resource in your system.

# components.schemas.UserRoleAssignment.properties.resource.properties.resource_type_slug.description
The slug of the resource type this resource belongs to.

# components.schemas.UserRoleAssignment.properties.source.properties.type.description
Whether the role was assigned directly or derived from a group.

# components.schemas.UserRoleAssignment.properties.source.properties.group_role_assignment_id.description
The ID of the group role assignment the role was derived from, or null if direct.

# components.schemas.UserRoleAssignmentList.properties.data.description
The list of records for the current page.

# components.schemas.UserRoleAssignmentList.properties.list_metadata.properties.before.description
An object ID that defines your place in the list. When the ID is not present, you are at the start of the list.

# components.schemas.UserRoleAssignmentList.properties.list_metadata.properties.after.description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.

# components.schemas.UserRoleAssignmentList.properties.list_metadata.description
Pagination cursors for navigating between pages of results.

# components.schemas.Role.properties.type.description
Whether the role is scoped to the environment or an organization (custom role).

# components.schemas.Role.properties.resource_type_slug.description
The slug of the resource type the role is scoped to.

# components.schemas.Role.properties.permissions.description
The permission slugs assigned to the role.

# components.schemas.RoleList.properties.data.description
The list of records for the current page.

# components.schemas.UserlandUser.properties.profile_picture_url.description
A URL reference to an image representing the user.

# components.schemas.UserlandUser.properties.email_verified.description
Whether the user's email has been verified.

# components.schemas.UserlandUser.properties.metadata.description
Object containing metadata key/value pairs associated with the user.

# components.schemas.UserlandUser.properties.last_sign_in_at.description
The timestamp when the user last signed in.

# components.schemas.UserlandUserOrganizationMembershipBaseWithUser.properties.id.description
The unique ID of the organization membership.

# components.schemas.UserlandUserOrganizationMembershipBaseWithUser.properties.organization_id.description
The ID of the organization which the user belongs to.

# components.schemas.UserlandUserOrganizationMembershipBaseWithUser.properties.status.description
The status of the organization membership. One of `active`, `inactive`, or `pending`.

# components.schemas.UserlandUserOrganizationMembershipBaseWithUser.properties.directory_managed.description
Whether this organization membership is managed by a directory sync connection.

# components.schemas.UserlandUserOrganizationMembershipBaseWithUser.properties.organization_name.description
The name of the organization which the user belongs to.

# components.schemas.UserlandUserOrganizationMembershipBaseWithUser.properties.custom_attributes.description
An object containing IdP-sourced attributes from the linked [Directory User](/reference/directory-sync/directory-user) or [SSO Profile](/reference/sso/profile). Directory User attributes take precedence when both are linked.

# components.schemas.UserlandUserOrganizationMembershipBaseWithUser.properties.user.description
The user that belongs to the organization through this membership.

# components.schemas.UserlandUserOrganizationMembershipBaseWithUserList.properties.data.description
The list of records for the current page.

# components.schemas.UserlandUserOrganizationMembershipBaseWithUserList.properties.list_metadata.properties.before.description
An object ID that defines your place in the list. When the ID is not present, you are at the start of the list.

# components.schemas.UserlandUserOrganizationMembershipBaseWithUserList.properties.list_metadata.properties.after.description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.

# components.schemas.UserlandUserOrganizationMembershipBaseWithUserList.properties.list_metadata.description
Pagination cursors for navigating between pages of results.

# components.schemas.Connection.properties.organization_id.description
Unique identifier for the Organization in which the Connection resides.

# components.schemas.Connection.properties.connection_type.description
The type of the SSO Connection used to authenticate the user. The Connection type may be used to dynamically generate authorization URLs.

# components.schemas.Connection.properties.name.description
A human-readable name for the Connection. This will most commonly be the organization's name.

# components.schemas.Connection.properties.state.description
Indicates whether a Connection is able to authenticate users.

# components.schemas.Connection.properties.domains.items.properties.id.description
Unique identifier for the Connection Domain.

# components.schemas.Connection.properties.domains.items.properties.object.description
Distinguishes the Connection Domain object.

# components.schemas.ConnectionList.properties.data.description
The list of records for the current page.

# components.schemas.ConnectionList.properties.list_metadata.properties.before.description
An object ID that defines your place in the list. When the ID is not present, you are at the start of the list.

# components.schemas.ConnectionList.properties.list_metadata.properties.after.description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.

# components.schemas.ConnectionList.properties.list_metadata.description
Pagination cursors for navigating between pages of results.

# components.schemas.CorsOriginResponse.properties.created_at.description
Timestamp when the CORS origin was created.

# components.schemas.CorsOriginResponse.properties.updated_at.description
Timestamp when the CORS origin was last updated.

# components.schemas.Directory.properties.organization_id.description
The unique identifier for the Organization in which the directory resides.

# components.schemas.Directory.properties.type.description
The type of external Directory Provider integrated with.

# components.schemas.Directory.properties.state.description
Describes whether the Directory has been successfully connected to an external provider.

# components.schemas.Directory.properties.domain.description
The URL associated with an Enterprise Client.

# components.schemas.Directory.properties.metadata.properties.users.description
Counts of active and inactive directory users.

# components.schemas.Directory.properties.metadata.description
Aggregate counts of directory users and groups synced from the provider.

# components.schemas.DirectoryList.properties.data.description
The list of records for the current page.

# components.schemas.DirectoryList.properties.list_metadata.properties.before.description
An object ID that defines your place in the list. When the ID is not present, you are at the start of the list.

# components.schemas.DirectoryList.properties.list_metadata.properties.after.description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.

# components.schemas.DirectoryList.properties.list_metadata.description
Pagination cursors for navigating between pages of results.

# components.schemas.DirectoryGroup.properties.object.description
Distinguishes the Directory Group object.

# components.schemas.DirectoryGroup.properties.id.description
Unique identifier for the Directory Group.

# components.schemas.DirectoryGroup.properties.idp_id.description
Unique identifier for the group, assigned by the Directory Provider. Different Directory Providers use different ID formats.

# components.schemas.DirectoryGroup.properties.directory_id.description
The identifier of the Directory the Directory Group belongs to.

# components.schemas.DirectoryGroup.properties.organization_id.description
The identifier for the Organization in which the Directory resides.

# components.schemas.DirectoryGroup.properties.raw_attributes.description
The raw attributes received from the directory provider.

# components.schemas.DirectoryGroupList.properties.data.description
The list of records for the current page.

# components.schemas.DirectoryGroupList.properties.list_metadata.properties.before.description
An object ID that defines your place in the list. When the ID is not present, you are at the start of the list.

# components.schemas.DirectoryGroupList.properties.list_metadata.properties.after.description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.

# components.schemas.DirectoryGroupList.properties.list_metadata.description
Pagination cursors for navigating between pages of results.

# components.schemas.DirectoryUserWithGroups.properties.object.description
Distinguishes the Directory User object.

# components.schemas.DirectoryUserWithGroups.properties.id.description
Unique identifier for the Directory User.

# components.schemas.DirectoryUserWithGroups.properties.directory_id.description
The identifier of the Directory the Directory User belongs to.

# components.schemas.DirectoryUserWithGroups.properties.organization_id.description
The identifier for the Organization in which the Directory resides.

# components.schemas.DirectoryUserWithGroups.properties.idp_id.description
Unique identifier for the user, assigned by the Directory Provider. Different Directory Providers use different ID formats.

# components.schemas.DirectoryUserWithGroups.properties.emails.items.properties.primary.description
Whether this is the primary email address.

# components.schemas.DirectoryUserWithGroups.properties.raw_attributes.description
The raw attributes received from the directory provider.

# components.schemas.DirectoryUserWithGroups.properties.custom_attributes.description
An object containing the custom attribute mapping for the Directory Provider.

# components.schemas.DirectoryUserWithGroups.properties.groups.description
The directory groups the user belongs to. Deprecated: starting May 1, 2026, this field returns an empty array by default for newly created teams. Existing teams currently depending on this field should migrate to the new access pattern for better throughput performance — the field is unbounded by user, so users with many group memberships produce large, slow response payloads. Use the List Directory Groups endpoint with a `user` filter to fetch a user's group memberships.

# components.schemas.DirectoryUserList.properties.data.description
The list of records for the current page.

# components.schemas.DirectoryUserList.properties.list_metadata.properties.before.description
An object ID that defines your place in the list. When the ID is not present, you are at the start of the list.

# components.schemas.DirectoryUserList.properties.list_metadata.properties.after.description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.

# components.schemas.DirectoryUserList.properties.list_metadata.description
Pagination cursors for navigating between pages of results.

# components.schemas.UserlandUserOrganizationMembershipBaseList.properties.data.items.properties.id.description
The unique ID of the organization membership.

# components.schemas.UserlandUserOrganizationMembershipBaseList.properties.data.items.properties.organization_id.description
The ID of the organization which the user belongs to.

