feat(generated): Changes to agents, pipes, and user_management

[workos-sdk-automation]

Summary

feat(agents): Add parameter AgentsSessions.list.organization_id

• Added parameter AgentsSessions.list.organization_id.

feat(pipes): Update Pipes API surface

• Added enum PipesOwnership.
• Added user to CreateDataIntegrationOwnership.
• Added user to DataIntegrationOwnership.
• Added endpoint GET /data-integrations/{slug}/organization.
• Added endpoint PUT /data-integrations/{slug}/organization.
• Added endpoint DELETE /data-integrations/{slug}/organization.
• Added parameter Pipes.listDataIntegrations.ownership.
• Changed errors for endpoint GET /data-integrations.
• Changed errors for endpoint PUT /user_management/users/{user_id}/connected_accounts/{slug}.
• Changed errors for endpoint DELETE /user_management/users/{user_id}/connected_accounts/{slug}.

feat(user_management): Add user management API surface

• Added model CreateAuthkitOAuthResource.
• Added model AuthkitOAuthResource.
• Added service UserManagementAuthkitOAuthResources.

fix(pipes): Update Pipes API surface

• Removed userland_user from CreateDataIntegrationOwnership.
• Removed userland_user from DataIntegrationOwnership.
• Changed errors for endpoint POST /user_management/users/{user_id}/connected_accounts/{slug}.

Triggered by workos/openapi-spec@0b4d419

BEGIN_COMMIT_OVERRIDE
feat(agents): Add parameter AgentsSessions.list.organization_id (#727)
feat(pipes): Update Pipes API surface (#727)
feat(user_management): Add user management API surface (#727)
fix(pipes): Update Pipes API surface (#727)
END_COMMIT_OVERRIDE

[greptile-apps]

Confidence Score: 4/5

Preserve the existing Pipes model constructor bindings before merging; positional callers currently produce incorrect request data.

Findings

1.  Positional arguments silently change meaning ▶
2.  New request bodies lack coverage ▶
3.  Unknown-state regression coverage removed ▶

Fix with agent prompt

### Issue 1
src/workos/pipes/models/api_key_installation.py:15-18
Previously, `ApiKeyInstallation` accepted `(user_id, secret, organization_id=None)` through its alias. The replacement reverses the first two arguments: existing code such as `ApiKeyInstallation("user_123", "sk_example")` now serializes the secret as `user_id` and the user ID as `secret`. Passing this model as `api_key` breaks integration creation and key rotation.

The same compatibility issue affects `CreateDataIntegration`, where ownership displaces description, and `DataIntegrationsUpsertClientCredentialsRequest`, where the new selectors displace config. Preserve existing field positions, append new optional fields, and add positional-construction regression tests.

### Issue 2
tests/test_pipes.py:196-206
The organization-update tests supply no update fields and check only the method/path. The credential and token tests also never supply the new ownership and plural-connection body selectors, so they would pass even if serialization dropped those inputs.

Add sync and async body assertions for organization updates with `enabled=False`, explicit nullable fields, and a nested payload. Also exercise organization/account selectors and both boolean values in credential requests. This would protect the new behavior rather than only confirming that its routes exist.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

### Issue 3
tests/test_pipes_models_round_trip.py:300-303
Replacing `unexpected_data_integration_state` with `valid` removes the existing check that `DataIntegration` preserves unfamiliar server state values. The new unknown-ownership case should extend that coverage, not replace it. Keep both fields unknown here, or parameterize the test to exercise each independently.

```suggestion
            "ownership": "unexpected_data_integration_ownership",
            "description": "Production GitHub app",
            "enabled": True,
            "state": "unexpected_data_integration_state",
```

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

• Adds organization filtering to agent-session lists.
• Adds organization-owned integration endpoints, ownership selectors, and plural-connection controls to Pipes.
• Adds synchronous and asynchronous OAuth resource list/create/delete methods and typed models.
• Public Pipes model constructor changes break existing positional callers; request-body coverage and an existing unknown-enum regression test also need attention.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  App[Python application] --> Agents[Agents session list]
  Agents --> Filter[organization_id filter]
  App --> Pipes[Pipes]
  Pipes --> Roots[User-owned or organization-owned integration]
  Roots --> Manage[Create, retrieve, update, delete]
  Pipes --> Select[User, organization, and connected-account selectors]
  Select --> Credentials[Retrieve token or vend credentials]
  App --> UM[User Management]
  UM --> OAuth[List, create, delete OAuth resource indicators]

Loading

_{Reviews (1) · Last reviewed commit: "chore(generated): add release notes frag..."}

[greptile-apps]

Positional arguments silently change meaning

Previously, ApiKeyInstallation accepted (user_id, secret, organization_id=None) through its alias. The replacement reverses the first two arguments: existing code such as ApiKeyInstallation("user_123", "sk_example") now serializes the secret as user_id and the user ID as secret. Passing this model as api_key breaks integration creation and key rotation.

