Rust SDK

Bug Fixes

• renovate: explicitly enable minor and patch updates (https://github.com/workos/workos-rust/issues/99" rel="noreferrer" target="_blank">#99) (https://github.com/workos/workos-rust/commit/2639af6f0749120a134dd292ef40af3df09e7fd6" rel="noreferrer" target="_blank">2639af6)
• sdk: omit defaulted screen_hint from auth URLs (https://github.com/workos/workos-rust/issues/102" rel="noreferrer" target="_blank">#102) (https://github.com/workos/workos-rust/commit/2dc6fa4a3bfc17a5ef399c6683c406f839f5083b" rel="noreferrer" target="_blank">2dc6fa4)

• https://github.com/workos/workos-rust/pull/97" rel="noreferrer" target="_blank">#97 feat(generated)!: regenerate from spec (8 changes)

⚠️ Breaking

• organization_membership: Split organization membership operations from user_management into dedicated service
• New OrganizationMembershipApi service with full CRUD and role management for organization memberships
• Moved from UserManagementApi: list/create/get/update/delete/deactivate/reactivate operations
• Breaking change: symbols removed from user_management and moved to organization_membership (see compat_breaking list)
• Role enum (Single/Multiple variants) moved from user_management to organization_membership
• client.user_management_organization_membership_groups() removed; use client.organization_membership().list_organization_membership_groups() instead
• Group membership listing now accessible via organization_membership.list_organization_membership_groups
• radar: Remove deprecated action and control fields from Radar standalone assessment
• Removed deprecated enum variants: RadarStandaloneAssessRequestAction::Login, RadarStandaloneAssessRequestAction::Signup, RadarStandaloneResponseControl::CredentialStuffing, RadarStandaloneResponseControl::IpSignUpRateLimit
• Removed lenient parsing aliases for SignUp ("sign up", "sign_up") and SignIn ("sign in", "sign_in"); only canonical wire values "sign-up" and "sign-in" are accepted
• Removed fields from RadarStandaloneAssessRequest: device_fingerprint and bot_score (marked breaking in spec)
• vault: Replaced hand-written helpers::VaultApi with generated resources::VaultApi
• client.vault() now returns resources::VaultApi instead of helpers::VaultApi
• Old custom types removed: DataKeyPair, DataKey, KeyContext, ObjectMetadata, VaultObject, VaultObjectDigest, VaultObjectVersion, VaultListObjectsParams, VaultListObjectsResponse, VaultCreateDataKeyParams, VaultCreateObjectParams, VaultUpdateObjectParams, VaultDecryptDataKeyParams
• Replaced by generated types: CreateDataKeyRequest, CreateDataKeyResponse, DecryptRequest, DecryptResponse, RekeyRequest, CreateObjectRequest, UpdateObjectRequest, VaultObject, ObjectMetadata, ObjectSummary, ObjectVersion, ObjectListResponse, VersionListResponse
• Local encrypt/decrypt convenience methods preserved on resources::VaultApi with the same behavior
• Crypto helpers moved from helpers::vault to helpers::vault_crypto (re-exported: VaultEncryptResult, local_encrypt, local_decrypt, extract_encrypted_keys)
• generated: Rename types to remove Json suffix and standardize naming
• AuditLogExportJsonState → AuditLogExportState
• AuditLogActionJson → AuditLogAction
• AuditLogExportJson → AuditLogExport
• AuditLogsRetentionJson → AuditLogsRetention
• WebhookEndpointJson → WebhookEndpoint, WebhookEndpointJsonStatus → WebhookEndpointStatus
• RadarAction → RadarListAction, RadarType → RadarListType
• AuditLogSchema renamed to AuditLogSchemaDto; new AuditLogSchemaInput, AuditLogSchemaActorInput, AuditLogSchemaTargetInput types added