# components.schemas.UserlandUserOrganizationMembershipBaseList.properties.data.items.properties.status.description
The status of the organization membership. One of `active`, `inactive`, or `pending`.

# components.schemas.UserlandUserOrganizationMembershipBaseList.properties.data.items.properties.directory_managed.description
Whether this organization membership is managed by a directory sync connection.

# components.schemas.UserlandUserOrganizationMembershipBaseList.properties.data.items.properties.organization_name.description
The name of the organization which the user belongs to.

# components.schemas.UserlandUserOrganizationMembershipBaseList.properties.data.items.properties.custom_attributes.description
An object containing IdP-sourced attributes from the linked [Directory User](/reference/directory-sync/directory-user) or [SSO Profile](/reference/sso/profile). Directory User attributes take precedence when both are linked.

# components.schemas.UserlandUserOrganizationMembershipBaseList.properties.data.description
The list of records for the current page.

# components.schemas.UserlandUserOrganizationMembershipBaseList.properties.list_metadata.properties.before.description
An object ID that defines your place in the list. When the ID is not present, you are at the start of the list.

# components.schemas.UserlandUserOrganizationMembershipBaseList.properties.list_metadata.properties.after.description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.

# components.schemas.UserlandUserOrganizationMembershipBaseList.properties.list_metadata.description
Pagination cursors for navigating between pages of results.

# components.schemas.Group.properties.organization_id.description
The ID of the Organization the Group belongs to.

# components.schemas.GroupList.properties.data.description
The list of records for the current page.

# components.schemas.GroupList.properties.list_metadata.properties.before.description
An object ID that defines your place in the list. When the ID is not present, you are at the start of the list.

# components.schemas.GroupList.properties.list_metadata.properties.after.description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.

# components.schemas.GroupList.properties.list_metadata.description
Pagination cursors for navigating between pages of results.

# components.schemas.EventContextActorDto.properties.source.description
The source of the actor that performed the action.

# components.schemas.EventContextDto.properties.google_analytics_sessions.description
The Google Analytics sessions associated with the event.

# components.schemas.EventContextDto.properties.client_id.description
The client ID associated with the event.

# components.schemas.EventContextDto.properties.previous_attributes.description
Attributes that changed from their previous values.

# components.schemas.DirectoryUser.properties.object.description
Distinguishes the Directory User object.

# components.schemas.DirectoryUser.properties.id.description
Unique identifier for the Directory User.

# components.schemas.DirectoryUser.properties.directory_id.description
The identifier of the Directory the Directory User belongs to.

# components.schemas.DirectoryUser.properties.organization_id.description
The identifier for the Organization in which the Directory resides.

# components.schemas.DirectoryUser.properties.idp_id.description
Unique identifier for the user, assigned by the Directory Provider. Different Directory Providers use different ID formats.

# components.schemas.DirectoryUser.properties.emails.items.properties.primary.description
Whether this is the primary email address.

# components.schemas.DirectoryUser.properties.raw_attributes.description
The raw attributes received from the directory provider.

# components.schemas.DirectoryUser.properties.custom_attributes.description
An object containing the custom attribute mapping for the Directory Provider.

# components.schemas.PipesConnectedAccount.properties.provider_slug.description
The provider slug for this connected account.

# components.schemas.PipesConnectedAccount.properties.user_id.description
The ID of the User the connected account belongs to.

# components.schemas.PipesConnectedAccount.properties.organization_id.description
The ID of the Organization the connected account belongs to.

# components.schemas.PipesConnectedAccount.properties.scopes.description
The OAuth scopes granted for this connected account.

# components.schemas.VaultByokKeyProvider.description
The external key provider used for BYOK.

# components.schemas.WaitlistUser.properties.approved_at.description
The timestamp when the Waitlist User was approved, or null if not yet approved.

# components.schemas.WaitlistUser.properties.waitlist_id.description
The unique ID of the Waitlist that the Waitlist User joined.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.object.description
Distinguishes the agent registration claim attempt object.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.id.description
Unique identifier of the agent registration claim attempt.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.expires_at.description
The timestamp when the claim attempt expires.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.created_at.description
The timestamp when the claim attempt was created.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.updated_at.description
The timestamp when the claim attempt was last updated.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.object.description
Distinguishes the agent registration claim object.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.id.description
Unique identifier of the agent registration claim.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.completed_by_attempt_id.description
The ID of the claim attempt that completed the claim.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.claimed_by.properties.user_id.description
The ID of the user who completed the claim.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.claimed_by.properties.organization_id.description
The ID of the organization the claiming user belongs to.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.completed_at.description
The timestamp when the claim was completed.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.created_at.description
The timestamp when the claim was created.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.updated_at.description
The timestamp when the claim was last updated.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.object.description
Distinguishes the agent registration object.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.id.description
Unique identifier of the agent registration.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.agent_identity.properties.object.description
Distinguishes the agent identity object.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.agent_identity.properties.id.description
Unique identifier of the agent identity.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.agent_identity.properties.userland_user_id.description
The ID of the userland user bound to this agent identity.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.agent_identity.description
The agent identity for this registration.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.organization_id.description
The ID of the organization the registration belongs to.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.method.description
The authentication method of the registration.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.created_at.description
The timestamp when the registration was created.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.updated_at.description
The timestamp when the registration was last updated.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.object.description
Distinguishes the agent registration credential object.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.id.description
Unique identifier of the agent registration credential.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.detail.oneOf[].properties.expires_at.description
The timestamp when the access token expires.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.created_at.description
The timestamp when the credential was issued.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.updated_at.description
The timestamp when the credential was last updated.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.agent_registration_id.description
The agent registration that was deleted.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.from_organization_id.description
The agent-created organization the registration is moving off of. Migrate its resources to `to_organization_id`, then delete it.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.to_organization_id.description
The organization the registration now belongs to.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.agent_registration_id.description
The agent registration whose identity assertion was refreshed.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.agent_registration_id.description
The agent registration that was revoked.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.owner.oneOf[].properties.id.description
The unique identifier of the API key owner.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.owner.oneOf[].properties.id.description
The unique identifier of the user who owns the API key.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.owner.oneOf[].properties.organization_id.description
The unique identifier of the organization the API key belongs to.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.last_used_at.description
The timestamp when the API key was last used.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.expires_at.description
Timestamp when the API Key expires. Null means the key does not expire.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.created_at.description
The timestamp when the API key was created.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.updated_at.description
The timestamp when the API key was last updated.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.owner.oneOf[].properties.id.description
The unique identifier of the API key owner.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.owner.oneOf[].properties.id.description
The unique identifier of the user who owns the API key.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.owner.oneOf[].properties.organization_id.description
The unique identifier of the organization the API key belongs to.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.last_used_at.description
The timestamp when the API key was last used.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.expires_at.description
Timestamp when the API Key expires. Null means the key does not expire.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.created_at.description
The timestamp when the API key was created.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.updated_at.description
The timestamp when the API key was last updated.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.owner.oneOf[].properties.id.description
The unique identifier of the API key owner.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.owner.oneOf[].properties.id.description
The unique identifier of the user who owns the API key.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.owner.oneOf[].properties.organization_id.description
The unique identifier of the organization the API key belongs to.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.last_used_at.description
The timestamp when the API key was last used.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.expires_at.description
Timestamp when the API Key expires. Null means the key does not expire.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.created_at.description
The timestamp when the API key was created.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.updated_at.description
The timestamp when the API key was last updated.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.previous_attributes.properties.expires_at.description
The previous timestamp when the API Key expired. Null means the key did not expire.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.previous_attributes.description
Previous API key attributes before the update.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.control.description
The control action taken for the detected risk.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.blocklist_type.description
The type of blocklist that triggered the risk detection.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.organization_id.description
The ID of the organization the connection belongs to.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.domains.items.properties.object.description
Distinguishes the connection domain object.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.domains.items.properties.id.description
Unique identifier of the connection domain.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.domains.description
The domains associated with the connection.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.organization_id.description
The ID of the organization the connection belongs to.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.domains.items.properties.object.description
Distinguishes the connection domain object.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.domains.items.properties.id.description
Unique identifier of the connection domain.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.domains.description
The domains associated with the connection.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.organization_id.description
The ID of the organization the connection belongs to.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.connection.properties.organization_id.description
The ID of the organization the connection belongs to.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.connection.description
The connection with the expiring certificate.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.certificate.properties.is_expired.description
Whether the certificate has already expired.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.days_until_expiry.description
The number of days until the certificate expires.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.connection.properties.organization_id.description
The ID of the organization the connection belongs to.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.connection.description
The connection with the renewed certificate.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.organization_id.description
The ID of the organization the directory belongs to.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.domains.items.properties.object.description
Distinguishes the organization domain object.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.domains.items.properties.id.description
Unique identifier of the organization domain.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.domains.description
The domains associated with the directory.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.organization_id.description
The ID of the organization the directory belongs to.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.object.description
Distinguishes the Directory Group object.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.id.description
Unique identifier for the Directory Group.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.idp_id.description
Unique identifier for the group, assigned by the Directory Provider. Different Directory Providers use different ID formats.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.directory_id.description
The identifier of the Directory the Directory Group belongs to.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.organization_id.description
The identifier for the Organization in which the Directory resides.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.raw_attributes.description
The raw attributes received from the directory provider.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.object.description
Distinguishes the directory token object.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.id.description
Unique identifier of the directory token.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.directory_id.description
The ID of the directory the token authenticates to.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.organization_id.description
The ID of the organization the directory belongs to.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.token_suffix.description
The trailing characters of the bearer token, for identification only. The full token value is never included in events.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.object.description
Distinguishes the directory token object.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.id.description
Unique identifier of the directory token.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.directory_id.description
The ID of the directory the token authenticates to.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.organization_id.description
The ID of the organization the directory belongs to.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.token_suffix.description
The trailing characters of the bearer token, for identification only. The full token value is never included in events.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.group.description
The directory group the user was added to.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.user.description
The directory user removed from the group.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.group.description
The directory group the user was removed from.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.object.description
Distinguishes the Directory User object.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.id.description
Unique identifier for the Directory User.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.directory_id.description
The identifier of the Directory the Directory User belongs to.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.organization_id.description
The identifier for the Organization in which the Directory resides.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.idp_id.description
Unique identifier for the user, assigned by the Directory Provider. Different Directory Providers use different ID formats.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.emails.items.properties.primary.description
Whether this is the primary email address.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.raw_attributes.description
The raw attributes received from the directory provider.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.custom_attributes.description
An object containing the custom attribute mapping for the Directory Provider.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.object.description
Distinguishes the email verification object.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.id.description
The unique ID of the email verification code.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.expires_at.description
The timestamp when the email verification code expires.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.environment_id.description
The ID of the environment the Feature Flag belongs to.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.slug.description
A unique key to reference the Feature Flag.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.name.description
A descriptive name for the Feature Flag.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.description.example
Enable advanced analytics dashboard feature

