feat(generated): Pipes (batch 77e46600)

[workos-sdk-automation]

Summary

Regenerated SDK from spec changes.

Triggered by workos/openapi-spec@6557d44

[greptile-apps]

Greptile Summary

This PR regenerates the Python SDK for new Pipes credential and API-key flows. The main changes are:

• New sync and async Pipes methods for API-key upsert and credential vending.
• New common and Pipes models for connected accounts, credential responses, and request bodies.
• Updated generated manifest, changelog entry, fixtures, and Pipes tests.

Confidence Score: 4/5

One contained correctness issue needs to be fixed before merging.

The generated endpoint methods and most models match the new API surface, but the credential model rejects API-key credential responses that the new endpoint can return.

src/workos/pipes/models/data_integration_credentials_response_credential.py

T-Rex Logs

What T-Rex did

• Reproduced the API-key credentials deserialization path by running a focused Python repro that feeds an API-key shaped payload to DataIntegrationCredentialsResponse.from_dict, including auth_method \"api_key\" and credential.value while omitting expires_at and scopes.
• Validated the API-method validation flow by inspecting before- and after-run artifacts, noting that the before state had update_data_integration_api_key redacted and no credentials created, while the after state showed credentials created and multiple API calls issued, with an exit code indicating success.
• Ran the generated-models validation; after adjustments, all non-ledger cases passed and the process exited with code 0.

_{Ran code and verified through T-Rex}

Important Files Changed

Filename	Overview
src/workos/pipes/_resource.py	Adds sync and async Pipes methods for API-key upsert and credential vending endpoints.
src/workos/pipes/models/data_integration_credentials_response.py	Adds generated wrapper response model for credential vending results.
src/workos/pipes/models/data_integration_credentials_response_credential.py	Adds generated credential model, but it currently requires OAuth-only fields and rejects API-key credential payloads.
src/workos/common/models/connected_account.py	Adds common generated connected account model including API-key metadata.
tests/test_pipes.py	Adds sync and async tests for new Pipes endpoints, but does not cover API-key credential response deserialization.
tests/fixtures/data_integration_credentials_response.json	Adds credential response fixture covering only OAuth-shaped credential data.

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
participant App as SDK caller
participant Pipes as workos.pipes.Pipes
participant Client as WorkOSClient
participant API as WorkOS API

App->>Pipes: update_data_integration_api_key(slug, user_id, secret)
Pipes->>Client: "PUT /data-integrations/{slug}/api-key"
Client->>API: "body {user_id, organization_id?, secret}"
API-->>Client: ConnectedAccount
Client-->>Pipes: ConnectedAccount model
Pipes-->>App: ConnectedAccount

App->>Pipes: create_data_integration_credential(slug, user_id)
Pipes->>Client: "POST /data-integrations/{slug}/credentials"
Client->>API: "body {user_id, organization_id?}"
API-->>Client: DataIntegrationCredentialsResponse
Client-->>Pipes: credentials response model
Pipes-->>App: DataIntegrationCredentialsResponse

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
participant App as SDK caller
participant Pipes as workos.pipes.Pipes
participant Client as WorkOSClient
participant API as WorkOS API

App->>Pipes: update_data_integration_api_key(slug, user_id, secret)
Pipes->>Client: "PUT /data-integrations/{slug}/api-key"
Client->>API: "body {user_id, organization_id?, secret}"
API-->>Client: ConnectedAccount
Client-->>Pipes: ConnectedAccount model
Pipes-->>App: ConnectedAccount

App->>Pipes: create_data_integration_credential(slug, user_id)
Pipes->>Client: "POST /data-integrations/{slug}/credentials"
Client->>API: "body {user_id, organization_id?}"
API-->>Client: DataIntegrationCredentialsResponse
Client-->>Pipes: credentials response model
Pipes-->>App: DataIntegrationCredentialsResponse

Loading

Prompt To Fix All With AI

Fix the following 1 code review issue. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 1
src/workos/pipes/models/data_integration_credentials_response_credential.py:37-39
**Handle API-key credentials**
`create_data_integration_credential` documents that API-key installations return the stored secret, but this deserializer requires OAuth-only response fields (`expires_at`, `scopes`, and `missing_scopes`). When the API returns an API-key credential with `auth_method: "api_key"` and `value`, callers get a deserialize error instead of the vended secret.

_{Reviews (1): Last reviewed commit: "chore(generated): add release notes frag..." | Re-trigger Greptile}

[greptile-apps]

Handle API-key credentials
create_data_integration_credential documents that API-key installations return the stored secret, but this deserializer requires OAuth-only response fields (expires_at, scopes, and missing_scopes). When the API returns an API-key credential with auth_method: "api_key" and value, callers get a deserialize error instead of the vended secret.

Artifacts

Repro: focused deserialization script with api_key credential payload

• Contains supporting evidence from the run (text/x-python; charset=utf-8).

Repro: command output showing WorkOSError for missing expires_at

• Keeps the command output available without making the summary code-heavy.

_{Ran code and verified through T-Rex}

Prompt To Fix With AI

This is a comment left during a code review.
Path: src/workos/pipes/models/data_integration_credentials_response_credential.py
Line: 37-39

Comment:
**Handle API-key credentials**
`create_data_integration_credential` documents that API-key installations return the stored secret, but this deserializer requires OAuth-only response fields (`expires_at`, `scopes`, and `missing_scopes`). When the API returns an API-key credential with `auth_method: "api_key"` and `value`, callers get a deserialize error instead of the vended secret.

How can I resolve this? If you propose a fix, please make it concise.