feat: add attack protection CAPTCHA policies, client grants search, anonymous session network binding, DPoP strict refresh token binding; move experiment & feature flag status transitions to PATCH

[fern-api]

🔧 Changes

Adds management support for attack protection CAPTCHA policies, client grants search, anonymous session transfer network binding, DPoP strict refresh token binding, Google Workspace provisioning on connection profiles, and organization member access levels on organization connection events. Experiment and feature flag status transitions now go through the standard update (PATCH) methods instead of separate updateStatus endpoints.

• Attack Protection – CAPTCHA Policies (new resource): client.attackProtection.captchaPolicies with list, create, get, update, and delete (/attack-protection/captcha/policies). A policy has a name, an optional description, a priority (lower number = higher precedence), a match (exactly one of auth0_managed or geo_country_codes), and an action that overrides the CAPTCHA provider configuration. create() and update() throw ConflictError on 409.
  • New types: AttackProtectionCaptchaPolicy, AttackProtectionCaptchaPolicyMatch, AttackProtectionCaptchaPolicyAction, AttackProtectionCaptchaPolicyActionInput, ListAttackProtectionCaptchaPoliciesResponseContent, CaptchaActiveProviderEnum (simple_captcha | auth_challenge | recaptcha_v2 | recaptcha_enterprise | hcaptcha | friendly_captcha | arkose), and per-provider action types CaptchaPolicyActionSimpleCaptcha, CaptchaPolicyActionAuthChallenge, CaptchaPolicyActionRecaptchaV2/Input, CaptchaPolicyActionRecaptchaEnterprise/Input, CaptchaPolicyActionHcaptcha/Input, CaptchaPolicyActionFriendlyCaptcha/Input, CaptchaPolicyActionArkose/Input. The *Input variants accept secrets (secret, api_key), which are not returned in responses.
  • New request types: CreateAttackProtectionCaptchaPolicyRequestContent and UpdateAttackProtectionCaptchaPolicyRequestContent.
  • New sub-package export: auth0/attackProtection/captchaPolicies.
• Attack Protection – Brute Force Protection: BruteForceProtectionFormSubmissionModeEnum description updated (no value changes).
• Client Grants: new client.clientGrants.search() (GET /client-grants/search). It searches client grants with SCIM or Lucene filter syntax (parser), returns eventually consistent results, and is paginated with take/from. Supports q, parser, fields, include_fields, take, from, and sort. In addition to the standard errors, it maps 500 to InternalServerError and 504 to GatewayTimeoutError.
  • New types: SearchClientGrantsRequestParameters, SearchClientGrantsResponseContent, and ClientGrantSortFieldEnum (audience | updated_at).
• Clients: enforce_anon_session_transfer_network_binding (ip | asn | none, default ip) controls whether an anonymous session transfer token must be consumed from the same IP or ASN that issued it. Added to CreateClientRequestContent, UpdateClientRequestContent, Client, ClientSearchResponse, CreateClientResponseContent, GetClientResponseContent, UpdateClientResponseContent, and RotateClientSecretResponseContent. New enum ClientAnonymousSessionTransferNetworkBindingEnum.
  • clients.registerCimdClient() now throws ConflictError on 409.
• Tenant Settings: dpop_strict_refresh_token_binding enables strict DPoP refresh token binding per RFC 9449. Added to UpdateTenantSettingsRequestContent, GetTenantSettingsResponseContent, and UpdateTenantSettingsResponseContent.
• Experimentation:
  • Experiments: removed experiments.updateStatus() (POST /experimentation/experiments/{id}/status). Use experiments.update() (PATCH /experimentation/experiments/{id}) with status (active | paused | completed | archived) instead. status was added to UpdateExperimentRequestParameters.
  • Feature Flags: removed featureFlags.updateStatus() (POST /experimentation/feature-flags/{id}/status). Use featureFlags.update() (PATCH /experimentation/feature-flags/{id}) with status (draft | active | archived) instead. status was added to UpdateFeatureFlagRequestContent.