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.tags.description
Labels assigned to the Feature Flag for categorizing and filtering.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.enabled.description
Specifies whether the Feature Flag is active for the current environment.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.default_value.description
The value returned for users and organizations who don't match any configured targeting rules.

# components.schemas.EventSchema.allOf[].oneOf[].properties.context.properties.client_id.description
The client ID associated with the flag event.

# components.schemas.EventSchema.allOf[].oneOf[].properties.context.properties.actor.properties.source.description
The source of the actor that performed the action.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.environment_id.description
The ID of the environment the Feature Flag belongs to.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.slug.description
A unique key to reference the Feature Flag.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.name.description
A descriptive name for the Feature Flag.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.description.example
Enable advanced analytics dashboard feature

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.tags.description
Labels assigned to the Feature Flag for categorizing and filtering.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.enabled.description
Specifies whether the Feature Flag is active for the current environment.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.default_value.description
The value returned for users and organizations who don't match any configured targeting rules.

# components.schemas.EventSchema.allOf[].oneOf[].properties.context.properties.client_id.description
The client ID associated with the flag event.

# components.schemas.EventSchema.allOf[].oneOf[].properties.context.properties.actor.properties.source.description
The source of the actor that performed the action.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.environment_id.description
The ID of the environment the Feature Flag belongs to.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.slug.description
A unique key to reference the Feature Flag.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.name.description
A descriptive name for the Feature Flag.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.description.example
Enable advanced analytics dashboard feature

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.tags.description
Labels assigned to the Feature Flag for categorizing and filtering.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.enabled.description
Specifies whether the Feature Flag is active for the current environment.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.default_value.description
The value returned for users and organizations who don't match any configured targeting rules.

# components.schemas.EventSchema.allOf[].oneOf[].properties.context.properties.client_id.description
The client ID associated with the flag event.

# components.schemas.EventSchema.allOf[].oneOf[].properties.context.properties.configured_targets.properties.organizations.description
The organizations targeted by the flag rule.

# components.schemas.EventSchema.allOf[].oneOf[].properties.context.properties.configured_targets.description
The configured targets for the flag rule.

# components.schemas.EventSchema.allOf[].oneOf[].properties.context.properties.previous_attributes.properties.data.properties.enabled.description
Whether the flag was previously enabled.

# components.schemas.EventSchema.allOf[].oneOf[].properties.context.properties.previous_attributes.properties.data.description
The previous data attributes of the flag.

# components.schemas.EventSchema.allOf[].oneOf[].properties.context.properties.previous_attributes.properties.context.properties.access_type.description
The previous access type of the flag rule.

# components.schemas.EventSchema.allOf[].oneOf[].properties.context.properties.previous_attributes.properties.context.properties.configured_targets.properties.organizations.description
The organizations targeted by the flag rule.

# components.schemas.EventSchema.allOf[].oneOf[].properties.context.properties.previous_attributes.properties.context.properties.configured_targets.description
The previous configured targets for the flag rule.

# components.schemas.EventSchema.allOf[].oneOf[].properties.context.properties.previous_attributes.properties.context.description
The previous context attributes of the flag rule.

# components.schemas.EventSchema.allOf[].oneOf[].properties.context.properties.previous_attributes.description
Attributes that changed from their previous values.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.environment_id.description
The ID of the environment the Feature Flag belongs to.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.slug.description
A unique key to reference the Feature Flag.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.name.description
A descriptive name for the Feature Flag.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.description.example
Enable advanced analytics dashboard feature

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.tags.description
Labels assigned to the Feature Flag for categorizing and filtering.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.enabled.description
Specifies whether the Feature Flag is active for the current environment.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.default_value.description
The value returned for users and organizations who don't match any configured targeting rules.

# components.schemas.EventSchema.allOf[].oneOf[].properties.context.properties.client_id.description
The client ID associated with the flag event.

# components.schemas.EventSchema.allOf[].oneOf[].properties.context.properties.actor.properties.source.description
The source of the actor that performed the action.

# components.schemas.EventSchema.allOf[].oneOf[].properties.context.properties.previous_attributes.properties.data.properties.enabled.description
Whether the flag was previously enabled.

# components.schemas.EventSchema.allOf[].oneOf[].properties.context.properties.previous_attributes.properties.data.description
The previous data attributes of the flag.