Features

• vault: Add Vault service with key management and object storage APIs
• New VaultApi service providing encryption key management and encrypted object storage
• Key management: create_data_key, create_decrypt, create_rekey for cryptographic operations
• Object storage: list_kv, create_kv, get_kv, get_name, update_kv, delete_kv for managing encrypted key-value pairs
• Metadata operations: list_kv_metadata and list_kv_versions for inspecting object history without decryption
• api_key: Add expires_at field to API key models
• New optional expires_at field added to ApiKey, OrganizationApiKey, OrganizationApiKeyWithValue, UserApiKey, UserApiKeyWithValue models
• Allows setting expiration timestamps on API keys; null means no expiration
• Event data models updated: ApiKeyCreatedData and ApiKeyRevokedData now include expires_at
• New optional parameter expires_at in CreateOrganizationApiKey and CreateUserApiKey request bodies
• webhooks: Add Pipes connected account events to webhook subscriptions
• Three new webhook event types for Pipes integrations: PIPES_CONNECTED_ACCOUNT_CONNECTED, PIPES_CONNECTED_ACCOUNT_DISCONNECTED, PIPES_CONNECTED_ACCOUNT_REAUTHORIZATION_NEEDED
• New model types: PipeConnectedAccount, PipesConnectedAccountConnected, PipesConnectedAccountDisconnected, PipesConnectedAccountReauthorizationNeeded
• New enum PipeConnectedAccountState for connected account status tracking
• connect: Add typed connect application models and new fields
• New ConnectApplicationM2M and ConnectApplicationOAuth model types for M2M and OAuth applications
• New fields on ConnectApplication: redirect_uris, uses_pkce, is_first_party, was_dynamically_registered
• New ConnectApplicationRedirectUri and ConnectApplicationOAuthRedirectUris types
• generated: Add new general-purpose models
• New Actor model for representing users or API keys that performed actions
• New ErrorResponse model for structured error response bodies
• New ListMetadata model for cursor-based pagination metadata
• New VaultOrder enum for ordering vault list results

Fixes

• generated: Standardize type names and fix parameter defaults in authorization service
• Added resource_id, resource_external_id, and resource_type_slug filters to ListRoleAssignmentsParams for more granular assignment filtering
• Added role_slug filter to ListRoleAssignmentsForResourceParams and ListRoleAssignmentsForResourceByExternalIdParams
• Removed search parameter from ListResourcesParams (deprecated)
• connect: Fix last_used_at field type in application credentials
• NewConnectApplicationSecret.last_used_at type changed from invalid string value to ISO 8601 timestamp
• ApplicationCredentialsListItem.last_used_at type changed from invalid string value to ISO 8601 timestamp
• Ensures consistency with API contract for credential timestamp tracking
• sso: Expand login_hint documentation to include custom SAML
• Updated GetAuthorizationUrlParams.login_hint documentation to indicate support for custom SAML connections in addition to existing OAuth/OpenID Connect/Okta/Entra ID support

v1.0.0...v1.0.1" rel="noreferrer" target="_blank">1.0.1 (2026-05-13)

Bug Fixes

• generated: Regenerate from oagen with query encoder + typed param bodies (https://github.com/workos/workos-rust/commit/e63d620673b1e0b1270b1ca0ad7539d462c94e51" rel="noreferrer" target="_blank">e63d620)

v0.8.1...v1.0.0" rel="noreferrer" target="_blank">1.0.0 (2026-05-10)

⚠ BREAKING CHANGES

• prep for v1

Features

• Add ApiError, RequestOptions, and auto-paging streams (https://github.com/workos/workos-rust/commit/a1a66ba8cad6f8d79456c4f951cd00b1c0d8b108" rel="noreferrer" target="_blank">a1a66ba)
• client: Add path_segment encoder and shared auto-paging driver (https://github.com/workos/workos-rust/commit/7f1c2d3b2490b588bf32abb8b5c76e1c0598e9e4" rel="noreferrer" target="_blank">7f1c2d3)
• client: Gate retries by safety and add per-request RequestStrategy (https://github.com/workos/workos-rust/commit/1fb9b1c8835daeb77f603b689418b0860352de6c" rel="noreferrer" target="_blank">1fb9b1c)
• prep for v1 (https://github.com/workos/workos-rust/commit/9b42e7753ae5b73ebcfb7cba9cebd9967a49c94f" rel="noreferrer" target="_blank">9b42e77)
• secret: Add SecretString wrapper for sensitive fields (https://github.com/workos/workos-rust/commit/d3729a98c9ce6c9bf654779e8c252c7887f83cd5" rel="noreferrer" target="_blank">d3729a9)

Bug Fixes

• helpers: Harden webhook, session, and vault crypto paths (https://github.com/workos/workos-rust/commit/98b8a59781d461a78b429c4757224d86a4bb68be" rel="noreferrer" target="_blank">98b8a59)

Added

• Added organization_id to DirectoryUsers and DirectoryGroups (https://github.com/workos/workos-rust/pull/84" rel="noreferrer" target="_blank">#84)

Changed

• Updated the endpoints used for ChallengeFactor and VerifyChallenge operations (https://github.com/workos/workos-rust/pull/81" rel="noreferrer" target="_blank">#81)
• Changed project status to "experimental" (https://github.com/workos/workos-rust/pull/82" rel="noreferrer" target="_blank">#82)

Added

• Initial release