  • Removed types: UpdateExperimentStatusRequestContent, UpdateExperimentStatusResponseContent, UpdateFeatureFlagStatusRequestContent, and UpdateFeatureFlagStatusResponseContent.
  • Segments: status (active | archived) added to Segment, CreateSegmentResponseContent, GetSegmentResponseContent, and UpdateSegmentResponseContent. It is also settable through UpdateSegmentRequestContent; archiving cannot be undone. New enum SegmentStatusEnum.
  • Feature Flag Variations: variations.delete() no longer maps 400 to BadRequestError.
• Roles: owner_id is now typed as RoleOwnerId on Role, CreateRoleResponseContent, GetRoleResponseContent, UpdateRoleResponseContent, and UserEffectivePermissionRoleSourceResponseContent. The owner_id filter on ListRolesRequestParameters is typed as RoleOwnerIdFilter. Passing owner_id: "auth0" to roles.list() returns Auth0-managed System Roles. New types: RoleOwnerId, RoleOwnerIdFilter, and SystemRoleOwnerId.
• Connection Profiles: provisioning.google_workspace.sync_users added to ConnectionProfileProvisioning and ConnectionProfileStrategyOverridesProvisioning. New types: ConnectionProfileProvisioningGoogleWorkspace and ConnectionProfileProvisioningGoogleWorkspaceSyncUsers.
• Event Streams:
  • organization_member_access_level (none | readonly | limited | full) added to the object and previous_object payloads of the organization connection added/updated events, with the matching EventStreamCloudEventOrgConnection{Added,Updated}{Object,PreviousObject}OrganizationMemberAccessLevel* types.
  • a0stream is now optional on all CloudEvent types.
• Connections: ConnectionResponseCommon no longer extends CreateConnectionCommon. It declares its fields directly, and display_name is now required in connection responses.
• Organizations: metadata removed from SearchOrganization.
• Enabled Features: directory_sync added to EnabledFeaturesEnum.
• Discriminated unions (generator change): union types for Flow actions, Forms (blocks, fields, widgets, nodes, payment charge), Log Streams, Event Stream destinations, webhook authorization, and CloudEvent connection/group/member objects now reference named namespace variants (e.g. Management.FlowActionTwilio.SendSms), and those variants declare the discriminator value. Before, each union was a plain union of variant interfaces, and each interface declared its own discriminator. No variants were added or removed.
  • • Event Stream CloudEvents: strategy is no longer declared on the connection object/previous_object variants (EventStreamCloudEventConnection{Created,Updated,Deleted}{Object,PreviousObject}{0..7}), type on the group variants (EventStreamCloudEvent{Group*,OrgGroupRole*}…Group{0..2} and EventStreamCloudEventGroup{Created,Updated,Deleted}{Object,PreviousObject}{0..2}), and member_type on the group member variants (EventStreamCloudEventGroupMember{Added,Deleted}{Object,PreviousObject}Member{0,1}); they now come from the corresponding unions.
  • Flow actions: action is no longer declared on the individual FlowAction* interfaces, and their per-variant Action constants (e.g. Management.FlowActionTwilioSendSms.Action) were removed. type is unchanged.
  • Log streams: type is no longer declared on LogStream*ResponseSchema / CreateLogStream*RequestBody; it now comes from the LogStreamResponseSchema / CreateLogStreamRequestContent unions.
  • Webhook authorization: method is no longer declared on EventStreamWebhookBasicAuth, EventStreamWebhookBearerAuth (now an empty interface), or EventStreamWebhookCustomHeaderAuth; it now comes from the EventStreamWebhookAuthorizationResponse union.
  • Forms: type is no longer declared on the individual block/field/widget/node interfaces or on FormFieldPaymentConfigChargeOneOff. The inline subscription charge is now the named FormFieldPaymentConfigCharge.Subscription variant.
• Docs and dependencies: reference.md regenerated, and yarn.lock refreshed (@typescript-eslint/* 8.71.0 → 8.71.2 plus minor transitive bumps).