# components.schemas.EventSchema.allOf[].oneOf[].properties.context.properties.previous_attributes.description
Attributes that changed from their previous values.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.accepted_at.description
The timestamp when the invitation was accepted, or null if not yet accepted.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.revoked_at.description
The timestamp when the invitation was revoked, or null if not revoked.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.expires_at.description
The timestamp when the invitation expires.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.organization_id.description
The ID of the [organization](/reference/organization) that the recipient will join.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.inviter_user_id.description
The ID of the user who invited the recipient, if provided.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.accepted_user_id.description
The ID of the user who accepted the invitation, once accepted.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.role_slug.description
Slug of the role the invitee will be assigned on acceptance. Reflects the current role on the invitee's organization membership. null when the invitation has no associated organization.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.accepted_at.description
The timestamp when the invitation was accepted, or null if not yet accepted.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.revoked_at.description
The timestamp when the invitation was revoked, or null if not revoked.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.expires_at.description
The timestamp when the invitation expires.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.organization_id.description
The ID of the [organization](/reference/organization) that the recipient will join.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.inviter_user_id.description
The ID of the user who invited the recipient, if provided.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.accepted_user_id.description
The ID of the user who accepted the invitation, once accepted.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.role_slug.description
Slug of the role the invitee will be assigned on acceptance. Reflects the current role on the invitee's organization membership. null when the invitation has no associated organization.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.accepted_at.description
The timestamp when the invitation was accepted, or null if not yet accepted.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.revoked_at.description
The timestamp when the invitation was revoked, or null if not revoked.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.expires_at.description
The timestamp when the invitation expires.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.organization_id.description
The ID of the [organization](/reference/organization) that the recipient will join.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.inviter_user_id.description
The ID of the user who invited the recipient, if provided.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.accepted_user_id.description
The ID of the user who accepted the invitation, once accepted.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.role_slug.description
Slug of the role the invitee will be assigned on acceptance. Reflects the current role on the invitee's organization membership. null when the invitation has no associated organization.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.accepted_at.description
The timestamp when the invitation was accepted, or null if not yet accepted.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.revoked_at.description
The timestamp when the invitation was revoked, or null if not revoked.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.expires_at.description
The timestamp when the invitation expires.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.organization_id.description
The ID of the [organization](/reference/organization) that the recipient will join.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.inviter_user_id.description
The ID of the user who invited the recipient, if provided.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.accepted_user_id.description
The ID of the user who accepted the invitation, once accepted.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.role_slug.description
Slug of the role the invitee will be assigned on acceptance. Reflects the current role on the invitee's organization membership. null when the invitation has no associated organization.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.expires_at.description
The timestamp when the Magic Auth code expires.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.name.description
A descriptive name for the Organization. This field does not need to be unique.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.domains.items.properties.object.description
Distinguishes the organization domain object.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.domains.items.properties.id.description
Unique identifier of the organization domain.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.domains.items.properties.verification_token.description
Validation token to be used in DNS TXT record.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.stripe_customer_id.description
The Stripe customer ID of the Organization.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.name.description
A descriptive name for the Organization. This field does not need to be unique.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.domains.items.properties.object.description
Distinguishes the organization domain object.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.domains.items.properties.id.description
Unique identifier of the organization domain.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.domains.items.properties.verification_token.description
Validation token to be used in DNS TXT record.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.stripe_customer_id.description
The Stripe customer ID of the Organization.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.object.description
Distinguishes the organization domain object.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.id.description
Unique identifier of the organization domain.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.verification_token.description
Validation token to be used in DNS TXT record.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.object.description
Distinguishes the organization domain object.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.id.description
Unique identifier of the organization domain.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.verification_token.description
Validation token to be used in DNS TXT record.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.object.description
Distinguishes the organization domain object.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.id.description
Unique identifier of the organization domain.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.verification_token.description
Validation token to be used in DNS TXT record.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.reason.description
The reason the domain verification failed.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.organization_domain.properties.object.description
Distinguishes the organization domain object.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.organization_domain.properties.id.description
Unique identifier of the organization domain.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.organization_domain.properties.verification_token.description
Validation token to be used in DNS TXT record.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.organization_domain.description
The organization domain that failed verification.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.object.description
Distinguishes the organization domain object.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.id.description
Unique identifier of the organization domain.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.verification_token.description
Validation token to be used in DNS TXT record.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.id.description
Unique identifier of the organization membership.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.status.description
The status of the organization membership.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.role.description
The role associated with the membership.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.roles.description
The roles associated with the membership.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.custom_attributes.description
Custom attributes associated with the membership.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.directory_managed.description
Whether the membership is managed by a directory sync provider.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.id.description
Unique identifier of the organization membership.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.status.description
The status of the organization membership.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.role.description
The role associated with the membership.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.roles.description
The roles associated with the membership.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.custom_attributes.description
Custom attributes associated with the membership.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.directory_managed.description
Whether the membership is managed by a directory sync provider.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.id.description
Unique identifier of the organization membership.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.status.description
The status of the organization membership.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.role.description
The role associated with the membership.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.roles.description
The roles associated with the membership.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.custom_attributes.description
Custom attributes associated with the membership.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.directory_managed.description
Whether the membership is managed by a directory sync provider.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.object.description
Distinguishes the organization role object.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.organization_id.description
The ID of the organization the role belongs to.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.resource_type_slug.description
The slug of the resource type the role applies to.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.object.description
Distinguishes the organization role object.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.organization_id.description
The ID of the organization the role belongs to.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.resource_type_slug.description
The slug of the resource type the role applies to.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.object.description
Distinguishes the organization role object.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.organization_id.description
The ID of the organization the role belongs to.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.resource_type_slug.description
The slug of the resource type the role applies to.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.name.description
A descriptive name for the Organization. This field does not need to be unique.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.domains.items.properties.object.description
Distinguishes the organization domain object.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.domains.items.properties.id.description
Unique identifier of the organization domain.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.domains.items.properties.verification_token.description
Validation token to be used in DNS TXT record.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.stripe_customer_id.description
The Stripe customer ID of the Organization.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.object.description
Distinguishes the password reset object.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.id.description
The unique ID of the password reset object.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.expires_at.description
The timestamp when the password reset token expires.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.created_at.description
The timestamp when the password reset token was created.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.object.description
Distinguishes the password reset object.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.id.description
The unique ID of the password reset object.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.expires_at.description
The timestamp when the password reset token expires.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.created_at.description
The timestamp when the password reset token was created.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.system.description
Whether the permission is a system permission.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.resource_type_slug.description
The slug of the resource type the permission applies to.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.system.description
Whether the permission is a system permission.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.resource_type_slug.description
The slug of the resource type the permission applies to.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.system.description
Whether the permission is a system permission.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.resource_type_slug.description
The slug of the resource type the permission applies to.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.provider_slug.description
The provider slug for this connection attempt.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.user_id.description
The ID of the User the connection attempt belongs to.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.organization_id.description
The ID of the Organization the connection attempt belongs to.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.error_code.description
A machine-readable error code for the failure.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.error_reason.description
A human-readable explanation of the failure.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.provider_error.description
The raw error code returned by the OAuth provider.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.provider_error_description.description
The raw error description returned by the OAuth provider.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.provider_error_description.example
The user denied the authorization request.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.resource_type_slug.description
The slug of the resource type the role applies to.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.resource_type_slug.description
The slug of the resource type the role applies to.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.resource_type_slug.description
The slug of the resource type the role applies to.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.impersonator.properties.email.description
The email address of the WorkOS Dashboard user who is impersonating the user.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.impersonator.properties.reason.description
The justification the impersonator gave for impersonating the user.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.impersonator.properties.reason.example
Investigating an issue with the customer's account.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.impersonator.description
Information about the impersonator if this session was created via impersonation.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.ip_address.description
The IP address from which the session was created.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.organization_id.description
The ID of the organization this session is associated with.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.user_agent.description
The user agent string from the device that created the session.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.user_agent.example
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.user_id.description
The ID of the user this session belongs to.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.auth_method.description
The authentication method used to create this session.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.impersonator.properties.email.description
The email address of the WorkOS Dashboard user who is impersonating the user.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.impersonator.properties.reason.description
The justification the impersonator gave for impersonating the user.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.impersonator.properties.reason.example
Investigating an issue with the customer's account.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.impersonator.description
Information about the impersonator if this session was created via impersonation.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.ip_address.description
The IP address from which the session was created.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.organization_id.description
The ID of the organization this session is associated with.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.user_agent.description
The user agent string from the device that created the session.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.user_agent.example
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.user_id.description
The ID of the user this session belongs to.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.auth_method.description
The authentication method used to create this session.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.organization_id.description
The unique identifier of the organization.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.organization_id.description
The unique identifier of the organization.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.verified.description
Whether the BYOK key verification completed successfully.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.key_id.description
The unique identifier of the encryption key.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.key_id.description
The unique identifier of the encryption key.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.key_id.description
The unique identifier of the encryption key.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.key_id.description
The unique identifier of the data encryption key.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.key_ids.description
The unique identifiers of the data encryption keys.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.key_id.description
The unique identifier of the key encryption key.

# components.schemas.EventSchema.allOf[].oneOf[].properties.data.properties.key_id.description
The unique identifier of the key encryption key.

# components.schemas.EventList.properties.data.description
The list of records for the current page.

# components.schemas.EventList.properties.list_metadata.properties.after.description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.

# components.schemas.EventList.properties.list_metadata.description
Pagination cursor for navigating to the next page of results.

# components.schemas.JwtTemplate.properties.content.description
The JWT template content as a Liquid template string.

# components.schemas.JwtTemplate.properties.created_at.description
The timestamp when the JWT template was created.

# components.schemas.JwtTemplate.properties.updated_at.description
The timestamp when the JWT template was last updated.

# components.schemas.OrganizationDomainStandAlone.properties.object.description
Distinguishes the organization domain object.

# components.schemas.OrganizationDomainStandAlone.properties.id.description
Unique identifier of the organization domain.

# components.schemas.OrganizationDomainStandAlone.properties.verification_token.description
Validation token to be used in DNS TXT record.

# components.schemas.Flag.properties.slug.description
A unique key to reference the Feature Flag.

# components.schemas.Flag.properties.name.description
A descriptive name for the Feature Flag. This field does not need to be unique.

# components.schemas.Flag.properties.description.example
Enable advanced analytics dashboard feature

# components.schemas.Flag.properties.tags.description
Labels assigned to the Feature Flag for categorizing and filtering.

# components.schemas.Flag.properties.enabled.description
Specifies whether the Feature Flag is active for the current environment.

# components.schemas.Flag.properties.default_value.description
The value returned for users and organizations who don't match any configured targeting rules.

# components.schemas.FlagList.properties.data.description
The list of records for the current page.

# components.schemas.FlagList.properties.list_metadata.properties.before.description
An object ID that defines your place in the list. When the ID is not present, you are at the start of the list.

# components.schemas.FlagList.properties.list_metadata.properties.after.description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.

# components.schemas.FlagList.properties.list_metadata.description
Pagination cursors for navigating between pages of results.

# components.schemas.OrganizationApiKey.properties.obfuscated_value.description
An obfuscated representation of the API Key value.

# components.schemas.OrganizationApiKey.properties.last_used_at.description
Timestamp of when the API Key was last used.

# components.schemas.OrganizationApiKey.properties.expires_at.description
Timestamp when the API Key expires. Null means the key does not expire.

