From f85dedd5ba11cc9636e8db8165a56ec293a38479 Mon Sep 17 00:00:00 2001
From: "workos-sdk-automation[bot]"
 <255426317+workos-sdk-automation[bot]@users.noreply.github.com>
Date: Wed, 28 Oct 2026 20:21:17 +0000
Subject: [PATCH] Update OpenAPI spec from
 workos/workos@a8c727e42cd9042bf005144c681466fdeb48ad23

---
 .last-synced-sha        |  2 +-
 spec/open-api-spec.yaml | 32 +++++++++++++++++++++++++-------
 2 files changed, 26 insertions(+), 8 deletions(-)

diff --git a/.last-synced-sha b/.last-synced-sha
index 4a232d8..e79186c 100644
--- a/.last-synced-sha
+++ b/.last-synced-sha
@@ -1 +1 @@
-4995e489061a65fd19183952a80756989ea11b36
+a8c727e42cd9042bf005144c681466fdeb48ad23
diff --git a/spec/open-api-spec.yaml b/spec/open-api-spec.yaml
index 11b40ab..d94e4de 100644
--- a/spec/open-api-spec.yaml
+++ b/spec/open-api-spec.yaml
@@ -12662,6 +12662,7 @@ paths:
                     - repo
                     - user:email
                   missing_scopes: []
+                  metadata: {}
                   config: {}
         '400':
           description: Bad Request
@@ -32166,6 +32167,8 @@ components:
             type: string
             enum:
               - widgets:users-table:manage
+              - widgets:user-api-keys:manage-self
+              - widgets:user-api-keys:manage-all
               - widgets:domain-verification:manage
               - widgets:sso:manage
               - widgets:api-keys:manage
@@ -47926,6 +47929,18 @@ components:
                 the access token, they're listed here. Present for `oauth` and
                 `client_credentials` credentials; absent for `api_key`.
               example: []
+            metadata:
+              type: object
+              additionalProperties: {}
+              description: >-
+                Non-sensitive fields captured from the provider token response
+                (e.g. Salesforce `instance_url`), as configured for the
+                provider. Captured on OAuth code exchange and refresh, and on
+                each `client_credentials` mint. A field a later OAuth refresh
+                omits keeps its stored value. Present for `oauth` and
+                `client_credentials` credentials; absent for `api_key`.
+              example: &ref_39
+                instance_url: https://acme.my.salesforce.com
             config:
               type: object
               additionalProperties:
@@ -47949,6 +47964,7 @@ components:
             - expires_at
             - scopes
             - missing_scopes
+            - metadata
             - config
         - type: object
           properties:
@@ -48045,9 +48061,11 @@ components:
               description: >-
                 Non-sensitive fields captured from the provider token response
                 (e.g. Salesforce `instance_url`), as configured for the
-                provider. Only present for `client_credentials` credentials.
-              example:
-                instance_url: https://acme.my.salesforce.com
+                provider. Captured on OAuth code exchange and refresh, and on
+                each `client_credentials` mint. A field a later OAuth refresh
+                omits keeps its stored value. Present for `oauth` and
+                `client_credentials` credentials; absent for `api_key`.
+              example: *ref_39
             config:
               type: object
               additionalProperties:
@@ -48494,7 +48512,7 @@ components:
                         items:
                           type: string
                         description: The OAuth scopes granted for this connection.
-                        example: &ref_39
+                        example: &ref_40
                           - repo
                           - user:email
                       auth_method:
@@ -48544,7 +48562,7 @@ components:
                           `installation` scope, excluding secret and undeclared
                           fields. Returned for every authentication method;
                           empty when no stored values can be disclosed.
-                        example: &ref_40
+                        example: &ref_41
                           instance_url: https://example.my.salesforce.com
                       state:
                         type: string
@@ -48729,7 +48747,7 @@ components:
                       items:
                         type: string
                       description: The OAuth scopes granted for this connection.
-                      example: *ref_39
+                      example: *ref_40
                     auth_method:
                       type: string
                       enum:
@@ -48776,7 +48794,7 @@ components:
                         `installation` scope, excluding secret and undeclared
                         fields. Returned for every authentication method; empty
                         when no stored values can be disclosed.
-                      example: *ref_40
+                      example: *ref_41
                     state:
                       type: string
                       enum: