0.6.1 (2026-09-04)
- /oauth/authorize に screen_hint を追加し WorkOS AuthKit へパススルーする (40567d7)
- sdk: add screen_hint parameter to /oauth/authorize (cf9b10d)
- sdk: correct overstated claims in the screen_hint contract (fb9ef21)
0.6.0 (2026-09-03)
- sdk: the generated SDK now types these against named enums instead of string — Client / AdminClientCreateRequest / AdminClientUpdateRequest / AdminClientCreatedResponse (client_type, allowed_scopes, grant_types_supported, token_endpoint_auth_method), JsonWebKey (kty, use, alg), MyOrganization (domain_verification_status, sso_connection_status), AdminPortalSessionCreateRequest (intent), OpenIDProviderMetadataResponse (subject_types_supported, prompt_values_supported), and the members-list
sort_by/sort_orderarguments. The matching*_ALLOWABLE_VALUESconstants andget*AllowableValues()helpers are gone; read the enum cases instead. studio-api requires ^0.3.0 (locked at v0.3.3), so it does not pick this up until that constraint is raised deliberately.
- sdk: extract inline spec enums into leaf schemas (9977f28)
- sdk: document that invitation_token bypasses silent SSO (18687cc)
- sdk: document the access_denied redirect for a rejected organization binding (932bb7c)
- sdk: document the membership rejection on the organization_id parameter (7cb278e)
- sdk: document when the authorize context parameter reaches the IdP (a6dad76), closes #1692
- sdk: exclude prompt=none from the context IdP-redirect examples (133fa08)
- sdk: scope the access_denied membership rejection to the non-SSO login path (16cd4cc)
- sdk: scope the invitation interaction_required to a live session (6812905)
- sdk: scope the invitation trigger on the interaction_required code (2307c67)
0.5.0 (2026-08-27)
- sdk: the pending-authentication lookup operation and the PENDING_AUTHENTICATION_TOKEN grant type are gone from the SDK.
- add the pending-authentication-token grant to /oauth/token (#1645) (9cb6583)
- look up organization candidates for a pending authentication token (#1646) (7e062e7)
- render the organization picker on the authorization server (#1647) (cb7be38)
- sdk: add the pending-authentication-token grant to the token spec (2865361)
- sdk: document organization_selection_required on the authorize redirect (5f97773)
- sdk: document the 429 on the WorkOS webhook path (fa3760b), closes #1646
- sdk: document the pending-authentication lookup endpoint (980ab23), closes #1646
- sdk: document the rate limit on the pending-authentication lookup (8161b8b), closes #1646
- sdk: remove the pending-authentication lookup endpoint and grant (84e557e)
- sdk: return the standard interaction_required instead of a custom code (e9e891d)
- sdk: correct the Referrer-Policy contract and state the BFF obligations (142b571)
0.4.0 (2026-08-07)
- sdk: reading a response gets strictly easier, but constructing one does not. In the TS SDK type / title / status / detail / instance stop being optional and trace_id / correlation_id / service_tag / occurred_at / log_reference appear as required members, so consumer fixtures, mocks and object literals typed as ProblemDetails no longer compile until every member is supplied; the same holds for OrganizationMemberUser's name / given_name / family_name, which go from
string | null | undefinedtostring | null. In the PHP SDK the accessors for the newly required non-nullable members narrow from?string/?inttostring/int, so passing null to a setter now raises a TypeError. The SDK is 0.x, so bump-minor-pre-major lands this as a minor bump.
- sdk: correct the token example names and pin invalid_params in the 400 tests (af6ed9d)
- sdk: declare the ProblemDetails members this API always returns (a5bb57c)
- sdk: document only the 400 shape revoke and introspect can actually return (e3fd7d5)
- sdk: document the 400 responses six admin operations already return (705caed), closes #1501
- sdk: document the problem+json shape the OAuth 400 responses also return (d0f15bf), closes #1502
- sdk: let the PHP SDK accept an explicitly-null required member (8d253df), closes #1521
- sdk: 実装が返しているのに spec 未記載だった 400 レスポンスを記載する (8a3cc3a)
0.3.3 (2026-07-31)
- register post_logout_redirect_uris via the admin client API (5d0c6b8)
- sdk: add post_logout_redirect_uris to admin client schemas (0ce4ac7), closes #1464
- sdk: pass primitive-only oneOf raw values through deserialization (75a65ca), closes #1520
- sdk: pass primitive-only oneOf raw values through SDK deserialization (e62d29e)
0.3.2 (2026-07-22)
- ci: publish the auth API reference to studio-internal on stable SDK releases (ca3e45c)
- openapi: add build:docs script for the static API reference bundle (285c78d)
- sdk: accept stdClass body and exact-match the problem+json media type (862da81)
- sdk: classify authorize/callback error formats per status (5d561e5)
- sdk: correct auth examples and expand the SDK READMEs (657f947)
- sdk: correct auth examples and expand the SDK READMEs (a1e9997)
- sdk: correct Node runtime guidance and error-shape docs (4ebbc0f)
- sdk: gate getProblem() on the problem+json content type (#1459) (039e7d0)
- sdk: gate getProblem() on the problem+json content type (#1459) (f2e467e)
- sdk: handle undefined response and deserialize-failure in error docs (64a119b)
- sdk: limit async ApiException conversion to transport exceptions (8fcf53a)
- sdk: make error-handling docs match actual SDK behavior (a3e7bbc)
- sdk: refer to the internal portal without exposing its hostname (b7cd0d6)
- sdk: reject async ConnectException as the base ApiException (20192db)
- sdk: reject async ConnectException as the base ApiException (3c25b51)
- sdk: require a JSON object body before resolving Problem Details (3bc478c)
- sdk: scope OAuth error format to 400/401 in Node docs (a4c596a)
0.3.1 (2026-06-15)
- sdk: document sso_enforced claim in IntrospectResponse (4db12d8), closes #1312
- sdk: document the 403 user_disabled callback response (50920f0)
- sdk: expose 422 self-role-change-must-be-downgrade on member role PATCH (d4ee967)
- sdk: expose given_name/family_name on OrganizationMemberUser (8b445e2)
- user offboarding & SSO enforcement (epic #1309) (c8dd30a)
0.3.0 (2026-05-20)
- sdk: PATCH /organizations/{organization_id}/members/{member_id} no longer returns 400 when the caller targets their own membership. Successful self-demotions now return 200, and attempts that would remove the last remaining owner return 409 (LastOwnerRoleCannotBeChanged) instead of 400. Clients that branched on the previous 400 contract must be updated to handle 200/409 accordingly.