# components.schemas.OrganizationApiKey.properties.permissions.description
The permission slugs assigned to the API Key.

# components.schemas.OrganizationApiKeyList.properties.data.description
The list of records for the current page.

# components.schemas.OrganizationApiKeyList.properties.list_metadata.properties.before.description
An object ID that defines your place in the list. When the ID is not present, you are at the start of the list.

# components.schemas.OrganizationApiKeyList.properties.list_metadata.properties.after.description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.

# components.schemas.OrganizationApiKeyList.properties.list_metadata.description
Pagination cursors for navigating between pages of results.

# components.schemas.OrganizationApiKeyWithValue.properties.obfuscated_value.description
An obfuscated representation of the API Key value.

# components.schemas.OrganizationApiKeyWithValue.properties.last_used_at.description
Timestamp of when the API Key was last used.

# components.schemas.OrganizationApiKeyWithValue.properties.expires_at.description
Timestamp when the API Key expires. Null means the key does not expire.

# components.schemas.OrganizationApiKeyWithValue.properties.permissions.description
The permission slugs assigned to the API Key.

# components.schemas.OrganizationApiKeyWithValue.properties.value.description
The full API Key value. Only returned once at creation time.

# components.schemas.Organization.properties.name.description
A descriptive name for the Organization. This field does not need to be unique.

# components.schemas.Organization.properties.domains.items.properties.object.description
Distinguishes the organization domain object.

# components.schemas.Organization.properties.domains.items.properties.id.description
Unique identifier of the organization domain.

# components.schemas.Organization.properties.domains.items.properties.verification_token.description
Validation token to be used in DNS TXT record.

# components.schemas.Organization.properties.stripe_customer_id.description
The Stripe customer ID of the Organization.

# components.schemas.Organization.properties.allow_profiles_outside_organization.description
Whether the Organization allows profiles outside of its managed domains.

# components.schemas.OrganizationList.properties.data.description
The list of records for the current page.

# components.schemas.OrganizationList.properties.list_metadata.properties.before.description
An object ID that defines your place in the list. When the ID is not present, you are at the start of the list.

# components.schemas.OrganizationList.properties.list_metadata.properties.after.description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.

# components.schemas.OrganizationList.properties.list_metadata.description
Pagination cursors for navigating between pages of results.

# components.schemas.AuditLogConfiguration.properties.retention_period_in_days.description
The number of days Audit Log events will be retained before being permanently deleted.

# components.schemas.AuditLogConfiguration.properties.state.description
The current state of the audit log configuration for the organization.

# components.schemas.AuditLogConfiguration.properties.log_stream.properties.id.description
Unique identifier of the Audit Log Stream.

# components.schemas.AuditLogConfiguration.properties.log_stream.properties.type.description
The type of the Audit Log Stream destination.

# components.schemas.AuditLogConfiguration.properties.log_stream.properties.state.description
The current state of the Audit Log Stream.

# components.schemas.AuditLogConfiguration.properties.log_stream.properties.last_synced_at.description
ISO-8601 timestamp of when the last event was successfully synced, or null if no events have been synced.

# components.schemas.AuditLogConfiguration.properties.log_stream.description
The Audit Log Stream currently configured for the organization, if any.

# components.schemas.DataIntegrationCredentials.properties.credentials_type.description
The credentials type for this integration (e.g., `shared`, `custom`, or `organization`).

# components.schemas.DataIntegrationCredentials.properties.has_credentials.description
Whether the organization has supplied OAuth credentials for this integration.

# components.schemas.DataIntegrationCredentials.properties.client_id.description
The OAuth client ID supplied by the organization, or `null` when none is configured.

# components.schemas.DataIntegrationCredentials.properties.client_secret_last_four.description
The last four characters of the organization-supplied OAuth client secret, or `null` when none is configured.

# components.schemas.DataIntegrationCredentials.properties.redirect_uri.description
The redirect URI to register with the provider when configuring the organization-managed OAuth application.

# components.schemas.DataIntegrationCredentials.description
Organization-managed OAuth credential configuration. Present only for integrations whose credentials are supplied by the organization; absent otherwise.

# components.schemas.DataIntegrationConfigurationResponse.properties.object.description
Distinguishes the data integration configuration object.

# components.schemas.DataIntegrationConfigurationResponse.properties.id.description
The unique identifier of the data integration.

# components.schemas.DataIntegrationConfigurationResponse.properties.slug.description
The slug identifier of the provider (e.g., `github`, `slack`, `notion`).

# components.schemas.DataIntegrationConfigurationResponse.properties.name.description
The display name of the data integration.

# components.schemas.DataIntegrationConfigurationResponse.properties.enabled.description
Whether the integration is enabled for this organization. Reflects the organization override when one exists, otherwise the provider default.

# components.schemas.DataIntegrationConfigurationResponse.properties.scopes.description
The OAuth scopes in effect for this organization. Reflects the organization override when one is set, otherwise the provider scopes, or `null` when none are configured.

# components.schemas.DataIntegrationConfigurationResponse.properties.config.description
The provider-specific config values in effect for this organization, keyed by config field. Reflects the organization override for organization-credential providers, otherwise the provider root. Empty when none are configured.

# components.schemas.DataIntegrationConfigurationResponse.properties.created_at.description
The timestamp when the configuration was created.

# components.schemas.DataIntegrationConfigurationResponse.properties.updated_at.description
The timestamp when the configuration was last updated.

# components.schemas.DataIntegrationConfigurationListResponse.properties.data.description
A list of data integration configurations for the organization.

# components.schemas.ConfigureDataIntegrationBody.properties.enabled.description
Whether the provider is enabled for the organization.

# components.schemas.ConfigureDataIntegrationBody.properties.scopes.description
The OAuth scopes to request for the organization. Pass `null` to inherit the provider scopes.

# components.schemas.ConfigureDataIntegrationBody.properties.client_id.description
The OAuth client ID of the organization's own application. Must be provided together with `client_secret`, and only for providers whose credentials are supplied by the organization.

# components.schemas.ConfigureDataIntegrationBody.properties.client_secret.description
The OAuth client secret of the organization's own application. Must be provided together with `client_id`.

# components.schemas.ConfigureDataIntegrationBody.properties.config.description
Provider-specific config values to set for the organization, keyed by config field. Only fields the provider declares are accepted, and each value must match that field's pattern. Accepted only for providers whose credentials are organization-managed; for shared or custom credential providers, config belongs on the integration itself (via the data-integrations API) and supplying it here is rejected.

# components.schemas.DataIntegration.properties.object.description
Distinguishes the Data Integration object.

# components.schemas.DataIntegration.properties.id.description
Unique identifier of the Data Integration.

# components.schemas.DataIntegration.properties.slug.description
The provider slug for this Data Integration.

# components.schemas.DataIntegration.properties.integration_type.description
The integration type derived from the provider.

# components.schemas.DataIntegration.properties.description.description
An optional description of the Data Integration.

# components.schemas.DataIntegration.properties.enabled.description
Whether the Data Integration is enabled.

# components.schemas.DataIntegration.properties.scopes.description
The OAuth scopes configured for the Data Integration. `null` when the provider's configured scopes are used.

# components.schemas.DataIntegration.properties.redirect_uri.description
The OAuth redirect URI to register with the provider when configuring the custom application.

# components.schemas.DataIntegration.properties.auth_methods.description
How accounts authenticate with the provider for this Data Integration.

# components.schemas.DataIntegration.properties.credentials.description
The integration-level OAuth app credentials. `null` for `api_key` integrations, which hold no OAuth credentials (keys are installed per-tenant).

# components.schemas.DataIntegration.properties.credentials.oneOf[].properties.type.description
The credentials type. `custom` uses your own OAuth app credentials; `organization` has each organization supply its own credentials (so `client_id`/`redacted_client_secret` are null on the integration itself).

# components.schemas.DataIntegration.properties.credentials.oneOf[].properties.client_id.description
The OAuth client ID configured for the provider app. Null for `organization` credentials.

# components.schemas.DataIntegration.properties.credentials.oneOf[].properties.redacted_client_secret.description
The last four characters of the OAuth client secret. The full secret is never returned. Null for `organization` credentials.

# components.schemas.DataIntegration.properties.installation.description
The tenant installation created when an API key was supplied at creation time; `null` otherwise. Not populated on list/get responses.

# components.schemas.DataIntegration.properties.installation.oneOf[].properties.organization_id.description
The Organization the installation is scoped to, or null when unscoped.

# components.schemas.DataIntegration.properties.installation.oneOf[].properties.api_key_last_4.description
The last four characters of the stored API key. The full key is never returned.

# components.schemas.DataIntegration.properties.config.description
Provider-specific config values set on the Data Integration (e.g. a Snowflake `account`), keyed by config field. Only fields the provider declares are accepted.