// Attack protection CAPTCHA policy
await client.attackProtection.captchaPolicies.create({
    name: "Block high-risk regions",
    priority: 1,
    match: { geo_country_codes: ["XX"] },
    action: { active_provider_id: "recaptcha_v2", recaptcha_v2: { site_key: "...", secret: "..." } },
});

// Client grants search
const page = await client.clientGrants.search({ q: 'audience:"https://api.example.com"', parser: "lucene", take: 50 });

// Anonymous session transfer network binding
await client.clients.update("client_id", { enforce_anon_session_transfer_network_binding: "asn" });

// DPoP strict refresh token binding
await client.tenants.settings.update({ dpop_strict_refresh_token_binding: true });

// Experiment / feature flag status transitions (replaces updateStatus)
await client.experimentation.experiments.update("exp_id", { status: "paused" });
await client.experimentation.featureFlags.update("ff_id", { status: "active" });

⚠️ Breaking changes

• Removed experiments.updateStatus() and featureFlags.updateStatus(), along with UpdateExperimentStatusRequestContent, UpdateExperimentStatusResponseContent, UpdateFeatureFlagStatusRequestContent, and UpdateFeatureFlagStatusResponseContent. Use experiments.update(id, { status }) / featureFlags.update(id, { status }) instead.
• Removed the per-variant Action constants on Flow action types (e.g. Management.FlowActionTwilioSendSms.Action).
• Discriminator properties (action on FlowAction*; type on LogStream*ResponseSchema, CreateLogStream*RequestBody, Form block/field/widget/node types, FormFieldPaymentConfigChargeOneOff, and Event Stream CloudEvent group variants; method on EventStreamWebhook{Basic,Bearer,CustomHeader}Auth; strategy on Event Stream CloudEvent connection variants; member_type on Event Stream CloudEvent group member variants) are no longer declared on the individual variant interfaces. Use the union types (e.g. LogStreamResponseSchema, FlowActionTwilio, EventStreamWebhookAuthorizationResponse) or the new namespace variants (e.g. Management.FlowActionTwilio.SendSms) when you need the discriminator.
• a0stream is now optional on all Event Stream CloudEvent types.
• featureFlags.variations.delete() no longer throws BadRequestError on 400; it throws the generic ManagementError.
• SearchOrganization.metadata is no longer typed (now any via the index signature).
• display_name is now required on ConnectionResponseCommon (affects code that constructs connection response objects, e.g. test mocks).
• status is now required on Segment, CreateSegmentResponseContent, GetSegmentResponseContent, and UpdateSegmentResponseContent (affects code that constructs segment response objects, e.g. test mocks).

🔬 Testing

• attackProtection/captchaPolicies.test.ts – new wire tests for list (6), create (7), get (6), update (7), and delete (6), including error cases
• clientGrants.test.ts – new wire tests for search (8 cases)
• clients.test.ts – enforce_anon_session_transfer_network_binding added to 6 fixtures; new 409 ConflictError case for registerCimdClient
• tenants/settings.test.ts – dpop_strict_refresh_token_binding added to 2 fixtures
• experimentation/experiments.test.ts and experimentation/featureFlags.test.ts – updateStatus tests removed (8 + 6 cases)
• experimentation/featureFlags/variations.test.ts – 400 BadRequestError case for delete removed
• experimentation/segments.test.ts – status added to 4 fixtures
• connectionProfiles.test.ts – provisioning.google_workspace.sync_users added to 4 fixtures
• attackProtection/bruteForceProtection.test.ts – form_submission_mode fixture value changed from manual to auto
• flows.test.ts, forms.test.ts, logStreams.test.ts, events.test.ts – discriminator fields (action, type, strategy) reordered in fixtures to match the new union shape

📝 Checklist

• All new/changed/fixed functionality is covered by tests (or N/A)
• I have added documentation for all new/changed functionality (or N/A )

[codecov]

Codecov Report

❌ Patch coverage is 89.53975% with 25 lines in your changes missing coverage. Please review.
✅ Project coverage is 89.39%. Comparing base (d90bbd5) to head (973445d).
⚠️ Report is 1 commits behind head on beta.

Files with missing lines	Patch %	Lines
...tection/resources/captchaPolicies/client/Client.ts	88.52%	21 Missing ⚠️
...gement/api/resources/clientGrants/client/Client.ts	91.83%	4 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             beta    #1426      +/-   ##
==========================================
- Coverage   89.40%   89.39%   -0.02%     
==========================================
  Files         444      446       +2     
  Lines       21884    22022     +138     
  Branches    10441    10531      +90     
==========================================
+ Hits        19565    19686     +121     
- Misses       2319     2336      +17     

Flag	Coverage Δ
alltests	89.39% <89.53%> (-0.02%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
...nt/api/resources/attackProtection/client/Client.ts	100.00% <100.00%> (ø)
...ttackProtection/resources/captchaPolicies/index.ts	100.00% <100.00%> (ø)
.../api/resources/attackProtection/resources/index.ts	100.00% <100.00%> (ø)
.../management/api/resources/clients/client/Client.ts	89.32% <100.00%> (+0.06%)	⬆️
...rimentation/resources/experiments/client/Client.ts	88.71% <ø> (-0.06%)	⬇️
...imentation/resources/featureFlags/client/Client.ts	88.82% <ø> (+0.14%)	⬆️
...featureFlags/resources/variations/client/Client.ts	88.26% <ø> (-0.13%)	⬇️
...rc/management/api/resources/roles/client/Client.ts	89.60% <ø> (ø)
src/management/api/types/types.ts	100.00% <ø> (ø)
...gement/api/resources/clientGrants/client/Client.ts	89.53% <91.83%> (+0.59%)	⬆️
... and 1 more

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[ankita10119]

LGTM !