The same compatibility issue affects CreateDataIntegration, where ownership displaces description, and DataIntegrationsUpsertClientCredentialsRequest, where the new selectors displace config. Preserve existing field positions, append new optional fields, and add positional-construction regression tests.

Prompt To Fix With AI

This is a comment left during a code review.
Path: src/workos/pipes/models/api_key_installation.py
Line: 15-18

Comment:
**Positional arguments silently change meaning**

Previously, `ApiKeyInstallation` accepted `(user_id, secret, organization_id=None)` through its alias. The replacement reverses the first two arguments: existing code such as `ApiKeyInstallation("user_123", "sk_example")` now serializes the secret as `user_id` and the user ID as `secret`. Passing this model as `api_key` breaks integration creation and key rotation.

The same compatibility issue affects `CreateDataIntegration`, where ownership displaces description, and `DataIntegrationsUpsertClientCredentialsRequest`, where the new selectors displace config. Preserve existing field positions, append new optional fields, and add positional-construction regression tests.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[greptile-apps]

New request bodies lack coverage

The organization-update tests supply no update fields and check only the method/path. The credential and token tests also never supply the new ownership and plural-connection body selectors, so they would pass even if serialization dropped those inputs.

Add sync and async body assertions for organization updates with enabled=False, explicit nullable fields, and a nested payload. Also exercise organization/account selectors and both boolean values in credential requests. This would protect the new behavior rather than only confirming that its routes exist.

Knowledge Base Used:

• Product automation services
• Pagination and shared types

Prompt To Fix With AI

This is a comment left during a code review.
Path: tests/test_pipes.py
Line: 196-206

Comment:
**New request bodies lack coverage**

The organization-update tests supply no update fields and check only the method/path. The credential and token tests also never supply the new ownership and plural-connection body selectors, so they would pass even if serialization dropped those inputs.

Add sync and async body assertions for organization updates with `enabled=False`, explicit nullable fields, and a nested payload. Also exercise organization/account selectors and both boolean values in credential requests. This would protect the new behavior rather than only confirming that its routes exist.

**Knowledge Base Used:**
- [Product automation services](https://app.greptile.com/workos/-/custom-context/knowledge-base/workos/workos-python/-/docs/product-automation-services.md)
- [Pagination and shared types](https://app.greptile.com/workos/-/custom-context/knowledge-base/workos/workos-python/-/docs/pagination-and-shared-types.md)

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

[greptile-apps]

Unknown-state regression coverage removed

Replacing unexpected_data_integration_state with valid removes the existing check that DataIntegration preserves unfamiliar server state values. The new unknown-ownership case should extend that coverage, not replace it. Keep both fields unknown here, or parameterize the test to exercise each independently.

Suggested change

	"ownership": "unexpected_data_integration_ownership",
	"description": "Production GitHub app",
	"enabled": True,
	"state": "unexpected_data_integration_state",
	"state": "valid",
	"ownership": "unexpected_data_integration_ownership",
	"description": "Production GitHub app",
	"enabled": True,
	"state": "unexpected_data_integration_state",

Prompt To Fix With AI

This is a comment left during a code review.
Path: tests/test_pipes_models_round_trip.py
Line: 300-303

Comment:
**Unknown-state regression coverage removed**

Replacing `unexpected_data_integration_state` with `valid` removes the existing check that `DataIntegration` preserves unfamiliar server state values. The new unknown-ownership case should extend that coverage, not replace it. Keep both fields unknown here, or parameterize the test to exercise each independently.

```suggestion
            "ownership": "unexpected_data_integration_ownership",
            "description": "Production GitHub app",
            "enabled": True,
            "state": "unexpected_data_integration_state",
```

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.