# components.schemas.DataIntegration.properties.custom_provider.description
The OAuth definition when this is a custom provider; `null` for built-in providers.

# components.schemas.DataIntegration.properties.custom_provider.oneOf[].properties.name.description
A descriptive name for the custom provider.

# components.schemas.DataIntegration.properties.custom_provider.oneOf[].properties.authorization_url.description
The provider's OAuth authorization endpoint.

# components.schemas.DataIntegration.properties.custom_provider.oneOf[].properties.refresh_token_url.description
The endpoint used to refresh tokens, if different from the token endpoint.

# components.schemas.DataIntegration.properties.custom_provider.oneOf[].properties.pkce_enabled.description
Whether PKCE is used during the authorization code flow.

# components.schemas.DataIntegration.properties.custom_provider.oneOf[].properties.request_scope_separator.description
The separator used to join requested scopes.

# components.schemas.DataIntegration.properties.custom_provider.oneOf[].properties.scopes_required.description
Whether at least one scope must be selected when connecting an account.

# components.schemas.DataIntegration.properties.custom_provider.oneOf[].properties.client_secret_required.description
Whether a client secret is required for this provider.

# components.schemas.DataIntegration.properties.custom_provider.oneOf[].properties.additional_authorization_parameters.description
Additional static query parameters appended to the authorization request.

# components.schemas.DataIntegration.properties.custom_provider.oneOf[].properties.token_body_content_type.description
The Content-Type used when exchanging the token request.

# components.schemas.DataIntegration.properties.custom_provider.oneOf[].properties.authenticate_via.description
How client credentials are sent when exchanging authorization codes and refreshing tokens.

# components.schemas.DataIntegrationList.properties.data.description
The list of records for the current page.

# components.schemas.DataIntegrationList.properties.list_metadata.properties.before.description
An object ID that defines your place in the list. When the ID is not present, you are at the start of the list.

# components.schemas.DataIntegrationList.properties.list_metadata.properties.after.description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.

# components.schemas.DataIntegrationList.properties.list_metadata.description
Pagination cursors for navigating between pages of results.

# components.schemas.DataIntegrationAuthorizeUrlResponse.properties.url.description
The OAuth authorization URL to redirect the user to.

# components.schemas.DataIntegrationAccessTokenResponse.oneOf[].properties.active.description
Indicates whether the access token is valid and ready for use, or if reauthorization is required.

# components.schemas.DataIntegrationAccessTokenResponse.oneOf[].properties.access_token.properties.access_token.description
The OAuth access token for the connected integration.

# components.schemas.DataIntegrationAccessTokenResponse.oneOf[].properties.access_token.properties.expires_at.description
The ISO-8601 formatted timestamp indicating when the access token expires.

# components.schemas.DataIntegrationAccessTokenResponse.oneOf[].properties.access_token.properties.missing_scopes.description
If the integration has requested scopes that aren't present on the access token, they're listed here.

# components.schemas.DataIntegrationAccessTokenResponse.oneOf[].properties.access_token.description
The [access token](/reference/pipes/access-token) object, present when `active` is `true`.

# components.schemas.DataIntegrationAccessTokenResponse.oneOf[].properties.active.description
Indicates whether the access token is valid and ready for use, or if reauthorization is required.

# components.schemas.DataIntegrationAccessTokenResponse.oneOf[].properties.error.description
- `"not_installed"`: The user does not have the integration installed.
- `"needs_reauthorization"`: The user needs to reauthorize the integration.

# components.schemas.AuthMethodMismatchError.properties.code.description
Error code indicating the endpoint does not match the installation auth method.

# components.schemas.AuthMethodMismatchError.properties.message.description
A human-readable explanation of the mismatch.

# components.schemas.AuthMethodMismatchError.properties.message.example
This installation uses oauth authentication. Use the POST /:slug/token endpoint instead.

# components.schemas.DataIntegrationCredentialsResponse.oneOf[].properties.credential.properties.auth_method.description
The authentication method for this credential. Additional values may be added in the future; handle unknown values gracefully.

# components.schemas.DataIntegrationCredentialsResponse.oneOf[].properties.credential.properties.expires_at.description
The ISO-8601 formatted timestamp indicating when the credential expires.

# components.schemas.DataIntegrationCredentialsResponse.oneOf[].properties.credential.properties.missing_scopes.description
If the integration has requested scopes that aren't present on the access token, they're listed here.

# components.schemas.DataIntegrationCredentialsResponse.oneOf[].properties.credential.description
The credential object containing the vended secret.

# components.schemas.DataIntegrationCredentialsResponse.oneOf[].properties.credential.properties.auth_method.description
The authentication method for this credential. Additional values may be added in the future; handle unknown values gracefully.

# components.schemas.DataIntegrationCredentialsResponse.oneOf[].properties.credential.description
The credential object containing the vended secret.

# components.schemas.DataIntegrationCredentialsResponse.oneOf[].properties.credential.properties.auth_method.description
The authentication method for this credential. Additional values may be added in the future; handle unknown values gracefully.

# components.schemas.DataIntegrationCredentialsResponse.oneOf[].properties.credential.properties.expires_at.description
The ISO-8601 formatted timestamp indicating when the credential expires.

# components.schemas.DataIntegrationCredentialsResponse.oneOf[].properties.credential.properties.missing_scopes.description
If the integration has requested scopes that aren't present on the access token, they're listed here.

# components.schemas.DataIntegrationCredentialsResponse.oneOf[].properties.credential.properties.metadata.description
Non-sensitive fields captured from the provider token response (e.g. Salesforce `instance_url`), as configured for the provider.

# components.schemas.DataIntegrationCredentialsResponse.oneOf[].properties.credential.description
The credential object containing the vended secret.

# components.schemas.DataIntegrationCredentialsResponse.oneOf[].properties.active.description
Indicates credentials are not available.

# components.schemas.DataIntegrationCredentialsResponse.oneOf[].properties.error.description
The reason credentials are unavailable. Additional values may be added in the future; handle unknown values gracefully.
- `"not_installed"`: The user does not have the integration installed.
- `"needs_reauthorization"`: The user needs to reauthorize the integration.

# components.schemas.ConnectedAccount.properties.object.description
Distinguishes the connected account object.

# components.schemas.ConnectedAccount.properties.id.description
The unique identifier of the connected account.

# components.schemas.ConnectedAccount.properties.organization_id.description
The [Organization](/reference/organization) identifier associated with this connection, or `null` if not scoped to an organization.

# components.schemas.ConnectedAccount.properties.scopes.description
The OAuth scopes granted for this connection.

# components.schemas.ConnectedAccount.properties.auth_method.description
The authentication method used for this connection (`oauth`, `api_key`, or `client_credentials`). Defaults to `oauth` if absent.

# components.schemas.ConnectedAccount.properties.api_key_last_4.description
The last four characters of the API key, or `null` for OAuth connections.

# components.schemas.ConnectedAccount.properties.client_id.description
The client ID supplied for this connection. Only present when `auth_method` is `client_credentials`.

# components.schemas.ConnectedAccount.properties.client_secret_last_4.description
The last four characters of the client secret supplied for this connection, or `null` when it can't be read. Only present when `auth_method` is `client_credentials`.

# components.schemas.ConnectedAccount.properties.config.description
The connection-level configuration values stored for this connection — the fields the provider declares at `installation` scope, excluding any it declares as secret. Only present when `auth_method` is `client_credentials`.

# components.schemas.ConnectedAccount.properties.state.description
The state of the connected account:
- `connected`: The connection is active and tokens are valid.
- `needs_reauthorization`: The user needs to reauthorize the connection, typically because required scopes have changed.
- `disconnected`: The connection has been disconnected.

# components.schemas.ConnectedAccount.properties.created_at.description
The timestamp when the connection was created.

# components.schemas.ConnectedAccount.properties.updated_at.description
The timestamp when the connection was last updated.

# components.schemas.DataIntegrationsListResponse.properties.data.items.properties.name.description
The display name of the provider (e.g., "GitHub", "Slack").

# components.schemas.DataIntegrationsListResponse.properties.data.items.properties.description.description
A description of the provider explaining how it will be used, if configured.

# components.schemas.DataIntegrationsListResponse.properties.data.items.properties.description.example
Connect your GitHub account to access repositories.

# components.schemas.DataIntegrationsListResponse.properties.data.items.properties.slug.description
The slug identifier used in API calls (e.g., `github`, `slack`, `notion`).

# components.schemas.DataIntegrationsListResponse.properties.data.items.properties.integration_type.description
The type of integration (e.g., `github`, `slack`).

# components.schemas.DataIntegrationsListResponse.properties.data.items.properties.credentials_type.description
The type of credentials used by the provider (e.g., `oauth2`).

# components.schemas.DataIntegrationsListResponse.properties.data.items.properties.scopes.description
The OAuth scopes configured for this provider, or `null` if none are configured.