- sdk: allow self-demotion on organization member role update (ffbe6ab)
0.2.26 (2026-05-16)
0.2.25 (2026-05-07)
- sdk: add domain/sso status fields to getMyOrganization (a8e890d)
- sdk: extract inline enums to named component schemas (8f261c2)
- sdk: extract Prompt enum to a named component schema (5091bb6)
- sdk: refine enum schemas after review, add drift tests (e710be2)
- sdk: remove duplicate description in MyOrganization schema (b77e8ef)
0.2.24 (2026-04-22)
- sdk: document user-scope 404 type URI for admin-portal-sessions (4ec1a31)
- sdk: document user-scope 404 type URI on invitations endpoint (4f5b5b0)
- openapi: keep client authentication required for the token endpoint (ae15201)
- sdk: restore JWK inheritance in generated PHP SDK (bbebd87)
0.2.23 (2026-04-21)
- sdk: add user-scope POST /organizations/{organization_id}/admin-portal-sessions (130b13c)
- sdk: document 404 response on user-scope admin-portal-sessions and tighten auth description (6f26a9d)
0.2.22 (2026-04-21)
- sdk: add user-scope PATCH /organizations/{organization_id} spec (4075aa5)
- sdk: resolve oneOf discriminator correctly in PHP SDK templates (574e808)
- sdk: throw on unknown discriminator value instead of silently falling back (10a8440)
0.2.21 (2026-04-20)
- sdk: document error handling for getMyOrganization in TS SDK (ffc71da)
- sdk: document error handling for getMyOrganization in TS SDK (a1b94fc)
0.2.20 (2026-04-20)
- sdk: remove hardcoded production URL from TS SDK README (ee97c45)
- sdk: TS SDK READMEから本番URLを除去 & CHANGELOG同梱 (3f26a7d)
0.2.19 (2026-04-20)
- sdk-ts, sdk-php: expose user-scope DELETE organization member endpoint (e47ccf3)
- sdk: expose user-scope DELETE organization member endpoint (ca003ea)
0.2.18 (2026-04-20)
- ci: switch SDK publishing to tag-triggered OIDC workflow (#1088) (f5404d6), closes #1077
- sdk-ts, sdk-php: expose user-scope DELETE organization member endpoint (e47ccf3)
- sdk: replace Changesets with checksum-based auto-versioning (6ab4bde)
- ci: ヘルスチェックに IAM 認証トークンを付与 (2395215)
- 2f4c850: chore(sdk-php): Packagist 公開に向けた SDK テンプレート・CI ワークフロー整備
-
a44aeee: fix(sdk-php): PHP 8.4 互換性修正 — HeaderSelector の型エラーを解消
HeaderSelector::getNextWeight()で10 ** floor(...)がfloatを返すため、 PHP 8.4 の厳密な型チェックでint戻り値型と不一致になる問題を修正。adjustWeight()のパラメータ型もfloat→intに統一。
- b8c0cbe: Fix PHP SDK version: remove hardcoded artifactVersion from config.json so CLI override works correctly
- d29fe0a: Initial PHP SDK release
- fddff51: Artifact Registry 移行に伴うリリースフロー確認
-
d7c5ccb: Remove Workspace endpoints and models from the API
The following Admin API endpoints have been removed:
POST /admin/workspaces(createWorkspace)GET /admin/workspaces(listWorkspaces)GET /admin/workspaces/{workspace_id}(getWorkspace)PATCH /admin/workspaces/{workspace_id}(updateWorkspace)DELETE /admin/workspaces/{workspace_id}(deactivateWorkspace)
The following models have been removed:
WorkspaceAdminWorkspaceCreateRequestAdminWorkspaceCreatedResponseAdminWorkspaceListResponseAdminWorkspaceUpdateRequest
Workspace management will be handled by client-side APIs instead of the shared auth server.
-
3e0166b: Initial release of TypeScript SDK for Auth Service API
- Auto-generated TypeScript types and SDK functions from OpenAPI spec
- Fetch-based HTTP client with authentication support
- All API operations available as tree-shakeable functions