# components.schemas.DataIntegrationsListResponse.properties.data.items.properties.auth_methods.description
The authentication methods supported by this provider (`oauth`, `api_key`, `client_credentials`, or a combination). Defaults to `["oauth"]` if absent.

# components.schemas.DataIntegrationsListResponse.properties.data.items.properties.ownership.description
Whether the provider is owned by a user or organization.

# components.schemas.DataIntegrationsListResponse.properties.data.items.properties.created_at.description
The timestamp when the provider was created.

# components.schemas.DataIntegrationsListResponse.properties.data.items.properties.updated_at.description
The timestamp when the provider was last updated.

# components.schemas.DataIntegrationsListResponse.properties.data.items.properties.connected_account.description
The user's [connected account](/reference/pipes/connected-account) for this provider, or `null` if the user has not connected.

# components.schemas.DataIntegrationsListResponse.properties.data.items.properties.connected_account.oneOf[].properties.object.description
Distinguishes the connected account object.

# components.schemas.DataIntegrationsListResponse.properties.data.items.properties.connected_account.oneOf[].properties.id.description
The unique identifier of the connected account.

# components.schemas.DataIntegrationsListResponse.properties.data.items.properties.connected_account.oneOf[].properties.organization_id.description
The [Organization](/reference/organization) identifier associated with this connection, or `null` if not scoped to an organization.

# components.schemas.DataIntegrationsListResponse.properties.data.items.properties.connected_account.oneOf[].properties.scopes.description
The OAuth scopes granted for this connection.

# components.schemas.DataIntegrationsListResponse.properties.data.items.properties.connected_account.oneOf[].properties.auth_method.description
The authentication method used for this connection (`oauth`, `api_key`, or `client_credentials`). Defaults to `oauth` if absent.

# components.schemas.DataIntegrationsListResponse.properties.data.items.properties.connected_account.oneOf[].properties.api_key_last_4.description
The last four characters of the API key, or `null` for OAuth connections.

# components.schemas.DataIntegrationsListResponse.properties.data.items.properties.connected_account.oneOf[].properties.client_id.description
The client ID supplied for this connection. Only present when `auth_method` is `client_credentials`.

# components.schemas.DataIntegrationsListResponse.properties.data.items.properties.connected_account.oneOf[].properties.client_secret_last_4.description
The last four characters of the client secret supplied for this connection, or `null` when it can't be read. Only present when `auth_method` is `client_credentials`.

# components.schemas.DataIntegrationsListResponse.properties.data.items.properties.connected_account.oneOf[].properties.config.description
The connection-level configuration values stored for this connection — the fields the provider declares at `installation` scope, excluding any it declares as secret. Only present when `auth_method` is `client_credentials`.

# components.schemas.DataIntegrationsListResponse.properties.data.items.properties.connected_account.oneOf[].properties.state.description
The state of the connected account:
- `connected`: The connection is active and tokens are valid.
- `needs_reauthorization`: The user needs to reauthorize the connection, typically because required scopes have changed.
- `disconnected`: The connection has been disconnected.

# components.schemas.DataIntegrationsListResponse.properties.data.items.properties.connected_account.oneOf[].properties.created_at.description
The timestamp when the connection was created.

# components.schemas.DataIntegrationsListResponse.properties.data.items.properties.connected_account.oneOf[].properties.updated_at.description
The timestamp when the connection was last updated.

# components.schemas.PortalLinkResponse.properties.link.description
An ephemeral link to initiate the Admin Portal.

# components.schemas.RadarChallenge.properties.object.description
Distinguishes the Radar Challenge object.

# components.schemas.RadarChallenge.properties.expires_at.description
The timestamp when the Radar Challenge code expires.

# components.schemas.RadarChallenge.properties.code.description
The code used to verify the Radar Challenge.

# components.schemas.SendRadarSmsChallengeResponse.properties.verification_id.description
The ID of the SMS verification. Pass this to the authenticate endpoint to verify the code.

# components.schemas.SendRadarSmsChallengeResponse.properties.phone_number.description
The phone number the verification code was sent to.

# components.schemas.RadarStandaloneResponse.properties.reason.description
A human-readable reason for the verdict.

# components.schemas.RadarStandaloneResponse.properties.attempt_id.description
Unique identifier of the authentication attempt.

# components.schemas.RadarStandaloneResponse.properties.control.description
The Radar control that triggered the verdict. Only present if the verdict is `block` or `challenge`.

# components.schemas.RadarStandaloneResponse.properties.blocklist_type.description
The type of blocklist entry that triggered the verdict. Only present if the control is `restriction`.

# components.schemas.RadarListEntryAlreadyPresentResponse.properties.message.description
A message indicating the entry already exists.

# components.schemas.RedirectUri.properties.default.description
Whether this is the default redirect URI.

# components.schemas.RedirectUri.properties.created_at.description
The timestamp when the redirect URI was created.

# components.schemas.RedirectUri.properties.updated_at.description
The timestamp when the redirect URI was last updated.

# components.schemas.UserlandUserAuthenticationFactorList.properties.data.description
The list of records for the current page.

# components.schemas.UserlandUserAuthenticationFactorList.properties.list_metadata.properties.before.description
An object ID that defines your place in the list. When the ID is not present, you are at the start of the list.

# components.schemas.UserlandUserAuthenticationFactorList.properties.list_metadata.properties.after.description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.

# components.schemas.UserlandUserAuthenticationFactorList.properties.list_metadata.description
Pagination cursors for navigating between pages of results.

# components.schemas.UserlandUserAuthenticationFactorEnrollResponse.properties.authentication_factor.description
The [authentication factor](/reference/authkit/mfa/authentication-factor) object that represents the additional authentication method used on top of the existing authentication strategy.

# components.schemas.MagicAuth.properties.expires_at.description
The timestamp when the Magic Auth code expires.

# components.schemas.MagicAuth.properties.code.description
The code used to verify the Magic Auth code.

# components.schemas.UserlandUserInvite.properties.accepted_at.description
The timestamp when the invitation was accepted, or null if not yet accepted.

# components.schemas.UserlandUserInvite.properties.revoked_at.description
The timestamp when the invitation was revoked, or null if not revoked.

# components.schemas.UserlandUserInvite.properties.expires_at.description
The timestamp when the invitation expires.

# components.schemas.UserlandUserInvite.properties.organization_id.description
The ID of the [organization](/reference/organization) that the recipient will join.

# components.schemas.UserlandUserInvite.properties.inviter_user_id.description
The ID of the user who invited the recipient, if provided.

# components.schemas.UserlandUserInvite.properties.accepted_user_id.description
The ID of the user who accepted the invitation, once accepted.

# components.schemas.UserlandUserInvite.properties.role_slug.description
Slug of the role the invitee will be assigned on acceptance. Reflects the current role on the invitee's organization membership. null when the invitation has no associated organization.

# components.schemas.UserlandUserInvite.properties.token.description
The token used to accept the invitation.

# components.schemas.UserlandUserInvite.properties.accept_invitation_url.description
The URL where the recipient can accept the invitation.

# components.schemas.UserlandUserInviteList.properties.data.description
The list of records for the current page.

# components.schemas.UserlandUserInviteList.properties.list_metadata.properties.before.description
An object ID that defines your place in the list. When the ID is not present, you are at the start of the list.

# components.schemas.UserlandUserInviteList.properties.list_metadata.properties.after.description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.

# components.schemas.UserlandUserInviteList.properties.list_metadata.description
Pagination cursors for navigating between pages of results.

# components.schemas.UserlandUserOrganizationMembership.properties.id.description
The unique ID of the organization membership.

# components.schemas.UserlandUserOrganizationMembership.properties.organization_id.description
The ID of the organization which the user belongs to.

# components.schemas.UserlandUserOrganizationMembership.properties.status.description
The status of the organization membership. One of `active`, `inactive`, or `pending`.

# components.schemas.UserlandUserOrganizationMembership.properties.directory_managed.description
Whether this organization membership is managed by a directory sync connection.

# components.schemas.UserlandUserOrganizationMembership.properties.organization_name.description
The name of the organization which the user belongs to.

# components.schemas.UserlandUserOrganizationMembership.properties.custom_attributes.description
An object containing IdP-sourced attributes from the linked [Directory User](/reference/directory-sync/directory-user) or [SSO Profile](/reference/sso/profile). Directory User attributes take precedence when both are linked.

# components.schemas.UserlandUserOrganizationMembership.properties.role.description
The primary role assigned to the user within the organization.

# components.schemas.UserlandUserOrganizationMembership.properties.roles.description
The list of roles assigned to the user within the organization.

# components.schemas.UserlandUserOrganizationMembership.properties.user.description
The user that belongs to the organization through this membership.

# components.schemas.UserlandUserOrganizationMembershipList.properties.data.description
The list of records for the current page.

# components.schemas.UserlandUserOrganizationMembershipList.properties.list_metadata.properties.before.description
An object ID that defines your place in the list. When the ID is not present, you are at the start of the list.

# components.schemas.UserlandUserOrganizationMembershipList.properties.list_metadata.properties.after.description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.

# components.schemas.UserlandUserOrganizationMembershipList.properties.list_metadata.description
Pagination cursors for navigating between pages of results.

# components.schemas.UserApiKey.properties.owner.properties.organization_id.description
Unique identifier of the organization the API Key can access.

# components.schemas.UserApiKey.properties.obfuscated_value.description
An obfuscated representation of the API Key value.

# components.schemas.UserApiKey.properties.last_used_at.description
Timestamp of when the API Key was last used.

# components.schemas.UserApiKey.properties.expires_at.description
Timestamp when the API Key expires. Null means the key does not expire.

# components.schemas.UserApiKey.properties.permissions.description
The permission slugs assigned to the API Key.

# components.schemas.UserApiKeyList.properties.data.description
The list of records for the current page.

# components.schemas.UserApiKeyList.properties.list_metadata.properties.before.description
An object ID that defines your place in the list. When the ID is not present, you are at the start of the list.

# components.schemas.UserApiKeyList.properties.list_metadata.properties.after.description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.

# components.schemas.UserApiKeyList.properties.list_metadata.description
Pagination cursors for navigating between pages of results.

# components.schemas.UserApiKeyWithValue.properties.owner.properties.organization_id.description
Unique identifier of the organization the API Key can access.

# components.schemas.UserApiKeyWithValue.properties.obfuscated_value.description
An obfuscated representation of the API Key value.

# components.schemas.UserApiKeyWithValue.properties.last_used_at.description
Timestamp of when the API Key was last used.

# components.schemas.UserApiKeyWithValue.properties.expires_at.description
Timestamp when the API Key expires. Null means the key does not expire.

# components.schemas.UserApiKeyWithValue.properties.permissions.description
The permission slugs assigned to the API Key.

# components.schemas.UserApiKeyWithValue.properties.value.description
The full API Key value. Only returned once at creation time.

# components.schemas.UserlandUserList.properties.data.description
The list of records for the current page.

# components.schemas.UserlandUserList.properties.list_metadata.properties.before.description
An object ID that defines your place in the list. When the ID is not present, you are at the start of the list.

# components.schemas.UserlandUserList.properties.list_metadata.properties.after.description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.

# components.schemas.UserlandUserList.properties.list_metadata.description
Pagination cursors for navigating between pages of results.

# components.schemas.EmailVerification.properties.object.description
Distinguishes the email verification object.

# components.schemas.EmailVerification.properties.id.description
The unique ID of the email verification code.

# components.schemas.EmailVerification.properties.expires_at.description
The timestamp when the email verification code expires.

# components.schemas.SendVerificationEmailResponse.properties.user.description
The user to whom the verification email was sent.

# components.schemas.PasswordReset.properties.object.description
Distinguishes the password reset object.

# components.schemas.PasswordReset.properties.id.description
The unique ID of the password reset object.

# components.schemas.PasswordReset.properties.expires_at.description
The timestamp when the password reset token expires.

# components.schemas.PasswordReset.properties.created_at.description
The timestamp when the password reset token was created.

# components.schemas.PasswordReset.properties.password_reset_url.description
The URL where the user can reset their password.

# components.schemas.EmailChange.properties.new_email.description
The new email address the user is changing to.

# components.schemas.EmailChange.properties.expires_at.description
The timestamp when the email change code expires.

# components.schemas.EmailChange.properties.created_at.description
The timestamp when the email change challenge was created.

# components.schemas.UserlandAuthenticateResponse.properties.organization_id.description
The ID of the organization the user selected to sign in to.

# components.schemas.UserlandAuthenticateResponse.properties.authkit_authorization_code.description
An authorization code that can be exchanged for tokens by a different application.

# components.schemas.UserlandAuthenticateResponse.properties.access_token.description
A JWT containing information about the current session.

# components.schemas.UserlandAuthenticateResponse.properties.authentication_method.description
The authentication method used to initiate the session.

# components.schemas.UserlandAuthenticateResponse.properties.impersonator.properties.email.description
The email address of the WorkOS Dashboard user who is impersonating the user.

# components.schemas.UserlandAuthenticateResponse.properties.impersonator.properties.reason.description
The justification the impersonator gave for impersonating the user.

# components.schemas.UserlandAuthenticateResponse.properties.impersonator.properties.reason.example
Investigating an issue with the customer's account.

# components.schemas.UserlandAuthenticateResponse.properties.impersonator.description
Information about the impersonator if this session was created via impersonation.

# components.schemas.UserlandAuthenticateResponse.properties.oauth_tokens.properties.provider.description
The OAuth provider used for authentication.

# components.schemas.UserlandAuthenticateResponse.properties.oauth_tokens.properties.refresh_token.description
The refresh token from the OAuth provider.

# components.schemas.UserlandAuthenticateResponse.properties.oauth_tokens.properties.access_token.description
The access token from the OAuth provider.

# components.schemas.UserlandAuthenticateResponse.properties.oauth_tokens.properties.expires_at.description
The timestamp at which the access token expires.

# components.schemas.UserlandAuthenticateResponse.properties.oauth_tokens.properties.scopes.description
A list of OAuth scopes for which the access token is authorized.

# components.schemas.UserlandAuthenticateResponse.properties.oauth_tokens.description
The OAuth tokens from the identity provider, if applicable.

# components.schemas.DeviceAuthorizationResponse.properties.verification_uri_complete.description
Verification URI that includes the user code.

# components.schemas.WebhookEndpointJson.properties.object.description
Distinguishes the Webhook Endpoint object.

# components.schemas.WebhookEndpointJson.properties.id.description
Unique identifier of the Webhook Endpoint.

# components.schemas.WebhookEndpointJson.properties.secret.description
The secret used to sign webhook payloads.

# components.schemas.WebhookEndpointJson.properties.status.description
Whether the Webhook Endpoint is enabled or disabled.

# components.schemas.WebhookEndpointJson.properties.events.description
The events that the Webhook Endpoint is subscribed to.

# components.schemas.WebhookEndpointList.properties.data.description
The list of records for the current page.

# components.schemas.WebhookEndpointList.properties.list_metadata.properties.before.description
An object ID that defines your place in the list. When the ID is not present, you are at the start of the list.

# components.schemas.WebhookEndpointList.properties.list_metadata.properties.after.description
An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.

# components.schemas.WebhookEndpointList.properties.list_metadata.description
Pagination cursors for navigating between pages of results.

# components.schemas.Profile.properties.organization_id.description
The ID of the organization the user belongs to.

# components.schemas.Profile.properties.connection_id.description
The ID of the SSO connection used for authentication.

# components.schemas.Profile.properties.idp_id.description
The user's unique identifier from the identity provider.

# components.schemas.Profile.properties.role.description
The role assigned to the user within the organization, if applicable.

# components.schemas.Profile.properties.roles.description
The roles assigned to the user within the organization, if applicable.

# components.schemas.Profile.properties.groups.description
The groups the user belongs to, as returned by the identity provider.

# components.schemas.Profile.properties.custom_attributes.description
Custom attribute mappings defined for the connection, returned as key-value pairs.

# components.schemas.Profile.properties.raw_attributes.description
The complete set of raw attributes returned by the identity provider.

# components.schemas.SsoTokenResponse.properties.access_token.description
An access token that can be exchanged for a user profile. Access tokens are short-lived — see the `expires_in` field for the exact lifetime.

# components.schemas.SsoTokenResponse.properties.expires_in.description
The lifetime of the access token in seconds.

# components.schemas.SsoTokenResponse.properties.profile.description
The user profile returned by the identity provider.

# components.schemas.SsoTokenResponse.properties.oauth_tokens.properties.provider.description
The OAuth provider used for authentication.

# components.schemas.SsoTokenResponse.properties.oauth_tokens.properties.refresh_token.description
The refresh token from the OAuth provider.

# components.schemas.SsoTokenResponse.properties.oauth_tokens.properties.access_token.description
The access token from the OAuth provider.

# components.schemas.SsoTokenResponse.properties.oauth_tokens.properties.expires_at.description
The timestamp at which the access token expires.

# components.schemas.SsoTokenResponse.properties.oauth_tokens.properties.scopes.description
A list of OAuth scopes for which the access token is authorized.

# components.schemas.SsoTokenResponse.properties.oauth_tokens.description
OAuth tokens issued by the identity provider, if available.

# components.schemas.SsoLogoutAuthorizeResponse.properties.logout_url.description
The URL to redirect the user to in order to log out ([Logout Redirect](/reference/sso/logout) endpoint ready to use).

# components.schemas.SsoLogoutAuthorizeResponse.properties.logout_token.description
The logout token to be used in the [Logout Redirect](/reference/sso/logout) endpoint.

# components.schemas.JwksResponse.properties.keys.description
The public keys used for verifying access tokens.